Find your next learning step
A successor ledger should close only when the replacement product is known, affected users have recertified their workflows and unresolved copies are bounded. Time then creates a new risk: recertification can drift as scripts, scenes, models and derivative products change. A later discovery across several users may show that the problem is not an isolated orphaned copy but a fleet-wide control failure. This article separates closure evidence, ongoing recertification and the escalation needed when the same lineage gap reappears.
Open the chapter contents · Remote Sensing root · Gold Standard of Education · How X Works
Chapter contents
Choose the route closest to the decision, or read from Chapter 1. The chapters remain open; these grouped routes are a navigable index.
Route 1 · Define the decision
Route 2 · Work the ledgers
Route 3 · Transfer the method
Route 4 · Check limits and evidence
Route 5 · Ask and continue
CHAPTER 1 OF 12 · DEFINE THE DECISION
1. Define what successor-ledger closure claims
State the retired product version, its successor, affected derivatives, known users, migration boundary, unresolved exceptions and closure owner. Closure means the documented obligations have been discharged or bounded; it does not mean the retired data cease to exist.
Keep historical identifiers resolvable. A future analyst must be able to determine which processing date, calibration and correction chain produced a cited result, even when operational use has moved to the successor.
CHAPTER 2 OF 12 · DEFINE THE DECISION
2. Treat recertification as a maintained state
Recertification can drift when a user changes code, thresholds, spatial masks, training labels, cloud filters or upstream products after the original check. Define which changes invalidate the prior attestation and how quickly a fresh check is required.
Monitor version manifests and derivative lineage rather than relying on an annual email. A user may still say “Collection 2” while combining scenes processed on different dates or retaining an old cached tile.
CHAPTER 3 OF 12 · WORK THE LEDGERS
3. Work a successor-ledger closure register
A coastal programme retires product P4 after selected scenes are reprocessed and tracks migration to P5.
| Obligation | Evidence | Residual item | Owner | Closure status |
|---|---|---|---|---|
| Successor inventory | P5 product identifiers verified | None | Archive lead | Close |
| Workflow recertification | 11 of 11 scripts rerun | None | Methods lead | Close |
| Derivative replacement | Maps and tables regenerated | One training slide labelled historical | Communications lead | Bounded exception |
| User acknowledgement | All operational users attest | None | Product owner | Close |
| Historical citation | P4 DOI and processing date preserved | None | Data steward | Close |
The exception has an owner and a review date. If the slide is later copied into an operational guide, the closure decision must be reopened.
CHAPTER 4 OF 12 · WORK THE LEDGERS
4. Escalate a repeated fleet-wide discovery
Three months later, a checksum scan finds old P4 tiles in several downstream caches. The review distinguishes local housekeeping from a repeated control failure.
| Signal | Observed scope | Threshold | Decision | Action |
|---|---|---|---|---|
| Old tiles in one sandbox | One isolated user | Below fleet threshold | Local containment | Delete and document |
| Same tiles in shared cache | Seven users inherit copy | Fleet pathway confirmed | Escalate | Freeze shared outputs |
| Derivative models trained on P4 | Two production models | Decision impact possible | Critical review | Open successor ledger |
| Recertification attestations | Five now incomplete | Attestation drift confirmed | Fleet recertification | Rerun all affected workflows |
| Citation lineage | Public reports identify dates | Historical use transparent | No recall | Retain record |
The programme opens a new successor ledger rather than editing the closed one invisibly. It links the new event to the former closure evidence and records which assumptions failed.
CHAPTER 5 OF 12 · WORK THE LEDGERS
5. Freeze propagation before measuring total scope
Pause automated exports, shared mosaics, model refreshes and dashboard publication where the discovered version can propagate. Preserve logs and cache contents long enough to reconstruct the pathway before cleaning them.
Containment is not the same as deletion. First identify identifiers, checksums, processing dates, derivative jobs, recipient systems and decision uses; then replace or quarantine each copy under a controlled plan.
CHAPTER 6 OF 12 · TRANSFER THE METHOD
6. Open a successor ledger without erasing the old closure
Give the repeated discovery its own scope, owner, clock and evidence. Reference the previous closure, but do not rewrite its historical decision as if the later pathway had been known. This preserves the difference between a reasonable earlier closure and a newly exposed weakness.
Reclose only after fleet-wide recertification, derivative review, user acknowledgement and control repair. The new ledger should explain how the recurrence threshold and discovery method will be monitored.
CHAPTER 7 OF 12 · TRANSFER THE METHOD
7. Changed-context transfer: wildfire severity products
Transfer the method to a wildfire programme that updates a severity product after calibration repair. A later scan finds the old version in regional model caches and a training pipeline shared by four agencies.
Because the pathway is shared and two models influence recovery funding, the programme escalates beyond local replacement. It freezes refreshes, opens a successor ledger, recertifies each model and retains old outputs only for labelled historical reproduction.
CHAPTER 8 OF 12 · TRANSFER THE METHOD
8. Connect retirement, discovery and amendment debt
Start with post-retirement discovery and fleet-wide recertification. Use orphaned-copy containment and user-version attestation for the earlier control stage.
Return to debt burn-down verification and amendment-reopen triggers when the repeated discovery exposes residual derivative obligations.
CHAPTER 9 OF 12 · CHECK LIMITS AND EVIDENCE
9. Limits and common misconceptions
A closed ledger is not a guarantee that no old copy remains. Recertification is not permanent when workflows and inputs change. Repetition across users does not by itself prove shared cause; confirm the propagation path before assigning fleet scope.
Replacing source scenes does not automatically repair trained models, reports or exported tables. Historical use need not be recalled when it was correct for its stated version and remains clearly labelled.
CHAPTER 10 OF 12 · CHECK LIMITS AND EVIDENCE
10. Practical evidence and fleet checks
Retain product identifiers, processing dates, checksums, successor mapping, user inventory, derivative graph, recertification protocol, attestations, exceptions, closure approval and monitoring rule. For recurrence, preserve discovery queries, propagation evidence, containment and impact decisions.
A robust closeout states what was searched, which systems were outside reach, how user changes invalidate recertification, the repeated-discovery threshold, who can reopen the ledger and how public citations remain resolvable.
CHAPTER 11 OF 12 · ASK AND CONTINUE
11. Frequently asked questions
Does a new processing date always require recertification?
Assess the change against the workflow’s decision claim. If pixels, calibration, quality masks or derived behaviour can change materially, rerun the prespecified check.
When is a discovery fleet-wide?
When evidence shows a shared distribution, cache, pipeline or governance pathway affects multiple users or decision products, not merely because several unrelated copies exist.
Should the former ledger be edited?
Preserve it as the historical closure record. Open a linked successor or reopened ledger for the new discovery so the decision lineage stays visible.
CHAPTER 12 OF 12 · ASK AND CONTINUE
12. Sources and next reading
USGS explains on its current Landsat Collection 2 page that reprocessed scenes receive updated product identifiers and users should consider replacing downloaded and derived products. The Landsat reprocessing guide updated 6 January 2026 provides a practical route for keeping holdings current. These sources ground the version-control problem; the coastal and wildfire cases are original teaching examples.
Continue through the Remote Sensing root, the Gold Standard of Education and How X Works.
Top · Contents · Previous · How X Works