# Control-policy working — open-source maintainer burnout

## STATE.problem
- statement: A widely-used OSS library, 3 volunteer maintainers, thousands of free-riding corporate beneficiaries; demand (bugs, features, security qs, angry escalations) vastly exceeds capacity; 2 maintainers gone dark, 1 near quitting. The remaining maintainer controls *how work is accepted, who gets attention, what is expected of users, how contribution is recognized* — but cannot force payment or labor.
- success: load sustainably matched to capacity within 6 months AND no lapse in security response.
- failure: last maintainer burns out (lapse) OR gatekeeping so heavy the user/contributor pipeline collapses.

## history (verb → why)

1. **match (search_by_facets)** — oblique, multi-structure problem (a shared resource exhausted by free consumers; demand > fixed capacity; gift-as-entitlement; private-cost/public-benefit; goodwill-dependence; ration attention without killing inflow; convert beneficiaries to contributors). Read per-facet lists. Resource-exhaustion facet → **commons_governance** top (0.72), with `tragedy_of_the_commons / free_riding / public_goods / scarcity` as primes. Throughput facet → `queue_discipline_design`, `service_rate_matching`, `load_leveling`. Recognition facet → **contribution_visibility_design** top (0.70).
2. **match (search_prime, meta-model query)** — domain-stripped skeleton query returned `tragedy_of_the_commons` (distinctive, 0.70) as top hit with the commons family; confirms primary anchor; `load_balancing`/`system_slack`/`resource_management` confirm the capacity sub-structure.
3. **get_archetype commons_governance / contribution_visibility_design / queue_discipline_design** — pulled full component lists + anti-signatures.
4. **salience-rank / prune** — operative set below.
5. **compose** — typed relational model (referential integrity checked).
6. **lift L1** — domain-stripped skeleton; every role witnessed.
7. **lift L2** — COVERAGE MAP against commons_governance (primary) + secondary patterns.
8. **evaluate-fit** — anti-signature gate on all three.

## operative_primes (salience-ranked)
- `tragedy_of_the_commons` — load_bearing (the core: maintainer attention/capacity is a finite commons depleted by individually-rational free requests). type mixed-framed.
- `free_riding` — load_bearing (corporate beneficiaries consume, contribute nothing; the cost asymmetry to break).
- `public_goods` — context (library itself is non-rival; explains why exclusion is blunt — but the *scarce* object is maintainer attention, a congestible commons, so commons_governance not public_goods_provision).
- `resource_management` / `scarcity` — load_bearing (finite maintainer hours; the quantity being governed).
- `reciprocity` / `incentive_compatibility` — load_bearing (convert beneficiaries to contributors/funders; align voice with contribution).
- `accountability` / `observability` (via contribution_visibility) — context (recognition + funding-visibility).
- `procedural_fairness` (via queue_discipline) — context (security-triage legitimacy, not heavy gatekeeping).

Pruned: `load_balancing`, `deadlock`, `system_slack` (these describe the symptom, add no mechanism beyond capacity/quota already covered); `property_rights` (no exclusion mechanism available — declined).

## model (typed; referential integrity)
- nodes: M(maintainer,actor) · U_free(free beneficiary,actor) · U_corp(corporate dependent,actor) · C(contributor,actor) · RES(maintainer-attention,resource) · LIB(library,public-good) · SEC(security channel,channel) · INTAKE(request channel,channel) · FUND(funding pool,resource) · RULES(charter,institution)
- edges: U_free→draws_from→RES [toc, free_riding]; U_corp→draws_from→RES [free_riding]; M→replenishes→LIB [public_goods]; RULES→bounds→RES [resource_management, scarcity]; RULES→sets_access→INTAKE [reciprocity, incentive_compatibility]; SEC→prioritized_by→RULES [procedural_fairness]; C→replenishes→RES [reciprocity]; FUND→sustains→M [incentive_compatibility]; RULES→recognizes→C [accountability, observability].
- every edge connects declared nodes; every operative prime appears as an annotation. ✔

## meta_model (lifted, domain-stripped; L1 witnesses)
- roles: a small fixed-capacity *replenisher set*; a large unbounded *consumer set* that bears none of the upkeep cost; a *congestible shared capacity* (not the artifact, the upkeep effort); an *access boundary*; a *contribution/reciprocity channel*; a *critical sub-stream that must never starve*. (witnesses: M, U_free/U_corp, RES, RULES, C/FUND, SEC.) No domain terms remain. ✔

## COVERAGE MAP — primary pattern: commons_governance (13 components)
| Component | Status | Witness / reason |
|---|---|---|
| Shared Resource Boundary | instantiated | Name the protected scarce thing as *maintainer attention/time*, not the codebase. Published statement: "this project is maintained by volunteers at N hours/week." |
| Access Rule | instantiated | Tiered intake: anyone may use/fork freely; only *self-contained, reproducible, properly-formatted* reports/PRs enter the work queue; demands phrased as entitlements are closed with a canned policy link. |
| Use Quota / Use Limit | instantiated | Issue templates + auto-triage caps: stale/incomplete issues auto-close after a window; feature requests parked in a backlog the maintainer is explicitly not obligated to clear. |
| Monitoring Signal | instantiated | Public dashboard: open security items, response SLA, maintainer hours, funding level — makes resource health visible. |
| Sanction Rule | homolog | Cannot punish free users, but the functional equivalent is *graduated withdrawal of attention*: rude/entitled/incomplete tickets get a one-line policy reply then lock; repeat abusers are blocked. Sanction = denial of the scarce good, proportionate. |
| Replenishment Rule | instantiated | Two replenishment paths: (a) paid time via funding pool/sponsorship + paid-support SLA for companies; (b) expanded maintainer/triager bench via contributor ladder. |
| Legitimacy Basis | instantiated | A short published charter (what users can expect, what is owed, why) — consent-by-transparency; the rules are stated up-front, not improvised. |
| Dispute Resolution Path | instantiated | A code-of-conduct + escalation/appeal contact, and a public "why this was closed" rationale convention. |
| Adaptation Cadence | instantiated | Quarterly review of SLA, funding, backlog, maintainer load; rules revised against measured resource condition. |
| Contribution Rule | instantiated | Clear ladder: good first issues → reviewer → committer; companies wanting priority must fund or contribute fixes; "you may ask for X if you give Y." |
| Funding Pool | instantiated | Sponsorship tiers + paid commercial-support/priority-SLA contracts; a fiscal host so money can flow without forcing anyone to pay (those who want priority opt in). |
| Exception Process | instantiated | Security overrides every queue rule (see queue pattern); named emergency path. |
| Transparency Record | instantiated | Public funding ledger, response-time metrics, contributor credits — same dashboard as Monitoring. |

No component missing. ✔

## COVERAGE MAP — secondary: queue_discipline_design (used for the security-never-starves invariant)
- Queue Membership Boundary / Service Order Rule / Prioritization Criteria — instantiated: security > regressions in supported versions > funded work > everything else (best-effort).
- Starvation Prevention Rule — instantiated: security is a protected lane with a hard SLA; cannot be displaced.
- Override & Exception Path / Audit & Appeal — instantiated: security override + closure-rationale convention.
- Eligibility/Readiness Test — instantiated: the "reproducible & complete" intake filter doubles as readiness.
- Service-Level Target — instantiated: published security SLA; explicit *no* SLA on features.
- Fairness Policy / Tie-Break / Lane Partitioning / Service-Time Estimate / Class Partition — homolog/declined: a single solo maintainer needs a coarse 4-lane rule, not fine scheduling; forcing full queue machinery would distort (over-lift guard). Class partition is folded into the funded-vs-free access tier.

## COVERAGE MAP — secondary: contribution_visibility_design (recognition / anti-burnout / pipeline)
- Contribution Unit / Effort Recognition / Ownership Record — instantiated: public credits, "maintainers" file, recognition of triage/review/docs as first-class work, sponsor wall.
- Overload Monitor / Review & Rebalancing Cadence — instantiated: the maintainer-hours dashboard + quarterly review = overload monitor that triggers recruiting more help.
- Visibility Safety Boundary / Context Note — correctly_declined: surveillance-of-individuals framing does not apply to a volunteer OSS context; forcing it would distort the open, low-friction recognition that grows the pipeline.

## evaluate-fit (anti-signature gate)
- commons_governance: "fully private resource" — no (shared). "underproduction of a non-rival benefit, use public_goods_provision" — partially true (the library is non-rival) BUT the binding-scarce object here is congestible maintainer attention failing by *neglect/overload*, which the archetype's own "Maintenance Commons Governance" variant explicitly claims (it names OSS maintainer burnout). KEEP. "central authority can just allocate" — no, no authority, no coercion. "one-time two-party dispute" — no, recurring many-party. → verdict KEEP, none disqualifying.
- queue_discipline_design: anti-sig "the problem is excess inflow before entry, not order among waiting items — use rate limiting / admission" — PARTIALLY TRIPPED: the dominant lever IS inflow control (intake filter, access rules), so queue discipline is used only narrowly for the security-lane ordering, with admission/quota carried by commons_governance. Used in bounded scope → not disqualified, but de-emphasized (over-lift guard honored).
- contribution_visibility_design: anti-sig "would primarily surveil/shame rather than recognize" — declined the surveillance components for exactly this reason. KEEP only the recognition half.
- Failure-mode guard against the problem's own failure criterion (gatekeeping collapses pipeline): access rules gate *the work queue*, never *use/fork/read*; least-coercive-rule decision-rule applied throughout. ✔

COST: ~9 operations (1 facet search, 1 meta-model prime search, 3 archetype fetches, compose/lift/gate reasoning), ~16k tokens.

===RECOMMENDATION_BEGIN===
Treat the maintainers' time and attention — not the code — as the scarce thing being protected, and make every rule defend it. Start by publishing a short, plain charter at the top of the project that states what the project is, that it is run by volunteers with limited hours, what users can reasonably expect, and what they are expected to give back. This single document converts vague entitlement into stated, accepted expectations and gives every later refusal a legitimate, impersonal basis.

Redesign how work enters. Reading, using, and forking the library stays completely free and open — never gate that, or the community dies. But the maintainer's *work queue* becomes selective. Require issues and pull requests to come through templates that demand a minimal reproducible case, version details, and a clear ask; anything incomplete is auto-labeled and closed after a grace window with a friendly note on how to reopen it properly. This filter, not manual triage, absorbs most of the flood. Feature requests go into an explicitly best-effort backlog the maintainer is under no obligation to clear. Demands written as if to a paid support desk get a single canned reply pointing to the charter, then the thread is locked; repeat abusers are blocked. The scarce good is attention, so the proportionate response to abuse is simply to withhold it.

Carve out one protected lane that can never be crowded out: security. Publish a security-response commitment with a real timeframe, route it through a dedicated channel, and let it override every other rule. Everything else is ordered behind it as: confirmed regressions in supported versions, then funded or contributed work, then best-effort. Publish exactly which versions are supported so the surface to defend shrinks. This is the mechanism that guarantees no lapse in security even when general responsiveness is deliberately low.

Open real replenishment paths so the project does not run on one exhausted person's goodwill. Set up sponsorship through a fiscal host and create paid commercial tiers: companies that want guaranteed response times or priority fixes buy a support contract. No one is forced to pay, but those who need certainty opt in, and that money funds maintainer hours or hires a part-time triager. Pair money with people: define a visible contributor ladder — good first issues lead to reviewer status, then commit rights — and actively promote reliable contributors so the maintainer bench grows beyond three. Make the deal explicit and reciprocal: you may ask for priority if you fund it or fix it.

Make contribution and project health visible. Keep a public dashboard showing open security items and response times, current funding, and maintainer load, plus generous credit for everyone who triages, reviews, writes docs, or files clean reports — not just code authors. Recognition is cheap fuel for the contributor pipeline and a defense against burnout; a sponsor wall and contributor credits turn passive beneficiaries into invested participants. Review these numbers quarterly and adjust the rules, the supported-version list, and the support pricing against what the load actually looks like; recruit more help whenever maintainer hours trend past the stated budget.

The final operating rule: protect maintainer attention as a finite shared resource — keep use of the software free and open, but make entry to the maintainers' work queue earned through clean, complete, funded, or contributed effort; guarantee only security with a hard commitment and let everything else be honestly best-effort; and convert dependence into money, contributors, and recognition rather than spending it as goodwill. If load ever exceeds the published budget, tighten intake and raise the contribution bar before touching the security lane or asking the remaining maintainer for more.
===RECOMMENDATION_END===
