The seventh thaw begins with a narrow finding: one updated device family no longer delivers its decision field inside the window that supported Q10. The rest of the sixth re-freeze remains stable. The next job is not to rebuild every queue rule; it is to design a fair experiment around that unsupported state.
This guide converts release-monitoring evidence into challengers. It preserves stable references, distinguishes a longer information window from an early fallback and a version-aware predictor, replays every eligible rule on the same decision-time records, translates choices into capacity and requires fresh confirmation after selection.
The Gold Standard is a bounded thaw whose evidence can survive transfer. A candidate must explain the drift mechanism, remain executable at the decision and pass assignment, service and protected-outcome gates together.
A practical orientation
Treat the detected drift as a changed information process, not automatically as a capacity problem. A longer wait may recover more fields but can create holding-lane bursts; an immediate fallback avoids delay but donates work.
The worked example compares four declared candidates on 2,400 family-D arrivals, then withholds a later week for confirmation. It shows why the best screening score is not yet a re-freeze.
- Bound the seventh thaw — for owners protecting stable sixth-cycle scope.
- Design drift-aware challengers — for analysts expressing competing mechanisms.
- Follow the common replay — for a complete numerical example.
- Apply re-freeze gates — for confirmation and rollback.
- Transfer the design — for another queue or information delay.
Chapter contents
Open a route that matches the decision in front of you, or read straight through. Each route returns to the same evidence chain.
Start with the operating question
Build the evidence chain
Build challengers from distinct drift mechanisms
Work the example
Stress-test the decision
1. Translate drift evidence into one seventh-thaw question
Write the question in operational form: for family-D devices on the affected software versions, can a longer bounded wait or version-aware decision reduce timeouts without breaching holding, fallback or specialist service limits? Exclude device families whose field-time distribution still matches Q10’s release contract.
Freeze Q10, Q5, Q0, the release-monitoring definitions, protected outcomes and the evidence window. The seventh thaw changes only the declared family-D branch unless new evidence proves broader scope.
- Affected device, software and decision-time state.
- Observed field-delay mechanism and alternative explanations.
- Rule components allowed to change.
- Holding, fallback and specialist capacity guards.
- Screening, confirmation, rollback and decision owners.
2. Preserve stable references and lineage
Keep Q10 executable for supported devices and store its counterfactual output for every seventh-thaw arrival. Preserve Q0 as safe fallback and the earlier Q7, Q8 and guard components when they help explain what changed.
Lineage should show which candidate alters the window, which alters assignment and which uses a new predictor. Do not hide a tuned rule behind an old name or compare a new candidate with a degraded implementation of the reference.
| Reference | Role | Must remain fixed |
|---|---|---|
| Q10 | Sixth re-freeze | Supported scope and implementation |
| Q0 | Safe fallback | Executable service path |
| Release monitor | Drift evidence | Clock and denominator definitions |
| Protected outcomes | Safety boundary | Maturity and comparison rules |
3. Build challengers from distinct drift mechanisms
Register a compact portfolio. Q11 can route affected versions immediately to Q0. Q12 can extend the family-D wait from eight to fourteen minutes. Q13 can predict timely arrival from decision-time version, network and retry metadata. Q14 can use the eventual field as a diagnostic oracle but is ineligible for deployment.
Declare the expected changed set and service consequence for each rule. Q12 consumes holding capacity and can release a burst; Q11 donates work immediately; Q13 creates false-wait and false-fallback costs. These are part of the model, not postscript metrics.
4. Reconstruct decision-time replay records
For each arrival, preserve device and version, the field snapshot, prediction inputs, candidate decision, field-arrival or censoring time, fallback route, service start, completion and mature outcome. Replay every eligible candidate on the same ordered records.
Prevent leakage. Q13 cannot use the actual field-arrival time, and Q12 cannot decide its wait from knowledge that the field eventually appeared. Split model fitting, threshold choice and confirmation by time or another defensible design.
5. Translate candidate decisions into interacting queues
Model the holding lane, fallback queue and specialist queue together. Count how many jobs move, when they move and their service demand. A fourteen-minute window can recover information but concentrate releases at the timeout boundary.
Use ordinary and stress arrival patterns, service-time distributions and upper-tail waits. Report abandonments, guard activations and backlog recovery as well as means. A candidate that improves assignment but violates a protected service tail does not pass.
6. Worked example: 2,400 family-D arrivals
In the screening period, 2,400 family-D arrivals meet the seventh-thaw definition. Under Q10’s eight-minute window, 1,586 fields arrive in time and 814 time out. Q11 sends all 2,400 immediately to Q0. Q12’s fourteen-minute window captures 1,944 fields but releases a large timeout batch. Q13 predicts 1,870 timely arrivals; 1,715 are correct, 155 wait unnecessarily and 229 timely fields are sent to fallback.
After the existing burst guard is applied consistently, Q12 remains inside the holding ceiling but narrowly breaches the fallback recovery-time limit during a declared stress block. A capped Q12b that admits at most 120 simultaneous holds passes screening. Because the cap was selected using these records, Q12b moves to a later confirmation week rather than being declared the winner.
| Candidate | Information result | Queue consequence | Screening decision |
|---|---|---|---|
| Q10 reference | 1,586 timely fields | 814 timeouts | Keep as comparator |
| Q11 fallback | No waiting recovery | Highest donated work | Safe reference |
| Q12 14-minute wait | 1,944 timely fields | Stress recovery breach | Modify |
| Q13 predictor | 1,715 correct waits | 155 false waits | Retain comparator |
| Q12b capped wait | Best screened balance | Inside screened limits | Confirm later |
7. Use shadow and limited release to test replay limits
Run Q12b in shadow on current family-D arrivals with reason codes, cap activations and counterfactual Q10/Q11 outputs. Then release to a small version cohort while stable devices remain on Q10 and Q0 remains available.
Observe feedback that replay cannot reproduce: upstream retries, staff overrides, synchronized app updates and user abandonment. Exercise rollback before expansion and record how held cases return to a safe route.
8. Set seventh re-freeze gates
Re-freeze only when Q12b’s mechanism transfers to fresh arrivals, the affected state matches the declared version boundary, holding and downstream queues pass ordinary and stress limits, protected outcomes do not deteriorate and reason-code integrity supports reconstruction.
Name the scope. A family-D version-specific re-freeze can coexist with Q10 elsewhere. Do not broaden the conclusion to devices or channels absent from the confirmation evidence.
- Fresh mechanism-linked confirmation.
- Decision-time eligibility and explainable changed set.
- Holding, fallback and specialist tails pass.
- Protected outcomes and maturity windows pass.
- Rollback and cap-failure behavior exercised.
- Unsupported scope and monitoring triggers recorded.
9. Re-freeze without deleting challenger evidence
Store Q12b’s window, cap, implementation version and release plan together with Q11, Q12 and Q13 results. Preserve Q14 as an explicitly ineligible upper bound. The rejected candidates explain the trade-off and provide future diagnostics.
Keep the sixth-release drift record linked to the new decision. A future reviewer should be able to see why family D thawed, which evidence selected Q12b and which stable paths were never reopened.
10. Know what the seventh-thaw evidence cannot prove
The replay and limited release remain conditional on recorded arrivals, candidate definitions, service-time models and the observed software cycle. Rare bursts, future device behaviour and unmeasured interventions may differ.
Selecting Q12b among declared candidates does not prove global optimality. It supports the narrower conclusion that Q12b met stated gates for the tested family-D scope while verified references stayed available.
11. Misconceptions, practical questions and transfer
Common mistakes include reopening stable devices, treating the oracle as deployable, fitting and confirming on one window, and evaluating only timely-field recovery. The repair is bounded scope, eligible challengers and joined service evidence.
Can Q12 be selected because it captures the most fields?
Not while its stress recovery breaches a protected limit. A capped revision is a new candidate and needs fresh confirmation.
Does a seventh re-freeze replace Q10 everywhere?
No. It applies only to the confirmed affected scope; Q10 and Q0 retain their declared roles elsewhere.
12. Changed-context evidence check and authoritative sources
Transfer the design to a document queue where one partner’s verification file now arrives later. Rebuild the delivery distribution, timeout burst and service consequences from that partner’s mechanism; do not copy the fourteen-minute device threshold.
NIST SP 800-137 supports continuous monitoring and timely response when controls no longer fit risk. The NIST handbook’s cumulative-sum control-chart discussion supports sustained-shift detection. These sources inform monitoring discipline; local queue and replay assumptions determine the seventh-thaw design.
Continue through the Gold Standard ecosystem
Return to the Queueing Theory subject root, the Gold Standard of Education parent, or the How X Works hub.
Immediate predecessor: sixth-re-freeze release monitoring and seventh-thaw gates · Earlier guide: sixth-thaw scope and new-state challenger replays · Queueing Theory root
These routes are grouped by learning purpose: prerequisite model, immediate predecessor, and the wider transfer framework. They are not substitutes for the evidence and limits stated in this guide.