# Working — c17 (control-policy trace)

## STATE: problem
- Statement: an open-source library serving thousands of free-riding companies is maintained by 3 burning-out volunteers; 2 have gone silent, 1 near quitting. The remaining maintainer controls how work is accepted, who gets attention, what is expected of users, and how contribution is recognized; cannot force anyone to pay or help.
- Success: maintenance load matched to capacity within 6 months AND no lapse in security response.
- Failure: last maintainer burns out (lapse) OR gatekeeping so heavy the community/contributor pipeline collapses.

## Verbs run (verb + why)

**1. match (retrieve) — search_by_facets + search_prime.** The problem is oblique (multi-structure), so I decomposed it into facets: unbounded asymmetric demand on a few providers; depletion of a shared resource by cost-externalizing users; near-zero ask-cost / high answer-cost flooded channel; entitlement without reciprocity; access regulation without pipeline collapse; converting consumers to contributors.
- Per-facet primes surfaced a tight cluster: `tragedy_of_the_commons`, `free_riding`, `public_goods`, `scarcity`, `reciprocity`, `attention`/`cognitive_resource_depletion`, `access_control`, `mechanism_design_and_incentive_structure`, `externality`, `mediator_availability_constraint`, `load_balancing`.
- Per-facet archetypes surfaced: `contribution_visibility_design` (top fused), `attention_budgeting`, `gateway_mediation`, `incentive_compatible_rule_design`, `reciprocity_protocol_design`, `commons_governance`, `price_signal_design`. Recorded source-prime overlap → candidates.

**2. salience-rank (ablation test on each candidate).**
- LOAD-BEARING: the shared resource being depleted is **maintainer attention/capacity**, used non-rivally as code but rivalrously as support — this is a *maintenance commons* (commons by neglect, not extraction). Remove this framing and the whole design changes → `commons_governance` is the spine. Also load-bearing: `free_riding`/`reciprocity` (the asymmetry is the disease), `gateway_mediation` (the near-zero ask-cost flooded channel is the proximate mechanism), `attention`/`cognitive_resource_depletion` (the finite stock).
- CONTEXT: `public_goods` (true for the code, but the code is non-rival and not the thing depleting — provision is not the problem, so demote), `incentive_compatible_rule_design` (informs anti-gaming guardrails), `contribution_visibility_design` (informs recognition layer).

**3. prune.** Cut to operative subset (~6): commons_governance (spine), gateway_mediation (intake), free_riding/reciprocity (asymmetry), attention/cognitive_resource_depletion (finite stock), incentive_compatible_rule_design (anti-gaming), contribution_visibility_design (recognition). Cut `price_signal_design`/`congestion_pricing` to context-only: the maintainer **cannot force payment** (constraint) and pricing risks the pipeline-collapse failure mode — kept as an *optional sponsor-priority* mechanism, not a gate. Cut `load_balancing` (homolog handled by triage, not equivalent-handler distribution).

**4. compose.** Model: nodes = {maintainers (finite stock), users/companies (drawers), code (non-rival output), support-channel (the boundary), contributors (replenishers)}. Edges: users→support-channel (uncontrolled crossing = flood), support-channel→maintainers (depletion), maintainers→code (replenishment), users→code (free benefit), contributors→maintainers (reciprocity). Every operative prime annotates an edge (referential integrity holds).

**5. lift (L1) — model → meta_model.** Roles: STEWARDS (finite-capacity providers), DRAWERS (many, cost-externalizing), the SHARED-SINK (steward attention/tolerance), the CROSSING (ungoverned intake), REPLENISHERS. Invariants: sink stays viable across repeated use; maintenance not indefinitely shifted to a small unprotected subgroup; access protection ≠ arbitrary exclusion; the critical-renewal function (security) never lapses. No domain terms remain.

**6. lift (L2) — coverage-enforcement against commons_governance components (the central verb).** Coverage map:
- Shared Resource Boundary → INSTANTIATED: declare the project's scope/SLA boundary (what the maintainers owe vs. don't).
- Access Rule → INSTANTIATED: tiered intake — security via private path always; everyone else via a single structured front door.
- Use Quota / Use Limit → INSTANTIATED (homolog): not a numeric quota but a *triage policy* + "no-response is a valid response" norm; attention budget reserved for security.
- Monitoring Signal → INSTANTIATED: triage labels + a public backlog/health board.
- Sanction Rule → HOMOLOG: graduated, soft — entitled/abusive behavior met with templated close + code-of-conduct, not punishment of newcomers.
- Replenishment Rule → INSTANTIATED: contributor pipeline + funding pool (sponsorship/grants/paid stewardship) + the security-critical renewal guarantee.
- Legitimacy Basis → INSTANTIATED: published charter stating the volunteer compact, so enforcement reads as fair not arbitrary.
- Dispute Resolution / Exception Process → INSTANTIATED: explicit escalation/exception path (incl. paid-priority option).
- Adaptation Cadence → INSTANTIATED: periodic review of load vs. capacity.
- Contribution Rule → INSTANTIATED: PRs/triage/funding accepted on stated terms; "report ≠ assignment."
- Transparency Record → INSTANTIATED: the public board doubles as audit.
- Funding Pool → INSTANTIATED (optional-but-named).
No component left `missing` → stop-eligible.

**7. lift (L2) — gateway_mediation components (over-lift guard applied).** Intake Channel, Validation Rule (issue templates/repro requirements), Access Policy, Forwarding/Routing, Rate Limit (declined — over-lift: a hard rate limit distorts the legitimate-newcomer sub-structure; the triage + bot handles it naturally), Quarantine/Rejection Path (templated close), Service-Level Commitment (the *asymmetric* SLA: security fast, features best-effort/none), Escalation Path. Declined: heavy authentication broker (not the boundary's problem).

**8. lift (L2) — contribution_visibility_design + incentive_compatible_rule_design.** Effort Recognition → INSTANTIATED (credit, maintainer status as a path). Free-Ride Monitor → HOMOLOG (the board surfaces who only takes). Anti-gaming / Participation Constraint → INSTANTIATED (templates resist low-effort dumps without blocking real bugs). Safety Boundary → INSTANTIATED (recognition not shaming).

**9. evaluate-fit (gate).** Walked anti-signatures:
- commons_governance "problem is underproduction not overuse/neglect" → NOT tripped: this is genuinely neglect/overload of a finite sink, not provision of the code. KEEP.
- commons_governance "central authority can just allocate" → not tripped (no authority, no money lever). KEEP.
- gateway_mediation "only volume → rate limiting" → partially tripped → so gateway is used for *structure/translation/routing*, volume handled by triage, not promoted to pure rate-limit. KEEP, scoped.
- price_signal_design / congestion_pricing → TRIPPED by the "cannot force payment" constraint + pipeline-collapse failure risk → DROP as gate; retain only as voluntary sponsor-priority. 
- load_balancing → tripped (no equivalent handlers) → DROP.

**10. reconcile.** Concrete model says "stop answering" relieves load; meta-model warns the *renewal* invariant (security) must never lapse and the *legitimacy/pipeline* invariant forbids blanket withdrawal. Resolution consistent with both: withdraw *undifferentiated free support* while hard-guaranteeing the security-renewal channel and keeping a low-friction contributor on-ramp. Views diverged → meta-model not decorative.

STOP: coverage map complete, gates walked, no missing component. Recommendation ready.

===RECOMMENDATION_BEGIN===
Treat the maintainers' time and attention as the project's scarce, exhaustible resource — not the code. The code is free and copies itself; what is being drained is a tiny pool of human capacity that thousands draw on while contributing nothing. The whole redesign follows from defending that pool while keeping the door open to people who help.

Start by writing down, publicly, what the project is and is not. Publish a short compact: this is volunteer-maintained software offered as-is; using it for free does not purchase support; bug reports are information, not work orders; no response is a normal and acceptable outcome. This single document converts a vague sense of obligation — the thing that lets angry users guilt the maintainers — into a stated, legitimate expectation. Enforcement later reads as fair rather than arbitrary because the rule was declared in advance.

Then build one controlled front door and close the side doors. All incoming requests go through structured issue templates that require a reproducible case, version details, and what was already tried; reports that don't meet the bar get an automated, polite pointer back to the template rather than a maintainer's time. Route at intake: security reports take a dedicated private channel that is always answered fast; ordinary bugs and questions land in a queue that is triaged but explicitly best-effort; feature demands are tagged "wanted — needs a contributor" and are not promised to anyone. The asymmetry is the point — fast and guaranteed for the one thing that must never lapse (security), best-effort or silent for everything else. Resist the urge to throttle by hard rate-limit; aggressive caps punish genuine newcomers and choke the contributor pipeline. Let triage and templates do the filtering instead.

Make neglect impossible to hide and contribution worth doing. Keep a public health board showing the backlog, what's triaged, and what's waiting on a contributor. This both signals honestly to users why their issue is sitting (lowering the entitled-escalation reflex) and shows companies that the thing they depend on is under-resourced. Pair it with real recognition: a documented path from "good triager / repeat contributor" to commit access and eventually co-maintainer, with visible credit. The aim is to convert the most capable free-riders into replenishers, because the only durable fix for a depleted commons is more stewards, not a more heroic few.

Open a funding pool, but never depend on it as a gate. Add sponsorship and offer paid-priority support and paid feature work as a voluntary option — companies that want guaranteed turnaround can buy it, which both funds stewardship and prices the externality for those willing to pay. Crucially, payment is an offered exception, not a requirement: the project must stay healthy even if no one pays, so free users are simply held to best-effort, never billed or blocked.

Handle abuse with graduated, soft sanctions. Entitled or aggressive users get a templated, calm close referencing the compact and code of conduct; repeat offenders get locked threads, not public shaming. Newcomers asking honestly are met generously — the failure mode to avoid is gatekeeping so harsh the community dies.

Finally, set a recurring, lightweight review — quarterly — comparing incoming load against actual maintainer capacity, and adjust scope: archive or deprecate modules no one will help maintain, narrow the stated support surface, and hand off or sunset what can't be sustainably carried. Scope reduction is a legitimate move, not a failure.

The operating rule that holds it all together: **the maintainers owe the project a working, secure release and a fair, open path for others to help — they do not owe any individual user unpaid labor on demand; protect the security-renewal channel absolutely, give everything else only the attention that remains after capacity is matched to load, and keep converting the people who take into the people who maintain.**
===RECOMMENDATION_END===

COST: ~7 operations (6 MCP tool calls + 1 file write), ~24,000 tokens.
