Boundary Disclosure Card

one_liner: A small, schematized, standardized disclosure attached at an artifact's reuse boundary so that consuming it and reading it are the same event.

core_idea:
A boundary disclosure card is a small, schematized, standardized
disclosure physically or digitally *attached* to an artifact at its
boundary of reuse, surfacing the conditions of proper use to every
downstream consumer who encounters the artifact. The structural
commitment has four parts. The artifact is reused across consumers who
do not see how it was produced and cannot easily inspect it before use.
A small set of load-bearing facts about proper use — contents, limits,
hazards, provenance, expiry, dependencies — is selected from a much
larger background of possible facts. Those facts are *schematized*,
encoded against a stable, agreed template so consumers can read them
without learning the producer's idiom.<!-- FACT-D58-601 -->[^frohlich-2009] And the schematized disclosure is
*attached at the boundary* — physically affixed, structurally embedded,
or contractually shipped — so that consuming the artifact and
encountering the card are the same event.

The prime turns documentation-that-might-be-read into a
disclosure-that-cannot-be-missed. The structural force is the
*indissoluble linkage* between artifact and card: documentation that
lives in a separate manual, on a website, or in producer memory does not
clear the bar, while documentation that travels stapled to the boundary
of every instance does. Detachment of card from artifact is the
characteristic failure mode, and when a use-failure traces to a missing
or stale card, the structural diagnosis is interface rather than
content.

What changes in a reader's view of a system is that the schema itself
becomes a distinct coordination object, separate from any individual
card. Agreeing the template across producers is the heaviest design
move and largely determines what consumers can ask; the card is the
per-instance instantiation of that schema. The disclosure is also not
the artifact's contents but a small projection onto a load-bearing fact
set, and the compression is structural rather than incidental, because
readability at the moment of consumption requires the projection to be
small.

structural_signature:
*an opaque reusable artifact* — *a reuse boundary crossed by consumers who cannot inspect the production* — *a selected set of load-bearing use-facts projected from a larger background* — *a shared schema (template) standardizing those facts* — *a per-instance card instantiating the schema* — *an indissoluble attachment fusing card to artifact at the boundary* — *detachment as the characteristic failure mode*

The pattern is present when each of the following holds:

- **An opaque reusable artifact.** A thing consumed across many users who do not see how it was produced and cannot easily inspect it before use — a food, a drug, a component, a dataset, a beam.
- **A reuse boundary.** A point at which the artifact passes from producer to consumer, impersonally and at scale, so trust and shared context are unavailable.
- **A selected fact set.** A small set of load-bearing facts about proper use — contents, limits, hazards, provenance, expiry, dependencies — projected out of a much larger background. The smallness is required for readability at consumption time.
- **A shared schema.** The facts are encoded against a stable, agreed template, so consumers read them without learning each producer's idiom. The schema, not the individual card, is the heavy coordination object.
- **A per-instance card.** Each artifact instance carries its own instantiation of the schema.
- **Indissoluble attachment.** The card is affixed, embedded, or contractually shipped so that consuming the artifact and encountering the card are the same event — distinguishing disclosure from mere documentation.
- **Detachment as failure mode.** When card and artifact separate, or the card goes stale, the diagnosis is interface failure, not content failure.

These compose into a substitute for inspection and trust at impersonal reuse: agree the schema, attach it to every instance, and audit detachment.

what_it_is_not:
- **Not provenance.** `provenance` (the embedding nearest neighbor) is the *record of origin and chain of custody* — where an artifact came from and how it changed hands. A boundary disclosure card may *include* a provenance slot, but its defining feature is the *attached, schematized, standardized* disclosure of use-conditions at the reuse boundary, of which origin is one fact among five.
- **Not an interface.** `interface` is the boundary-and-contract across which components interact functionally. The card is *disclosure attached at* a reuse boundary, not the operative contract governing interaction; a nutrition label tells you what is inside, it does not define how the food plugs into anything.
- **Not containment.** `containment` is keeping something *inside* a boundary (or out). The card does the opposite — it *exposes* selected facts across the boundary so consumers can read them; its concern is disclosure and readability, not confinement of contents.
- **Not versioning.** `versioning` is the discipline of tracking successive states of an artifact. A lifecycle/version marker is one slot on the card, but the card is the *standardized disclosure surface*, not the version-control mechanism; versioning answers "which state is this?", the card answers "what must I know to use it safely?"
- **Not conflict of interest.** `conflict_of_interest` is a structural misalignment of incentives. The card's "claims-not-truth" caveat touches this — a producer discloses self-servingly — but the prime is the *disclosure artifact and its schema*, not the incentive misalignment that an audit regime, not the card, addresses.
- **Common misclassification.** Calling any documentation a boundary disclosure card. The tell: ask whether a consumer can complete the use *without* passing through the disclosure. If the facts live in a separate manual, a website, or producer memory, it is documentation; only an indissoluble attachment that makes consuming the artifact and reading the card the *same event* clears the bar.

broad_use:
In food, the nutrition-facts label, allergen disclosure, and dating
marks are a standardized schema printed on every package by regulation,
identical across producers.<!-- FACT-D58-602 -->[^fda-2016-nutrition] In pharmaceuticals, package inserts carry
indications, dosage, contraindications, and interactions in every box.<!-- FACT-D58-603 -->[^fda-pli-2006]
In electronics, datasheets ship with every component, their
industry-stable schema letting engineers read across vendors. In
hazardous materials, safety data sheets travel with every shipment under
an internationally agreed sixteen-section schema.<!-- FACT-D58-604 -->[^ghs-2021] In buildings, occupancy
plaques and capacity placards are affixed at the point of use.<!-- FACT-D58-605 -->[^ibc-2021] In
software, API documentation and machine-readable interface schemas ship
with the endpoint, and dependency manifests travel with the package. In
machine learning, data cards and model cards — explicitly borrowing the
nutrition-label idea — travel with datasets and models, carrying
composition, intended use, and known limitations.<!-- FACT-D58-606 -->[^mitchell-etal-2019] In consumer goods,
care labels and energy-rating stickers attach the disclosure to the
item. In materials engineering, load and pressure ratings are stamped
onto the part itself.<!-- FACT-D58-607 -->[^asme-bpvc-viii] Across these substrates the structural force is
the same: when the producer-consumer interface is wide and reuse is
impersonal, a standardized disclosure attached to the boundary
substitutes for the trust, inspection, or shared context the consumer
cannot otherwise obtain — and the fact that ML data cards explicitly
borrowed the food-label pattern is direct evidence of the structure's
portability.<!-- FACT-D58-608 -->[^gebru-etal-2021]

clarity:
Naming the pattern surfaces a sharp distinction: *documentation*, which
the consumer must seek out and may or may not read, versus *boundary
disclosure*, which the consumer cannot encounter the artifact without
also encountering. The two are routinely conflated in everyday speech —
"it's all in the docs" — but their operational properties differ
sharply. Documentation is a universal fallback; boundary disclosure is a
structural property of the artifact-consumer interaction, and only the
latter guarantees the disclosure is seen at the decision point.

A second clarification separates the schema from the card. The schema —
the nutrition-facts template, the safety-data-sheet sections, the
model-card structure — is a small standards object that producers and
consumers agree to honor, and the card's value comes mostly from the
schema being shared; an idiosyncratic per-producer disclosure does not
clear the bar even if attached. A third clarification distinguishes the
card from the artifact's contents: a nutrition label is a small
projection of the food onto a small fact set, and the compression is
required for readability rather than being a limitation. By holding
these three distinctions — disclosure versus documentation, schema
versus card, card versus contents — the prime makes precise what would
otherwise be lumped together as "having good documentation."

manages_complexity:
A boundary disclosure card lets a consumer make a use-or-not-use
decision and a usage-parameters decision *without inspecting the
artifact's internals*. The card carries exactly the load-bearing facts;
the artifact carries everything else. This collapses the consumer's
decision problem from "understand the artifact" to "read the card and
check the intended use against the declared limits," a far smaller task
that scales across impersonal reuse.

Across the candidate domains the same accounting recurs in a small
recognizable schema: an intended-use envelope, the conditions under
which the producer warrants behavior; hazards and limits, the failure
modes outside the envelope; composition and provenance, what the
artifact is made of and where it came from; dependencies and
interactions, what else must be present; and lifecycle markers — expiry,
deprecation, version. Whether the artifact is a drug, a dataset, or a
steel beam, this five-slot accounting is recognizable, which is what
lets a single design discipline — agree the schema, attach it to every
instance, audit detachment — serve domains as different as
pharmaceuticals and machine learning. The compression is in reducing an
open-ended "what do I need to know to use this safely?" to a fixed,
shared set of slots.

abstract_reasoning:
The prime supports several inferences. The schema is the coordination
object, so agreeing it across producers is the heaviest design move and
largely determines what consumers can ask. Detachment is the
characteristic failure mode, so a use-failure traced to a missing or
stale card is diagnosed as an interface failure rather than a content
failure. Schema gaps make harms invisible: a known harm with no slot in
the schema — environmental impact absent from early food labels,
demographic-bias breakdowns absent from early model cards — is
structurally hidden until a slot is added.

Two further inferences concern dynamics and limits. Schemas evolve under
incident pressure: new slots are added when a class of incidents reveals
a previously absent disclosure, as allergen lists expanded after fatal
incidents and model-card sections expanded after bias incidents.<!-- FACT-D58-609 -->[^fda-falcpa-2004] And
cards establish only that the producer *claims* the disclosed facts, not
that they are true — a separate audit or certification regime validates
content, while the card itself is the exposed surface for liability,
since what a producer discloses is what they can be held to. These
inferences follow from the attached-schematized-standardized structure
alone, so they apply to any reuse boundary regardless of whether the
artifact is physical, digital, or informational, and they tell a
designer where the system's blind spots and liabilities will fall.

knowledge_transfer:
The transferable content is the four-commitment structure — selection,
schematization, attachment, standardization — together with the
five-slot accounting and the schema-as-coordination-object insight.
Because the structure is substrate-portable, the moves carry across
domains, and the historical record shows the transfer happening
explicitly: food-labeling discipline was deliberately borrowed into
machine learning as data cards and "nutrition labels for ML," solving
the same coordination problem with the same small-schema-attached-at-
reuse move.<!-- FACT-D58-610 -->[^gebru-etal-2021] Component datasheets port to API contracts, with recommended
operating conditions and max ratings becoming rate limits, auth schemes,
and error codes, and machine-readable interface specifications as the
schematized form. Pharmacology package inserts port to AI system cards —
indications and contraindications becoming intended and out-of-scope
uses. Safety data sheets port to software dependency manifests, the
bill-of-materials that travels with every package as the analogue of the
sheet that travels with every regulated substance.

These transfers work because the structural roles are stable across
substrates: an opaque reusable artifact, a reuse boundary, a shared
schema, a per-instance card, an indissoluble attachment, a declared
use-envelope, and a detachment failure mode. A food regulator, an API
designer, a model-card author, and a materials engineer are all running
the same move: select the load-bearing facts, schematize them against a
shared template, and attach them so the consumer cannot use the artifact
without seeing them. The portable intervention is uniform — agree the
schema, attach it to every instance, and audit detachment as a failure —
and the empirical observation that a substrate which standardizes its
disclosure schema enjoys lower per-instance disclosure cost and better
cross-vendor comparison than one that has not gives the transfer a
predictive edge. The portable lesson is that safe impersonal reuse
depends not on better documentation but on a small shared disclosure
fused to the artifact's boundary, a lesson that travels intact from a
cereal box to a trained model, and that, once held, reframes governance
of reused artifacts around the schema and its attachment rather than
around hoping the manual gets read.

formal_abstract:
The hazardous-materials Safety Data Sheet (SDS) is the disclosure card in
its most formally specified form, and tracing its structure shows the
prime's commitments operating as a designed protocol. The *opaque
reusable artifact* is a regulated chemical substance, consumed across
countless downstream handlers who cannot inspect its composition or
hazards by looking. The *reuse boundary* is each shipment crossing from
producer to handler, impersonally and at scale. The *selected fact set*
is a small projection from the vast space of chemical facts onto exactly
what governs safe handling — and the *shared schema* is the heavy
coordination object: the Globally Harmonized System fixes *sixteen
numbered sections* in a mandated order (identification, hazards,
composition, first-aid, firefighting, accidental-release, handling,
exposure controls, and so on).<!-- FACT-D58-611 -->[^ghs-2021] Because the schema is internationally
agreed, a handler in any country reads section 4 for first-aid without
learning each producer's idiom — the *standardization* that makes the
card more than per-producer documentation.<!-- FACT-D58-612 -->[^ghs-2021] The *per-instance card* is the
sheet shipped with each substance; the *indissoluble attachment* is the
regulatory requirement that the SDS travel with the shipment, so
receiving the chemical and receiving the sheet are one event. The
*detachment failure mode* is precise and auditable: a shipment whose SDS
is missing or stale is a *compliance* failure located at the interface,
not a defect in the chemical itself. The *schema-gap* inference is
visible historically — hazards with no section to live in were
structurally invisible until the harmonized template added a slot for
them, exactly as the prime predicts.

**Mapped back:** the SDS instantiates every commitment — selection of a
load-bearing fact set, schematization against a sixteen-section template,
standardization across producers, and indissoluble attachment to each
shipment — with detachment as an auditable interface failure, showing the
five-slot accounting as a literal regulatory artifact.

applied_industry:
Machine-learning model cards are the same structure deliberately
*borrowed* into a new substrate, which is itself the prime's portability
claim made concrete. The *opaque reusable artifact* is a trained model,
consumed by downstream developers who integrate it without seeing its
training data or knowing its failure modes. The *reuse boundary* is the
model's release on a hub, impersonally and at scale. The *selected fact
set* maps onto the prime's five recognizable slots: an *intended-use
envelope* (what the model is warranted for), *hazards and limits* (known
failure modes, out-of-scope uses), *composition and provenance* (training
data sources, demographics), *dependencies* (required preprocessing,
compute), and *lifecycle markers* (version, deprecation).<!-- FACT-D58-613 -->[^mitchell-etal-2019] The *shared
schema* — the model-card template — is again the coordination object, and
the field consciously imported it from the *food nutrition label*,
sometimes literally calling the artifacts "nutrition labels for ML."<!-- FACT-D58-614 -->[^gebru-etal-2021] The
*indissoluble attachment* is the card shipped in the model repository
alongside the weights. The prime's *schema-evolution-under-incident*
inference is observable: early model cards lacked demographic-bias
breakdowns, so that harm class was structurally hidden until bias
incidents pressured the template to add the slot — precisely the dynamic
by which allergen lists expanded on food labels after fatal incidents.<!-- FACT-D58-615 -->[^mitchell-etal-2019]
And the *claims-not-truth* inference holds: a model card establishes what
the producer *discloses*, defining the surface for accountability, while
a separate evaluation regime validates whether the disclosed facts are
true.

**Mapped back:** model cards are boundary disclosure cards — opaque
artifact, reuse boundary, five-slot fact set, a borrowed standardized
schema, attachment to the release — and the documented borrowing from
food labels plus the incident-driven addition of bias slots exhibit the
prime's portability and schema-evolution inferences directly.


Boundary Signal Spillover

type: prime

one_liner: A signal aimed at one audience reaches adjacent audiences whose own response overflows the planner's apparatus.

status: draft

core_idea:
Boundary signal spillover is the structural pattern in which a signal aimed at a specific target audience is also received by adjacent audiences whose receiver-side calculus produces unintended behaviour at volumes the planner did not size for. The structural commitments are four: a sender transmits a signal targeted at an audience A; the *carrier* on which the signal travels is permeable — broadcast media, public records, observed actions, market price signals, regulatory announcements, social reach — so an audience B also receives it; audience B applies its *own* decision calculus to the signal, which need not match the sender's model of A's calculus; and B's responsive behaviour overflows the planner's target-scaled apparatus, whether that apparatus is route capacity, shelter capacity, supply chains, deterrence effect, regulatory burden, or marketing infrastructure.

The pattern enforces a distinction missing from most policy and communication frames: *audience-as-targeted*, the population the sender intends, versus *audience-as-received*, the population reached by the carrier intersected with the population whose receiver-side calculus triggers a response. When planners scope their apparatus to the targeted audience and the carrier reaches a wider set, the unintended responders create predictable overflow signatures — load appears where it was not expected, in volumes the apparatus was not sized for, and the response degrades for everyone, including the targeted audience. What the prime forces into view is that *the audience boundary is set by the receiver, not the sender*. Any permeable carrier delivers the signal to all receivers, and any receiver who infers personal relevance will act on it; restriction is a property of carrier design and receiver-side filtering, not of sender intent.

structural_signature:
*a sender with a targeted audience* — *a permeable carrier* — *an adjacent received audience* — *the receiver-side decision calculus* — *the target-scoped response apparatus* — *the overflow invariant (received response exceeds apparatus capacity)*

The pattern is present when each of the following holds:

- **A sender and a targeted audience.** Some party transmits a signal intended for a specific population A, and models A's likely response when planning.
- **A permeable carrier.** The signal travels on a medium — broadcast, public record, observed action, price, announcement — that the sender cannot confine to A; reach is a property of the carrier, not of intent.
- **An adjacent received audience.** A second population B, intersected by the carrier's reach, also receives the signal even though it was not the intended target. The audience boundary is set by the receiver, not the sender.
- **A receiver-side calculus.** B applies its *own* decision rule to the signal — often a locally rational reading that differs from the sender's model of A — and may infer personal relevance and act.
- **A target-scoped apparatus.** The sender sizes its response capacity — routes, shelters, supply, deterrence, reviewers — to the targeted audience A alone.
- **The overflow invariant.** B's responsive behaviour loads the apparatus beyond what it was sized for, degrading the response for everyone, including A. Surprising spillover is evidence of an unmodelled receiver calculus, not receiver irrationality.

The components compose so that two questions routinely conflated come apart: *was the signal received* (a carrier property — yes, by all the carrier reached) and *was the apparatus sized for the responders* (a planning property — no, if scoped to the target). The remedy lives in carrier design and apparatus sizing, not in clearer messaging to a misreading audience.

what_it_is_not:
- **Not a boundary.** `boundary` is a separating interface between regions or systems; boundary signal spillover is the *failure* of an intended audience boundary, because a permeable carrier delivers a signal past the line the sender meant to draw. The audience boundary is set by the receiver, not the sender.
- **Not signaling.** `signaling` is a party emitting a costly cue to convey hidden type to an intended audience; boundary signal spillover is about an *unintended adjacent audience* receiving the signal and responding on its own calculus, overflowing an apparatus.
- **Not propagation.** `propagation` is the spread of an effect through a medium step by step; spillover is a single signal reaching multiple audiences at once via a permeable carrier, with the load on a *target-scoped apparatus* being the structural concern.
- **Not an externality.** `externality` is an uncompensated cost or benefit imposed on a third party by a transaction; spillover is specifically about a *signal's reach* exceeding its intended audience and overloading planned capacity, whether or not anyone bears an uncompensated cost.
- **Not horizon scanning.** `horizon_scanning` is the deliberate search for weak signals of emerging change; spillover is the unplanned reception of a *deliberate* signal by an adjacent audience.
- **Common misclassification.** Blaming the adjacent audience for "misreading" the signal when it is reading correctly on a different but locally rational calculus. Catch it by asking what calculus would make the adjacent response rational; if one exists, the problem is carrier reach and apparatus sizing, not receiver irrationality.

broad_use: The pattern recurs across emergency management, finance, public health, regulation, marketing, criminal justice, diplomacy, and media. In emergency management a mandatory evacuation order for one zone is heard on regional broadcast and acted on by residents of a lower-risk adjacent zone who self-evacuate, overwhelming highways and shelters sized for the target zone alone.<!-- FACT-D58-626 -->[^lindell-perry-2012] In banking, an announced bailout for one institution is received by depositors and creditors of similar institutions who act on their own risk calculus, so a target-scoped rescue becomes an industry-wide stability problem.<!-- FACT-D58-627 -->[^diamond-dybvig-1983] In public health, a regional advisory triggers school closures, travel cancellations, and panic buying in adjacent regions whose hazard profile may not warrant it.<!-- FACT-D58-628 -->[^wong-etal-2020] In regulation, a rule targeted at one sector triggers anticipatory restructuring in an adjacent sector that fears extension.<!-- FACT-D58-629 -->[^aiyar-etal-2014] In marketing, a campaign aimed at one demographic goes viral with another that overwhelms call centres and fulfilment.<!-- FACT-D58-630 -->[^berger-2016] The pattern also appears in product recalls that shift demand to substitute brands whose supply chains overflow, in exemplary punishment that chills adjacent conduct, in warning-shot diplomacy received by allies and neutrals as escalation, and in media coverage of one suicide or shooting that recruits copycat audiences through receiver-side identification.<!-- FACT-D58-631 -->[^phillips-carstensen-1986]

clarity: The prime separates two questions routinely conflated in failure post-mortems: was the signal received, and did the apparatus accommodate the responders? The first is a carrier property — yes, by everyone the carrier reached. The second is a planner's modelling error — no, because the apparatus was sized only for the targeted audience. By naming the spillover pattern, the analyst stops blaming the receivers ("why did the adjacent zone evacuate when they weren't told to?") and starts auditing the carrier-apparatus mismatch ("what was the predictable adjacent-audience response, and did our apparatus size for it?"). The construct also distinguishes spillover from misinterpretation. The adjacent audience is not necessarily misreading the signal; it is reading it correctly and acting on a *different* but locally rational calculus. Depositors of a similar institution are not confused about which institution was rescued — they are correctly inferring that the announcement carries information about industry-wide policy direction.<!-- FACT-D58-632 -->[^diamond-dybvig-1983] This clarification matters because the two diagnoses imply different remedies: a misreading invites clearer messaging, while a correct reading on a different calculus invites carrier redesign and apparatus resizing.

manages_complexity: A spillover-aware planning frame compresses what otherwise looks like a stack of bizarre unintended consequences — a metropolitan-wide evacuation under a single-zone order, a bailout that causes a wider run, a recall that wipes out the substitute brand — into a single skeleton: carrier reach times receiver-side calculus times target-scoped apparatus equals overflow. The planner's question simplifies to: what is the carrier's actual reach, what are the receiver-side calculi of the adjacent populations, and what is the resulting load on the apparatus? The reduction points to a structured intervention space. One can *narrow the carrier* through private channels or geographically restricted broadcasts. One can *communicate the boundary explicitly* ("this advisory is for Zone A; Zone B residents should remain in place"). One can *size the apparatus for actual reach* rather than intended target. And one can *pre-coordinate with adjacent-audience leaders* to shape their receiver-side calculus before the signal lands. The same four moves apply whether the signal is an evacuation order, a bailout announcement, a regulatory rule, or a marketing campaign, because the structural object — a permeable carrier delivering a signal to receivers whose responses the planner failed to size for — is invariant.

abstract_reasoning: The prime makes precise a class of failures that look like communication problems but are actually audience-boundary modelling problems. The reasoning move it enables is to separate the model of who you are talking to from the model of who is listening, and to check that the apparatus is sized for the latter. This corrects a deep cognitive bias toward sender-intent thinking: designers and planners habitually model the audience as the audience they intended, not the audience the carrier delivers. A second abstract move is to treat *the adjacent audience's response as information about a misalignment* between the planner's model of their calculus and their actual calculus. Unexpected spillover is evidence that the planner has not yet seen what looks rational from the adjacent audience's standpoint, so investigating "what calculus would make this response rational?" is more productive than dismissing the response as irrational. Both moves follow from the structural separation of targeted from received audience, and both are available in any substrate where a signal travels on a permeable carrier to receivers with their own decision rules — which is why the same reasoning applies to an evacuation, a bank run, and a chilling effect alike.

knowledge_transfer: An emergency manager who has internalised spillover thinks like a central banker about bailout-announcement design and like a regulator about anticipatory-restructuring effects; a marketer who has internalised it scopes campaigns the way an epidemiologist scopes a contagion; a diplomat who has internalised it thinks about a warning shot the way a journalist thinks about coverage contagion.<!-- FACT-D58-633 -->[^lindell-perry-2012] The transfer cuts across substrates because the load-bearing structure — a permeable carrier, a receiver-side calculus, and a target-scoped apparatus — is substrate-independent, and the substrate fixes only the carrier and the calculus. The transfer is not metaphorical: the same intervention vocabulary — narrow the carrier, communicate boundaries, size for actual reach, pre-coordinate with adjacent populations — works in each substrate with substantive bite, because each move acts on the same three structural elements. A practitioner who has learned in emergency management that an apparatus must be sized for the broadcast's actual reach rather than the order's intended zone arrives in banking already knowing that a rescue's credibility commitments must be sized for the industry the announcement reaches, not the single institution it names; the lesson is the same structural lesson with a different carrier. The most valuable transfer is the diagnostic habit of distinguishing the targeted from the received audience before scoping any apparatus, and of treating surprising adjacent responses as evidence of a calculus the planner has not yet modelled rather than as receiver irrationality. Because every instance is rooted in human signalling and policy contexts, the pattern carries a planning-failure overtone and reads as framed; but within that range — emergency management, finance, regulation, marketing, diplomacy, and media — the signal-and-audience vocabulary travels intact, and the recognition that boundaries are set by receivers rather than senders is the portable core that carries from one domain to the next.

formal_abstract:
The pattern can be made precise as a load-balancing argument over an audience-response apparatus, exposing exactly where the planning error enters. Let a *sender* size a *response apparatus* of capacity C to absorb the responses of a *targeted audience* A whose expected response volume is V_A, choosing C so that C exceeds V_A with margin. The *carrier* is modelled by a reach function that maps the signal to the set of populations it actually touches; because the carrier is *permeable*, this set is A union B, where B is an *adjacent received audience* the sender did not target. Each member of B applies a *receiver-side calculus* — a local decision rule mapping the received signal to a probability of responding — and this rule is generally *not* the sender's model of A's calculus. The total load on the apparatus is therefore V_A plus V_B, where V_B is B's expected response volume. The *overflow invariant* is the inequality V_A + V_B > C: whenever the unmodelled adjacent load pushes total demand past the target-scaled capacity, the apparatus saturates and service degrades *for everyone, including A*. The model makes the two conflated questions formally separate: *was the signal received* is a property of the reach function (yes, by all of A union B), while *was the apparatus sized for the responders* is the inequality test against C. The diagnostic the formalism enables is that surprising overflow is evidence that the planner used reach(A) rather than reach(A ∪ B) in sizing C, or mis-specified B's calculus — not that B behaved irrationally. The intervention space reads directly off the terms: shrink reach to exclude B (narrow the carrier), lower B's response probability (communicate the boundary), or raise C (size for actual reach).

**Mapped back:** The load-balancing model instantiates every role of the signature — sender, permeable carrier as a reach function, adjacent received audience, receiver-side calculus, target-scoped capacity, and the overflow inequality — and shows the prime's central separation, reception (a carrier property) versus apparatus sizing (a planning property), as two distinct formal conditions.

applied_industry:
A mandatory single-zone evacuation order and a single-institution bank bailout are the same spillover object on different substrates, and reading both through the prime redirects the post-mortem from blame to carrier-apparatus repair. In the evacuation case the *sender* is an emergency-management agency; the *targeted audience* is the residents of a high-risk flood or fire zone; the *permeable carrier* is regional broadcast and emergency alerts, which cannot be confined to the target zone; the *adjacent received audience* is residents of lower-risk neighbouring zones who hear the same broadcast.<!-- FACT-D58-634 -->[^lindell-perry-2012] Their *receiver-side calculus* — "an official emergency is underway nearby and leaving early is prudent" — is locally rational, not a misreading, and triggers self-evacuation. The *target-scoped apparatus* is the highway capacity and shelter beds sized for the ordered zone alone, and the *overflow invariant* fires: shadow evacuation overwhelms routes and shelters, degrading egress for the high-risk residents the order was meant to protect.<!-- FACT-D58-635 -->[^dash-gladwin-2007] In the banking case the *sender* is a central bank or treasury; the *targeted audience* is one failing institution and its counterparties; the *permeable carrier* is the public announcement of a rescue; the *adjacent received audience* is depositors and creditors of *similar* institutions, who correctly infer information about industry-wide policy and act on their own risk calculus — pulling funds or repricing risk — turning a target-scoped rescue into a system-wide stability problem.<!-- FACT-D58-636 -->[^diamond-dybvig-1983] The prime's intervention catalogue ports across both with substantive bite: narrow the carrier (geographically restricted alerts; private rather than public liquidity support), communicate the boundary explicitly ("this advisory is for Zone A; Zone B remain in place"; clarifying the rescue's scope and conditions), size the apparatus for actual reach (stage shelters and routes for the broadcast's footprint; size credibility commitments to the industry the announcement reaches), and pre-coordinate with adjacent-audience leaders before the signal lands.

**Mapped back:** The evacuation order and the bailout are one structural object — a permeable carrier delivering a signal to receivers whose locally rational responses overflow a target-scoped apparatus — so the diagnostic is identical in both: stop blaming the adjacent audience and audit the carrier reach and apparatus sizing.


Boundary State Loss

one_liner: State crossing a carrier boundary through a bounded artifact is constitutively reduced, surfacing later as failure.

core_idea:
Boundary state loss is the structural pattern in which state-bearing content held in one carrier must cross a boundary into a different carrier through a bounded-capacity transfer artifact, and the artifact is constitutively unable to convey the full state — so the receiving side reconstructs a working state from an impoverished encoding and proceeds as if it were complete, with the gap surfacing later as downstream behaviour driven by the missing content. The structural commitments are that state lives in a carrier — a person's working memory, a process's RAM, a craft's lived practice, a system's internal representation; that the state must transit a boundary to a different carrier — the next shift, the next process, the next generation, the next module; that the boundary admits only a transfer *artifact* of bounded capacity — a sign-out note, a serialized message, a written manual, an API payload; that the artifact is a lossy encoding, so tacit knowledge, soft commitments, in-flight context, and pattern-recognition fail to fit through the channel; and that the receiver reconstructs a *working state* from the artifact and acts on it, often with a delay before the missing content surfaces as a problem.

The prime distinguishes a structural pattern constantly mis-diagnosed as either human error on the receiver's part ("they should have known") or insufficient documentation on the sender's part ("they should have written more"). It is neither: the loss is *constitutive of the boundary itself*. No artifact, however richly authored, can carry through a fixed-bandwidth channel the unbounded tacit context held in the sender's carrier. The intervention space is therefore not "try harder at the artifact" but *re-engineer the transfer* — richer artifact formats, overlap windows where both carriers are live, protocolised handoff conversations, shared substrate that obviates the transfer, or shadowing apprenticeships that move tacit content alongside explicit content. What the prime forces into view is the difference between *channel-loss inside a continuous transmission*, a signal degrading over distance or time, and *discontinuous boundary loss at the moment of hand-over*, a state intact on both sides but reduced in the act of transfer.

structural_signature:
*a source carrier holding rich state* — *a carrier boundary* — *a bounded-capacity transfer artifact* — *the constitutive-loss invariant (artifact capacity < state)* — *the receiver's reconstruction of a working state* — *the delayed surfacing of the missing content*

The pattern is present when each of the following holds:

- **A source carrier.** State-bearing content — working memory, runtime representation, lived practice, internal model — resides in some medium and includes tacit, contextual, and dispositional content beyond what is explicitly written.
- **A carrier boundary.** The state must transit to a *different* carrier: the next shift, process, generation, module, or owner. This is a discontinuous crossing, distinct from steady-state carrying within one carrier.
- **A bounded transfer artifact.** The only thing that crosses the boundary is an encoding of fixed capacity — a sign-out note, serialized message, manual, schema payload.
- **The constitutive-loss invariant.** The artifact cannot carry the full state: its capacity is structurally less than the tacit and contextual content held in the source carrier. The loss is a property of the boundary, not of effort or documentation quality.
- **Receiver reconstruction.** The receiving side rebuilds a *working* state from the impoverished artifact and proceeds as if it were complete.
- **Delayed surfacing.** The gap manifests later as downstream behaviour driven by the missing content, mis-read as receiver incompetence or insufficient documentation.

The components compose so that the load-bearing object is the *transfer*, not the artifact: a richer artifact reduces but cannot eliminate the loss, so the design choice is never artifact-versus-none but transfer-mechanism design — overlap windows, protocolised handoffs, shared substrate, or apprenticeship that moves tacit content alongside the explicit encoding.

what_it_is_not:
- **Not a boundary.** `boundary` is the static separating interface; boundary state loss is the *constitutive reduction of state* that occurs when content crosses that boundary through a bounded artifact. The boundary is the site; the loss is the event.
- **Not escape and leakage.** `escape_and_leakage` is the continuous, distributed loss of a quantity through imperfect containment over time; boundary state loss is *discontinuous loss at the moment of hand-over*, intact on both sides but reduced in the act of transfer.
- **Not latency.** `latency` is delay in a signal's arrival; boundary state loss is *content* lost at a carrier crossing, independent of how long the transfer takes — five minutes of handoff can lose what hours of continuous carrying preserved.
- **Not impedance mismatch.** `impedance_mismatch_and_coupling_efficiency` concerns lost power or signal at an interface between mismatched media; boundary state loss concerns *tacit and contextual content* that no encoding of bounded capacity can carry, regardless of coupling.
- **Not three horizons analysis.** `three_horizons_analysis` is a futures-planning frame across time horizons; boundary state loss is about state crossing a carrier boundary, unrelated to horizon scanning.
- **Common misclassification.** Diagnosing a post-handoff failure as receiver incompetence ("they should have known") or insufficient documentation ("they should have written more"). Catch it by asking what the source carrier held that no field of the artifact could capture; persistent surprises despite a "complete" briefing signal constitutive tacit-state loss, not effort failure.

broad_use: The pattern recurs across healthcare, software, craft, manufacturing, and law. In healthcare shift change, a nurse signs out a patient list through a structured handoff form that captures vitals, medications, and pending labs but not the gestalt of "this patient looks worse than her chart says"; adverse events spike at shift boundaries.<!-- FACT-D58-651 -->[^starmer-etal-2013] In software, design intent lives in the head of the engineer who built a system, and the codebase, comments, and commit messages are all that remain when she leaves, so the next engineer inherits a working system but not the *why* and accumulates defensive technical debt.<!-- FACT-D58-652 -->[^brooks-1995] In craft and cultural transmission, tacit practice — smithing, jazz, surgery, ritual — requires apprenticeship-like overlap, and a book or video is constitutively impoverished, so the practice is lost when the master dies without an apprentice even though every explicit artifact survives.<!-- FACT-D58-653 -->[^polanyi-1966] In computing, state serialization across a process or network boundary cannot transmit closures, open descriptors, or runtime-only objects, and microservice migrations regularly discover state that lived in the monolith and did not survive the split.<!-- FACT-D58-654 -->[^oracle-serialization] The pattern also appears in multi-stage manufacturing handoffs, patient transitions across care settings, organizational acquisitions, multi-attorney case transfers, and API and RPC boundaries where anything not in the schema is lost.<!-- FACT-D58-655 -->[^ahrq-transitions]

clarity: The prime corrects two persistent confusions. First, it separates the *act of transfer* from the *steady-state carrying*: a long-lived team carries state cheaply because the carrier is continuous, while a handoff is expensive because the carrier discontinuously changes. The same total information may be perfectly preserved across hours of a single shift and largely lost in five minutes of handoff — the loss is a property of the boundary crossing, not of the elapsed time or the volume of information. Second, it separates the *artifact* from the *transfer*: a richer artifact reduces but does not eliminate the loss, because tacit and contextual content is structurally outside the channel's capacity. The choice is therefore not artifact-versus-no-artifact but transfer-mechanism design. This is why retrospectives that conclude "we need better documentation" so often fail to prevent the next instance — the constraining channel is fixed, and only a richer transfer mechanism can move the content the artifact cannot. The clarifying force is to redirect attention from the quality of the artifact and the competence of the receiver to the structure of the boundary crossing itself.

manages_complexity: A boundary-state-loss frame compresses what would otherwise be a stack of disconnected pathologies — hospital handoff errors, microservice migration failures, lost craft traditions, refactoring debt, acquisition-integration failures, RPC bugs — into a single structural object with a small intervention vocabulary. One can *enrich the artifact*, *introduce an overlap window during which both carriers are live*, *protocolise the handoff to surface tacit content*, *share substrate so the transfer becomes unnecessary*, or *introduce apprenticeship-style mentor-shadow overlap*. The same vocabulary works across all the substrates with substantive bite: an overlap window is parallel-run cutover in systems migration, a co-operating year in surgery, and a ninety-day overlap with a departing attorney in law.<!-- FACT-D58-656 -->[^nonaka-takeuchi-1995] The frame also clarifies which interventions are *insufficient by construction*: "better documentation" alone cannot fully solve any of these problems, because the constraining channel is fixed and only a richer transfer mechanism can move tacit content. The complexity reduction is that a practitioner facing a new boundary need not invent a remedy from scratch; they enumerate which of the five moves the substrate affords and choose among them, knowing in advance that the artifact-only fix will under-perform.

abstract_reasoning: The prime makes precise a load-bearing distinction between *information* and *state*. Information can in principle be encoded and transferred completely; state includes tacit, contextual, dispositional, and intentional content that resists explicit encoding. The reasoner who has internalised this stops asking "what should we document?" and starts asking "where are the boundaries, and what state must cross them?" — and then "what cannot fit in the artifact, and how do we transfer it?", which is the design move. The prime also enables a structural inference: unexpected post-handoff failures are evidence of boundary state loss, not of incompetence in the receiver. When a new engineer breaks the system, a new nurse misses a deterioration, or a new ambassador misreads the host country, the structural inference is "what state was held in the previous carrier and lost at transfer?" — and the remedy is upstream in transfer design, not downstream in receiver training. This inference is available in any substrate where state crosses a carrier boundary through a bounded artifact, because the information/state distinction and the constitutive-loss property are properties of the structure rather than of any particular medium.

knowledge_transfer: A hospital quality-improvement team that has internalised boundary state loss thinks about electronic-record handoff redesign the same way a software architect thinks about microservice boundaries — schema as artifact, overlap window as solution, shared substrate, in which a single team owns both sides, as elimination. An anthropologist studying craft transmission thinks the same way as an integration team after an acquisition. The transfer is substantive rather than analogical because the underlying object is identical: structured handoff protocols in medicine, pair-programming and architectural decision records in software, apprenticeship traditions in craft, overlap periods with departing attorneys in law, and parallel-run cutovers in systems migration are all the *same intervention*, optimised for their carrier.<!-- FACT-D58-657 -->[^nonaka-takeuchi-1995] A practitioner who has learned in one substrate that the artifact is necessary but never sufficient, and that an overlap window is the move that actually moves tacit content, carries that lesson intact into the next, needing only to identify which carrier-specific form the overlap takes. The transfer also runs through the shared failure signature: in every substrate the gap surfaces *later*, as behaviour driven by content the artifact could not carry, so a delayed, inexplicable failure after a handoff is in every domain a prompt to look upstream at the transfer rather than at the receiver. The pattern's structural core — carrier to bounded artifact to carrier, with constitutive loss and receiver-side reconstruction — is substrate-free, which is why it ports cleanly from the human and organizational settings where it was first named to the computational setting of serialization across process boundaries; the framing is hybrid because many of its salient instances are practice-bound, in medicine, craft, and law, but the channel-capacity bottleneck for tacit content beneath those instances is general. The most valuable transfer is the recognition that the choice is never artifact-versus-no-artifact but always transfer-mechanism design, so that a team in any new domain reaches past the reflexive "document more" toward the overlap windows, protocolised conversations, and shared substrates that the structure actually requires.

formal_abstract:
Object serialization across a process boundary is the cleanest computational instance, and it makes the *constitutive-loss invariant* a literal fact about channel capacity rather than a matter of effort. The *source carrier* is a live process's heap: a rich runtime state holding objects, open file descriptors, network sockets, thread contexts, and closures that capture references to other live objects.<!-- FACT-D58-658 -->[^oracle-serialization] The *carrier boundary* is the process or network boundary the state must cross — to a forked child, a remote host, or a persisted snapshot. The *bounded transfer artifact* is the serialized byte stream produced by marshalling the object graph. The invariant bites immediately: the serializer can encode plain data fields, but it *cannot* encode an open socket, a file descriptor's kernel-side state, a thread's stack, or a closure's captured environment — these are runtime-only entities outside the schema's expressive capacity.<!-- FACT-D58-659 -->[^oracle-serialization] The *receiver* on the far side *reconstructs a working state* by deserializing the byte stream, and proceeds as if the reconstructed object were equivalent to the original. The *delayed surfacing* is the characteristic bug: the deserialized object looks complete and behaves correctly until code paths that depend on the dropped socket or descriptor execute, at which point a null reference or a "connection closed" error appears, often far downstream and seemingly unrelated to the transfer.<!-- FACT-D58-660 -->[^oracle-serialization] The prime's diagnosis is exact and corrects the reflexive instinct: the fix is not "serialize more fields" (the artifact's capacity is structurally bounded — closures and live handles cannot be marshalled at all) but *transfer-mechanism redesign* — re-establish connections on the receiving side, pass handles through a shared substrate the two processes both reach, or restructure so the state never needs to cross the boundary.

**Mapped back:** Serialization instantiates every role of the signature — a rich source carrier, a boundary crossing, a bounded artifact, a capacity invariant that *provably* excludes runtime-only state, receiver reconstruction, and delayed surfacing — and shows the prime's claim that the loss is a property of the boundary, not of documentation effort, as a hard fact about what a byte stream can encode.

applied_industry:
Hospital nursing shift change and software succession after an engineer departs are the same boundary-state-loss object on human substrates, and reading both through the prime redirects the remedy from "try harder at the artifact" to transfer-mechanism design. In shift change the *source carrier* is the outgoing nurse's working memory; the *state* includes charted vitals, medications, and pending labs *and* the tacit gestalt "this patient looks worse than her chart says"; the *carrier boundary* is the change of shift; the *bounded artifact* is the structured sign-out form. The form captures the chartable facts but is constitutively unable to carry the tacit clinical intuition, so the incoming nurse *reconstructs a working picture* and proceeds — and the *delayed surfacing* is a deterioration missed because the warning that lived only in the prior nurse's pattern-recognition never crossed the boundary. The prime's diagnosis is that this is neither "the nurse forgot" nor "the form needs more fields" but a constitutive boundary loss, and the effective intervention is an *overlap window* — a bedside handoff where both nurses are live and the tacit content can be demonstrated, not just written. In software succession the *source carrier* is a departing engineer's understanding of *why* a system is built as it is; the *artifact* is the codebase, comments, and commit history; the loss is the design intent and the rationale for non-obvious choices; the *delayed surfacing* is the successor's accumulating defensive technical debt as she re-derives constraints the hard way. The transfer between domains is substantive, not analogical: the bedside overlap window, a parallel-run cutover in systems migration, a co-operating period in surgery, and a ninety-day overlap with a departing attorney in law are all the *same intervention* optimised for their carrier — and in every case the lesson is that the artifact is necessary but never sufficient, and a delayed, inexplicable post-handoff failure is a prompt to look upstream at the transfer rather than at the receiver.<!-- FACT-D58-661 -->[^starmer-etal-2013]

**Mapped back:** Shift change and engineering succession are one structural object — carrier to bounded artifact to carrier, with constitutive loss of tacit content and delayed surfacing — so in both the design choice is never artifact-versus-none but which overlap-style transfer mechanism moves the content the artifact cannot.


Bounded Rationality

one_liner: Limited decision capacity.

core_idea: Bounded rationality is the structural claim that real decision-makers — humans, organizations, or algorithms — operate under binding limits on information, cognitive or computational capacity, and time, and that these limits fundamentally shape the decision process and its outputs in ways that cannot be captured by models assuming unconstrained optimization.[^simon-1990]<!-- FACT-D07-110 -->[^simon-1990] Rather than selecting the globally best option from a fully enumerated choice set, bounded agents search locally, apply heuristics, and stop when an option is "good enough" (satisficing) relative to an aspiration level — a process that is adaptive to the environment rather than deficient by contrast with an idealized optimum.[^simon-1955]<!-- FACT-D07-112 -->[^simon-1955] The structural claim rests on four essential specifications. First, the agent and decision problem must be specified, including what information and computational resources are available. Second, the binding constraints — whether cognitive, informational, temporal, or attentional — must be identified, since not all limits constrain equally at a given decision point.[^simon-1972]<!-- FACT-D07-111 -->[^simon-1972] Third, the resulting decision procedure must be characterized: the search strategy, evaluation method, and stopping rule that the agent actually employs, not assumed to employ. Fourth, the procedure's outputs must be compared not against an impossible global optimum but against feasible alternatives in the actual environment, measuring performance relative to environment-procedure fit.[^simon-1956]<!-- FACT-D07-116 -->[^simon-1956] This reframing — from "how far does observed behavior deviate from the unconstrained optimum?" to "what procedure is being run, under what constraints, in what environment, and how well adapted is it?" — reorganizes the entire landscape of choice under uncertainty.

structural_signature:
A decision model is bounded-rational when each of the following holds:

- **Agent with real limits.** A specifiable decision-maker whose limits on information, computation, time, or attention are part of the problem structure, not eliminable by assumption. Herbert Simon's scissors metaphor clarifies the relationship: cognition and environment must be understood as the two blades of a scissors, each meaningless without the other.[^simon-1990]<!-- FACT-D07-110 --> Limits are not defects to be excused; they are constitutive of the decision situation.

- **Non-trivial choice set.** A choice environment in which full enumeration, evaluation, or optimization is infeasible or prohibitively costly relative to available resources. This infeasibility may arise from combinatorial explosion (the choice set grows exponentially with problem parameters), from uncertainty about outcomes, or from the computational complexity of ranking all alternatives.[^simon-1972]<!-- FACT-D07-111 --> The key is that the complexity is not an artifact of model but of the world the agent inhabits.

- **Procedural decision rule.** The agent follows a specifiable procedure — search order, evaluation method, stopping rule — that yields a choice without requiring exhaustive optimization. Procedural rationality asks "is the process sound?" whereas outcome rationality asks "is the result good?"; bounded-rationality models commit to procedural characterization because the agent cannot verify outcomes ex ante.[^simon-1955]<!-- FACT-D07-112 --> The procedure may include heuristics, satisficing rules, standard operating procedures, or recognition-primed matching against past experience.

- **Aspiration or stopping criterion.** Some criterion terminates search: an aspiration level, a time budget, a threshold of satisfaction, or an externally imposed deadline. Aspiration levels are not fixed but adapt dynamically: if an agent repeatedly achieves a target, aspiration rises; if repeated failures occur, aspiration adjusts downward.[^stigler-1961]<!-- FACT-D07-113 -->[^stigler-1961] This aspiration-driven search connects to sequential search models in economics, where agents search with a reservation price in mind, comparing each new option against a learnable threshold.[^stigler-1961]<!-- FACT-D07-113 -->

- **Environment-procedure fit.** Performance depends critically on the alignment between the decision procedure and the statistical structure of the environment. A procedure that is ecologically rational — well-adapted to the actual regularities and constraints of its environment — may fail when moved to a different context.[^gigerenzer-todd-1999]<!-- FACT-D07-114 --> Gigerenzer and Todd's fast-and-frugal heuristics exemplify this principle: simple decision rules that ignore information can outperform complex algorithms when the environment's structure aligns with the heuristic's logic.

- **Not irrationality.** Bounded rationality is not a catalogue of errors or cognitive biases against an omniscient optimum; it is a different modeling stance in which the agent is rational given the constraints, and the constraints are part of what rationality itself must accommodate.[^kahneman-tversky-1974]<!-- FACT-D07-115 -->[^kahneman-tversky-1974] This distinguishes the Simonian bounded-rationality framework from the heuristics-and-biases tradition initiated by Kahneman and Tversky, which treats deviations from normative benchmarks as systematic errors. Both traditions invoke resource limits, but they differ in their normative commitments.

what_it_is_not:
- **Not irrationality or cognitive bias.** Bounded rationality is a structural stance toward decision-making under constraints, not a failure mode or a catalog of errors. Systematic biases and errors are observations that bounded agents sometimes produce, but the framework focuses on resource-constrained decision procedures themselves, not on deviations from an imagined optimum. See `heuristic`, `confirmation_bias`, `anchoring_bias`.

- **Not a heuristic.** A heuristic is a specific shortcut procedure — availability, recognition, satisficing-on-threshold, representativeness — while bounded rationality is the broader framework asserting that resource limits shape all decisions and that heuristics are one form of adaptive response. Heuristics are instruments or manifestations of bounded rationality; the two are not interchangeable categories. See `heuristic`.

- **Not classical rationality with noise.** Classical rational-choice theory with a random error term added still takes the unbounded optimum as the reference point; bounded rationality changes the reference entirely — the question becomes whether the procedure is well-adapted to its environment, not how much observed behavior strays from the theoretical optimum.

- **Not an excuse for poor decisions.** Recognizing that decisions are bounded by constraints does not justify every decision or insulate poor performance from critique. Some procedures are poorly fitted to their environments and produce systematically bad outcomes. The framework supports rigorous analysis of when and why procedures fail, not a blanket moral excuse. See `sunk_cost_fallacy`, `availability_bias`.

- **Not only about humans.** Organizations, markets, and algorithms are all bounded-rational in the same sense — they operate under information, time, and computation constraints and use procedures adapted to those constraints.[^simon-1947]<!-- FACT-D07-117 -->[^simon-1947] A firm satisficing on profit targets, a search engine's ranking algorithm operating under latency constraints, and a person choosing a restaurant are all governed by the same structural logic.

- **Common misclassification.** Using "bounded rationality" as a synonym for "people make mistakes"; conflating bounded rationality with the heuristics-and-biases program (one particular research tradition within bounded rationality that emphasizes error); treating satisficing as always inferior to optimizing rather than as a procedure adapted to specific problem-environment pairs; assuming that recognizing bounded rationality excuses or explains away observed failures without further analysis.

broad_use:
- **Economics and behavioral economics.** Simon's *Administrative Behavior* established bounded rationality as the framework for real decision-making: search, evaluation, stopping rules rather than global optimization.[^simon-1947]<!-- FACT-D07-117 --> Behavioral economics (Kahneman, Thaler) builds on this to analyze consumer choice and markets. Sequential search models ground reservation-price decision rules in economics.[^stigler-1961]<!-- FACT-D07-113 -->

- **Organizational management science.** The Carnegie School (Simon, March, Cyert) showed firms use standard operating procedures, aspiration-level adaptation, and sequential attention, not comprehensive optimization.[^march-simon-1958]<!-- FACT-D07-119 -->[^march-simon-1958]<!-- FACT-D07-120 -->[^cyert-march-1963] The garbage-can model extends this to decisions under radical uncertainty.

- **Political science and policy.** Policymakers as bounded-rational agents face agenda constraints, attention limits, and incomplete information. Lindblom's "muddling through" captures incremental, reversible policy adjustments rather than comprehensive planning.[^lindblom-1959]<!-- FACT-D07-121 -->[^lindblom-1959]

- **Artificial intelligence and computer science.** Heuristic search, anytime algorithms, and bounded-optimality frameworks make bounded rationality an engineering principle: systems must decide well within computational budgets.[^russell-subramanian-1995]<!-- FACT-D07-123 --> Resource-rational analysis reframes cognition and algorithms as optimal computation given limited resources.[^lieder-griffiths-2020]<!-- FACT-D07-125 -->[^lieder-griffiths-2020]

- **Cognitive science and psychology.** Gigerenzer's ecological rationality shows simple rules outperforming complex optimization in structured environments.[^gigerenzer-todd-1999]<!-- FACT-D07-114 --> Kahneman-Tversky's heuristics-and-biases tradition explains systematic deviations from normative theory.[^kahneman-tversky-1974]<!-- FACT-D07-115 --> Klein's recognition-primed decision-making describes expert judgment under time pressure.[^klein-1998]<!-- FACT-D07-122 --> Modern resource-rational analysis unifies human and artificial bounded rationality.[^lieder-griffiths-2020]<!-- FACT-D07-125 -->

- **Negotiation, conflict resolution, and law.** Bounded rationality shapes litigation decisions, plea bargaining, and settlement. BATNA reasoning is bounded-rational aspiration-level calculation.[^conlisk-1996]<!-- FACT-D07-124 -->[^conlisk-1996] Legal procedures structure information revelation and decision sequencing.

clarity: Bounded rationality clarifies by replacing the question "what would an omniscient optimizer do?" with "what procedure is the agent actually running, under what constraints, in what environment, and how well adapted is it to that environment?" This reframing eliminates false precision.[^simon-1955]<!-- FACT-D07-112 --> A claim like "the manager made a bad decision" resolves into "the manager faced decision D with constraints [information gaps, time budget, cognitive capacity, organizational politics], ran procedure P [search strategy, stopping rule, escalation threshold], and chose option C; a differently resourced agent might have chosen C' because their procedure P' could access [knowledge, time, computational capacity] that P could not; the question is whether P is well-adapted to D's environment, what the cost of improving P would be, and whether an intervention on constraints or procedure would yield better outcomes at acceptable cost." The clarifying force turns abstract optimality gaps into concrete procedure-environment fit analyses with specific operational levers: invest in information gathering, loosen time constraints, redesign the search order, adjust aspiration levels, or restructure decision rights. This forces specificity about what is actually broken and what would fix it.

manages_complexity:
- **Supports realistic decision modeling.** Instead of modeling every agent as a full optimizer — an assumption that requires assuming away information, time, and computational limits — bounded rationality specifies the constraints and procedures that actual agents use. This yields models that match observed behavior and make testable predictions about how agents respond when constraints are relaxed or tightened.

- **Enables procedure design.** If agents will satisfice rather than optimize, designers can set aspiration levels, default options, and search orders to guide good outcomes. This is the foundation of choice architecture and behavioral nudging: small changes to the decision environment can steer bounded agents toward better outcomes without requiring them to optimize globally.

- **Structures AI and algorithm design.** Anytime algorithms, bounded-optimal reasoners, and resource-rational agents represent explicit engineering of procedures for resource-constrained decision environments.[^russell-subramanian-1995]<!-- FACT-D07-123 --> This principle has become central to real-world AI deployment: systems must make good decisions within strict latency, memory, and compute budgets, not theoretical optima.

- **Frames organizational design.** Standard operating procedures, division of labor, specialization, and hierarchical decision rights all allocate the burden of bounded rationality across agents so that the organization as a whole can handle problems that would overwhelm any individual.[^march-simon-1958]<!-- FACT-D07-119 --> Slack (excess capacity, buffers, flexibility) becomes a design variable, not a sign of inefficiency.

- **Supports realistic performance evaluation.** Rather than comparing choices to an unattainable optimum, evaluate decision procedures and their outcomes against feasible alternatives in the same environment. This enables diagnostic analysis: did the procedure fail because of inadequate information, time pressure, poor aspiration setting, or mismatch with environment?

- **Connects micro and macro.** Individual bounded-rational decision procedures, when aggregated across agents in an environment, produce market, organizational, and policy outcomes that cannot be predicted from optimization assumptions. This applies from consumer search aggregating to market prices, to organizational routines aggregating to firm strategy, to bureaucratic procedures aggregating to policy implementation.

abstract_reasoning:
Bounded rationality trains a reasoner to ask:

- Who is the agent (human, organization, algorithm, ecosystem), and what specific decision is being made?

- What are the binding constraints — information (incomplete? costly? asymmetric?), computation (time to think? processing capacity?), time (deadline? sequential window?), attention (how many considerations can be tracked?), resources (money, social capital, political capital)?

- What procedure does the agent actually run — search order, evaluation method, stopping rule, escalation triggers? Is it explicit or tacit, formal or habitual?

- What aspiration or threshold terminates the search? Does it adapt based on experience or remain fixed?

- How well does the procedure fit the environment's statistical structure — the distribution of alternatives, the signal-noise ratio in available information, the feedback timing?

- Would relaxing a specific constraint (more time, better information, fewer distractions, decision aids) improve outcomes, and at what cost in money, attention, or complexity?

- What other procedures could the agent feasibly run given realistic constraints, and how would their outcomes compare in the same environment?

- Does the agent have feedback mechanisms to detect when the environment has shifted such that a previously adapted procedure no longer fits?

- Where does the procedure risk failure — what environmental changes or decision types would expose its limits?

knowledge_transfer:
Role mappings across domains:

| Structural Role | Economics | Organization | AI/Algorithm | Cognitive Science | Policy |
|---|---|---|---|---|---|
| **Agent** | Consumer, firm, market-maker | Manager, department, firm | Search algorithm, reasoner | Person, expertise community | Policymaker, agency, government |
| **Binding constraint** | Information asymmetry, search cost, time-to-decision | Attention, slack, coordination cost | Latency budget, memory, compute | Working memory, cognitive load, learning time | Institutional constraints, agenda control, political capital |
| **Decision procedure** | Sequential search, reservation-price acceptance, negotiation | SOPs, satisficing heuristic, escalation rules | Bounded-optimal algorithm, anytime planner | Recognition-primed matching, heuristic evaluation | Incremental adjustment, domain-specific policy routine |
| **Aspiration/threshold** | Reservation price, acceptable quality-to-price ratio | Profit target, customer-satisfaction target, employee-retention target | Solution-quality threshold, time budget | Expected utility threshold, satisfactory plan | Stakeholder-acceptance threshold, implementation feasibility |
| **Environment structure** | Price distribution, quality variance, market thickness | Industry dynamics, competitor behavior, resource availability | Problem instance distribution, solution-space structure | Task domain regularities, feedback statistics | Policy domain regularities, electoral cycle, interest-group landscape |
| **Fit / Performance** | Reservation-price calibration to market conditions | SOP effectiveness as conditions change | Algorithm approximation ratio, solution quality vs. time | Expert speed-accuracy tradeoff, expertise recognition accuracy | Policy implementation effectiveness as conditions change |

A behavioral economist analyzing consumer search behavior, an AI researcher designing bounded-optimal planners for robot navigation, and an organizational theorist modeling managerial decision rules under cost constraints are all doing the same core structural work: identify the agent and decision, specify the binding constraints, characterize the procedure the agent runs, evaluate the fit between procedure and environment, and consider interventions on constraints or procedure. The same diagnostic framing — "what agent, what constraints, what procedure, what environment fit, what leverage points?" — applies across their contexts, with the same failure modes (ignoring constraints and modeling agents as unbounded optimizers; assuming procedures are universally good or bad rather than environment-specific; conflating bounded-rational behavior with irrationality; failing to track when environmental change has invalidated a procedure) in each domain.

prose:
*(Pass B — pending; see `tracker/v2_upgrade.md`.)*

### Catalog cross-references (v1, batches 02–29)

Solution archetypes that reference this prime (per `solution_archetypes/_catalog/catalog_v1_batches_02_29.yaml`):

**As related prime (12):** `anti_herding_signal_design`, `credible_signaling`, `incentive_compatible_rule_design`, `minimum_sufficient_solution`, `network_effect_bootstrapping`, `objective_function_alignment`, `opportunity_cost_surfacing`, `parsimony_filter`, `present_bias_countermeasure`, `price_signal_design`, `principal_agent_alignment`, `progressive_narrowing`

notes:
Bounded rationality is a parent construct to satisficing (#248), which is one specific decision procedure within the bounded-rationality framework, not a synonym. Many bounded-rational agents use satisficing (sequential search with an aspiration level), but bounded rationality encompasses other procedures too: heuristic evaluation, recognition-primed decision-making, fast-and-frugal heuristics, and procedural rules. The relationship is genus-to-species: satisficing is a bounded-rational procedure; bounded rationality is the broader theoretical framework.

The construct emerges from the Carnegie School lineage: Herbert Simon's foundational work in the 1950s on organizational decision-making and bounded rationality, extended by James G. March and Richard M. Cyert to formalize aspiration-level adaptation and organizational coalitions.[^march-simon-1958]<!-- FACT-D07-119 -->[^cyert-march-1963]<!-- FACT-D07-120 --> This lineage flows into modern behavioral economics (Kahneman, Thaler), organizational theory (Gavetti, Levinthal), cognitive science (Gigerenzer, Todd, Klein), and AI (Russell, Subramanian, Griffiths).[^klein-1998]<!-- FACT-D07-122 -->[^klein-1998]<!-- FACT-D07-123 -->[^russell-subramanian-1995]<!-- FACT-D07-125 --> The construct is multi-origin in a true parallel-emergence sense: Simon worked across behavioral economics, organizational management, and cognitive science from the start, and each field developed bounded-rationality principles independently while drawing on his foundational work.

Cross-DP B3 candidate: Simon's distinction between inner environment (the agent's mental model) and outer environment (the world the agent acts in) in *The Sciences of the Artificial* is also cited in DP-04 representation (#386); flag for deduplication at B3 review.

The construct originated in behavioral_economics but is equally foundational to organizational_management_science (the Carnegie School's application domain) and psychology_behavioral_sciences (Gigerenzer and Kahneman's empirical traditions). This three-way origin reflects genuine parallel emergence rather than diffusion from a single source.