THE GOLD STANDARD OF HYDROLOGY · SPECIALIST STUDY
Correct a forecast archive without erasing the scientific and rights history needed to understand it
A published hydrological forecast package may need restriction or withdrawal when a licence changes, sensitive material is discovered, calibration is corrected or a file proves unfit for use. Deleting the bytes is only one action. A defensible takedown identifies the exact objects and authority, preserves a tombstone and decision record, traces mirrors and derivatives, notifies downstream users proportionately, produces a versioned replacement when possible and keeps old citations resolvable to an honest correction path.
This guide belongs to the Hydrology subject root, the Gold Standard of Education, and the How X Works hub. It begins with a concrete decision, then tests whether the method still holds when the context changes.
Choose a reading route
Classify the correction event · chapters 1, 2, 3
Contain access and preserve evidence · chapters 4, 5
Reach downstream copies · chapters 6, 7, 8
Build and validate a replacement · chapters 9, 10, 11
Correct citations and transfer · chapters 12, 13
The whole problem at a glance
| Event | Default response | Preserved evidence |
|---|---|---|
| Licence change | Restrict affected objects | Terms, authority and dependency map |
| Scientific error | Correct or supersede | Impact assessment and version lineage |
| Sensitive disclosure | Contain and notify | Minimal incident record and access log |
| Broken packaging | Repair and reissue | Checksums and validation failure |
Choose the least disruptive action that satisfies rights, safety and scientific integrity.
CHAPTER 1 OF 13 · Classify the correction event
1. Classify the trigger before acting
Licence withdrawal, privacy exposure, security concern, scientific error, malware, corruption and packaging failure have different authorities, urgency and disclosure needs. “Take it down” is not a complete decision.
Evidence record: Record reporter, discovery time, affected object and versions, trigger class, initial evidence, plausible harm, legal or policy basis and decision owner. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Use a rapid containment path for credible harm while preserving a review path that can narrow or reverse the action. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A suspected licence breach becomes a metadata-only attribution error; reduce the response when evidence changes. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 1 check · what should survive an audit
- State the decision unit for “Classify the trigger before acting”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 2 OF 13 · Classify the correction event
2. Choose correction, restriction, supersession or withdrawal
A metadata correction may keep data available; a flawed product may be superseded; a rights problem may require restricted access; an unusable or harmful resource may need withdrawal.
Evidence record: Compare action alternatives, affected users, scientific impact, reversibility, authority, notice duty and residual risk. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Select the least destructive action that fully addresses the substantiated problem and document why broader deletion was unnecessary. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A corrected calibration changes results materially; prefer a linked new version over silent replacement. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 2 check · what should survive an audit
- State the decision unit for “Choose correction, restriction, supersession or withdrawal”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 3 OF 13 · Classify the correction event
3. Define scope at object and version level
Archive packages mix data, code, documentation, licences and derivatives. Removing a whole project for one affected forcing file can destroy legitimate access and obscure which science remains valid.
Evidence record: Keep stable object IDs, version IDs, checksums, manifests, provenance edges, access tiers and dependency graph. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Quarantine only the proven affected set plus unresolved dependants, then expand or contract scope through evidence. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A common input feeds ten forecast packages; trace dependency rather than relying on directory location. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 3 check · what should survive an audit
- State the decision unit for “Define scope at object and version level”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 4 OF 13 · Contain access and preserve evidence
4. Contain public access without destroying provenance
Disable downloads, mirrors or APIs as authorised, but retain controlled evidence needed for investigation, audit and reproducibility. A blank 404 hides the existence and reason of change.
Evidence record: Capture pre-action URLs, landing pages, headers, files, checksums, logs, search state, permissions and containment time in a protected record. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Leave a safe tombstone whenever disclosure rules permit, identifying status, date, scope and contact without republishing sensitive content. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A cached preview exposes the restricted field; include search and content-delivery caches in containment. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 4 check · what should survive an audit
- State the decision unit for “Contain public access without destroying provenance”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 5 OF 13 · Contain access and preserve evidence
5. Preserve chain of custody and decision lineage
Investigators need to know who collected which artefact, how it was verified and what changed. Evidence storage must be access-controlled and separate from the public archive.
Evidence record: Log collector, time, source, method, checksum, storage location, access, transformation and review for each preserved artefact. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Do not edit the sole evidence copy; derive redacted or analytical copies with new checksums and lineage. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A vendor supplies a corrected licence by email; preserve the authoritative communication and verification. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 5 check · what should survive an audit
- State the decision unit for “Preserve chain of custody and decision lineage”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
Worked dependency trace
| Object | Problem | Downstream state | Action |
|---|---|---|---|
| Rainfall forcing F1 | Redistribution right withdrawn | Two public mirrors | Restrict and notify |
| Forecast P1 | Derived from F1 | Downloaded by three teams | Review derivation rights |
| Skill table S1 | Uses P1 and open observations | Cited in report | Assess scientific and rights impact |
| Manifest M1 | Lists all objects | Primary site only | Replace with corrected lineage |
Derived products need separate rights and scientific review.
CHAPTER 6 OF 13 · Reach downstream copies
6. Interpret licence changes precisely
A new licence version may affect future distributions, existing copies, derivative products or none of these, depending on terms and governing law. Avoid assuming retroactivity or permanent rights.
Evidence record: Retain the exact licence accepted at acquisition, later notice, effective date, object coverage, permissions, obligations and qualified legal interpretation. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Route ambiguous rights questions to the authorised rights or legal function and apply a bounded interim access state. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: The provider permits public summaries but not raw redistribution; classify each derivative rather than deleting all outputs. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 6 check · what should survive an audit
- State the decision unit for “Interpret licence changes precisely”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 7 OF 13 · Reach downstream copies
7. Discover known copies and derivative routes
Copies can exist in mirrors, object stores, catalogues, notebooks, teaching sets, partner systems and DOI landing pages. Inventory is evidence, not a promise of perfect recall.
Evidence record: Search release logs, download records, mirror configuration, repository relations, citations, support tickets and partner registers with privacy minimisation. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Maintain a known-copy ledger with owner, location, version, contact basis, response and unresolved status. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A public dataset was copied into an inaccessible third-party repository; document the limit and correction route. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 7 check · what should survive an audit
- State the decision unit for “Discover known copies and derivative routes”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 8 OF 13 · Reach downstream copies
8. Notify downstream users proportionately
A scientific error may require urgent reanalysis; a rights change may require access or redistribution action; a privacy incident may restrict detail. Notices should be specific enough to act without amplifying harm.
Evidence record: Version notification text, audience classes, lawful contact basis, send time, delivery, acknowledgement, requested action, deadline and support route. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Prioritise users whose decisions or publications could be materially affected and avoid collecting unnecessary personal information. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A classroom user and an operational flood service need different urgency and remediation instructions. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 8 check · what should survive an audit
- State the decision unit for “Notify downstream users proportionately”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 9 OF 13 · Build and validate a replacement
9. Assess derived products independently
A derivative may remain scientifically valid but have a rights problem, or it may be rights-safe but scientifically invalid. Evaluate both axes and whether restricted input can be reconstructed.
Evidence record: For each derivative keep source versions, transformation, licence interpretation, disclosure test, scientific impact, current users and chosen state. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Do not label all derivatives safe or unsafe by inheritance alone; record the reasoning and unresolved cases. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: An aggregated skill score reveals no raw forcing values but changes after corrected calibration; issue a scientific correction. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 9 check · what should survive an audit
- State the decision unit for “Assess derived products independently”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
Replacement release gate
| Gate | Evidence | Failure response |
|---|---|---|
| Authority | Approved action and scope | Keep quarantined |
| Scientific validity | Clean rerun and expected outputs | Return to correction |
| Rights | Licence and redistribution review | Change access tier |
| Reproducibility | Manifest, checksums and environment test | Do not publish |
| Citation | New identifier and relation | Hold announcement |
Passing one gate cannot compensate for another.
CHAPTER 10 OF 13 · Build and validate a replacement
10. Build a replacement from a clean boundary
A replacement should start from authorised inputs and corrected procedures, not from a contaminated package with files manually removed. Rebuild the lineage and environment.
Evidence record: Pin input versions, code commit, dependencies, model and calibration, observations, licence, environment, build logs, random seeds and expected outputs. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Require an independent clean build before publication and prove no withdrawn bytes or identifiers leak into the package. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: One dependency is unavailable; disclose the reproducibility limit rather than claiming a complete rebuild. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 10 check · what should survive an audit
- State the decision unit for “Build a replacement from a clean boundary”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 11 OF 13 · Build and validate a replacement
11. Validate scientific comparability and changed claims
Compare old and replacement products at the level users need: events, locations, thresholds, skill, uncertainty and downstream decisions. A small file difference can have a large operational effect.
Evidence record: Keep predefined metrics, event set, tolerance, differences, affected claims, reviewer interpretation and decision about comparability. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: State which previous conclusions survive, change or cannot be assessed; never use “corrected” as a substitute for impact analysis. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A mean score is stable but extreme-event ranking changes; notify users concerned with extremes. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 11 check · what should survive an audit
- State the decision unit for “Validate scientific comparability and changed claims”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 12 OF 13 · Correct citations and transfer
12. Version identifiers, tombstones and citations
DataCite supports relations between corrected and obsoleted versions, while NASA PDS preserves version and modification history for revised products. Old identifiers should resolve to honest status and the preferred replacement.
Evidence record: Record old and new identifier, relation, withdrawal or supersession date, reason category, citation text, landing page and change log. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Do not silently reuse a citation for materially changed data; publish a linked correction and machine-readable relation where supported. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: A documentation-only fix leaves data unchanged; distinguish it from a data revision in citation guidance. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 12 check · what should survive an audit
- State the decision unit for “Version identifiers, tombstones and citations”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
CHAPTER 13 OF 13 · Correct citations and transfer
13. Close through verification, not announcement
The incident is not finished when a notice is posted. Verify primary and known mirror states, replacement integrity, citation routes, user acknowledgements, access revocation and retained evidence.
Evidence record: Run final inventory, URL and checksum checks, unresolved-copy review, authority acceptance, lessons, monitoring and scheduled recheck. Preserve versions, timestamps, denominators, excluded cases, failures and rejected alternatives so another reviewer can reconstruct the decision rather than inherit a conclusion.
Decision rule: Close only when required actions are verified or remaining exposure is explicitly accepted by the proper authority. Name the authorised owner, trigger, stop condition, remedy and verification window. A control is incomplete until a changed-context case tests the mechanism it is meant to protect.
Evidence discipline: record the observation, version or time boundary that supports this chapter’s conclusion. Preserve the rejected alternative as well as the selected action. That makes a later review able to distinguish a changed world from an undocumented change of mind.
Changed-context transfer: Transfer the method to a public-health data archive with stricter personal-data notification duties. The method transfers only if the decision question and measurement meaning survive the change. If either changes, rebuild the comparison rather than copying the earlier threshold or weight.
Chapter 13 check · what should survive an audit
- State the decision unit for “Close through verification, not announcement”.
- Bind every claim to an observed version, time boundary and comparison set.
- Connect the evidence to an owner, bounded action and later verification.
Verification lab: work the decision twice
A rainfall licence changes after release. Trace one raw input, forecast, skill table and report citation; choose restriction, review or correction for each.
Design a tombstone that preserves identifier, date, reason category and replacement path without exposing a sensitive coordinate.
Build a replacement release gate, then fail the clean-environment reproduction step and decide what remains public.
Limits and misconceptions
Deletion is not complete correction
Mirrors, citations, derivatives and user decisions remain.
Licence effects are not universal
Interpret exact terms, dates, objects and jurisdiction through authorised expertise.
A derivative needs its own review
Rights, disclosure and scientific validity can diverge.
A replacement is not the same object
Version it, validate it and link it to the earlier citation.
Questions readers ask
When should a forecast archive be taken down?
- When authorised review shows that restriction or withdrawal is necessary for rights, safety, privacy or scientific integrity.
Should the old URL return 404?
- Usually a safe tombstone is more informative, unless disclosure or security duties require otherwise.
Must every downloader be contacted?
- Follow lawful records and proportional impact; prioritise materially affected users and document limits.
Can derived forecasts remain public?
- Sometimes, after separate rights, disclosure and scientific-impact review.
How should a corrected package be cited?
- With a new or clearly versioned identifier linked to the obsolete or withdrawn version and a change record.
What evidence survives withdrawal?
- Controlled copies, checksums, provenance, decisions, notices, validation and closure records as policy permits.
Practise, verify and continue
Write a takedown and replacement plan for a forecast archive with one withdrawn forcing licence, two public mirrors, three known downstream teams and a cited skill report. Include containment, evidence, notices, replacement and citation correction.
Move the method to a biodiversity archive. Replace hydrological products and operational thresholds while preserving object scope, rights review, tombstones, downstream notice, clean replacement and citation lineage.
Practical evidence check
Before implementation, write a one-page evidence map with the decision, unit of analysis, version or time boundary, inputs, outcomes, uncertainty, authority and stop rule. Attach one worked case that passes and one that fails. A reviewer should be able to reproduce the reasoning without relying on the memory of the person who built the system.
Run one changed-context rehearsal before approval. Alter a mechanism rather than a cosmetic detail, then identify which calculation, safeguard or governance gate must change. Record any conclusion that does not transfer. This short rehearsal is often the fastest way to expose a hidden assumption before it becomes an operational dependency.
Related eduKate reading
Forecast archive access, redaction and reproducible release
Forecast archive fixity audits and repair provenance
Forecast archive tiered storage and restoration
Forecast archive format migration and preservation validation
Authoritative sources and scope
DataCite guidance on connecting corrected and obsoleted versions
DataCite guidance for retracted resources and tombstones
NASA PDS policy on superseded data
NASA PDS4 Data Provider’s Handbook
DataCite and NASA PDS sources support persistent tombstones, version relations, modification history and superseded-data handling. They do not determine contractual rights or notification law for a particular archive. The worked dependency trace is fictional; actual actions require the archive’s governing agreement, policy, jurisdiction and authorised rights, privacy, security and scientific review.