## Working

STATE.
- **problem**: An abuse-detection system for a marketplace is decaying — adversaries learn its signals and adapt past them, while wrongly-restricted ordinary sellers have no way to find out why or contest it. Redesign so it stays effective against adapting adversaries AND treats ordinary users fairly. Failure = evadable rubber stamp OR blunt instrument punishing the innocent.
- **meta_model**: A defender publishes (implicitly) a fixed detection rule against an adversary who observes the rule and adapts just enough to evade; the detection performance silently degrades over time; affected non-adversaries are subject to an automated decision with no notice, hearing, or reasons.

VERBS RUN (verb — why):
1. **match (search_by_facets)** — oblique, multi-structure problem; decomposed into five facets (adversary-adapts-to-rule, measure-becomes-target, silent-degradation, no-recourse, no-independent-review). Per-facet lists surfaced `observer_effect`, `temporal_decay_and_degradation`/`maintenance`, `procedural_fairness_due_process`/`adjudication_dispute_resolution`, and archetypes `deterioration_monitoring`, `periodic_review_and_reset`, `independent_verification_oversight`, `escalation_exit_gate`, `anti_herding_signal_design`.
2. **match (search_prime, targeted)** — the arms-race core was under-served by fusion; query surfaced `coevolution`, `competition`, and distinctively `game_theory_strategy` (defender-vs-adversary, observable-strategy exploitation, randomized/Stackelberg defense).
3. **match (search_prime, targeted)** — the "fixed rule gets gamed once known" facet; surfaced `game_theory_strategy` again + `information_asymmetry`, confirming secrecy/unpredictability as load-bearing.
4. **salience-rank / prune** (judgment) — operative subset: `game_theory_strategy` (adversarial design), `observer_effect` (signals-known-self-defeat), `temporal_decay_and_degradation`+`deterioration_monitoring` (decay/maintenance), `procedural_fairness_due_process` (fair recourse). Dropped psychological noise (bystander, decision_fatigue, existential_angst) as off-structure.
5. **lift (get_prime ×2 + get_archetype)** — pulled `game_theory_strategy` (randomized defense, unpredictability deters, layered/secret signals), `procedural_fairness_due_process` (notice→hearing→impartial review→reasons; Mathews proportionality; transparency-vs-gaming tension; avoid compliance theater), `deterioration_monitoring` (baseline→leading indicators→cadence→threshold→owner→response).
6. **evaluate-fit (gate)** — checked candidates against anti-signatures: deterioration_monitoring requires signals → action (no passive dashboards); due_process T4/T5 warns disclosure can enable gaming and that hollow procedure is failure; game_theory warns computed defenses must be feasible. All survive with the graduated-disclosure + tiered-response resolution below.
7. **reconcile + lower** — mapped the abstract skeleton (adversarial decay + fair recourse) to concrete marketplace mechanisms, resolving the disclosure tension by separating what users get (specific, contestable reasons) from what adversaries can reverse-engineer (rotating, partly-secret signals).

COST: ~6 operations, ~16k tokens.

===RECOMMENDATION_BEGIN===
Treat this as two coupled problems: a moving contest against people who watch the system and adapt, and a fairness obligation to everyone the system touches by mistake. Both fail the same way — by going static.

**Make the defense a moving target, not a fixed rule.** The hit rate fell because the signals stopped changing while the people gaming them never stopped. Split the signal set into a stable public layer (basic, well-known rules you are happy for everyone to know) and a rotating private layer that you change on an irregular cadence and never publish. Within the private layer, randomize which signals are weighted heavily in any given window, so that "what the system looks for" this month is not what it looked for last month and cannot be inferred from a few probes. Add deliberately unpredictable spot-checks: even accounts that pass the automated screen face a small, randomized chance of deeper review. Unpredictability itself is a deterrent — an adversary who cannot learn the rule cannot reliably tune just under it. Keep a private holdout of fresh fraud cases the live system has never been tuned on; if detection on that holdout is falling, the system is being learned around even if headline numbers look fine.

**Measure decay before it becomes visible.** Define a baseline of what good performance looks like and track leading indicators of erosion, not just the catch count: rising share of fraud found only after the fact, clustering of accounts that pass with signal values bunched just under thresholds (a fingerprint of tuning-to-evade), and complaint volume from restricted sellers. Review these on a fixed cadence with a named owner who is accountable for acting — a dashboard nobody acts on is worthless. Set explicit trigger points: when the evasion fingerprint or the wrongful-restriction rate crosses a threshold, that forces a signal refresh or a recalibration, not a discretionary maybe.

**Separate the response from the certainty.** A single flag should not equal a restriction. Score confidence, and let consequences scale with it. High-confidence, high-harm cases (clear payment fraud, coordinated rings) can be restricted immediately. Ambiguous flags get softer, reversible responses first — rate limits, holds on payouts, a verification step — that contain harm without amputating a legitimate seller's livelihood. This makes false positives cheap to recover from and buys time for review.

**Give wrongly-hit users a real way back, and make that path itself improve the system.** Every restricted account gets prompt notice that a decision was made, a specific-enough reason to actually respond to (which behavior, which category — not a bare code), a genuine chance to present their side before or quickly after the restriction takes effect, and a review by someone or something not identical to the model that flagged them. Crucially, the reason given to the user must be specific enough to contest but not so specific that it hands adversaries a map of the private signals: state the category and the contestable facts, withhold the exact feature weights and thresholds. Scale the depth of this process to the stakes — a payout hold needs a light, fast path; a permanent ban needs a fuller hearing with human review and written reasons. Track appeal outcomes: a high overturn rate on a given signal is direct evidence that signal is now a blunt instrument, and feeds straight back into recalibration.

**Close the loop between the two halves.** The appeals stream and the holdout-decay stream are your two early-warning systems, and they pull in opposite directions on purpose. If overturns climb, you are over-restricting innocents — loosen or fix the offending signals. If holdout detection falls, you are being evaded — refresh and tighten. A healthy system sits between them; drift toward either edge triggers action. This is what keeps you off both failure modes at once.

**Guard against the quiet failures.** Beware procedure that exists on paper but is hollow — appeals routed back to the same automated logic that flagged the account, or "reasons" that are boilerplate. Independent review must be genuinely independent of the flagging path, or it adds cost without adding fairness. And beware optimizing to the metric: if you reward the team purely on catch rate, they will catch easy honest mistakes; if purely on low complaints, they will under-enforce. Hold both targets together.

**Final operating rule.** Keep the signals moving and partly secret so they cannot be learned around; keep the consequences graduated so a wrong flag is recoverable rather than ruinous; give every affected user clear notice, a real reason, and a fast independent way to contest; and run two early-warning gauges — evasion on a private holdout, and the appeal-overturn rate — refreshing detection whenever evasion rises and correcting signals whenever wrongful restrictions rise. When either gauge crosses its line, you act; you never let the system stand still.
===RECOMMENDATION_END===
