Envy-free Matchings with Lower Quotas

While every instance of the Hospitals/Residents problem admits a stable matching, the problem with lower quotas (HR-LQ) has instances with no stable matching. For such an instance, we expect the existence of an envy-free matching, which is a relaxation of a stable matching preserving a kind of fairness property. In this paper, we investigate the existence of an envy-free matching in several settings, in which hospitals have lower quotas and not all doctor-hospital pairs are acceptable. We first show that, for an HR-LQ instance, we can efficiently decide the existence of an envy-free matching. Then, we consider envy-freeness in the Classified Stable Matching model due to Huang (2010), i.e., each hospital has lower and upper quotas on subsets of doctors. We show that, for this model, deciding the existence of an envy-free matching is NP-hard in general, but solvable in polynomial time if quotas are paramodular.


Introduction
Since the seminal work of Gale and Shapley [11], the Hospitals/Residents problem (HR, for short), or the College Admission problem, has been studied extensively [14,21,30]. They proposed an algorithm that finds a stable matching in linear time for every instance. In this problem, each hospital has an upper quota for the number of doctors assigned to it. In some applications, each hospital also has a lower quota for the number of doctors it receives. That is, we want to consider the Hospitals/Residents problem with lower quotas (HR-LQ, for short). Unfortunately, for HR-LQ, we cannot ensure the existence of a stable matching. However, it is easy to decide whether there is a stable matching or not for a given HR-LQ instance, because the number of doctors assigned to each hospital is identical for any stable matching (according to the well-known Rural Hospitals Theorem [12,27,28,29]).
When a given HR-LQ instance has no stable matching, one natural approach is to weaken stability concept while preserving some kind of fairness. Envy-freeness [33] (also called fairness in the school choice literature [8,13]) of matchings is a relaxation of stability obtained by giving up efficiency. Similarly to stability, envy-freeness forbids the existence of a doctor who has justified envy toward some other doctor, but it tolerates the existence of a doctor who claims a hospital's vacant seat. The importance of envy-freeness and its variants has recently been recognized in the context of constrained matching [8,13,19,20,4], and structural properties of envy-free matchings were investigated in [33].
Envy-free matchings naturally arise when we find a matching in the following ad hoc manner. For an HR-LQ instance, suppose that we find a stable matching while disregarding the lower quotas, and that the obtained matching does not meet the lower quotas. Let us reduce the upper quotas of hospitals that receive many doctors, and again find a stable matching while disregarding the lower quotas, and repeat. If we find a stable matching that meets the lower quotas after repeating such adjustments, then the obtained matching is an envy-free matching of the original instance (see Proposition 2.4).
Because an envy-free matching is a relaxation of a stable matching, it is more likely to exist. Indeed, if all doctor-hospital pairs are acceptable and the sum of lower quotas of all hospitals does not exceed the number of doctors, then we can ensure the existence of an envyfree matching. (This follows from the results of Fragiadakis et al. [8]). However, if not all pairs are acceptable, then even an envy-free matching may fail to exist. Moreover, deciding the existence of an envy-free matching is not so simple because envy-free matchings have different sizes unlike stable matchings.
Our Contribution In this paper, we study envy-free matchings for the HR-LQ model and its generalizations. In our models, not all doctor-hospital pairs are acceptable (i.e., preference lists are incomplete).
We first investigate envy-free matchings in the setting of HR-LQ. We provide the following characterization of the existence of an envy-free matching. Let I be a given HR-LQ instance and let I be an HR instance obtained from I by removing lower quotas and replacing upper quotas with the original lower quotas. We prove that I has an envy-free matching if and only if every hospital is full in a stable matching of I (Theorem 2.6). Combined with the rural hospitals theorem, this characterization yields an efficient algorithm to decide the existence of an envy-free matching for an HR-LQ instance. That is, we can decide it by finding a stable matching for the HR instance whose upper quotas are the original lower quotas, and checking whether all hospitals are full or not.
Next, we move to a generalized model, in which each hospital imposes an upper and a lower quota on each subset of doctors. That is, we consider an envy-free matching version of Huang's Classified Stable Matching [18] (CSM, for short). (See "Related Works" below for results on stable matchings of CSM and its generalizations.) In Huang's original model, each hospital has a family of sets of doctors, called classes, and each class has an upper and a lower quota. We formulate this setting by letting each hospital have a pair of set functions defined on the set of acceptable doctors. These two functions respectively represent upper quotas and lower quotas. For this model, we show that it is NP-hard to decide the existence of an envy-free matching, even if the number of non-trivial quotas is linear (Theorem 2.6). The proof is by a reduction from the NP-complete problem (3,B2)-SAT [2].
Then, we provide a tractable special case of CSM. We show that if the pair of lower and upper quota functions of each hospital is paramodular [9] (see Section 4 for the definition), then we can decide the existence of an envy-free matching in polynomial time. This means that the problem is tractable if the family of acceptable doctor sets forms a generalized matroid for each hospital. A generalized matroid [31] (also called an M -convex family [24]) is a family of subsets satisfying a certain axiom called the exchange axiom. It is known that a paramodular function pair defines a generalized matroid and vice versa. Because constraints defined on a laminar (or hierarchical) family yield a generalized matroid, our tractable special case includes a case in which each hospital defines quotas on a laminar family of doctors.
Related Works Recently, the study of matching models with lower quotas has developed substantially [1,7,13,15,16,18,21,22]. The Hospitals/Residents problem with lower quotas (HR-LQ) was first studied by Hamada et al. [15,16], who considered the minimization of the number of blocking pairs subject to upper and lower quotas. They showed the NP-hardness of the problem, gave an inapproximability result, and provided an exponential-time exact algorithm. Motivated by the matching scheme used in Hungary's higher education sector, Biró et al. [3] considered a version of HR-LQ in which hospitals (i.e., colleges) are allowed to be closed, i.e., each hospital is assigned enough doctors or no doctor. They showed the NP-completeness to decide the existence of a stable matching.
The Classified Stable Matching problem (CSM), proposed by Huang [18], is a generalization of HR-LQ without hospital closures. In this model, each hospital (or institute, in Huang's terminology) has a classification of doctors (i.e., applicants) based on their expertise and gives an upper and lower quota for each class. Huang showed that it is NP-complete in general to decide the existence of a stable matching, and proved that it is solvable in polynomial time if classes form a laminar family. For this tractable special case, Fleiner and Kamiyama [7] gave a concise explanation in terms of matroids, and their framework is generalized by Yokoi [34] to a framework with generalized matroids.
To cope with the nonexistence of a stable matching in constrained matching models (not only models with lower quotas but also with other types of constraints such as regional constraints), several relaxations of stability have been proposed. See, e.g., Kamada and Kojima [19,20], Fragiadakis et al. [8], and Goto et al. [13]. Envy-freeness is one of them that places emphasis on fairness rather than efficiency. Fragiadakis et al. [8] provided a strategy-proof algorithm that always finds an envy-free matching (or fair matching, in their terminology) of HR-LQ under the assumption that all doctor-hospital pairs are acceptable. The outcome of their mechanism also fulfills a second-best efficiency (i.e., nonwastefulness) property. Their framework is generalized in Goto et al. [13] so that regional quotas can be handled.
Here we compare our models with the above models. Unlike the models of Goto et al. [13] and Kamada and Kojima [19,20], our models cannot handle regional quotas. Instead, our CSM model (in Sections 3 and 4) allows each hospital to have quotas on classes of doctors, which are not dealt with in their models. The setting of a tractable special case of CSM described in Section 4 is equivalent to a many-to-one case of Yokoi's model [34], which studied stable matchings. Neither [34] nor the study in this paper relies on the results of the other, while both of them utilize the matroid framework of Fleiner [5,6].
The remainder of this paper is organized as follows. Section 2 investigates envy-free matchings in the Hospitals/Residents problem with lower quotas (HR-LQ). In Section 3, we define an envy-free matching in the classified stable matching (CSM) model, and show the NP-hardness of its existence test. As its tractable special case, Section 4 presents results on CSM with paramodular quota functions. Proofs for the theorems and corollary in Section 4 are provided in the Appendix.

Envy-freeness in HR with lower quotas
In this section, we investigate envy-free matchings in the Hospitals/Residents problem with lower quotas (HR-LQ).
There are two disjoint sets D and H, which represent doctors and hospitals, respectively. A set of acceptable doctor-hospital pairs is denoted by E ⊆ D × H. For each doctor d ∈ D, its acceptable hospital set is denoted by and d has a preference list (strict order) d on A(d). Similarly, for each hospital h ∈ H, and h has a preference h on A(h). Each hospital h has a lower quota l h ∈ Z and an upper quota We call a tuple I = (D, H, E, DH , {(l h , u h )} h∈H ) an HR-LQ instance, where DH is an abbreviated notation for the union of { d } d∈D and { h } h∈H . In particular, if l h = 0 for all h ∈ H, we call it an HR instance. An arbitrary subset M of E is called an assignment. For any assignment M , we denote If |M (d)| = 1, the notation M (d) is also used to refer its single element.
For an HR instance, it is known that the algorithm of Gale and Shapley [11] always finds a stable matching. The set of stable matchings has the following property. Proposition 2.2 ("Rural Hospitals" Theorem [12,27,29]). For a given HR instance, any two stable matchings M, M satisfy |M As mentioned in the Introduction, if hospitals have lower quotas, then we cannot guarantee the existence of a stable matching anymore. By Proposition 2.2, however, we can easily check the existence by finding a stable matching while disregarding lower quotas, and checking whether the obtained matching meets lower quotas.
For an instance that has no stable matching, we want to obtain some matching that still has a kind of fairness. As a relaxation of the concept of stability, envy-freeness (also called fairness) of matchings has been proposed [8,33].
Note that, if d has justified envy toward d with M (d) = h, then it means that (d, h) is a blocking pair. Thus, stability implies envy-freeness. The envy-freeness of a matching is also regarded as the stability with reduced upper quotas, as follows.
Proof. The "if" part is clear because feasibility in I implies that in I, and stability implies envy-freeness. For the "only if" part, suppose that M is envy-free in I and set u h := |M (h)| for each h ∈ H. Then, M is feasible for I and all hospitals are full, and hence there is no doctor who claims a hospital's vacant seat. Because M is envy-free, it is stable in I . By Proposition 2.4, to check whether we can obtain a stable matching by reducing upper quotas, it suffices to check for the existence of an envy-free matching.
Under the assumption that all doctor-hospital pairs are acceptable and the sum of lower quotas does not exceed the number of doctors, Fragiadakis et al. [8] provided a strategy-proof mechanism that always finds an envy-free matching. As a corollary, we have the following.
and |D| ≥ h∈H l h , there exists an envy-free matching.
However, if not all pairs are acceptable, then even an envy-free matching may not exist. Figure 1 shows } is the unique feasible matching, but it is not envy-free because d 2 has justified envy toward d 1 . Hence, there is no envy-free matching.

Doctor's preferences
Hospitals' preferences Note that an envy-free matching does exist if there is no lower quota, because empty matching is clearly envy-free. Therefore, the existence test of an envy-free matching is non-trivial when incomplete lists and lower quotas are introduced simultaneously. Here we provide a characterization. Proof. For the "if" part, let M be a stable matching of I satisfying |M (h)| = l h for all h ∈ H. Then, M is feasible for I and no doctor has justified envy because M has no blocking pair. Thus, M is an envy-free matching of I.
For the "only if" part, assume that I has an envy-free matching M . Suppose, to the contrary, a stable matching Consider a bipartite graph G = (D, H; N ∪ N ), i.e., a graph between doctors and hospitals with edge set N ∪ N = M M . Let G * be a connected component of G including h * , and denote by D * and H * the sets of doctors and hospitals in G * , respectively. Because there is no edge connecting G * and the outside, In this way, we obtain is a blocking pair in I , which contradicts the stability of M .
Theorem 2.6 ensures that the following algorithm decides the existence of an envy-free matching of an HR-LQ instance Step2. return M if |M (h)| = l h for all h ∈ H, and otherwise "there is no envy-free matching." Since the Gale-Shapley algorithm finds a stable matching of an HR instance in O(|E|) time, we obtain the following theorem.

Envy-freeness in Classified Stable Matching
In this section, we consider the envy-freeness in a model in which each hospital has lower and upper quotas on subsets of doctors. This can be regarded as an envy-free matching version of the Classified Stable Matching, proposed by Huang [18]. Similarly to Section 2, we have doctors D, hospitals H, acceptable pairs E ⊆ D × H, and preferences DH .
The only difference from HR-LQ is that, in the current model, each hospital h ∈ H has a pair of functions p h , q h : 2 A(h) → Z, instead of a pair of numbers l h , u h . These functions define a lower and an upper quota for each subset of acceptable doctors. Throughout this paper, we assume that for any hospital h, the functions p h and q h satisfy We call such a tuple (D, H, E, DH , {(p h , q h )} h∈H ) a CSM instance. For each h ∈ H, the family of acceptable subsets of doctors is denoted by For any h ∈ H, we say that B ⊆ A(h) has a non-trivial lower (resp., upper) constraint if p h (B) > 0 (resp., q h (B) < |B|). We denote the family of constrained subsets by Then, we see that F(p h , q h ) is represented as As in the case of HR-LQ, an envy-free matching can be regarded as a stable matching with reduced upper quotas as follows. For any h ∈ H and k ∈ Z with 0 ≤ k ≤ q(A(h)), a function q h : 2 A(h) → Z is called a k-truncation of q h if q (A(h)) = k and q (B) = q(B) for every B A(h). Also, we simply say that q h is a truncation of q h if there is such k ∈ Z.  Hence, (d, h) is a blocking pair in I , a contradiction.
We provide a hardness result for deciding the existence of an envy-free matching. Here, we assume that evaluation oracles of set functions p h and q h are available for each hospital h. Theorem 3.4. It is NP-hard to decide whether a CSM instance I = (D, H, E, DH , {(p h , q h )} h∈H ) has an envy-free matching or not. The problem is NP-complete even if the size of C(p h , q h ) is at most 4 for each h ∈ H.
Proof. We use reduction from the NP-complete problem (3, B2)-SAT [2], which is a restriction of SAT such that each clause contains exactly three literals and each variable occurs exactly twice as a positive literal and exactly twice as a negative literal. Let ϕ = c 1 ∧ c 2 ∧ · · · ∧ c m be an instance of (3, B2)-SAT with Boolean variables v 1 , v 2 , . . . , v n . Then, each clause c j is a disjunction of three literals, (e.g., c j = v 1 ∨ ¬v 2 ∨ ¬v 3 ) and each of literals v i and ¬v i appears in exactly two clauses. For each variable v i , denote by j * (i, 1), j * (i, 2) the indices of two clauses that contain v i . Similarly, denote by j * (i, −1), j * (i, −2) the indices of clauses that contain ¬v i .
We now define a CSM instance corresponding to ϕ. We have a variable-hospital h i for each variable v i , and a clause-hospital h j for each clause c j . For each variable v i , we have four doctors The set E is defined as the set of all pairs (d i,t , h) such that h ∈ A(d i,t ). Then, for each variable-hospital h i and clause-hospital h j , we have Note that d i,t ∈ A(h j ) implies v i ∈ c j or ¬v i ∈ c j . Also, each of v i ∈ c j and ¬v i ∈ c j implies d i,t ∈ A(h j ) for some unique t ∈ {1, 2, −1, −2}. Therefore, |A(h j )| = 3 for each clause-hospital h j . For each variable-hospital h i , define p h i and q h i so that Then, we see that We define preference lists of hospitals arbitrarily. Note that |C(p h , q h )| ≤ 4 for every hospital. We show that this CSM instance has an envy-free matching if and only if ϕ = c 1 ∧ c 2 ∧ · · · ∧ c m is satisfiable.
The "only if " part: Suppose that there is an envy-free matching M . Then, for every variable-hospital i . This Boolean assignment satisfies every clause c j of ϕ as follows. Because M (h j ) ∈ F(p h j , q h j ), we have |M (h j )| ≥ 1. Hence, some d i,t with j * (i, t) = j is assigned to h j . Then, d i,t ∈ M (h i ). There are two cases: (i) t ∈ {1, 2}, (ii) t ∈ {−1, −2}. In the case (i), d i,t ∈ M (h i ) implies M (h i ) = D + i , and hence v i is set to TRUE. Also, t ∈ {1, 2} and j * (i, t) = j imply v i ∈ c j . Hence, clause c j is satisfied. Similarly, in the case (ii), we see that v i is set to FALSE and we have ¬v j ∈ c j . Hence, clause c j is satisfied.
The "if " part: Suppose that there is a Boolean assignment satisfying ϕ. Define an assignment M so that We can observe that |M (d)| = 1 for every doctor d, and M (h i ) ∈ F(p h i , q h i ) for every variablehospital h i . Also, because all clauses are satisfied, the above definition implies M (h j ) ∈ F(p h j , q h j ) for every clause-hospital h j . Then, M is feasible. We now show the envy-freeness of M . Suppose, to the contrary, d i,t has justified envy toward d . Because we have |M (d i,t )| = 1,

Envy-freeness in CSM with Paramodular Quotas
In Section 3, we showed that it is NP-hard in general to decide whether a CSM instance has an envy-free matching or not. This section shows that the problem is solvable in polynomial time if the pair of quota functions is paramodular for each hospital. The proofs of the theorems and corollary in this section are provided in the Appendix. We first introduce the notion of paramodularity [9]. Let A be a finite set and let p, q : 2 A → Z. The pair (p, q) is paramodular (or, called a strong pair [10]) if Example 4.1 (Laminar Constraints). Let L ⊆ 2 A be a laminar (or hierarchical) classification (i.e., any X, Y ⊆ L satisfy X ⊆ Y or X ⊇ Y or X ∩ Y = ∅). Letp,q : L → Z be functions that define a lower and an upper quota for each class. Denote the acceptable set family by J (L,p,q) := { B ⊆ A | ∀X ∈ L :p(X) ≤ |B ∩ X| ≤q(X) }. If J (L,p,q) is nonempty, then J (L,p,q) = F(p, q) for some paramodular pair (p, q).
For a set function p : 2 A → Z, its complement p : 2 A → Z is defined by Recall that a CSM instance is represented as a tuple (D, H, E, DH , {(p h , q h )} h∈H ), where it is assumed that 0 ≤ p h (B) ≤ q h (B) ≤ |B| for every h ∈ H and B ⊆ A(h). Here is the main theorem of this section. We denote by 0 a set function that is identically zero. Also, if (b) holds, then M is an envy-free matching of I.
As will be shown in Appendix A.4, the existence of a stable matching of I and the equivalence between (b) and (c) follows from Fleiner's results on the matroid framework [5,6]. The most difficult part is showing the equivalence between conditions (a) and (b). To show that (a) implies (b), we construct a stable matching M of I from an envy-free matching M of I. This construction is achieved by using the fixed-point method of Fleiner [6]. The paramodularity of each (p h , q h ) (or a generalized matroid structure of each F(p h , q h )) is essential to show the existence of a fixed-point satisfying a required condition (see Lemma A. 16  Step2. If |M (h)| = p h (A(h)) for every h ∈ H, then return M . Otherwise, return "there is no envy-free matching." As will be shown in the Appendix, Step 1 (i.e., finding a stable matching of I ) can be done efficiently by the generalized Gale-Shapley algorithm studied in [5,6]. The detailed description of the algorithm is as follows. Here, for each h ∈ H, N ⊆ E, and d ∈ N (h), we use the notation return "there is no envy-free matching"; end In the Appendix, we show that the assignment M obtained in the algorithm is indeed a stable matching of I . Also, it will be shown that N D is monotone decreasing and N H is monotone increasing in the algorithm, and hence the "while loop" is iterated at most 2|E| times. Thus, we obtain the following theorem. (See Appendix A.5 for the details.) is paramodular, the algorithm EF-Paramodular-CSM decides whether I has an envy-free matching or not in O(|E| 2 ) time, provided that evaluation oracles of {p h } h∈H are available.
As is shown in Examples 4.1 and 4.2, when the family of acceptable doctor sets of each hospital h ∈ H is defined by a laminar constraint J h := J (L h ,p h ,q h ) or by a staffing constraint The following corollary states that, in such a case, we can decide the existence of an envy-free matching of I = (D, H, E, DH , {(p h , q h )} h∈H ) even if evaluation oracles of {p h } h∈H are not provided.
has an envy-free matching or not in time polynomial in |E| (resp., in |E| and max h∈H |S h |).
Proof. Since we have Theorem 4.4, it completes the proof to show that we can simulate an evaluation oracle of each p h in time polynomial in |E| (resp., in |E| and |S h |).
which is a weight minimization problem on a generalized matroid. As explained in [34,Appendix C], when J h is given in the form above, this can be reduced to the minimum cost circulation problem, which can be solved in strongly polynomial time [32,26]. (See [34] for the details of the reduction.) Thus, the proof is completed. Then, (p h , q h ) is paramodular and

Acknowledgments
I wish to thank the anonymous reviewers whose comments have benefited the paper greatly. This work was supported by JST CREST, Grant Number JPMJCR14D2, Japan.

A Proofs for Section 4
Here, we provide proofs of Theorems 4.3, 4.4. This section consists of five subsections, and the first three introduce notions and previous results needed for the proofs. More precisely, Sections A.1, A.2, and A.3 respectively introduce notions of generalized matroids, choice functions induced from matroids, and the lattice fixed-point method for stable matchings. Using them, the last two subsections provide the proofs of our results.

A.1 Generalized Matroids
For a finite set A and a family J ⊆ 2 A , the pair (A, J ) is called a generalized matroid [31] (g-matroid, for short) if J is nonempty and satisfies the following property called simultaneous (or symmetric) exchange property 2 [25].
(B -EXC) For any X, Y ∈ J and e ∈ X \ Y , we have The family J of a g-matroid (A, J ) is also called an M -convex family [23,24]. (There are various characterizations for g-matroids. See, e.g., Tardos [31], Frank [9] and Murota [23] for more information on g-matroid and its extensions.) For set functions p, q : 2 A → Z, the pair (p, q) is called g-matroidal if it is paramodular and satisfies 0 ≤ p(B) ≤ q(B) ≤ |B| for every B ⊆ A. As its name indicates, there is a one-to-one correspondence between generalized matroids and g-matroidal pairs (see, e.g., [9,10]). A pair (A, I) is called a matroid if it is a g-matroid and ∅ ∈ I. In terms of quota functions, a pair (A, I) is a matroid if there is a matroid rank function r such that I = F(0, r). Indeed, we can check that the pair (0, r) is g-matroidal for any matroid rank function r.

A.2 Choice Functions Induced from Matroid Rank Functions
Let r : 2 A → Z be a matroid rank function on A and be a linear order on A. Let M = (A, r, ) and define a function C M : 2 A → 2 A as follows. Let n = |A| and, for i = 1, 2, . . . , n, let e i be the i-th best element of A with respect to , i.e. e 1 e 2 · · · e n . Let A 0 := ∅ and A i := {e 1 , e 2 , . . . , e i } for each i = 1, 2, . . . , n. Then, define C M by We call C M the choice function induced from M = (A, r, ). Note that, for any e i ∈ A and X ⊆ A, the value of r(A i ∩ X) − r(A i−1 ∩ X) is 1 or 0 by the monotonicity and submodularity of r. Also, e i ∈ A \ X implies r(A i ∩ X) − r(A i−1 ∩ X) = 0. Then, for any X ⊆ A, we have Such a choice function was introduced by Fleiner [5,6] and used in several works [3,7,34]. In these works, matroids are usually given by independent set families rather than matroid rank functions. The following propositions (Propositions A.2-A.6) are known facts, but we provide alternative proofs in terms of matroid rank functions.
Proposition A.2. For any X ⊆ A, we have C M (X) ∈ F(0, r).

Proof. It suffices to show |C
Thus, e i ∈ B, r( The monotonicity of r implies r(X ∩ B) ≤ r(B), and the proof is completed.
Proof. Suppose that e i ∈ X \ C M (X) for some i. This implies r(A i ∩ X) − r(A i−1 ∩ X) = 0 by (2). By the diminishing returns property and X ⊆ Y , the value of r(A i ∩ Y ) − r(A i−1 ∩ Y ) is also 0, and hence e i ∈ Y \ C M (Y ) by (2).
Proof. This immediately follows from Proposition A.3 and the monotonicity of r.
Proposition A.6. For any X ⊆ A, the set C M (X) dominates every element in X \ C M (X). That is, the following two hold.
• For every e ∈ X \ C M (X), we have C M (X) + e ∈ F(0, r).
• For every e ∈ X \ C M (X) and e ∈ C M (X), if e e , then C M (X) + e − e ∈ F(0, r).
Proof. Let i be the index such that e = e i , i.e., e is the i-th best element for . By Proposition A.3, we have |C M (X)∩A i | = r(A i ∩X). With C M (X) ⊆ X and e i ∈ X \C M (X), this implies , and hence C M (X) + e i ∈ F(0, r).
For the second claim, let i be the index such that e = e i . Then, e e implies i < i , and hence e i ∈ A i . This yields |(

A.3 Fixed-point Method for Stable Matchings on Matroids
Here we introduce the lattice fixed-point framework for stable matchings on matroids, studied by Fleiner [5,6] (see also Hatfield and Milgrom [17]).
Let I = (D, H, E, DH , {0, r h } h∈H ) be a CSM instance such that r h is a matroid rank function for each h ∈ H. That is, each hospital has a matroidal upper quota function and no lower quota.
From (D, E, { d } d∈D ), we define doctors' joint choice function C D : 2 E → 2 E . For any set N ⊆ E, let C D (N ) be the set of each doctor's best choices among N , i.e., and a function F I : Recall that C h is substitutable for each h ∈ H, This implies the following property of F I . Proposition A.8 (Fleiner [5,6]). For I = (D, H, E, DH , {0, r h } h∈H ) such that each r h is a matroid rank function, the function F I is monotone with respect to ≥. That is, The monotonicity of F I implies the existence of a stable matching as follows.
Proposition A.9 (Fleiner [5,6]). Let I = (D, H, E, DH , {0, r h } h∈H ) be an instance such that each r h is a matroid rank function. One can find a stable matching in O(|E| · EO DH ) time, where EO DH is a time to compute C D (N ) and C H (N ) for any N ⊆ E.
Proof. Since (E, ∅) is the maximum in 2 E × 2 E with respect to ≥, we have (E, ∅) ≥ F I (E, ∅). As F I is monotone by Proposition A.8, then Since 2 E × 2 E is a finite lattice whose longest chain is of length 2|E|, we have What is left is to show that the condition (a) is also equivalent. For this purpose, we prepare the following three claims. The first and second claims are basic facts of paramodular functions [9]. The third one utilizes the exchange property of g-matroids (M -convex families).

A.5 Proof of Theorem 4.4
We first show that the "while loop" of the algorithm EF-Paramodular-CSM computes a stable matching of I = (D, H, E, DH , {(0, p h )} h∈H ). By the proof of Proposition A.9, it suffices to show that, each iteration updates (N D , N H ) to F I (N D , N H ). That is, we show that the subsets R D and R H defined as Here, each C h : 2 A(h) → 2 A(h) is a choice function induced from (A(h), p h , h ). By definitions of C h and p h , for any N ⊆ E, we have By the monotonicity of p h (shown in the proof of Claim A.11), for any d ∈ N (h), we have We now analyze the time complexity. As shown in the proof of Proposition A.9, a stable matching is found by computing F I at most 2|E| times, i.e., the "while loop" is iterated O(|E|) times. Also, we see that each iteration can be done in O(|E|) time. Checking the condition |M (h)| = p h (A(h)) (h ∈ H) is done in O(|E|) time. Thus, the algorithm runs in O(|E| 2 ) time.