The Gold Standard · Anthropology
Make the decision path visible
Authoritative re-synchronisation is not complete when the fastest systems agree. A field tablet, restored backup, contractor export or after-hours directory can reconnect later with an older owner map and quietly republish it. The graph then drifts after everyone believed the incident had closed.
The gold standard treats reconnection as a controlled admission event. Every returning consumer proves its version, authority and intended writes before it can influence the appeal route; rejected changes remain visible for repair and learning.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · RECOGNISE RE-ENTRY
1. Define late-reconnection drift
Late-reconnection drift occurs when a consumer returns after authoritative re-synchronisation and presents an older graph, delegation or closure state as current. The consumer may be technically healthy while its authority is stale.
Separate delayed delivery from stale authority. A queued notice that still names the right role can be processed; an old write that changes who may decide needs containment.
CHAPTER 2 OF 12 · RECOGNISE RE-ENTRY
2. Inventory consumers beyond the central directory
List mobile devices, local exports, backup restores, message routers, contractor systems, printed runbooks and manual distribution lists. Record who reads, writes and republishes ownership.
The inventory should include expected offline duration and a responsible owner. Unknown consumers are an evidence gap, not proof that the graph is complete.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · RECOGNISE RE-ENTRY
3. Set an admission contract for reconnection
Require a current version marker, source identity, last successful sync, pending-write summary and proof of the consumer’s permitted role. Define which mismatch causes read-only access, quarantine or rejection.
A reconnecting consumer should not acquire write authority merely because its credentials still authenticate.
| Field | Evidence |
|---|---|
| Identity | Known device or service |
| Graph version | Current or stale |
| Pending writes | Scope and consequence |
| Owner | Admission reviewer |
CHAPTER 4 OF 12 · CONTAIN STALE AUTHORITY
4. Quarantine stale writes before merge
Place pending changes in a review queue and prevent bidirectional sync until authority is checked. Preserve local timestamps and source sequence, but do not let them override the effective authoritative version.
Quarantine protects both sides: the central graph cannot be corrupted, and potentially legitimate field evidence is not discarded.
CHAPTER 5 OF 12 · CONTAIN STALE AUTHORITY
5. Use monotonic versions and fenced authority
Issue graph versions that only move forward and attach a fencing token or equivalent authority marker to consequential writes. Consumers with an older marker can read the current state but cannot change it.
Clock time alone is weak evidence. Devices can have incorrect clocks, and a later local timestamp can still represent an older authority decision.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · CONTAIN STALE AUTHORITY
6. Worked example: an offline tablet restores the losing owner
A field team reconnects a tablet after six weeks. It carries the pre-rollback directory and three pending updates, including an appeal closure assigned to the losing owner. The central service accepts the device login but holds its writes because the graph version is obsolete.
The reviewer keeps two new contact observations, rejects the ownership write and reopens the closure for the authoritative duty role. Changed-context check: if the tablet was deliberately authorised to collect observations while offline, those observations can be admitted without granting it power to rewrite decision authority.
| Item | Treatment |
|---|---|
| Observation | Validate and retain |
| Ownership write | Reject if stale |
| Closure | Re-review |
| Unknown export | Isolate |
CHAPTER 7 OF 12 · RECONCILE EFFECTS
7. Reconcile decisions, not just records
Trace notices, acknowledgements, assignments and closures influenced by the returning consumer. Reconsider only outcomes for which stale authority could have changed participation or effect.
A rejected write may still reveal a real event. Preserve factual evidence separately from the consumer’s outdated interpretation of who could decide.
CHAPTER 8 OF 12 · RECONCILE EFFECTS
8. Release a consumer through staged reintegration
Update the consumer in read-only mode, verify that pending changes are classified, run a no-write comparison and then enable the minimum necessary write path. Record the new version and release approver.
If the device or system cannot prove safe version behaviour, keep it as a bounded evidence source rather than a graph authority.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · RECONCILE EFFECTS
9. Test changed-context reconnection
Simulate restored backups, long travel, renamed roles, expired delegates, after-hours routing and a consumer that reconnects after another graph change. Confirm that stale writes fail safely while valid observations remain recoverable.
Testing should include the human workflow: reviewers must understand why a write was held and where to resolve it.
| Stage | Proof |
|---|---|
| Read only | Current state loaded |
| Compare | No unsafe delta |
| Limited write | Fence accepted |
| Release | Owner records approval |
CHAPTER 10 OF 12 · PREVENT RECURRENCE
10. Monitor for recurrence after apparent convergence
Watch rejected versions, unexpected writers, repeated quarantine, unowned devices and ownership changes originating outside the authoritative service. Use thresholds that trigger investigation and temporary write restrictions.
A quiet dashboard can miss consumers that have not yet returned. Keep the monitoring window aligned with the longest credible offline cycle.
CHAPTER 11 OF 12 · PREVENT RECURRENCE
11. State limits and misconceptions
Version controls cannot discover every spreadsheet, paper list or informal delegation. Quarantine can also delay urgent work if there is no staffed review path.
Document unobserved consumers, emergency exceptions and the evidence supporting closure. Recurrence containment is a bounded operational claim, not permanent certainty.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · PREVENT RECURRENCE
12. Audit the full re-entry lifecycle
Track expected consumers, reconnect attempts, presented versions, held writes, review decisions, repaired outcomes, release approvals and recurrence. Compare the graph inventory with actual writers over time.
The gold standard lets delayed systems return without letting old authority return with them. It preserves useful field evidence while keeping one accountable decision path.
| Signal | Warning |
|---|---|
| Old version returns | Inventory incomplete |
| Repeated quarantine | Consumer not repaired |
| Unknown writer | Authority leakage |
| Delayed review | Containment burden |
Frequently asked questions
Should every offline consumer be blocked?
No. Block or quarantine consequential writes when version or authority is stale; valid read-only work and factual observations may continue under explicit rules.
Why not resolve conflicts by latest timestamp?
A later device clock does not prove newer authority. Use the verified graph version and decision record.
When is a reconnecting consumer safe to release?
After it loads the current graph, pending changes are reconciled, stale writes are rejected and a changed-context test confirms fenced behaviour.
How long should recurrence monitoring continue?
At least through the longest credible offline or backup-restoration cycle, with the remaining limits recorded.
Continue through verified routes
Core routes
Anthropology subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Contact-graph rollback reconciliation, split-brain directories and authoritative re-synchronisation
- Contact-graph drift repair rollback, incorrect synchronisation and restoring the last known-good route
- Contact-graph version drift, stale alternates and recurrence prevention
- Dead-letter recovery recurrence, broken contact graphs and notification resilience