The two commands an archive never runs
For working directories, overwriting and deleting are ordinary hygiene. For an archive, they are the two ways to destroy the thing the archive exists to hold. The discipline is blunt: never overwrite, never delete. New things land beside their predecessors; disk is spent on history; and when space truly runs out, removal is an explicit, recorded decision — never a silent side effect of an update or a cleanup script.
Why so absolute? Because every casual overwrite story ends the same way. The upstream repo "fixed" its files, and syncing the fix destroyed the revision you had pinned and verified. A cleanup script removed "duplicates" that were actually the only copy of a variant. A re-download landed over the verified original because the filename matched. Each seemed reasonable at the keystroke; each destroyed evidence.
Revision directories make immutability natural
The layout from lesson two carries this: each acquisition lands in its own variant-revision directory. A new revision is a new directory — the old one untouched, still pinned, still digest-verified against its NOTES. "Updating" a model in the archive is addition, not mutation. When you compare two revisions later (did the refresh change tensors? did the license file change?), the comparison is possible precisely because neither side was overwritten.
The same rule scales down to files: .part files never wear final names; digests are recorded in files that are appended to, not edited; the walk-away log only grows. An append-shaped archive is an auditable archive — every fact in it is either an addition or still true.
The honest exceptions
Two cases deserve honest treatment rather than dogma. Genuinely wrong acquisitions — a file that should never have landed (license bomb, mislabeled derivative) — can be removed, but as a recorded event: a walk-away-style entry saying what left and why, so the refusal survives the removal. Disk exhaustion — when the budget genuinely cannot hold both history and future — forces triage; the triage decisions (what left, what justified it) belong in the catalog, because a shrunk archive with silent deletions is just a slower junk drawer. In both cases the principle survives intact: the action is explicit, reasoned, and visible in the records.
Guarding the discipline mechanically
Discipline decays; permissions don't. The strongest guard is making the archive's canonical copy hard to write casually: a read-only share for everything except the acquisition process, or a sync tool running one direction (source → archive) so nothing in the archive ever propagates backward into overwrite positions. Belt: the periodic digest sweep — which is also your tripwire, because an overwrite or deletion shows up as a FAILED or missing entry, and then the records tell you whether it was ever a decision.