Once the shared foundation was established, the Qingya river valley quickly discovered that the foundation was only a thin layer. What it registered was the floor on which all parties had to stand: a contract total, a water-level table, a few gap entries carrying expiry markers. Beyond the floor, the meeting minutes still sat in the committee's warehouse, the requisition photographs still lay in the private files of the questioning faction, and the repair orders remained scattered through the provisional ledgers of the engineering camp. For the disputes to continue, these materials had to be findable, legible, and checkable. The question therefore shifted from "which facts can be shared" to "where records reside, through whose hands, and under what conditions they can be seen" — precisely the position left open at the end of Chapter 19.
If a record has only one entrance, controlling the entrance is equivalent to controlling the record. Chapter 3 has already shown that those who command the conditions of preservation can, by declining to archive, shortening retention periods, or restricting consultation, keep certain experiences from ever qualifying as history; the gatekeeper analysis of Chapter 14 showed that once intermediary positions concentrate, whether sources are visible becomes the gatekeeper's decision; Chapter 8 further noted that technical existence does not equal actual reachability — a file perfectly preserved in the depths of a warehouse, without an index, with dead links, with access credentials tightened layer by layer, remains intact in the physical sense while vanishing in the public sense. This chapter takes the positive half of the problem: how the number and structure of entrances make "a single entrance under control" no longer equal to "the record itself under control." Beyond preservation technique, we must also compare institutional conditions: the circumstances under which each of the four arrangements — version chains, checks on entrances to destruction, cross-version verification, and distributed preservation — holds or fails, and the three foreseeable degenerations: version confusion, selective abandonment in the name of cost, and correction deferred on the excuse of backup.
Record Entrances and the Version Skeleton
An entrance is not the location of a warehouse but the sum of four layers of relation: whether one can know the record exists (discovery), whether one can reach it (permissions and physical accessibility), whether one can read it (formats, catalogs, language), and whether one can verify it (versions, chains of provenance, originals). If any one of the four layers breaks, the record remains unusable however intact the other three. Those who understand an entrance as a location will assume that duplicating a warehouse yields two entrances; those who understand an entrance as a relation will keep asking: does the second warehouse have a catalog, who is qualified to enter, where is the version statement. A warehouse can be built overnight; the four layers of relation take years to grow.
For a party that wants to restrict a record, controlling the entrance is almost always cheaper than destruction. Destruction leaves a gap, and by the analysis of Chapter 3, an anomalous absence can itself serve as evidence; controlling the entrance leaves nothing behind — the record is "perfectly preserved," only the consultation queue stretches indefinitely and copying requires approval at every layer. The evidentiary threshold for identifying this condition is correspondingly concrete: not proving that someone does not want people to see, but comparing processing times, rejection rates, and the distribution of rejection reasons across similar materials. Chapter 19 used the distribution of processing times to test the fairness of the foundation; the same instrument here tests the health of entrances.
Chapter 8 has already noted that many web pages can cite the same database, and that deleting the database invalidates them all. The distinction between copies and entrances here turns from a technical reminder into an institutional question: two duplicates that share the same custodian, the same access rules, and the same upstream version are merely two windows onto a single entrance. A genuine second entrance requires independence of custodial interest — when one tightens, the other has no reason to tighten in step. To count entrances, counting windows is pointless; what must be counted is: facing one impulse to tighten, how many positions can hold still.
Version Chains Give Entrances a Common Skeleton
If multiple entrances are to be verifiable, each entrance must be able to state: when the version it holds was produced, from where it was obtained, which upstream version it corresponds to, and what differences are known. Without these statements, ten entrances are merely ten files of unknown provenance; with them, ten entrances join into a net along which paths of modification can be traced. The version chain is therefore not the internal discipline of some central warehouse but the common language of all entrances. When the foundation entries of Chapter 19 cite external archives, they should be able to state "this follows such-and-such version of such-and-such year from such-and-such entrance" — the seam between foundation and external archive is welded precisely by the version chain.
When the versions of two entrances disagree, the first response should not be to rule on which one counts, but to register the difference: where they diverge, when each appeared, whether the point of bifurcation can be traced. The analysis of provenance relations in Chapter 3 applies here: if both versions cite the same upstream, the difference may be no more than a transcription error; if the bifurcation predates the common upstream, then at least one has a stretch of independent history. The list of differences is itself material for the history of transmission — it records how the record has been used, altered, and selected. Any entrance system in a hurry to flatten differences is destroying precisely this history.
Chapter 8 described how link rot and ceaseless re-editing leave citers unable to determine what they once saw. If multiple entrances each manage their versions without recognizing one another, they replicate this rupture on a larger scale: two factions each cite the version of one entrance, both authentic, both retrievable, yet the disputes can never join. Mutual recognition of version chains need not require identical content; it requires only that each entrance can answer "where does your version come from, and how does it relate to the version held elsewhere." An entrance that cannot answer this question, however much material it preserves, is serving the fragmentation of the record.
Preservation, Destruction, and Verification
Chapter 8 established that destroying an entrance is graver than altering text, and that recognizing it requires concrete evidence of preservation rules, logs, and relations of benefit. Multiple entrances add structural support to this requirement: any entrance's decision to destroy or permanently seal materials should be notified to the other independent entrances and placed on record. Notification grants no veto to the others — that would confer infinite life on every scrap of waste paper — it merely makes destruction a witnessed act. A world in which a destruction can proceed unhurried, and a world in which a destruction will be recorded elsewhere and questioned afterward, offer entirely different incentives. The point of checks and balances has never been to make malice impossible, but to make malice keep accounts.
The minimum content of a destruction register follows the framework of Chapter 8: object, authorization, retention period, irreplaceable loss. What multiple entrances add is the requirement of scope verification: whether the version to be destroyed is the last surviving copy should first be verified across entrances, not self-reported by the destroyer. In this setting, claiming "it exists elsewhere" is easier than checking one by one, and the burden of verification is left to whoever later needs the record. Irreversible actions therefore require the inverse allocation: the party proposing destruction bears the duty of verification, and the verification record is preserved together with the destruction register, so that "assuming it exists elsewhere" and "never verified" can be distinguished after the fact.
Irreversibility itself should change procedure. Routine opening and tightening can remain at the custodian's discretion; permanent destruction, format conversions that lose information, and transfers of unique copies should each have, beyond the custodian, a position able to suspend the act. This position need not stand above the custodian — it need only stand farther away: different interests, different sources of funding, not subject to pressure on the same decision. The lesson of Chapter 14 transfers here: no role is reliable by nature; what matters is whether errors can be contained by other positions. Remote review adds no daily burden to the custodian; it only demands one more wait at the threshold of the irreversible.
The Daily Work of Cross-Version Verification
The purpose of periodically verifying the versions held by each entrance is not to confirm that they are fully identical — the point of independent preservation is precisely to permit difference — but to confirm that every difference has an explanation: where it bifurcated, why, and which version corresponds to which revision. Exact identity is itself grounds for suspicion: if two archives claiming independent preservation remain verbatim-identical over long stretches, the likeliest explanation is that one is not working independently, or that both share an upstream never declared. What verification then discovers is not difference but the falseness of independence.
The divergence entries that Chapter 19 designed for the foundation apply equally among entrances: when the versions of two entrances contradict one another and no ranking can be determined, register the contradiction, register both sides' materials and their times of appearance, and await new material. Such registration looks like doing nothing; in fact it moves the question "which version is true" from a contest of present volume to a position where evidence can accumulate. What determines the point of bifurcation years later is rarely who shouted louder at the time, but the registered times and chains of provenance.
Verification sometimes uncovers differences that should not exist: one entrance's version contains a passage absent from all other versions, or lacks a passage present in all of them. The anomaly itself is not a conclusion — Chapter 3 already warned that anomalous patterns cannot directly designate actors and motives — but the anomaly should have an outlet: registration, reporting to all entrances, triggering a dedicated investigation into that version's provenance, whose results are archived whether or not problems are found. An anomaly register without outlets is merely a more refined grievance; an anomaly register with outlets forces any party that plants a counterfeit version to reckon with the chain of explanations that discovery would set off.
Cross-version verification is labor, not an automatic process. Who performs it, who pays for it, and to whom results are published determine whether it is a public institution or the private instrument of one faction. An entrance verifying itself yields credibility capped by that entrance's interests; verification hosted in rotation among entrances with results registered uniformly becomes itself a form of public intercourse among entrances. Verification reports should also enter the version chain — they are records about records, equally open to correction by later verification.
The Gains and Limits of Distributed Preservation
The gains of distributed preservation are straightforward: fire, interrupted funding, institutional reorganization, unilateral tightening — each can wound only one place at a time. The analysis of disaster scenarios in Chapter 8 showed that what to save first in an emergency, and by whose priorities, is itself a decision of power; the more entrances there are, the smaller the irreversible consequences of such decisions — if one site rescues materials in the order of the power center's priorities, another site need not follow the same order. The value of multiple paths lies not in the copies themselves but in the fact that damage to any one path is no longer final.
Preservation distributed in name can share every point of fragility: the same funding source, the same supervising institution, the same retrieval platform, the same rotating cadre of custodians. Independence must be judged by structure of interest, not by address — two warehouses belonging to two committees that a single joint session could tighten simultaneously represent dispersion of distance, not distribution of structure. The method Chapter 3 confirmed for independent sources applies here in reverse: check times, paths of access, and common upstreams. Proof of independence is always valid once; it must be re-examined as structures change.
Chapter 19 argued that parallel archives are a source of correction for the foundation and should not be merged by proposals for a "unified record." Multiple entrances extend this principle into a general structure: entrances may differ in collection rules, in version policy, in access conditions, but the rules themselves should be set down in writing and visible. An entrance with visible rules, however pronounced its leaning, can still be used with correction by the users of other entrances — an archive known to lean somewhere is more verifiable than one claiming no lean at all. The diversity of rules is thus not a defect but the information entrances need in order to calibrate one another.
The Costs and Confusions of Multiple Entrances
The degeneration of multiple entrances has three foreseeable directions, the first of which is version confusion. Once entrances exceed a certain number and the registration of differences fails to keep pace with the growth of copies, no one knows which is the true text: citers grab whichever entrance comes to hand, readers cannot judge its provenance, and disputes decay into the endless loop of "your version is wrong." Multiple entrances then have not freed the record from control but freed it from use — and for those who need it, the two losses are one and the same.
Confusion need not arise naturally. A party wanting to invalidate some record can circulate copies bearing minute differences, forge an earlier "original version," and fabricate mutually contradictory provenance statements for the same document. These operations cost far less than destruction and leave almost none of destruction's gaps — Chapter 3 showed that anomalous absence can serve as evidence; but when "copies" of dubious provenance lie everywhere, absence is no longer anomalous, and the signal of evidence drowns in noise. Manufacturing confusion is thus a finer art than manufacturing silence: destruction is at least an act that can be pointed to, while confusion is a multitude of seemingly harmless additions.
Two kinds of actors profit from version confusion. One is whoever holds the power of collation — only they can rule on which version is usable, and the power of ruling rises with the degree of confusion. The other is those disadvantaged by the record's content — that the record cannot be trusted is already enough; it need not disappear; once every material comes trailing the remark "who knows which version this is," unfavorable evidence is discounted in advance. Those who bear the cost are ordinary users, and those whose evidence happens to fall on a contaminated version: the former pay the cost of infinite verification, the latter lose the standing to be heard even when their material is genuine.
The instinct for repairing version confusion is to establish an authoritative version repository, but this only ushers the gatekeeper back to the center. The workable structure separates two powers: the collator compiles lists of differences, fixes points of bifurcation, and publishes the strength of provenance of each version, but destroys no entrance and monopolizes no right to be cited; the preservers each maintain their versions but do not proclaim themselves the true text. Chapter 19 separated custody, access, and the adjudication of versions; here a fourth function is separated out: the power to compile comparisons must not simultaneously be the power to preserve. What users receive from the collator is an explained comparison, not a conclusion exempting them from comparison. The collation report itself has versions and can be disputed — it is an exceptionally diligent user, not a new monarch.
Preservation Cost as a Channel for Selective Abandonment
The second degeneration is gentler and far more common. Preservation costs money: warehouses, format migration, catalog maintenance, personnel. Cost is real, and is therefore the best cover — a party announcing that "funds are insufficient to continue preserving a certain class of materials" need not deny the value of those materials, need not declare any hostility, and the filtering is already complete. Chapter 3 argued that complete recording is a fantasy, and Chapter 8 conceded that repair requires priorities; this is precisely what makes the cost rationale nearly irrefutable: everyone can see the budget table, and no one can prove selectivity from a single abandonment alone. The force of cost discourse comes from the fact that most of the time it is true.
The problem lies not in finitude but in the asymmetry of selection. When weighing the preservation value of a class of materials, the committee naturally finds engineering drawings more important than compensation appeals, audit reports more urgent than residents' letters — not because it has argued the point, but because the users of the former sit in the same institution under the same appraisal as itself. When the power to assess preservation value overlaps with stake in the materials, "importance" drifts quietly toward the center of power, and the abandonment list becomes a second verdict signed by no one: the first verdict decides what the parties concerned lost, the second decides that posterity will never know about the first. This is not an accusation of conspiracy behind every budget cut, but the observation that without any conspiracy the distribution will still skew.
Repair does not demand an unlimited budget; it demands that abandonment become a visible decision: the abandonment list, with reasons, decision-makers, and dates, is registered and read alongside the preservation budget; before final disposal of abandoned materials, other entrances or community organizations have the right to take over preservation. Takeover cannot be compelled — compelled takeover merely shifts costs onto others — but the opportunity to take over must genuinely exist: deadlines public, transfer conditions reachable, no obstacles erected for the sake of the original custodian's embarrassment. The trace left by abandonment lets future users at least know what was lost; the existence of a takeover channel makes "unable to preserve" and "unwilling to preserve" structurally distinguishable. An entrance that neither registers its abandonments nor obstructs takeover, however honest its budget table, is carrying out destruction without a verdict.
How Backup Becomes a Reason to Defer Correction
The third degeneration appears after multiple entrances are running well. Since every entrance holds historical versions, the erroneous current version acquires an excuse for delay: the old version can be consulted elsewhere anyway, so it does not matter whether the display layer is corrected, and the correction need not happen this week. Backup turns from a public institution into an institution's vocabulary of exemption. The beneficiary is the custodian spared the cost of correction; those who bear the cost are actual users — the great majority of whom will never descend to the archival layer to check, and will forever see that erroneous but convenient current version.
Chapter 8 established that the default position of retrieval should not continue to display outdated conclusions. Multiple entrances push this requirement toward generality: every entrance must maintain an explicit status of the current version — which version is current, on what basis, changed when; historical versions serve re-examination, not citation. The status of the current version is a continuing labor, not a one-time setting; each update of "which versions have expired" enters the version chain, making delay measurable after the fact: the interval between the date an error is confirmed and the date the current version is updated is among the hardest indicators of an entrance's integrity. It cannot be retouched by narrative.
Chapter 19 required that corrections reach the point of use; here the dimension of time limits is added: once an error is confirmed, the update of the current version should carry a deadline, and overdue updates require stated reasons and registration; the delay itself enters the entrance's periodic audit. The tracking of citation relations extends from the foundation to the entrance layer — where a public decision has cited a version later corrected, the affected parties should be able to demand review on the strength of the correction record, rather than being told that what was relied on at the time was "a consultable version." A duty of correction without time limits, given the existence of backup, automatically degenerates into no duty: since the old version is forever consultable, correction can forever be done tomorrow.
Deletion, Use, and the Boundaries of Rebuilding Shared Facts
Chapter 8 established the legitimate place of deletion: privacy protection, erroneous personal information, materials obtained through serious violations — the objects of deletion should be proportionate to the risk, and restricted preservation retains the possibility of re-examination. Multiple entrances raise a further question: when the same material exists at several entrances, what does a legitimate deletion at one entrance mean for the others?
When one entrance deletes a material for privacy risk, must the others follow? Unlimited following would let any single entrance make deletion decisions for all, and multiple entrances would exist in name only; mutual silence would let the protection fail — a material legitimately deleted at one place revives intact from another, and the subject's risk is not reduced at all. The workable structure is layered notification: for deletions involving privacy risk to living subjects, the decision, with its reasons, is notified to the independent entrances, each of which reviews and handles it under its own rules and registers the outcome; deletions not involving such risk carry no power to demand that others follow. Notification conveys information, not commands — in this it resembles the destruction notice, while its structure of obligation differs.
Under multiple entrances, access restriction is no longer a master switch but should be decomposed into layers: a public layer reachable by all; an appeal layer consultable on proof of interest or research qualification, with consultation logged; a sealed layer with explicit terms and conditions of opening, the conditions set down in writing and automatically re-examined at expiry. Sealing without term is in effect equivalent to destruction and should therefore follow the procedure of destruction — cross-entrance notification, registered reasons, remote review. Disguising sealing as restriction is a newly emergent form of deception in this chapter's context: it borrows the mild appearance of restriction to carry out the irreversible consequences of destruction.
Entrance Quality and Users' Capacity for Verification
A record preserved while its catalog is not is a book placed in a warehouse without shelving. Catalogs, indexes, and retrieval rules age together with the record they serve, and are controlled together with it — retrieval ranking decides what users see first, an invisible adjudication noted in Chapter 8. Entrance maintenance must therefore treat the catalog as an object of preservation: the catalog's versions, changes, and reasons for revision enter the version chain, rather than being treated as a technical shell replaceable at any time. An entrance whose records are intact but whose catalog has fallen into disrepair presents the public with a tidy building that has been locked.
The layers of understanding likewise need maintenance. An archive clear to the professional may be wholly unreadable to the ordinary resident; introductory guides, search manuals, and answers to common questions decide whether the entrance can accomplish "understanding" beyond "arrival." This does not require every entrance to write a textbook; it requires that entrances set no additional hidden thresholds to understanding — statements of classification principles, format conversion tools, minimal explanations of terms. An entrance that treats the cost of understanding as a sieve is certainly substituting difficulty for qualification review.
The user's responsibility already appeared in Chapter 8: citing an old version requires marking the date, and discovering a correction requires updating. Multiple entrances add one step to this responsibility: citations should indicate the entrance and version relied upon, because with different entrances the provenance of the same sentence may differ. This is not formal fussiness but the distribution of cross-version verification across every act of citation — every citor who conscientiously marks the source contributes a data point to the list of differences. The force of habit exceeds that of institution: when marking the entrance becomes the citation convention of the community, a party planting counterfeit versions must forge the entire chain of provenance, and its costs rise layer by layer.
Entrance structure has temporal depth. Which entrances are reachable today determines what questions the next generation of researchers can pose, and which stretch of experience will have no materials to interrogate at all. This is not a plea to preserve everything for every possible question — Chapter 3 already rejected the fantasy of complete recording — but a plea that decisions of abandonment and blockade recognize that they are choosing topics on behalf of the future. Intergenerational humility consists not in preserving more, but in preserving the record of "what we did not preserve": the abandonment lists, the destruction registers, the gap statements are the most honest catalog this generation can leave to the next.
Counterexamples, Failure, and the Conditions of Rebuilding Shared Facts
Some losses are irreversible under any structure of entrances: the destruction of a unique copy, experiences never collected by any entrance, a party who dies before the record is formed. Multiple entrances lower the probability of such losses; they cannot recover the portion already incurred. Acknowledging this boundary guards against treating multiple entrances as proof that historical justice is complete; they can only improve the reachability of materials, not guarantee that trust or compensation will follow.
The degeneration of multiple entrances gives warning signs: difference registers left unupdated for long stretches; verification reports produced only after disputes erupt; preservation budgets for some class of materials shrinking year after year while the abandonment list remains invisible; the interval between confirmation of errors and updates of the current version lengthening steadily; the custodial decisions of the entrances beginning to move in step — tightening together, revising together, falling silent together. Any single sign can bear another explanation; when several coexist, the entrances remain multiple in number but are already one in function.
Repair begins with the cheapest step: restore the public visibility of the difference lists and verification reports, so that entrances can once again be compared; then the abandonment lists, destruction notices, and the distribution of processing times; only then the rearrangement of structure — the separation of collation power from preservation power, the rebuilding of independence, the establishment of remote review. Structural rearrangement comes last not because it matters less, but because the first two steps cost so little that no budget rationale can refuse them; at that point refusal itself becomes evidence. The boundary then stands clear: the number of entrances is not the achievement; what matters is their mutual independence, verifiability, and accountability. What multiple entrances preserve is not a mirror of truth but the lower bound of the cost of controlling a record — they turn "making a record vanish from the public world" from a single command into an engineering project that must succeed simultaneously at many mutually independent positions, each of which will leave traces. At this point records will still be lost, still err, still be disputed, but they can no longer be quietly disposed of. The reliability of public memory rests its hope not on the permanent goodwill of any entrance, but on malice being made to pay a price — and to leave a receipt.