My stamp collection will take a decade to verify, so the site does not wait for me

I am never going to finish verifying this collection. Between forty and sixty albums, thousands of stamps, and one person checking them by hand in the evenings. If the public site waited until I had personally confirmed every fact, it would be empty for a decade and then it would still be mostly empty.

So the real design question was not how to verify faster. It was how the site stays honest and useful while most of it is unverified, possibly forever.

Assertions, not records

The answer is an append-only log of assertions. An assertion is one small dated record that says somebody claimed something about a subject, on some basis. A detector that read a photo. A printed reference catalogue. Me, from memory. Each one carries who said it and how sure they were.

Nothing in the log is ever edited or deleted. If I change my mind, I add a new assertion that supersedes the old one, and the old one stays as history. In 2036 I want to be able to see what I believed in 2026 and why I was wrong. A row I can overwrite cannot give me that. A log I can only append to can.

Propose is not decide

The rule that keeps this honest is that a machine is allowed to propose and is not allowed to decide.

Concretely, a machine's claim is always a candidate. It carries a confidence, and it shows on the public page as a candidate, a hedged dot, never as a confirmed fact. Only a person confirming it turns the dot solid. There is one thing a machine may never do at all, at any confidence: establish which stamp a stamp is. Identity is a human act. A model can suggest that this is the 1935 Ceylon nine cent, but the record that says so can only be written by a person, because a wrong identity accepted quietly corrupts everything built on top of it.

Confidence gates attention, not truth

Here is the part that makes it survivable for one tired human.

Confidence does not decide whether a candidate is true. It decides whether the candidate interrupts me. A high confidence proposal publishes quietly as a candidate and never lands in my review queue. A low confidence proposal is the one that asks for my judgment. The machine's best guesses fill the map immediately, honestly labelled, and my scarce attention goes only to the cases where the machine was unsure of itself.

If I never look at a confident candidate, it stays a candidate forever. Honest, visible, and never promoted behind my back. That is the whole trick to a collection that fills in for years while its owner reviews it slowly. Nothing waits on me, and nothing pretends I checked it when I did not.

Three moves when I do look

When I do review something, there are three moves and all three are additions to the log.

Confirm, and the claim becomes a human fact that no later machine run may quietly overturn. Correct, which writes a new superseding assertion with the right value and keeps the wrong one in the history. Reject, which records that I considered it and said no, which is different from never having looked. None of the three destroys anything.

What is still missing

The proposers do not all exist yet. Today a lot of the candidates are things I assert directly, because the detectors that would read a theme or a colour off a photo, and the importer that would pull a date from a printed catalogue, are still to be built. The review queue itself is the next thing on my list.

And candidates can be wrong. That is the entire reason they are drawn as dots and not as solid facts. The site is honest about being unsure. It is not honest about being finished, because it is a long way from finished.

The next post is the piece underneath all of this: how the log survives being reprocessed forever, from a single photograph of each page.