Published means preserved.
In 1610, an Oxford librarian struck a deal that quietly changed what "publishing" means: a copy of every new book must be lodged in his library — an obligation attached at the moment of publication, not a favor asked afterward. Hyperscale treats a blockchain's data the same way: nothing becomes history until enough machines provably hold every byte of it.
Sir Thomas Bodley's deal
Thomas Bodley, rebuilding Oxford's ruined university library, understood something ahead of his time: a civilization's memory cannot depend on publishers' goodwill or collectors' luck. In 1610 he persuaded the Stationers' Company — the guild that controlled English printing — to lodge a copy of every book they registered with his library, as a standing condition of the trade itself. Parliament made the principle law in 1662, and "legal deposit" spread across the world; today six libraries in Britain and Ireland alone are entitled to a copy of everything published.
The genius is in the timing. Preservation isn't something that happens to a book later, if someone remembers, if the publisher cooperates, if a librarian notices a gap. The copy exists because the book does. Publication and deposit are one act — so nobody ever has to discover a loss and go begging for a reprint from a publisher who may be bankrupt, hostile, or gone.
The principle that outlived the printing press: attach the obligation to preserve at the moment of publication — never rely on detecting a loss and repairing it after the fact.
A ledger whose evidence is scattered
A sharded blockchain scatters its records by design. Shard Q's correctness routinely depends on data published by shard P: the transactions it must run, the provisions proving P's state (the generals), the certificates sealing P's results. And the delivery layer is gossip over a real network — lossy, reordered, unfair. The deadly subtlety is that absence is invisible: a node that never received something usually doesn't know there was a something. "I never got it" and "it never existed" look identical from the inside. The naive postures all fail:
You can't fetch what you can't name
Best-effort broadcast delivers almost everything, almost always — and the missing fraction is precisely the data nobody knows to ask for.
Not an architecture
"Never delete" turns every disk into a countdown clock, and still doesn't say who must serve what to whom — hoarding is not availability.
One node is not a guarantee
The machine that sent the data may have restarted, rotated off the committee, or be lying. A polite request to a single peer is hope with an address.
Hyperscale's answer runs on one design principle, applied everywhere: the artifact you need is either held by someone obligated to serve it, or provably expired. There is no third state — no shrug, no "ask around." That principle runs on three mechanisms: deposit, obligations, and provable forgetting.
Every certificate is a deposit receipt
The masterstroke is hidden inside consensus itself. A validator votes for a block only while holding the complete block — the header and every transaction, certificate, and provision body it references. Not a summary, not a hash list: every byte. Which means a quorum certificate does double duty (the overlap covers its first job): the moment 2f+1 signatures assemble, it is proven that 2f+1 machines each hold a full copy of everything the block carries — recoverable from any one of them.
Compare the ordinary alternative: certify a compact header now, distribute the heavy contents later, and discover during a crisis that "later" never came for the one block you need. Here the Bodley move closes that door structurally — a block cannot become official faster than it becomes preserved, because the signatures and the copies are the same act.
Who must hold what, until when
Beyond blocks, the cross-shard machinery generates artifacts with specific consumers — and each travels with an explicit obligation: a named class of holders, and a release condition. Three rules give the ledger its teeth:
Release on receipt, not on silence. A shard that publishes provisions must keep serving them until the destination's own quorum-signed certificate covers the batch — a positive, cryptographic acknowledgment — or the attested deadline passes. "It's probably fine by now" is not a release condition anywhere in the system.
Absence is announced. Since a missing thing can't announce itself, block headers pre-announce: which shards this block provisions, and a fingerprint of what each should expect. A destination therefore knows there is something to miss — and after a grace period, fetches it from the obligated committee rather than waiting on gossip's mood. The same pattern covers transactions a destination learns about but never received.
Obligations survive restarts. Requests are answerable from committed storage — including historical reads within the retention window — so a source node that crashed and recovered can still honor its shard's obligations. The duty attaches to the role, not to a process's uptime.
The archive that knows when to say no
The mirror half of preservation is disciplined forgetting — an archive that keeps everything forever eventually keeps nothing well. Every eviction in the system keys on BFT-attested time, which makes "we are allowed to forget this now" a consensus fact: the same on every honest machine, at the same attested moment. Past the horizon, a request isn't met with a shrug or a maybe — it is refused, identically, everywhere, and every protocol that consumes history is designed to complete its business within the window. A request can be satisfied or provably expired; it can never fall into the crack between.
Bodley's principle, restated for machines: an archive is not a building. It is a set of obligations attached at the moment of publication — held until receipted, or released by a clock everyone shares.
And the loss paths are rehearsed, not hoped away: the fault suite kills each gossip channel in turn and asserts the fetch obligations recover it — the crash lab.