Collision Quarantine Queue¶
Workflow — instantiates Collision-Free Mapping Design
A review workflow for conflicting assignments, suspected collisions, and merge decisions.
A collision quarantine queue is the holding pen and review workflow where flagged collisions wait for a decision instead of being auto-resolved either way. It exists because the two tempting reflexes are both wrong: auto-merging two records that collide risks conflating genuinely different sources, and auto-rejecting the second risks discarding a legitimate case. The queue holds the conflict, classifies how bad it would be, and routes it to a human with the authority to decide — and when the decision is "these really are the same, merge them," it captures who authorized that and why. It is the seam the whole archetype turns on: the place where an accidental collision is deliberately separated from an intentional merge, so that no two distinct sources collapse without someone signing for it.
Example¶
A bank onboards a new customer whose name, date of birth, and address fuzzily match an existing account holder. The system does neither reflex. It does not silently merge them — if they are two different people, funds and statements could misroute to the wrong one. It does not silently reject the new application — they might genuinely be the same person returning. Instead the case lands in a quarantine queue.
A data steward opens it, reads the preimage evidence side by side, and classifies severity: a shared marketing contact ID would be low, but a shared account-holder identity that could cross two people's money is critical and jumps the queue. The steward determines these are in fact two different people who happen to share a name and street, confirms the distinction, and the newcomer is issued a fresh identifier. Had they been the same person, the steward would have authorized an explicit merge — recorded with the steward's name, a rationale, and a timestamp — so that months later anyone can see the merge was a decision, not an accident.
How it works¶
- Receive, don't detect. The queue takes in collisions already flagged by indexes, scans, locks, and hash checks; its job starts where detection ends.
- Classify severity on intake. Each item is scored against a rubric — how much damage a wrong merge would do — which drives its SLA, its reviewer level, and its place in line.
- Route to a decision. A reviewer resolves each item as retry, disambiguate (renumber), expand the namespace, or authorize an explicit merge.
- Require a signed record for merges. A merge cannot proceed on a shrug; it demands an authorization record — approver, rationale, timestamp — that marks it as intentional and auditable.
- Age and escalate. Unresolved items don't vanish; they age with escalation so critical collisions can't rot in a backlog.
Tuning parameters¶
- Severity rubric — what makes a collision critical versus trivial. Sets which cases preempt the queue and which can wait.
- Auto-resolution threshold — how low-severity a case must be to disambiguate automatically without human review. Loosen it for throughput; tighten it for safety.
- Reviewer authority levels — who may sign off on a merge, and whether high-severity merges need two approvers. Guards against a single hasty hand.
- SLA / escalation timers — how long an item may sit at each severity before it escalates. Prevents silent backlog rot.
- Routing rules — which domain steward each collision goes to, so reviewers judge cases they actually understand.
When it helps, and when it misleads¶
Its strength is that it is the one mechanism built to separate accidental collision from intentional merge — the archetype's core distinction — and to make every deliberate collapse an on-the-record decision rather than a silent overwrite.
Its honest failure mode is congestion: a slow or understaffed queue becomes a dumping ground, items age, and the pressure to clear the backlog tempts reviewers into bulk auto-merges — which is exactly the unreviewed collapse the queue exists to prevent. That is the cataloguer's failure of conflation, where two distinct entities are fused into one authority record and the distinction is lost for good.[n1] The classic misuse is setting the auto-merge threshold so loose that the queue rubber-stamps merges it was meant to scrutinize. The guarding discipline is to keep merge authorization human and logged, and to monitor queue age and the false-merge rate as first-class health metrics.
How it implements the components¶
collision_exception_queue— it is the review-and-routing workflow that holds flagged collisions and moves each to retry, disambiguation, namespace expansion, or merge.merge_authorization_record— every intentional merge is captured with approver, rationale, and timestamp, marking it as a decision rather than an accident.collision_severity_policy— the intake rubric classifies each collision's severity, driving its priority, SLA, and reviewer level.
It does not detect collisions (Duplicate Target Scan, Hash Collision Check), enforce uniqueness at write (Unique Index Constraint), or hold namespace value states (Namespace Reservation Table); it adjudicates what those surface.
Related¶
- Instantiates: Collision-Free Mapping Design — it is the archetype's adjudication seam separating accidental collapse from authorized merge.
- Consumes: Duplicate Target Scan feeds it detected collisions; Preimage Audit Log supplies the source evidence reviewers weigh.
- Sibling mechanisms: Duplicate Target Scan · Preimage Audit Log · Unique Index Constraint · Namespace Reservation Table · Deterministic ID Allocator · Booking Lock · Hash Collision Check
Editorial Notes¶
Form Classification¶
Form family: Decision, Gate & Allocation
Rationale: A review workflow for conflicting assignments, suspected collisions, and merge decisions, making its operative form a case-specific gate, selection, routing, prioritization, or disposition decision.
Independent corroboration: The frozen evidence defines Collision Quarantine Queue as 'A review workflow for conflicting assignments, suspected collisions, and merge decisions', so its operative form is Decision, Gate & Allocation.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Library & Information Science
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Authority-control and bibliographic data stewardship established conservative holding and human review of ambiguous identities so records are not automatically conflated or discarded.
Related originating lineages:
- Computer Science & Software Engineering — Exception-queue and incident-workflow engineering supplies bounded holding states, service levels, signed disposition, and replayable repair.
- Data Science & Analytics — Entity-resolution pipelines supply candidate scoring, severity ranking, and the undecided region routed to human review.
Review resolution: OCLC's VIAF material documents ambiguity during identity clustering, conservative matching, and later cluster merges as evidence improves; WorldCat documents automated duplicate detection coupled to experienced cataloger control. Those are direct ancestors of holding suspected collisions for reasoned merge-or-split disposition, while data and software systems supply scoring and queue execution.
Attribution caveat: Computer systems provide the queue machinery, but library and information science is primary because the governing decision is whether two identifiers refer to one entity or distinct identities and must remain conservatively separated pending stewardship.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- OCLC Research: Managing Ambiguity in VIAF
- OCLC: Library Linked Data in the Cloud—VIAF
- OCLC: WorldCat Cooperative Quality
Notes¶
[n1] In library authority control, conflation is the error of merging two distinct entities — for example, two authors with the same name — into a single record. It is the canonical example of unreviewed many-to-one collapse, and undoing it after downstream references have propagated is notoriously hard. ↩