Quarantine: the user flow

Explainer, not proposed UI

What it is

The parking lot for records the system refused to guess about. When existing data is assigned to reporting cycles, the assignment rules never guess: a record whose year is ambiguous, whose framework cannot be resolved, or whose boundary situation is unclear gets parked with a reason code instead of being silently misfiled or dropped. The tab makes those parked records visible so a human resolves them.

When records appear (what a run is)

A run is never a user upload, and there is no start-run button for tenant users. Records arrive from two sources:

The one-time company backfill executed when a tenant is switched onto cycles. Operator-initiated; in I1 the operator is the vendor during rollout.
Ongoing ingestion afterwards, when an incoming record fails to resolve to exactly one cycle.

The flow

System

Admin

1 · Run executes
The one-time company backfill at switch-on (operator-initiated), or ongoing ingestion afterwards.

2 · Refused rows are parked
Every row the rules refuse to place gets a quarantine record: the run id, the row, a reason class, and candidate cycles where they exist.

3 · Tab shows the backlog
Per-run, per-reason counts; the tab badge carries the open total.

7 · Rows re-resolve
Rows whose cause is fixed clear; the rest stay listed with their reasons.

4 · Admin reads the reason
Opens a record; the reason is plain terms: no matching cycle, several candidates, year disagreement, and so on.

5 · Fixes the cause at the source
A data value or the boundary setup. Quarantine never edits reported numbers directly.

6 · Re-run triggered
A company backfill re-run is triggered after the fix.

In prose: a run executes. Every row the rules refuse to place gets a quarantine record carrying the run id, the row, a reason class, and candidate cycles where they exist. The tab shows per-run, per-reason counts, and the tab badge carries the open total. An admin opens a record and reads the reason in plain terms (no matching cycle, several candidates, year disagreement, and so on), then fixes the cause at the source, a data value or the boundary setup; quarantine never edits reported numbers directly. A company backfill re-run is triggered. Rows whose cause is fixed clear; the rest stay listed with their reasons.

The tab itself is drawn on the Quarantine tab wireframe.

Scope and cycle linkage

I1 scope is GRI-enabled tenants only. Existing frameworks never run this and existing tenants never see the tab. Records link back through their run; many rows are quarantined precisely because no single cycle could be resolved, which is why the tab sits at area level with a run filter rather than inside one cycle, and cycle detail links in pre-filtered.