An aggressive auto-merge collapses two different residents who share a common name into one golden person, mixing their benefit histories. What risk does this illustrate, and what control helps?

An aggressive auto-merge that collapses two different residents who share a common name into one golden person, mixing benefit histories, illustrates a false-positive merge; uncertain matches need review thresholds and human stewardship before commit. Civic benefit systems can harm residents when identities are wrongly fused. Calling this a false negative and lowering all thresholds to zero fails—the error type is false positive (incorrect merge), and zero thresholds worsen it. Blaming a metadata catalog outage fails; merge quality hinges on match confidence and stewardship, not catalog uptime. Calling it only a reference-data versioning issue fails; this is a party-master false merge, not a code-list version problem. Exam caveat: false positive = incorrect merge; mitigate with thresholds and human review for uncertain pairs. Operational check: set auto-merge only above a high confidence band, queue mid-band for stewards, sample post-merge audits for benefit domains, and enable unmerge. Report false-positive rate to the municipal data council as a safety metric, not only as a throughput statistic. Keep verification evidence with the municipal runbook so audits can prove the chosen control was applied as designed and that rejected alternatives would have left city services exposed to the failure modes described above.