It is interesting to imagine how such a useful program could operate in a capability system.
Retrieve uses its infinite authority to read any file on the disk.
Such authority is unlikely to be available in a capability system.
I suggest the following instead:
For a given word processor there are two factories which produce new documents (word processor instances). One is discreet and the other is not. The yield of the indiscreet factory deposits a RAT (Read Ascii Text) capability with the retrieve service. (Its ability to do this is the hole (the rat hole) that makes the factory indiscreet.) When RAT is invoked the information of the document is returned in flat ascii form. Now a program such as Retrieve can scan those documents that have not been hidden. It can read compressed files and Acrobat files.
The RAT capability might be amplifiable to a full document capability to be returned to the invoker of Retrieve. This does not help to recall where that document lives in the system. Indeed it might be used to retrieve the document after all copies of the main capability to the document have been lost.
An order on the main capability returns a RAT key for the requestor to disseminate as he wishes.