# Control-policy working — FC4 (condition C)

Acting as the CONTROL POLICY. Verbs run, in order, with the required pre-finalization discipline: (i) compose a referentially-consistent model, (ii) lift a domain-stripped skeleton with witnesses, (iii) run a SCOPED COVERAGE CHECK on the single operative pattern the chosen approach relies on, (iv) evaluate-fit the chosen approach's anti-signatures.

---

## Step 1 — match (retrieve)

Queried the catalog with the domain-stripped meta-model ("an uninformed party cannot observe counterparties' hidden type; the worse type is the most eager to participate; design terms so agents reveal their own type through their choices") via `search_prime` and a 5-facet `search_by_facets`.

Candidates (with source-prime overlap recorded):
- **screening** — distinctive (0.83 pct), `return_unit: exact`. Top hit on the "offer differentiated options so each type self-selects" facet (0.69). The *response* prime.
- **adverse_selection** — mid, twin. Fused-rank #1 across facets. The *problem* prime ("worst-for-the-uninformed types self-select in").
- **signaling** — informed-side counterpart (not what either approach uses; designer-side here).
- **incentive_compatibility** — the binding constraint a menu must satisfy.

Archetype neighborhood: `hidden_type_screening`, `adverse_selection_filtering` (both family `asymmetric_information_design`, source_primes = {screening, adverse_selection, set_and_membership}). Retrieval is clean and on-target; no neighborhood-crowding miss. Post satisfied (≥1 candidate, overlap recorded).

## Step 2 — salience-rank

- **adverse_selection** — *load_bearing*. It names the failure both approaches must beat: hidden type + uniform terms ⇒ the eager-to-apply high-risk pool self-selects in. Removing it changes nothing about the recommendation only if a uniform bar could separate types — and it structurally cannot.
- **screening** — *load_bearing*. It is the only catalog structure that produces a *separating* outcome (type revealed by choice) without direct verification — i.e. the only one that can satisfy BOTH success criteria at once.
- **incentive_compatibility** — *load_bearing*. The menu only works if each type's own payoff-maximizing choice is the one that reveals it (the single-crossing / cheap-for-low-costly-for-high condition). This is exactly the lever Approach A's "requirement cheap for low-risk, costly for high-risk" pulls.
- **signaling** — *context*. Informed-party-initiated; neither proposed approach is sender-side. Pruned.

## Step 3 — prune

Operative subset retained (4 → 3 load-bearing): {adverse_selection, screening, incentive_compatibility}. Cut: signaling (wrong initiating side); set_and_membership (downstream "who's admitted" bookkeeping, not the operative separation mechanism).

## Step 4 — compose (referential integrity)

Typed relational model:

- **nodes:** `designer` (admitting program, uninformed) | `agentLow` (low-risk type) | `agentHigh` (high-risk type, most eager) | `terms` (the offered admission terms) | `pool` (admitted set) | `outcome` (pool quality + low-risk inclusion)
- **edges:**
  - `agentHigh —hidden_type→ designer` *(prime_annotation: adverse_selection — type not directly observable)*
  - `agentHigh —most_eager_under_uniform_terms→ terms` *(adverse_selection — selection skews to worst type)*
  - `designer —sets→ terms`
  - `terms —induces_choice→ agentLow` and `terms —induces_choice→ agentHigh` *(screening — menu)*
  - `agent.choice —reveals→ type` *(screening + incentive_compatibility — choice is type-revealing iff IC holds)*
  - `pool —determines→ outcome`
- Referential integrity: every edge references declared nodes ✓; every operative prime (adverse_selection, screening, incentive_compatibility) appears as an annotation ✓.

## Step 5 — lift L1 (situation → meta-model, witness-checked)

Domain-stripped skeleton:
- **roles:** UNINFORMED-CHOOSER; AGENTS-WITH-HIDDEN-BINARY-TYPE (good/bad); the bad type has the strongest pull toward the offer.
- **relations:** chooser sets the terms of participation → agents self-select → the chooser's payoff depends on the resulting participant mix.
- **invariants:** (I1) type is not directly verifiable; (I2) under one uniform term, willingness-to-participate is monotone in "badness" ⇒ uniform terms cannot separate; (I3) separation is possible only if some offered dimension has a single-crossing cost (cheap for good, costly for bad).

Witness check (every role/relation has a model witness; no domain terms left):
- UNINFORMED-CHOOSER ⇽ `designer` ✓
- HIDDEN-TYPE AGENTS ⇽ `agentLow`/`agentHigh` ✓
- bad-type-most-eager ⇽ `agentHigh —most_eager_under_uniform_terms→` ✓
- terms→self-select→mix ⇽ `terms —induces_choice→` … `pool —determines→ outcome` ✓
- I1/I2/I3 ⇽ adverse_selection signature comp. 1–2 + screening "type-differentiated preferences / single-crossing" ✓

L1 post satisfied.

## Step 6 — transport + map (the two approaches onto the skeleton)

- **Approach A (self-sorting menu)** maps directly onto **screening**: offer ≥2 terms with a single-crossing cost (an option only worthwhile to low-risk, or a requirement cheap-for-low / costly-for-high). Choice reveals type ⇒ *separating* outcome. Structural recognition, no forced mapping.
- **Approach B (one uniform stricter bar)** maps onto the **uniform-terms / pooling** branch of adverse_selection (signature comp. 2–3). A single bar applied equally to all cannot make any agent's choice depend on type ⇒ it CANNOT separate. It can only (a) admit everyone who clears the bar — including every high-risk applicant who clears it — or (b) raise the bar until the pool shrinks, which turns away low-risk applicants indiscriminately because the bar is type-blind. Either way one success criterion is violated.

## Step 7 — SCOPED COVERAGE CHECK (lift L2) on the operative pattern of the CHOSEN approach

Chosen approach: **A**. Operative pattern: **screening / self-sorting menu** (archetype `hidden_type_screening`, canonical formula: hidden attribute + pre-commitment decision + designed elicitation channel + validated routing rule). Coverage-check each component against the Approach-A design (none left `missing`; over-build ⇒ `correctly_declined`):

```
coverage_map:
  pattern: screening_self_sorting_menu (hidden_type_screening / adverse_selection_filtering)
  components:
    - name: Uninformed designer
      status: instantiated
      witness: the admitting program, cannot observe risk type directly
    - name: Informed agents with heterogeneous hidden type
      status: instantiated
      witness: low-risk vs high-risk applicants; type known to self, hidden to program
    - name: Menu of >=2 options (differentiated terms)
      status: instantiated
      witness: Approach A's two-option offer (e.g. an option only worthwhile to low-risk + a baseline)
    - name: Type-differentiated / single-crossing preferences
      status: instantiated
      witness: the requirement is cheap for low-risk, costly for high-risk — the load-bearing single-crossing
    - name: Incentive-compatibility constraint
      status: instantiated
      witness: each type's payoff-max choice is its designated option; high-risk does not prefer to mimic low-risk's option
    - name: Individual-rationality / participation constraint
      status: homolog
      witness: each type still prefers its designated option to not applying — keeps low-risk from being driven out (the "not needlessly turned away" criterion)
    - name: Revelation / routing rule
      status: instantiated
      witness: chosen option -> inferred type -> admit/decline-or-different-terms
    - name: Validation & base-rate check (does the screen predict type?)
      status: instantiated
      witness: must confirm the single-crossing actually binds (low-risk takes the cheap-for-them option, high-risk does not); otherwise the menu pools
    - name: Anti-gaming / signal-integrity (single-crossing must hold so high-risk can't cheaply mimic)
      status: instantiated
      witness: the costly requirement is genuinely costlier for high-risk, so mimicry is not payoff-improving
    - name: Fairness / accessibility & appeal review
      status: homolog
      witness: discharged at the requirement-design level — the screening cost must track risk-type, not wealth/polish (the over-lift guard, below, keeps this from being mistaken for the operative core)
    - name: Downward distortion of low-type option (information-rent control)
      status: correctly_declined
      decline_reason: rent-minimization is a profit-maximization refinement; the stated objective is pool quality + low-risk inclusion, not extracting rents, so deliberately worsening the low-risk option would over-build and harm criterion 2
    - name: Continuous-type bunching / ironing
      status: correctly_declined
      decline_reason: the situation is binary (low/high risk); continuous-type machinery would distort a sub-structure that the two-option menu handles naturally
    - name: Direct verification / monitoring add-on
      status: correctly_declined
      decline_reason: the premise is that type cannot be directly observed; bolting on verification answers a different problem and over-builds
```

No component `missing` ⇒ the Approach-A design is allowed to STOP. (Contrast: Approach B leaves *type-differentiated/single-crossing preferences* and *revelation/routing* permanently `missing` — a uniform bar has no menu and cannot route on revealed type — so a B design could never close this coverage check. This is the decisive asymmetry.)

## Step 8 — evaluate-fit (gate) — Approach A's anti-signatures

Walked the `hidden_type_screening` / `adverse_selection_filtering` anti-signatures against the situation:

- "Relevant attributes already known and verified" — **not tripped** (type is explicitly unobservable).
- "Decision cost trivial / errors easily reversed" — **not tripped** (admission is a committing decision; undisclosed high-risk admits impose real downstream cost).
- "Screen cannot be validated against outcomes" — **not tripped, conditional**: the menu must be designed so the single-crossing genuinely binds; flagged as the one real design risk, mitigated by the validation component above.
- "Primary problem is risky behavior AFTER protection (moral hazard), not hidden type before acceptance" — **not tripped** (problem is pre-admission hidden type, the worst type most eager to apply).
- "Pool intentionally accepts heterogeneous risk for solidarity/universality" — **not tripped** (the stated objective is to keep the pool from being dominated by undisclosed high-risk).
- "Filter measures wealth/polish/paperwork rather than the target attribute" — **watch-item, not disqualifying**: avoided by requiring the menu's costly dimension to be costlier specifically for high-RISK, not merely for the less-resourced.

Gate verdict: **keep Approach A.** No disqualifying anti-signature trips.

## Step 9 — reconcile (concrete model vs meta-model)

- Concrete reading: a self-sorting menu gets low-risk applicants to take an option only they find worthwhile and screens high-risk out (or onto stricter terms) without ever verifying type.
- Meta reading (I2): under any single uniform term, willingness-to-participate is monotone in badness, so a uniform bar (B) cannot separate — it must either admit qualifying high-risk or reject low-risk wholesale.
- The two views agree and jointly indict B on BOTH success criteria simultaneously; they are not decorative. No collapse.

STOP — decision is sound.

===DECISION_BEGIN===
DECISIVE_FACTOR: A single uniform bar applied equally to everyone cannot tell the two groups apart, so it must either let in the high-risk applicants who clear it or be set so high it turns away low-risk applicants too — whereas terms designed so the two groups make different choices separate them without having to observe risk directly.
CHOICE: A
JUSTIFICATION: Because risk cannot be observed directly and the riskiest applicants are the keenest to apply, a single uniform standard cannot distinguish the two groups; it either admits every high-risk applicant who clears it or, if set high enough to deter them, also rejects many low-risk applicants — failing both goals at once. Offering a choice of terms where one option is worthwhile only to low-risk applicants (or carries a requirement that is cheap for low-risk and costly for high-risk) makes each group reveal itself through the option it picks. That keeps the admitted group from being dominated by undisclosed high-risk applicants while letting low-risk applicants in on terms they will accept. The design must ensure the distinguishing requirement genuinely tracks risk rather than wealth or effort, and that low-risk applicants still prefer to participate.
===DECISION_END===
