You are solving a hard design problem, acting as the CONTROL POLICY of a reasoning engine. You have a reference catalog of cross-domain abstractions via the encyclopedia tools (search_prime is SEMANTIC — query with the domain-stripped meta-model; search_by_facets for oblique problems; plus get_prime, get_prime_neighborhood, search_archetype, get_archetype, find_archetypes_for_prime, find_related_primes, list_components, find_archetypes_using_component, corpus_stats).

You have a VERB LIBRARY (below). Choose verbs in ANY order, repeat, skip. Record verb choices (verb + why).

BEFORE finalizing a recommendation you MUST satisfy these post-conditions and SHOW each:
 (i)   compose: referential integrity — every relationship connects declared elements; every operative prime
       appears in the model.
 (ii)  lift (situation -> skeleton): every skeleton element has a witness in the concrete model; no domain terms.
 (iii) SCOPED COVERAGE CHECK: identify the SINGLE operative pattern your design most relies on (ONE, not
       several). Name THAT pattern's full component set, and for EACH component state whether the design
       [instantiated] it (the concrete mechanism), discharges it via a [homolog] (name it), [correctly_declined]
       it (genuinely inapplicable here, or instantiating it would over-build the design — say why), or leaves it
       [missing]. You may NOT finalize while any component is [missing].
       AVOID OVER-BUILDING: do NOT pull in additional patterns and dutifully instantiate all their components;
       a lean design that covers the ONE operative pattern beats a sprawling one that instantiates everything.
       Use [correctly_declined] aggressively for components that do not earn their place in THIS problem.
 (iv)  evaluate-fit: walk the chosen pattern's anti-signatures against this scenario; confirm none disqualifies.

Produce the scoped COVERAGE MAP explicitly (component -> status -> witness/reason) in your working before the
recommendation block.

# Verb library v1 (shared, versioned — held fixed across conditions A/B/C)

Each verb reads/writes fields of the shared STATE object. Post-conditions are predicates over STATE;
condition C enforces a subset of them before any final recommendation.

## STATE (the object the control policy acts on)
- `problem` — statement, constraints, success_criteria, failure_criteria.
- `operative_primes` — [{slug, type: structural|framed|mixed, salience: load_bearing|context, rationale}].
- `model` — typed relational model: nodes [{id,label,kind}], edges [{src,dst,relation,prime_annotation?}], prime_annotations.
- `meta_model` — domain-stripped skeleton: roles, relations, invariants.
- `candidates` — [{archetype, source_prime_overlap, retrieval_score}].
- `coverage_map` — {pattern, components:[{name, status: instantiated|homolog|correctly_declined|missing, witness?, decline_reason?, gap_note?}]}.
- `gate_log` — [{candidate, anti_signatures:[{slug,tripped,reason}], verdict: keep|drop}].
- `recommendation` — final concrete design (emitted only at STOP).
- `history` — [{step, verb, args, rationale}].

## Verbs
- **match (retrieve).** Anchor the problem to the catalog; return candidate primes + archetype neighborhoods (semantic/type-aware/facet retrieval via the encyclopedia tools). Pre: a problem statement. Post: ≥1 candidate with a recorded source-prime overlap. Fails by: retrieval miss, neighborhood crowding.
- **salience-rank.** Order operative primes by load-bearing relevance (removing it would change the recommendation). Pre: ≥1 candidate prime. Post: each prime tagged load_bearing|context + rationale.
- **prune.** Cut to the operative subset (dual of salience-rank). Post: subset retained (≈3–9), each cut justified.
- **compose.** Assemble operative primes into the typed relational `model`. Pre: ≥2 operative primes. Post (CHECKABLE): every edge references declared nodes; every operative prime appears as an annotation (referential integrity).
- **lift — coverage-enforcement (the central verb).** Two modes sharing one artifact.
  - L1 (lift the situation): `model` → `meta_model`. Post (CHECKABLE): every meta-model role/relation has a witness in `model`; no domain terms remain.
  - L2 (lift a pattern's components onto the design): given a pattern in hand + the draft design — (1) name the pattern's components; (2) pose each as a candidate requirement; (3) coverage-check each: is it genuinely instantiated in the current design?; (4) keep gap-closers, mark already-covered as `instantiated`, decline genuinely-inapplicable ones AND back off any whose abstract framing would distort a sub-structure handled naturally (the over-lift guard), mark unmet ones `missing`. Post (CHECKABLE — the coverage map): every component listed with a status; instantiated/homolog carry a witness; correctly_declined carries a reason; missing carries a gap-note. **A design may stop only when no component is `missing`.** NOTE: lift is NOT gated on framed/structural — it fires by coverage on any pattern.
- **lower (instantiation).** Realize a transported pattern/role-set in the target domain. Post: every posed component/role maps to a named target mechanism (instantiated|homolog) or is flagged unsatisfiable (correctly_declined) — writes into `coverage_map`. Typed mode `lower-to-homolog`: on framed roles, find a substrate mechanism that discharges the same function and justify its independence. Fails by: forced lowering, under-specification, naive role-dropping.
- **transport (= retrieve + map).** Carry a pattern across a domain gap: match (retrieve) + map (align pattern-roles to situation-entities, report where the correspondence breaks). Typed: structural → direct recognitional; framed → lift-roles → map → lower-to-homolog. Fails by: retrieval failure, forced mapping.
- **decompose (framed/structural-GATED).** Given a *framed* prime, strip the frame to expose a structural core (three fates). Pre (TYPED GATE): prime is framed; on a structural prime it is a no-op. This is the one verb the framed/structural label gates — NOT lift. Checkable: fate-2 verified by transport (does the core project to ≥3 domains?).
- **evaluate-fit (gate).** Walk a candidate's anti-signatures/trigger conditions; drop it if the situation trips a disqualifying condition. Pre: candidate carries anti-signatures (well-typed over archetypes). Post (CHECKABLE): each anti-signature explicitly evaluated (tripped? + reason); candidate dropped if disqualified. Fails by: hollow gate.
- **reconcile.** Apply a candidate's logic to the concrete `model` and the `meta_model` separately; resolve divergent inferences, preferring the reading consistent with both. Diagnostic: if the views never disagree, the meta-model is decorative. Fails by: collapse (one view dominates).

## Verb relationships
lift ⊣ lower (adjoint-like); decompose ↔ frame; salience-rank ↔ prune. Cross-checks: decompose verified by transport; salience by ablation; lift(L1) by witness-check; compose by referential integrity; **lift(L2) coverage map is the discipline condition C enforces at STOP.**


PROBLEM.
An online marketplace runs a shared system that flags accounts likely to be abusing the platform (fake reviews, payment fraud, coordinated scams) so they can be reviewed or restricted. It worked well at launch. Over the last year its hit rate has quietly fallen: the bad actors who get through are the ones who learned what the system looks for and changed just enough to slip past, while a growing number of ordinary sellers complain they were wrongly restricted with no clear way to find out why. The team can change what signals the system uses, what happens when an account is flagged, what is logged, and what review or appeal exists around it.

Decision required: Design how this system should work so it keeps catching abuse over time and treats ordinary users fairly.

Success criteria: It remains effective as the people it targets adapt, AND ordinary users are not driven off by wrong restrictions. Failure = the system degrades into either an evadable rubber stamp or a blunt instrument that punishes the innocent.

OUTPUT — FINAL RECOMMENDATION as plain prose, MAX 1000 words, in a fenced block exactly:
===RECOMMENDATION_BEGIN===
<the design: concrete mechanisms, rules, thresholds, paths, and a final operating rule>
===RECOMMENDATION_END===
Rules: integrated prose (NOT a numbered checklist mirroring requirements; no requirement-number section
labels); plain domain terms only; do NOT name/allude to any external catalog, framework, methodology, prime,
archetype, or this exercise; if a candidate requirement does not genuinely fit, leave it out. Above the block,
include your working (state + verbs run with one-line why each; end with `COST: ~<n> operations, ~<n> tokens`);
the working is discarded before grading. Write your ENTIRE response to: experiments/project03_lowcov_2026-05-25/outputs/d31.md