There is a nice little Mac program, Retrieve, that scans the disk looking for given words and phrases. It shows you each context where the stuff is found and indicates which document it is in. It takes advantage of the fact that most Mac word processing programs tend to store their text in the "data fork" of the document file and formatting information is stored elsewhere. It is surprisingly effective. It is a bit like the Unix grep utility. It is defeated by compression schemes and formats such as Acrobat's .pdf files.

It is interesting to imagine how such a useful program could operate in a capability system. Retrieve uses its infinite authority to read any file on the disk. Such authority is unlikely to be available in a capability system. I suggest the following instead:
For a given word processor there are two factories which produce new documents (word processor instances). One is discreet and the other is not. The yield of the indiscreet factory deposits a RAT (Read Ascii Text) capability with the retrieve service. (Its ability to do this is the hole (the rat hole) that makes the factory indiscreet.) When RAT is invoked the information of the document is returned in flat ascii form. Now a program such as Retrieve can scan those documents that have not been hidden. It can read compressed files and Acrobat files.

The RAT capability might be amplifiable to a full document capability to be returned to the invoker of Retrieve. This does not help to recall where that document lives in the system. Indeed it might be used to retrieve the document after all copies of the main capability to the document have been lost.

An order on the main capability returns a RAT key for the requestor to disseminate as he wishes.