Data Safety & Integrity
Software can be replaced.
Museum history cannot.
MCVM was built around one overriding requirement: protect the museum's collection record.
Museum records may represent decades of work and contain information that cannot simply be recreated after a failure. MCVM was engineered on the assumption that computers fail, drives fail, software fails, and people make mistakes. Its job is to keep those failures from becoming the loss of institutional history.
The architecture starts with separation
The program is not the collection.
MCVM Collection Manager operates independently of the museum's collection data. The application can be updated, repaired, replaced, or rolled back without treating the museum database and collection files as replaceable program material.
Layered protection
No single backup is asked to carry the whole burden.
Multiple backup destinations
MCVM can preserve complete backups locally, on an external drive, and in cloud storage rather than depending on one device or one copy.
Retained backup history
Configurable retention keeps multiple generations of backups, giving the museum a path back when a problem is not discovered immediately.
Complete Backup
Protection is designed around more than a database file. Complete Backup preserves the collection database together with the associated museum files required for recovery.
Verification
Creating a backup file is not treated as proof that the museum is protected. MCVM verifies that the expected collection material is actually present.
Restore & migration safeguards
Backups are meant to be recoverable. MCVM includes deliberate workflows for restoring a collection and moving it to another computer without treating recovery as an improvised file-copy exercise.
Known-good states
Consequential operations are designed to preserve a known-good state and avoid silently accepting partial or ambiguous results.
Failure is part of the design
MCVM does not assume everything will always work.
Data safety is not based on confidence that hardware, Windows, networks, updates, or users will behave perfectly. It is based on layers of protection intended to keep an ordinary failure from becoming a museum emergency.
The collection is designed to be recoverable from complete backups rather than tied permanently to one workstation.
Independent backup destinations and retained generations reduce dependence on any single storage device.
MCVM's update architecture is designed around authenticated software, preserved known-good application versions, startup validation, and rollback rather than blindly replacing a working installation.
The recovery architecture separates the bootstrap/repair path from the replaceable application so program failure does not have to strand the museum's collection.
MCVM is designed to stop, preserve the known-good state, and surface the problem rather than bluff its way through an uncertain result.
Historical integrity, retained backups, deliberate confirmations, and recovery paths are intended to make correction possible without casually erasing institutional evidence.
Integrity is more than backup
Protecting the record also means protecting what the record means.
Institutional history
Consequential collection actions and corrections should preserve evidence of what happened instead of quietly rewriting the past.
Museum control
The museum's private collection database does not have to live on an MCVM-operated server. The institution retains control of its own records.
Authenticated releases
MCVM release integrity and publisher identity are treated as part of stewardship. Program updates should be authenticated before they are trusted.
Public/private boundaries
Public publishing is deliberately separated from the private working collection. The museum chooses which records, descriptions, photographs, and documents are approved for visitors.
Human authority over AI
AI may assist research and drafting, but suggestions do not automatically become museum fact. Museum staff remain responsible for the institutional record.
Recovery without sacrificing the collection
The program should be disposable compared with the data. Repairing MCVM should never require treating museum history as collateral damage.
The standard MCVM is built toward
A software failure should not become a museum data loss.
No responsible software can promise that hardware will never fail or that a human will never make a mistake. MCVM's answer is defense in depth: separate the program from the collection, preserve multiple recoverable copies, verify critical operations, retain known-good states, authenticate what replaces the software, and refuse to treat uncertainty as success.
Protect the collection first. Everything else can be rebuilt.