The Formula Keeper: Gaskets for Governance

Episode_62_The Formula Keeper: Gaskets for Governance

Old Samuel Machado kept a jar of R20 gaskets on his desk like other men keep sweets. The jar had a label: DO NOT AUDIT. Which made the auditors itch and left him in peace.

At 16:42 a banner crawled across his monitor:

STANDARDIZATION PASS SCHEDULED 00:00. DUPLICATES WILL BE RESOLVED AUTOMATICALLY.

He scrolled. Row 10,847 wore the yellow shame of a duplicate. MATSOMBE, MARIA / CCN 90017 / DUPLICATE WITH 90017-B. A child stapled to a mother by a hyphen no one had consented to.

If you have worked in resettlement data, you have met Row 10,847. Maybe it was a widow whose husband's name still owned the field. Maybe it was twins split by a clerk's keystroke. Maybe it was a farmer whose ñ fell off during a CSV upgrade and whose harvest disappeared from the rolls because the system couldn't match a name it had damaged.

Samuel knew these cases because he had spent fifteen years building the formulas that caught them. Seventeen helper columns. Forty-three named ranges. Nine workbooks. A masterwork of INDEX(MATCH) logic that could find any claimant's history across the entire archive. He didn't start as "the formula keeper." He started as a municipal apprentice with a wrench and a pocket full of rubber washers.

His first boss gave him the only sermon he ever kept:

A R20 gasket saves a R2000 pump. Put soft between hard. Don't over-tighten. Replace before failure.

When the body got tired of ladders, Samuel moved downstairs to databases. The sermon came with him. The jar followed.

Why this matters to governance On Monday, we met the Ghost Drakes: the people the system could not see. On Tuesday, the Two-Headed Dragon showed what happens when you force two realities into one model. Today's episode is about something quieter and, in operational terms, more dangerous.

Today is about what happens when the system can see you, matches you to a record, and gets it wrong. Confidently. Automatically. At midnight. While nobody with authority is watching.

The standardization pass is not malicious. It is a cleanup script doing exactly what it was told to do: resolve duplicates, enforce consistency, remove ambiguity. It will run at midnight because that is when batch jobs run. By morning, the -B will be gone. The child will be "resolved." The system will report fewer duplicates and call that progress.

Samuel's objection is not that automation is bad. His objection is that nobody gave the automation the context it needs to tell the difference between a genuine duplicate and a family.

IT would tell him to trust the dedupe. The dedupe would forget that Maria's husband died between versions. That the child took her surname in the camp. That -B is a plea, not a person. The Merge Dragon loves a clean table. It hates families.

The gasket rules Samuel's plumbing sermon translates directly into data governance controls. This is not a metaphor. It is a design pattern.

Put soft between hard. Wrap brittle matches in TRIM, CLEAN, and SUBSTITUTE so human mess doesn't leak through to the join. In pipeline terms: normalization wrappers, tolerant matching, context fields for disputes. Every place where a rigid rule meets messy reality needs insulation. Without it, the rigid rule wins and the messy reality becomes someone else's problem.

Don't over-tighten. Avoid EXACT() on names. Allow a mouth's truth to fit. Samuel built a named range called UNICHARFIX that bullied diacritics back into place. He wrote it the night the farmer's ñ disappeared. In governance terms: use confidence tiers instead of binary match/no-match. A name that's 90% similar to another name is not a duplicate. It might be a cousin.

Replace before failure. If a join works once, insulate it with IFERROR. If it works twice, name it loud (_WASHER_2009_2010) so the next person knows where to grip. In pipeline terms: canary runs, pre-flight checks, rollback points. Samuel named his fallback joins after the leaks they were built to stop. That naming convention is itself a governance act. It turns silent infrastructure into readable intent.

The night shift What Samuel did between 16:42 and midnight is the clearest demonstration of human override I can point to in the entire DataDragon source library. It is worth walking through because it shows what the Calvin Convention's Right of Override looks like when performed by someone who has never heard of the Calvin Convention.

At 17:19, the supervisor strolled past and tapped the gasket jar. "Audits next week. No more extras. Let the dedupe run." Samuel said "Of course" and moved a gasket from the DO NOT AUDIT jar to the plain jar with the soft clink of disobedience.

At 18:47, the tea auntie appeared with mercy disguised as tannin. "The woman who knew the old signature is at the blood bank. Her niece is with her. The niece knows the child's new surname as said." Samuel pushed a blank field into the sheet: PRONOUNCED_BY_AUNTIE. No function. Just room for ink.

At 21:37, he phoned the blood bank. The niece pronounced the child's surname twice, then once in the way the child says it when trying to be brave. Samuel typed exactly that into the pronouncing field and ring-stamped the auntie's name around it when she arrived, cheeks flushed, grateful to be believed in a way that costs someone else their neatness.

At 23:59, the standardization pass ran. Where Samuel had put soft between hard, it slid. Where he'd left ink, it stalled. Where there was nothing, it fed.

At 00:07, he scrolled. Maria Matsombe. Household: MATSOMBE. -B removed (manual override). Child: linked to mother (pronounced: "Mat-SOM-beh").

He moved a gasket to the plain jar. Clink. He wrote two words in the schoolbook: SEEN & HEARD. BILL PAID..

In the morning, the auntie brought the boy, shoes too clean for the office tiles. Samuel looped a spare gasket onto a string and tied it around the small wrist. "For your tap," he said. "Before it teaches you what steam is."

What the night shift teaches Samuel performed four governance functions that night, none of which appear in any formal governance framework I have seen.

He paused the outcome for Row 10,847 by placing manual overrides that the standardization pass would have to route around.

He gathered evidence from a source the system cannot access: a niece at a blood bank who knew how a child pronounces his own name.

He documented the override in wet ink, ring-stamped with a gasket, signed by a community authority the system does not recognize but the family trusts.

He named who discovered the edge case. Not "system flag." Not "audit finding." Samuel Machado, basement office, 21:37, because a tea auntie told him the niece was at the blood bank.

That fourth function is the one most registries lack. Edge cases are always discovered by the person closest to the ground. If your registry does not record who found it and how, you lose the network that finds the next one.

The artifact: Human Override Protocol Human override is not a panic lever. It is a defined route that answers four questions every time:

Who can stop the dragon? Named role. Not "someone senior." Not "the team." A name on a roster with a phone number and the authority to pause a batch job. If the answer is "it depends," nobody can stop it.

What evidence is required? Minimum proof, scaled to risk. Samuel needed a niece's pronunciation and an auntie's signature. He did not need a legal opinion. The evidence threshold should be proportional to the harm of getting it wrong, and the threshold should be written down before the situation arises.

What happens while it's stopped? Continuity mode. Hold queue with a maximum backlog. Quarantine outputs. Block downstream propagation. The system does not crash because one person exercised authority. If it does, the system was designed to be unquestionable, and that is a governance failure dressed as architecture.

How does the stop become learning? Registry entry. Remediation path. Verification steps. The override is not an exception to be tolerated. It is data about the system's limitations, discovered under operational pressure, and it belongs in the same architecture as the model's confidence scores.

The full Edge-Case Registry template and a procurement-ready Right of Override clause block are attached as downloadable appendices. They are written to be pasted into contracts. The clause includes a non-retaliation provision (A6): the vendor cannot degrade service based on how often you exercise override. That provision exists because, in practice, frequent overrides make vendors nervous, and nervous vendors start making the override process harder. The gasket rule applies here too: replace before failure.

The Calvin Convention connection Monday introduced the Right of Legibility: the governed must be legible to the system on their own terms. Wednesday introduces its companion: the Right of Override.

The Right of Override says that when automated processes make decisions about people, a named human authority must be able to pause, reverse, and require manual handling. The authority path must be resourced, documented, and protected from retaliation.

Samuel Machado has been exercising this right for fifteen years without a clause to cite. He does it with gaskets, wet ink, and a jar labelled DO NOT AUDIT. Your procurement documents should make it easier than that. The appendices are a start.

The refrain Conta, conta, mas escuta. Não sou número só.

Count, count, but listen. I am not only a number.

On Sunday, the Serpent learned to dance. On Monday, the Ghost Drakes demanded names. On Tuesday, the Two-Headed Dragon showed the cost of forced consensus. Today, a man in a basement proved that fifteen years of INDEX(MATCH) is a form of care the system has not yet learned to replicate.

His ledger line reads: SEEN & HEARD. BILL PAID..

Yours should too.

Today's prompt: Does your system have a named person who can stop a batch job at 23:59? If so, what evidence do they need, and where is that written down? If not, what happens to Row 10,847?

Tomorrow, the Dragon Tongue. Every button click writes an incantation in the background. If you cannot read the spell, you are applauding the performance, not governing the dragon.

Based on "Standard Deviation: Manual Override." Link coming soon. Read the earlier version: The Last Formula Keeper

Downloadable artifacts:

📄 Appendix A: Right of Override Clause Block (procurement-ready)

📄 Appendix B: Edge-Case Registry Template + Human Authority Path Blueprint

---

Watch / listen: https://youtu.be/gL3I110dHgU

Full playlist: Governance of Ghosts

#SociableSystems #DataGovernance #AIGovernance #DataDragonArc #CalvinConvention #RightOfOverride #FormulaKeeper #LiabilitySponge