# c12 — Open-source maintainer burnout / maintenance commons

## STATE + working (discarded before grading)

**problem.** A widely-used OSS library is maintained by 3 volunteers; thousands of firms free-ride. Unbounded inbound (bugs, feature demands, security questions) from non-contributing users who treat volunteers as paid support and escalate when ignored. Two maintainers have gone silent; the last is near exit → total lapse. Lever set: can change *how work is accepted, who gets attention, what is expected of users, how contribution is recognized*; CANNOT compel payment or labor. Success = load matched to capacity within 6 months AND no security-response lapse. Failure = last maintainer burns out, OR gatekeeping so heavy the user/contributor pipeline collapses.

### Verbs run (verb + why)

1. **match (search_by_facets)** — oblique, multi-structure problem, so decomposed into 6 structural facets (shared-upkeep-by-few, private-cost/public-benefit, unbounded-demand-vs-fixed-capacity, exhausted-few-vs-taking-many, no-filter-overuse, relied-upon-can-withdraw). Per-facet + fused rankings.
   - Fused primes: `tragedy_of_the_commons` (distinctive, mixed-framed, top), `public_goods`, `deadlock`, `scarcity`, `free_riding`, `margin_of_safety`, `solidarity`.
   - Fused archetypes: `capacity_reservation`, `contribution_visibility_design`, `commons_governance`, `bounded_backlog`, `comparative_advantage_specialization`, `queue_reservation`, `public_goods_provision`.
2. **match (corpus_stats)** — sanity: 643 primes / 625 archetypes, embedder live. OK.
3. **match (get_archetype ×3)** — pulled `commons_governance`, `bounded_backlog`, `contribution_visibility_design` for components + anti-signatures.
4. **match (search_archetype ×2)** — covered two latent facets a blended query buries: "who gets attention" (priority/triage) → `priority_based_admission`, `intake_queue_staging`, `attention_budgeting`; and "require contribution before granting" → `iterative_reciprocity_and_repeated_interaction`, `reciprocity_protocol_design`.
5. **match (get_archetype ×2)** — `iterative_reciprocity…` and `intake_queue_staging` for component grain.
6. **salience-rank.** Load-bearing: `tragedy_of_the_commons` (the spine — distributed benefit / concentrated maintenance cost, with *maintenance burnout* as a named failure mode and OSS as a named example), `bounded_backlog` (caps the unbounded obligation store), `intake_queue_staging` (separates *received* from *accepted* — kills the false support-desk commitment), `contribution_visibility_design` (recognition flips coasting to contributing), `iterative_reciprocity` (conditions attention on giving-back). Context only: `public_goods` (underproduction framing — see prune), `margin_of_safety`/`scarcity` (background), `deadlock`/`solidarity` (descriptive, no lever).
7. **prune.** Cut `public_goods_provision`: its own anti-signature in `commons_governance` says provision is for *underproduction of a non-rival benefit*; our failure is *overuse/neglect of a shared maintenance capacity* → commons governance, not provision. Kept ~5 operative patterns.
8. **compose** (mental model). Nodes: maintainers (finite capacity), users (taking firms / contributing users), inbound stream (bugs/features/security), the codebase+capacity (the commons). Edges: users→stream→capacity (depletion); maintainer→codebase (replenishment); reciprocity edge users↔attention. Every operative pattern annotates an edge. Referential integrity holds.
9. **lift L1** (situation→meta-model). Roles: STEWARDS (finite, can exit, uncompellable), BENEFICIARIES (many, can take w/o giving), SHARED-CAPACITY (depletes by neglect + overload), INBOUND-OBLIGATION (unbounded). Invariants: capacity must stay > security-critical load; stewardship must not rest on a hidden few; access must stay open enough to keep the contributor pipeline. No domain terms remain.
10. **lift L2 — coverage check (yes, I chose to run it).** Union the components of the operative patterns and status each against the draft design:
    - Shared-resource boundary → *instantiated* (scope statement: what the project owns vs. declines).
    - Use limit / backlog cap → *instantiated* (intake cap + triage SLAs).
    - Admission gate / received≠accepted → *instantiated* (issue template gate; "received" auto-label).
    - Overflow / clean-rejection path → *instantiated* (auto-close-with-pointer to discussions/paid lane).
    - Monitoring signal → *instantiated* (public backlog/age dashboard).
    - Sanction / graduated response → *homolog* (non-abuse code-of-conduct + rate-limited escalation, not punitive).
    - Replenishment / funding pool → *instantiated* (sponsorship + paid-priority lane; the exit-risk lever).
    - Contribution memory / reciprocity rule → *instantiated* (contributor standing → priority).
    - Effort recognition / credit → *instantiated* (CREDITS + maintainer tiers).
    - Legitimacy basis + adaptation cadence → *instantiated* (published charter, quarterly review).
    - Dispute/appeal path → *instantiated* (security exception lane + appeal).
    - Safety/exception (security) → *instantiated* (security never rate-limited; private disclosure + funded on-call).
    - Visibility safety boundary (anti-surveillance) → *correctly_declined* — contribution tracking here is voluntary public credit, not employee monitoring; the surveillance guard doesn't bind.
    - Over-lift guard: did NOT import full peer-evaluation / workload-heatmap machinery (distorts a 3-person volunteer group) — declined.
    - No component left `missing`. Stop condition met.
11. **evaluate-fit (gate).** `commons_governance` anti-sigs: not fully private; not mere underproduction (overuse+neglect both present); central command impossible (can't compel) → fits. `bounded_backlog` anti-sigs: problem is accumulated obligation stock not just inflow rate → fits (pair cap+rate-limit). `iterative_reciprocity` anti-sig: relationship IS repeatable + identity observable (GitHub handles) → available, but keep as mechanism inside governance, not the whole frame. No candidate tripped a disqualifier; security-exception requirement is the binding guardrail against over-gatekeeping. STOP.

COST: ~9 operations, ~30k tokens

===RECOMMENDATION_BEGIN===
Treat the project not as a free help desk but as a shared resource with a finite upkeep capacity that a few people are quietly carrying. The whole design must lower and stabilize the load on that capacity, keep security work always flowing, and stay open enough that new contributors can still arrive. Start by writing and publishing a short, plain charter: what the project promises (a maintained, secure library and a documented way to contribute) and, explicitly, what it does not promise (free, fast, personalized support on demand). This single act resets the implicit expectation that volunteers owe strangers a response.

Separate "received" from "accepted." Every inbound issue passes through a light front door: a required template that forces a reproducible report, version, and a check that it is not a duplicate or a support question. Incomplete or support-style items are not silently queued — they are auto-labeled "needs-info" or politely closed with a pointer to community discussions, the docs, or a paid lane. Only items that clear the gate become real, owned work. This kills the false sense that being in the queue is a service commitment, which is the source of the angry escalations.

Cap the work that can ever be "accepted." Maintain a visible, bounded backlog with a posted target size justified by the three people's actual capacity, plus published, deliberately modest response targets for non-security issues (for example, triaged within two weeks, no promise on fix date). When the backlog is full, intake for new feature work pauses and says so. The backlog, its age, and its drain rate are shown on a public dashboard, so overload is visible rather than hidden inside exhausted inboxes — and so the demand pressure becomes the project's argument for help, not the maintainers' private burden.

Carve out one lane that is never throttled: security. Provide a private disclosure channel and a standing commitment that security reports are handled ahead of everything else. Because this is the one thing whose lapse equals failure, fund it first (see below) and make it the explicit exception to every rate limit and pause.

Condition attention on giving back, without becoming a paywall. Requests from people who contribute — a reproduction, a failing test, a documentation fix, a triage of someone else's issue, code review — move ahead of requests from pure takers. Make this rule public and reciprocal: "contributors get priority" is stated as the norm, contributions are remembered (a contributor-standing record), and a clear, low-friction path lets anyone become a contributor. Recognize all forms of help, not just merged code: credit triagers, reviewers, doc writers, and funders by name. The goal is to convert a slice of the silent thousands into a wider, rotating pool of helpers so stewardship no longer rests on three people.

Address the funding/exit risk directly, since the maintainers cannot compel payment but can structure incentives. Open a sponsorship pool and, for the companies that depend on the library commercially, offer an explicit paid-priority support tier and/or a security-retainer: paying customers get a private channel and faster guaranteed response, which both funds the never-throttled security lane and converts the heaviest extractors into payers. Money raised should first buy down the security on-call burden (a paid or rotating on-call) before anything else. Critically, free users are never abandoned — they keep the open backlog, community support, and the security guarantee; the paid tier buys speed and a private channel, not the existence of maintenance.

Distribute and rotate stewardship. Grant triage and review rights generously to proven contributors so the bottleneck is not the original three; rotate a "maintainer of the week" so no single person owns the whole inbound stream; and write down the release and security process so the project survives any one person leaving. Govern conduct lightly but firmly: a code of conduct lets you mute or block users who abuse maintainers, with a simple appeal path, so the response to entitlement is a boundary rather than burnout.

Finally, review and retune quarterly: look at backlog age, drain rate, the ratio of contributors to takers, sponsorship income, and maintainer hours, and loosen the gate if the contributor pipeline is thinning or tighten it if load is still above capacity.

The operating rule that ties it all together: the project owes everyone a maintained, secure library and an open door to contribute — but personalized, fast attention is earned by contributing or paid for, security is always free and never throttled, and no individual is ever the last line of defense.
===RECOMMENDATION_END===
