What you actually hold when you hold a URL
Almost everything people call "having a model" is a pointer. You have a URL, maybe a bookmark, maybe a habit of re-downloading it into a cache folder whenever a project needs it. The pointer feels durable because the page usually loads. But a pointer is not the thing it points at — it is a permission, granted by whoever controls the server, revocable at their discretion, for reasons that have nothing to do with you.
Model weights have been removed from public reach in at least three documented ways. Sometimes an artifact is deleted: a licensing dispute ends with checkpoints pulled, or an author scrubs an experiment they no longer stand behind. Sometimes it is policy: a host tightens its terms, gates a repo behind access approval, or removes content categories wholesale — the artifact still exists somewhere, but not where your tooling expects it. And sometimes the company simply dies, and the servers with it. None of these require malice. All of them end the same loan.
The broader pattern is not specific to AI. In 2019, a routine server migration at MySpace destroyed roughly twelve years of user-uploaded music — an archive that musicians and archivists had assumed would keep existing because it had always existed. The lesson generalizes cleanly: data stored on infrastructure you do not control can be destroyed by ordinary operations. If the only copy of something you depend on lives behind someone else's door, your access is a tenancy, not an ownership.
Open weights are unusually ownable
Here is the part that makes this quest possible at all: model weights are one of the rare digital artifacts where genuine ownership is technically easy. A set of tensors serialized to a file is self-contained. It does not phone home to load (some hosted APIs do; the tensor file does not). It does not need the original training run, the dataset, or the company that made it. You can copy it, verify the copy is bit-identical to what the author published, move it between disks, and load it years later on hardware that did not exist when it was trained.
Compare that with the things you supposedly "own" in a streaming world: DRM-encumbered media, dependent accounts, license servers. Weights you have downloaded, digest-verified, and stored are closer to a paperback than a streaming license. The open-weight ecosystem, whatever its faults, ships artifacts that respect this. That is worth protecting by using it.
The archivist's first move
Libraries solved this problem centuries ago, and their answer was not "trust the publisher." It was acquisition: get a copy of the object, describe it, verify it is what the catalog says it is, and place it somewhere whose incentives align with keeping it. Every track in this quest is one of those verbs applied to tensors — acquire, describe, verify, place.
The cheapest time to make the copy is while the link is healthy. Waiting until a model is rumored for de-listing is the museum buying at auction after the artist dies: possible, expensive, and sometimes impossible. Quiet, patient acquisition while everything is boring is the entire strategy.