# FC4 — Control Policy C (coverage-enforced)

## Working

### Verb: match (retrieve)
Anchored the situation to the catalog. The situation: an uninformed party (the
program) faces participants whose decision-relevant attribute (risk type) is
**hidden and known privately to the applicant**, entry is **voluntary**, and the
**worst types are the most eager** to enter. Two proposed levers: a self-sorting
menu (A) vs. a single uniform stricter bar (B).

- `search_prime` (meta-model query) → top hit **adverse_selection** (0.74), with
  family {screening, signaling, price_discrimination}. Also `screening`
  (distinctive, 0.83 pct).
- `search_by_facets` (5 facets) → fused prime **adverse_selection** rank 1;
  fused archetypes **adverse_selection_filtering** (rank 1) and
  **hidden_type_screening** (rank ~3).
- `get_prime adverse_selection` — confirms the canonical structure: hidden type +
  uniform terms + self-selection → pool degradation; named mitigations are
  signaling, **screening (menu that induces self-separation)**, mandated pooling,
  provision.
- `get_archetype adverse_selection_filtering` — the operative pattern: the
  distinctive object is **pool composition**, not the individual decision.
- `get_archetype hidden_type_screening` — neighbor; its own anti-signature says
  "the primary problem is maintaining pool composition under self-selection" →
  *that is adverse_selection_filtering*. So the pool-composition framing is the
  correct parent here.

Post: ≥1 candidate with recorded source-prime overlap — met (adverse_selection,
screening, set_and_membership all source `adverse_selection_filtering`).

### Verb: salience-rank
- **adverse_selection** — *load_bearing*: removing the "worst types self-select
  in under uniform terms" fact changes the recommendation entirely. This is the
  whole problem.
- **screening** — *load_bearing*: it is the family of remedies; a self-sorting
  menu IS a screening device.
- **set_and_membership** (pool boundary) — *context→load_bearing*: the success
  criterion is stated over the *admitted pool*, so the unit of evaluation is the
  pool, not the applicant.
- signaling, price_discrimination, threshold — *context*: relevant vocabulary,
  not decisive.

### Verb: prune
Operative subset retained: {adverse_selection, screening, set_and_membership}.
Cut: signaling (informed-side mitigation, not what we are choosing), modal_reasoning /
herding / optionality (retrieval neighborhood crowding, not on-structure).

### Verb: compose (referential integrity check)
Nodes:
- N1 Program (kind: uninformed decider)
- N2 Applicant-low-risk (kind: hidden type, desirable)
- N3 Applicant-high-risk (kind: hidden type, undesirable, most eager)
- N4 Terms (kind: contract/offer)
- N5 AdmittedPool (kind: set)
- N6 PublicReport (kind: external constraint)

Edges (every edge references declared nodes):
- E1 N1 →(offers) N4
- E2 N4 →(is_accepted_by, conditional on type) N2, N3   [self-selection edge; prime_annotation: adverse_selection]
- E3 {N2,N3 admitted} →(compose) N5   [prime_annotation: set_and_membership]
- E4 N1 →(wants to discriminate terms by) hidden-type-on-N2/N3   [prime_annotation: screening]
- E5 N6 →(pressures toward uniform) N4   [the "cleaner to defend" note]

Prime annotations present: adverse_selection (E2), screening (E4),
set_and_membership (E3). Referential integrity: every operative prime appears as
an annotation; every edge references declared nodes. PASS.

### Verb: lift — L1 (lift the situation → meta_model)
Domain-stripped skeleton (witnesses in `model`):
- **Roles:** uninformed-decider (←N1); two hidden types, one costly-to-decider
  and over-eager (←N3), one desirable (←N2); an offer/terms object (←N4); a
  shared pool whose composition is the success unit (←N5); an external
  defensibility pressure toward uniformity (←N6).
- **Relations:** willingness-to-accept(terms) varies by hidden type (←E2);
  pool-composition := f(who self-selects in) (←E3).
- **Invariants:** decider cannot directly observe type; entry is voluntary; the
  most-costly type is the most eager; success is judged on the *resulting pool*,
  not per-applicant.
- No domain terms remain. Every role/relation has a witness. PASS.

### Verb: lift — L2 — SCOPED COVERAGE CHECK on the single operative pattern
The chosen approach must rely on ONE operative pattern. Both approaches sit
under the same parent structure (adverse_selection / pool-composition control),
so I coverage-check the operative pattern = **the pool-composition control
pattern (adverse_selection_filtering)**, asking which approach's design leaves no
component `missing`. Components from the archetype, scoped to the load-bearing few:

| Component | Status under chosen design (A: self-sorting menu) | Witness / reason |
|---|---|---|
| Pool / Offer Boundary | instantiated | N5 AdmittedPool is the named success unit |
| Hidden-Type Selection Model | instantiated | high-risk most eager, can't observe type (E2) |
| Pool Viability Target | instantiated | "not dominated by undisclosed high-risk" = viability bound |
| Entry Filter / Screen | **instantiated by A; MISSING under B** | A's menu = a screen that induces self-separation; a uniform bar applies one cutoff and does NOT separate by hidden type |
| Segmentation / Routing Rule | instantiated by A; correctly_declined for B | A offers type-distinguishing options; B has no routing |
| Term Adjustment Rule | instantiated by A | A's "cheap-for-low/costly-for-high" requirement is term differentiation by type |
| Incentive-Compatibility / anti-gaming | homolog | A's option is by construction worthwhile only to low-risk (self-selection is incentive-compatible) |
| Fairness / Access + Appeal | correctly_declined (over-lift guard) | high-stakes-rights apparatus would over-build this admissions toy; the substructure (don't needlessly turn away low-risk) is handled by A's design itself |
| Composition Monitor / Recalibration | correctly_declined (over-lift guard) | a runtime feedback loop over-builds a one-shot design choice |

Key coverage finding: under **Approach B (uniform stricter bar)** the
**Entry Filter / Screen** component is **MISSING** — a single cutoff applied to
everyone does not separate hidden types; it only raises the bar uniformly, which
**rejects the over-eager-but-distinguishable low-risk applicants together with
high-risk ones** (criterion-2 violation) while still admitting any high-risk
applicant who clears the higher bar (criterion-1 risk). A design may stop only
when no component is `missing`. **Approach A** closes the gap: the menu IS the
screening/separation device, so no component is missing.

### Verb: evaluate-fit (gate) — anti-signatures of the chosen pattern (Approach A / adverse_selection_filtering)
Walk each disqualifier:
1. "Costly behavior emerges only AFTER protection, not selected-in at entry
   (moral hazard)." — **Not tripped.** The risk here is a *characteristic known
   pre-entry* and selection happens *at entry*; this is selection, not hidden
   post-entry action.
2. "System already observes the relevant attributes accurately; only ranking
   scarce slots." — **Not tripped.** Premise is explicit: type cannot be directly
   observed.
3. "Just verify a credential / collect a form; no pool-composition risk." —
   **Not tripped.** Pool-composition degradation (high-risk domination) is the
   stated failure mode.
4. "Pool intentionally accepts heterogeneous risk for solidarity/universality and
   does NOT want risk-based segmentation." — **Not tripped.** Success criteria
   explicitly want to *keep high-risk from dominating*; this is not a solidarity
   pool. (This is the one anti-signature that, if tripped, would have pushed
   toward the uniform bar B; it is not tripped.)
5. "Problem is contamination/circulation, not hidden-type entry." — **Not
   tripped.**

Gate verdict on Approach A: **keep** (no anti-signature tripped).
Gate verdict on Approach B: the uniform-bar reading leaves the screening
component missing AND does not satisfy criterion-2 (needlessly turns away
distinguishable low-risk) → **drop** as the recommendation.

### Verb: reconcile (model vs meta_model)
- Concrete-model reading: the committee's "cleaner public report" pulls toward B
  (E5). On the concrete object this is a real, non-trivial pull — uniform looks
  defensible.
- Meta-model reading: defensibility is a property of the *external report*, not
  of the *pool-composition invariant*. The success criteria are defined over the
  pool, and only a type-separating device satisfies both halves (don't admit a
  high-risk-dominated pool AND don't needlessly reject low-risk). The two views
  genuinely disagree (so the meta-model is not decorative): the model surfaces a
  legitimate defensibility cost of A; the meta-model shows that cost does not
  touch the binding success constraint. Preferring the reading consistent with
  both: choose A, and note the report-defensibility as a manageable communication
  cost, not a reason to fail the criteria.

### STOP
No coverage component is `missing` under A; anti-signatures clear; referential
integrity and L1 witness checks pass; reconcile resolved. Decision is sound.

===DECISION_BEGIN===
DECISIVE_FACTOR: Because the harmful trait is hidden and the worst-risk applicants are the most eager, only differentiated terms that make each type sort itself can protect the admitted pool without rejecting distinguishable low-risk applicants.
CHOICE: A
JUSTIFICATION: Since you cannot observe who is high-risk and the high-risk are the keenest to apply, a single stricter bar would either still let high-risk applicants through or, by raising the cutoff for everyone, turn away low-risk applicants who would have been fine. Offering options that are attractive or cheap only to low-risk applicants makes the two groups reveal themselves through their own choices, so the admitted pool is not quietly dominated by high-risk applicants and capable low-risk applicants are not needlessly excluded. The committee's preference for a uniform rule is easier to write up but does not actually meet both goals.
===DECISION_END===
