The Succession
Persistence, Part IV
In 2019, Industrial Light & Magic did something almost nothing in this industry ever does. It transferred stewardship of something it still needed.
The thing was OpenEXR, the high dynamic range image format ILM built for its own pipeline and opened to the world in 2003, which grew into a widely used standard in professional visual effects, the container for the frames studios care most about. The people who built and carried it, Florian Kainz, Rod Bogart, Drew Hess, Piotr Stanczyk, Ed Hanway, moved on one by one, and by the later handoffs the work had settled into maintenance routine rather than active development. The studio’s engineering attention had long since shifted to bigger problems, because the format simply worked. Cary Phillips, the R&D supervisor it eventually landed on, describes inheriting it without a deep background in image science and with hardly any hands-on time in the modern tooling. And then a security vulnerability was reported in the library, and the team holding it had, in his words, so little experience with security issues that it was “ill-equipped to respond.”
The destination already existed, because someone else had been building one. Rob Bredow, ILM’s CTO, was serving with Phillips on the Academy’s Science and Technology Council, where an effort was brewing to safeguard the open software the whole industry runs on, and Bredow drove that effort into what became the Academy Software Foundation, a neutral home governed by the companies that depend on the code. In 2019, OpenEXR moved in. Phillips gave the public reason in the announcement, and it is a clear-eyed sentence about an institution’s own limits: “there’s a natural life cycle to software projects.” Architects leave. Expertise spreads. The ecosystem outgrows any single owner’s ability to keep up. Inside the studio, by his account, nobody argued against it. Quite the opposite. The one real condition was the counterparty. ILM would have hesitated to hand stewardship to an entity whose agenda might drift from its interests, and the Foundation, governed by seasoned professionals from the studios and vendors that live on the format, cleared the bar. Phillips signed on to chair the project’s technical committee for three reasons. It fit his council role. Two of the original developers are close friends, and he did not want to watch their creation wither. And it sounded like fun.
Read that sequence against everything this series has described, and the strangeness sharpens in both directions. This is not a rescue story. Nothing had been lost, no attic was involved, and the studio was still running its most important imagery through the format every day. A working institution looked at the people leaving, concluded its own custody had a horizon, and arranged for responsibility to outlive it, the first actor in four essays of accidents and defaults to behave like a preservation system on purpose. And honesty requires the other direction too. The Foundation was already being built, but the decision to move OpenEXR into it followed the scare, which readers of the second piece in this series will recognize as the oldest law in this machinery. Nothing moves until something forces it. What the move solved is also worth being precise about. A foundation can receive what a keeper is able to hand over, the code, the roadmap, the authority to decide. The judgment that leaves in the elevator is a different problem, and it has to be solved again, one successor at a time.
Where the survivors came from
The last piece in this series ended by saying that what survives tends to survive somewhere small, close, and tended. That described where survivors turn up. It did not explain why. What they actually share is that something with a different mandate was standing there when the first one stopped. The first three pieces studied the powers of persistence while they operated, the authority that decides what carries forward, the dependency that vetoes change, the judgment that knows when the rules stop applying. This one is about what happens when responsibility has to move.
The seam
Start with a number from the people whose entire job is keeping things. Researchers went through the global registry of research data repositories, the institutions built explicitly to preserve material for the long term, and identified 191 that had shut down. The median age of a repository at shutdown was twelve years. Fewer than half migrated their holdings to a successor before closing, and nearly half showed no sign of using any data-rescue strategy at all. Look at what that denominator means. These were organizations whose founding purpose was persistence, staffed by people trained in it, and their mandates still ended young, and in most cases the ending had no plan. Even the Digital Preservation Network, built to replicate holdings across organizations and geographies, with succession written into its design, wound itself down in 2018. Redundancy inside a mandate does not survive the end of the mandate.
The preservation field knows this about itself, which is why its standards read the way they do. A trusted repository is required to have a succession plan: a named successor, transferable material, enough context that a stranger could reconstitute the collection, the rights to hand it over, the capacity to receive it, and a trigger that fires while there is still something to hand over. The discipline learned, the hard way, that survival is not a property a system has. It is an arrangement between the system and whatever comes after it.
Now look at media. Almost nothing in it was built to that standard, because almost nothing in it was built as a preservation system. The studio pipeline exists to ship this year’s slate. The rights database exists to close this quarter’s deals. The playout chain exists to make air tonight. The format exists because somebody’s renderer needed it. Persistence, everywhere in this industry, is a side effect of systems designed for something else, and side effects do not get succession plans. Which means the moment the preservation field plans for arrives in media unplanned, and usually unannounced. Responsibility rarely gets put down cleanly. It erodes through a merger. It diffuses across a reorganization until no desk owns it. It evaporates when a team is cut, and the discovery that it evaporated comes years later, when someone reaches for the thing and finds that nobody has been carrying it. A great deal of media succession is somebody realizing, long after the fact, that nobody has the baton.
