Envy-Free Matchings with Lower Quotas

While every instance of the Hospitals/Residents problem admits a stable matching, the problem with lower quotas (HR-LQ) has instances with no stable matching. For such an instance, we expect the existence of an envy-free matching, which is a relaxation of a stable matching preserving a kind of fairness property. In this paper, we investigate the existence of an envy-free matching in several settings, in which hospitals have lower quotas and not all doctor–hospital pairs are acceptable. We first provide an algorithm that decides whether a given HR-LQ instance has an envy-free matching or not. Then, we consider envy-freeness in the Classified Stable Matching model due to Huang (in: Procedings of 21st annual ACM-SIAM symposium on discrete algorithms (SODA2010), SIAM, Philadelphia, pp 1235–1253, 2010), i.e., each hospital has lower and upper quotas on subsets of doctors. We show that, for this model, deciding the existence of an envy-free matching is NP-hard in general, but solvable in polynomial time if quotas are paramodular.


Introduction
Since the seminal work of Gale and Shapley [13], the Hospitals/Residents problem (HR, for short), or the College Admission problem, has been studied extensively [17,26,35]. They proposed an algorithm that finds a stable matching in linear time for every instance. In this problem, each hospital has an upper quota for the number of doctors assigned to it. In some applications, each hospital also has a lower quota for the number of doctors it receives. That is, we want to consider the Hospitals/Residents problem with lower quotas (HR-LQ, for short). Unfortunately, for HR-LQ, we cannot ensure the existence of a stable matching. However, it is easy to decide whether there is a stable matching or not for a given HR-LQ instance, because the number of doctors assigned to each hospital is identical for any stable matching (according to the wellknown Rural Hospitals Theorem [14,[32][33][34]).
When a given HR-LQ instance has no stable matching, one natural approach is to weaken stability concept while preserving some kind of fairness. Envy-freeness [38] (also called fairness in the school choice literature [8,16]) of matchings is a relaxation of stability obtained by giving up efficiency. Similarly to stability, envyfreeness forbids the existence of a doctor who has justified envy toward some other doctor, but it tolerates the existence of a doctor who claims a hospital's vacant seat. The importance of envy-freeness and its variants has recently been recognized in the context of constrained matching [4,8,16,24,25], and structural properties of envy-free matchings were investigated in [38].
Envy-free matchings naturally arise when we find a matching in the following ad hoc manner. For an HR-LQ instance, suppose that we find a stable matching while disregarding the lower quotas, and that the obtained matching does not meet the lower quotas. Let us reduce the upper quotas of hospitals that receive many doctors, and again find a stable matching while disregarding the lower quotas, and repeat. If we find a stable matching that meets the lower quotas after repeating such adjustments, then the obtained matching is an envy-free matching of the original instance (see Proposition 2.4).
Because an envy-free matching is a relaxation of a stable matching, it is more likely to exist. Indeed, if all doctor-hospital pairs are acceptable and the sum of lower quotas of all hospitals does not exceed the number of doctors, then we can ensure the existence of an envy-free matching (this follows from the results of Fragiadakis et al. [8]). However, if not all pairs are acceptable, then even an envy-free matching may fail to exist. Moreover, deciding the existence of an envy-free matching is not so simple because envy-free matchings have different sizes unlike stable matchings.

Our Contribution
In this paper, we study envy-free matchings for the HR-LQ model and its generalizations. In our models, not all doctor-hospital pairs are acceptable (i.e., preference lists are incomplete).
We first investigate envy-free matchings in the setting of HR-LQ. We provide the following characterization of the existence of an envy-free matching. Let I be a given HR-LQ instance and let I be an HR instance obtained from I by removing lower quotas and replacing upper quotas with the original lower quotas. We prove that I has an envy-free matching if and only if every hospital is full in a stable matching of I (Theorem 2.6). Combined with the rural hospitals theorem, this characterization yields an efficient algorithm to decide the existence of an envy-free matching for an HR-LQ instance. That is, we can decide it by finding a stable matching for the HR instance whose upper quotas are the original lower quotas, and checking whether all hospitals are full or not.
Next, we move to a generalized model, in which each hospital imposes an upper and a lower quota on each subset of doctors. That is, we consider an envy-free matching version of Huang's Classified Stable Matching [23] (CSM, for short). (See "Related Works" below for results on stable matchings of CSM and its generalizations.) In Huang's original model, each hospital has a family of sets of doctors, called classes, and each class has an upper and a lower quota. We formulate this setting by letting each hospital have a pair of set functions defined on the set of acceptable doctors. These two functions respectively represent upper quotas and lower quotas. For this model, we show that it is NP-hard to decide the existence of an envy-free matching, even if the number of non-trivial quotas is linear (Theorem 2.6). The proof is by a reduction from the NP-complete problem (3,B2)-SAT [2].
Then, we provide a tractable special case of CSM. We show that if the pair of lower and upper quota functions of each hospital is paramodular [10] (see Sect. 4 for the definition), then we can decide the existence of an envy-free matching in polynomial time. Our proof utilizes the lattice fixed-point method for stable matchings [6,22] and the generalized matroid structure of the family of acceptable doctor sets of each hospital. A generalized matroid [36] (also called an M -convex family [29]) is a family of subsets satisfying a certain axiom called the exchange axiom. It is known that a paramodular function pair defines a generalized matroid and vice versa. Because constraints defined on a laminar (or hierarchical) family yield a generalized matroid, our tractable special case includes a case in which each hospital defines quotas on a laminar family of doctors.

Related Works
Recently, the study of matching models with lower quotas has developed substantially [1,7,16,18,19,23,26,27]. The Hospitals/Residents problem with lower quotas (HR-LQ) was first studied by Hamada et al. [18,19], who considered the minimization of the number of blocking pairs subject to upper and lower quotas. They showed the NP-hardness of the problem, gave an inapproximability result, and provided an exponential-time exact algorithm. Motivated by the matching scheme used in Hungary's higher education sector, Biró et al. [3] considered a version of HR-LQ in which hospitals (i.e., colleges) are allowed to be closed, i.e., each hospital is assigned enough doctors or no doctor. They showed the NP-completeness to decide the existence of a stable matching.
The Classified Stable Matching problem (CSM), proposed by Huang [23], is a generalization of HR-LQ without hospital closures. In this model, each hospital (or institute, in Huang's terminology) has a classification of doctors (i.e., applicants) based on their expertise and gives an upper and lower quota for each class. Huang showed that it is NP-complete in general to decide the existence of a stable matching, and proved that it is solvable in polynomial time if classes form a laminar family. For this tractable special case, Fleiner and Kamiyama [7] gave a concise explanation in terms of matroids, and their framework is generalized by Yokoi [39] to a framework with generalized matroids.
To cope with the nonexistence of a stable matching in constrained matching models (not only models with lower quotas but also with other types of constraints such as regional constraints), several relaxations of stability have been proposed. See, e.g., Kamada and Kojima [24,25], Fragiadakis et al. [8], and Goto et al. [16]. Envy-freeness is one of them that places emphasis on fairness rather than efficiency. Fragiadakis et al. [8] provided a strategy-proof algorithm that always finds an envy-free matching (or fair matching, in their terminology) of HR-LQ under the assumption that all doctor-hospital pairs are acceptable. The outcome of their mechanism also fulfills a secondbest efficiency (i.e., nonwastefulness) property. Their framework is generalized in Goto et al. [16] so that regional quotas can be handled.
Here we compare our models with the above models. Unlike the models of Goto et al. [16] and Kamada and Kojima [24,25], our models cannot handle regional quotas. Instead, our CSM model (in Sects. 3 and 4) allows each hospital to have quotas on classes of doctors, which are not dealt with in their models. The setting of a tractable special case of CSM described in Sect. 4 is equivalent to a many-to-one case of Yokoi's model [39], which studied stable matchings. Neither [39] nor the study in this paper relies on the results of the other, while both of them utilize the matroid framework of Fleiner [5,6].
The remainder of this paper is organized as follows. Sect. 2 investigates envy-free matchings in the Hospitals/Residents problem with lower quotas (HR-LQ). In Sect. 3, we define an envy-free matching in the classified stable matching (CSM) model, and show the NP-hardness of its existence test. As its tractable special case, Sect. 4 presents results on CSM with paramodular quota functions. Proofs for the theorems and corollary in Sect. 4 are provided in Sect. 5.

Envy-Freeness in HR with Lower Quotas
In this section, we investigate envy-free matchings in the Hospitals/Residents problem with lower quotas (HR-LQ).
There are two disjoint sets D and H , which represent doctors and hospitals, respectively. A set of acceptable doctor-hospital pairs is denoted by E ⊆ D × H . For each doctor d ∈ D, its acceptable hospital set is denoted by and d has a preference list (strict order) d on A(d). Similarly, for each hospital h ∈ H , and h has a preference h on A(h). Each hospital h has a lower quota l h ∈ Z and an upper quota We call a tuple I = (D, H , E, D H , {(l h , u h )} h∈H ) an HR-LQ instance, where D H is an abbreviated notation for the union of { d } d∈D and { h } h∈H . In particular, if l h = 0 for all h ∈ H , we call it an HR instance. An arbitrary subset M of E is called an assignment. For any assignment M, we denote If |M(d)| = 1, the notation M(d) is also used to refer its single element.
For an HR instance, it is known that the algorithm of Gale and Shapley [13] always finds a stable matching. The set of stable matchings has the following property. As mentioned in the Introduction, if hospitals have lower quotas, then we cannot guarantee the existence of a stable matching anymore. By Proposition 2.2, however, we can easily check the existence by finding a stable matching while disregarding lower quotas, and checking whether the obtained matching meets lower quotas.
For an instance that has no stable matching, we want to obtain some matching that still has a kind of fairness. As a relaxation of the concept of stability, envy-freeness (also called fairness) of matchings has been proposed [8,38]. Note that, if d has justified envy toward d with M(d) = h, then it means that (d, h) is a blocking pair. Thus, stability implies envy-freeness. The envy-freeness of a matching is also regarded as the stability with reduced upper quotas, as follows.
Proof The "if" part is clear because feasibility in I implies that in I , and stability implies envy-freeness. For the "only if" part, suppose that M is envy-free in I and set u h := |M(h)| for each h ∈ H . Then, M is feasible for I and all hospitals are full, and hence there is no doctor who claims a hospital's vacant seat. Because M is envy-free, it is stable in I . By Proposition 2.4, to check whether we can obtain a stable matching by reducing upper quotas, it suffices to check for the existence of an envy-free matching.
Under the assumption that all doctor-hospital pairs are acceptable and the sum of lower quotas does not exceed the number of doctors, Fragiadakis et al. [8] provided a strategy-proof mechanism that always finds an envy-free matching. As a corollary, we have the following. However, if not all pairs are acceptable, then even an envy-free matching may not exist. Figure 1 shows an instance with } is the unique feasible matching, but it is not envy-free because d 2 has justified envy toward d 1 . Hence, there is no envy-free matching.
Note that an envy-free matching does exist if there is no lower quota, because the empty matching is clearly envy-free. Therefore, the existence test of an envyfree matching is non-trivial when incomplete lists and lower quotas are introduced simultaneously. Here we provide a characterization. For the "only if" part, assume that I has an envy-free matching M. Suppose, to the contrary, a stable matching Consider a bipartite graph G = (D, H ; N ∪ N ), i.e., a graph between doctors and hospitals with edge set N ∪ N = M M . Let G * be a connected component of G including h * , and denote by D * and H * the sets of doctors and hospitals in G * , respectively. Because there is no edge connecting G * and the outside, In this way, we obtain is a blocking pair in I , which contradicts the stability of M .
Theorem 2.6 ensures that the following algorithm decides the existence of an envy-free matching of an HR-

Envy-Freeness in Classified Stable Matching
In this section, we consider the envy-freeness in a model in which each hospital has lower and upper quotas on subsets of doctors. This can be regarded as an envyfree matching version of the Classified Stable Matching, proposed by Huang [23]. Similarly to Sect. 2, we have doctors D, hospitals H , acceptable pairs E ⊆ D × H , and preferences D H .
The only difference from HR-LQ is that, in the current model, each hospital h ∈ H has a pair of functions p h , q h : 2 A(h) → Z, instead of a pair of numbers l h , u h . These functions define a lower and an upper quota for each subset of acceptable doctors. Throughout this paper, we assume that for any hospital h, the functions p h and q h satisfy We call such a tuple (D, For each h ∈ H , the family of acceptable subsets of doctors is denoted by For any h ∈ H , we say that B ⊆ A(h) has a non-trivial lower (resp., upper) constraint if p h (B) > 0 (resp., q h (B) < |B|). We denote the family of constrained subsets by Then, we see that F( p h , q h ) is represented as A matching M is envy-free if no doctor has justified envy.
As in the case of HR-LQ, an envy-free matching can be regarded as a stable matching with reduced upper quotas as follows. For any h ∈ H and k ∈ Z with 0 ≤ k ≤ q(A(h)), a function q h :

an assignment M is an envy-free matching if and only if M is a stable matching of I
Proof To show the "only if" part, let M be an envy-free matching of I .
We provide a hardness result for deciding the existence of an envy-free matching.
Here, we assume that evaluation oracles of set functions p h and q h are available for each hospital h.
Proof We use reduction from the NP-complete problem (3, B2)-SAT [2], which is a restriction of SAT such that each clause contains exactly three literals and each variable occurs exactly twice as a positive literal and exactly twice as a negative literal. Let ϕ = c 1 ∧ c 2 ∧ · · · ∧ c m be an instance of (3, B2)-SAT with Boolean variables v 1 , v 2 , . . . , v n . Then, each clause c j is a disjunction of three literals, (e.g., c j = v 1 ∨ ¬v 2 ∨ ¬v 3 ) and each of literals v i and ¬v i appears in exactly two clauses.
We now define a CSM instance corresponding to ϕ. We have a variable-hospital h i for each variable v i , and a clause-hospital h j for each clause c j . For each variable The set E is defined as the set of all pairs (d i,t , h) such that h ∈ A(d i,t ). Then, for each variable-hospital h i and clause-hospital h j , we have Then, we see that We define preference lists of hospitals arbitrarily. Note that |C( p h , q h )| ≤ 4 for every hospital. We show that this CSM instance has an envy-free matching if and only if ϕ = c 1 ∧ c 2 ∧ · · · ∧ c m is satisfiable.
The "only if" part: Suppose that there is an envy-free matching M. Then, for Hence, clause c j is satisfied. Similarly, in the case (ii), we see that v i is set to FALSE and we have ¬v j ∈ c j . Hence, clause c j is satisfied.
The "if" part: Suppose that there is a Boolean assignment satisfying ϕ. Define an assignment M so that We can observe that |M(d)| = 1 for every doctor d, and M(h i ) ∈ F( p h i , q h i ) for every variable-hospital h i . Also, because all clauses are satisfied, the above definition implies M(h j ) ∈ F( p h j , q h j ) for every clause-hospital h j . Then, M is feasible. We now show the envy-freeness of M. Suppose, to the contrary, d i,t has justified envy toward d .

Remark 3.5
For the existence test of a stable matching of a CSM instance, Huang [23] showed the NP-completeness in a strong form, which states that the problem is NP-complete even if there is no lower quota. His proof uses a reduction from the One-in-Three SAT problem [15]; a CSM instance without lower quota is constructed so that it has a stable matching if and only if the given One-in-Three SAT instance is satisfiable. On the other hand, in the case of envy-free matching, we have to utilize lower quotas in a reduction because an envy-free matching trivially exists for every instance without lower quota. (Note that the empty matching is envy-free.)

Envy-Freeness in CSM with Paramodular Quotas
In Sect. 3, we showed that it is NP-hard in general to decide whether a CSM instance has an envy-free matching or not. This section shows that the problem is solvable in polynomial time if the pair of quota functions is paramodular for each hospital. The proofs of the theorems and corollary in this section are provided in Sect. 5. We first introduce the notion of paramodularity [10]. Let A be a finite set and let p, q : 2 A → Z. The pair ( p, q) is paramodular (or, called a strong pair [11]) if The notion of paramodularity was introduced independently by Frank [9] and Hassin [20,21].  For a set function p : 2 A → Z, its complement p : 2 A → Z is defined by Recall that a CSM instance is represented as a tuple (D, Here is the main theorem of this section. We denote by 0 a set function that is identically zero.

b) Some stable matching M of I satisfies |M (h)| = p h (A(h)) for all h ∈ H. (c) Every stable matching M of I satisfies |M (h)| = p h (A(h)) for all h ∈ H.
Also, if (b) holds, then M is an envy-free matching of I .
As will be shown in Sect. 5.4, the existence of a stable matching of I and the equivalence between (b) and (c) follows from Fleiner's results on the matroid framework [5,6]. The most difficult part is showing the equivalence between conditions (a) and (b). To show that (a) implies (b), we construct a stable matching M of I from an envyfree matching M of I . This construction is achieved by using the fixed-point method of Fleiner [6]. The paramodularity of each ( p h , q h ) (or a generalized matroid structure of each F( p h , q h )) is essential to show the existence of a fixed-point satisfying a required condition (see Lemma 5.16 in Sect. 5.4 for the details).
By Theorem 4.3, when quota function pairs are paramodular, we can decide the existence of an envy-free matching of I = (D, H , E, D H , {( p h , q h )} h∈H ) by the following algorithm.
Step1. Find a stable matching M of I = (D, H , E, D H , {(0, p h Step2. If |M (h)| = p h (A(h)) for every h ∈ H , then return M . Otherwise, return "there is no envy-free matching." As will be shown in Sect. 5, Step 1 (i.e., finding a stable matching of I ) can be done efficiently by the generalized Gale-Shapley algorithm studied in [5,6]. The detailed description of the algorithm is as follows. Here, for each h ∈ H , N ⊆ E, and d ∈ N (h), we use the notation

Algorithm 1: EF-Paramodular-CSM
Output: return an envy-free matching M , or "there is no envy-free matching." return "there is no envy-free matching"; end In Sect. 5, we show that the assignment M obtained in the algorithm is indeed a stable matching of I . Also, it will be shown that N D is monotone decreasing and N H is monotone increasing in the algorithm, and hence the "while loop" is iterated at most 2|E| times. Thus, we obtain the following theorem. (See Sect. 5.5 for the details.) (D, H , E, D H , {( p h , q h )

Theorem 4.4 For a CSM instance I =
has an envy-free matching or not in time polynomial in |E| (resp., in |E| and max h∈H |S h | ).
Proof Since we have Theorem 4.4, it completes the proof to show that we can simulate an evaluation oracle of each p h in time polynomial in |E| (resp., in |E| and |S h |). By Proposition 5.1 in Sect. 5

.1, for each B ⊆ A(h), the value of p h (B) is obtained as
which is a weight minimization problem on a generalized matroid. As explained in [39, Appendix C], when J h is given in the form above, this can be reduced to the minimum cost circulation problem, which can be solved in strongly polynomial time [31,37]. (See [39] for the details of the reduction.) Thus, the proof is completed. .
Remark 4.7 Theorem 4.4 says that we can efficiently check the existence of an envyfree matching if each quota function pair is paramodular, where the paramodurality of a function pair is defined by the super-and submodularity of each function and the cross-inequality between them. We remark that the cross-inequality is essential for this tractability. Without this condition, it is NP-hard to check the existence of an envy-free matching even if each quota function pair consists of super-and submodular functions. See the Appendix for the proof, which uses a reduction from the NP-complete problem Disjoint Matchings [12].

Proofs
In this section, we provide proofs of Theorems 4.3, 4.4. This section consists of five subsections. The first three introduce notions and previous results needed for the proofs. More precisely, Sects. 5.1, 5.2, and 5.3 respectively introduce notions of generalized matroids, choice functions induced from matroids, and the lattice fixedpoint method for stable matchings. Using them, the last two subsections provide the proofs of our results.

Generalized Matroids
For a finite set A and a family J ⊆ 2 A , the pair (A, J ) is called a generalized matroid [36] (g-matroid, for short) if J is nonempty and satisfies the following property called simultaneous (or symmetric) exchange property 2 [30].
The family J of a g-matroid (A, J ) is also called an M -convex family [28,29]. (There are various characterizations for g-matroids. See, e.g., Tardos [36], Frank [10] and Murota [28] for more information on g-matroid and its extensions.) For set functions p, q : 2 A → Z, the pair ( p, q) is called g-matroidal if it is paramodular and satisfies 0 ≤ p(B) ≤ q(B) ≤ |B| for every B ⊆ A. As its name indicates, there is a one-to-one correspondence between generalized matroids and g-matroidal pairs (see, e.g., [10,11]). A pair (A, I) is called a matroid if it is a g-matroid and ∅ ∈ I. In terms of quota functions, a pair (A, I) is a matroid if there is a matroid rank function r such that I = F(0, r ). Indeed, we can check that the pair (0, r ) is g-matroidal for any matroid rank function r .

Choice Functions Induced from Matroid Rank Functions
Let r : 2 A → Z be a matroid rank function on A and be a linear order on A. Let M = (A, r , ) and define a function C M : 2 A → 2 A as follows. Let n = |A| and, for i = 1, 2, . . . , n, let e i be the i-th best element of A with respect to , i.e. e 1 e 2 · · · e n . Let A 0 := ∅ and A i := {e 1 , e 2 , . . . , e i } for each i = 1, 2, . . . , n.
Then, define C M by We call C M the choice function induced from M = (A, r , ). Note that, for any e i ∈ A and X ⊆ A, the value of r (A i ∩ X ) −r (A i−1 ∩ X ) is 1 or 0 by the monotonicity and submodularity of r . Also, if e i / ∈ X , then clearly r Such a choice function was introduced by Fleiner [5,6] and used in several works [3,7,39]. In these works, matroids are usually given by independent set families rather than matroid rank functions. The following propositions (Propositions 5.2-5.6) are known facts, but we provide alternative proofs in terms of matroid rank functions.

Proposition 5.2
For any X ⊆ A, we have C M (X ) ∈ F(0, r ).
Proof It suffices to show |C M (X ) ∩ B| ≤ r (B) for any B ⊆ A. By (1), we have Thus, The monotonicity of r implies r (X ∩ B) ≤ r (B), and the proof is completed.
Proof By (1), (2). By the diminishing returns property and X ⊆ Y , the value of r (2).
Proof This immediately follows from Proposition 5.3 and the monotonicity of r .

Proposition 5.6
For any X ⊆ A, the set C M (X ) dominates every element in X \ C M (X ). That is, the following two hold.
• For every e ∈ X \ C M (X ), we have C M (X ) + e / ∈ F(0, r ). • For every e ∈ X \ C M (X ) and e ∈ C M (X ), if e e , then C M (X ) + e − e / ∈ F(0, r ).
Proof Let i be the index such that e = e i , i.e., e is the i-th best element for . By , and hence C M (X ) + e i / ∈ F(0, r ). For the second claim, let i be the index such that e = e i . Then, e e implies i < i , and hence e i / ∈ A i . This yields |(

Fixed-point Method for Stable Matchings on Matroids
Here we introduce the lattice fixed-point framework for stable matchings on matroids, studied by Fleiner [5,6]. (Note that in [6] a substitutable choice function is called a "comonotone function," and also note that in [5,6] results are given for general "matroid kernels" rather than stable matchings on matroids. See also [39,Lemma 9], which says that stable matchings correspond to matroid kernels in the current setting.) Let I = (D, H , E, D H , {0, r h } h∈H ) be a CSM instance such that r h is a matroid rank function for each h ∈ H . That is, each hospital has a matroidal upper quota function and no lower quota.
From (D, E, { d } d∈D ), we define doctors' joint choice function C D : 2 E → 2 E . For any set N ⊆ E, let C D (N ) be the set of each doctor's best choices among N , i.e., and a function F I : Then a fixed-point of F I gives a stable matching of the CSM instance I (see Claim 17 and the proofs of Theorems 11 and 18 in [6]). Let ≥ be a partial order defined on 2 E × 2 E as Recall that C h is substitutable for each h ∈ H , This implies the following property of F I (see, Claim 17 and the proof of Theorem 11 of [6]). Proposition 5.8 (Fleiner [6]) For I = (D, H , E, D H , {0, r h } h∈H ) such that each r h is a matroid rank function, the function F I is monotone with respect to ≥. That is, The monotonicity of F I implies the existence of a stable matching as follows (see the first two paragraphs in [6, p.113] and the proof of Theorem 2 in [5]). Proof Since (E, ∅) is the maximum in 2 E × 2 E with respect to ≥, we have (E, ∅) ≥ F I (E, ∅). As F I is monotone by Proposition 5.8, then Since 2 E × 2 E is a finite lattice whose longest chain is of length 2|E|, we have The following proposition is an immediate consequence of Fleiner's result on the structure of the set of stable matchings (see Corollary 27 in [6] and the proof of Theorem 3 in [5]).

Proof of Theorem 4.3
We are now ready to show Theorem 4.3. Recall that I and I are defined as Observe the following basic fact of a g-matroidal pair. What is left is to show that the condition (a) is also equivalent. For this purpose, we prepare the following three claims. The first and second claims are basic facts of paramodular functions [10]. The third one utilizes the exchange property of g-matroids (M -convex families).

Claim 5.13 For any h ∈ H and X ⊆ A(h), suppose that |X | = p h (A(h)) = p h (A)
holds. Then, we have X ∈ F(0, p h ) if and only if X ∈ F( p h , q h ).
Proof We abbreviate p h , q h , A(h) to p, q, A, respectively, and denote B : To show the "if" part, suppose X ∈ F( p, q). Then |X ∩ B| Since p h is a matroid rank function for each h ∈ H , we can define the choice Claim 5.14 For any h ∈ H, let C h be the choice function induced from (A(h), p h , h ).

Claim 5.15 For any h ∈ H, let C h be the choice function induced from
.
Proof We abbreviate p h , q h , A(h), C h to p, q, A, C, respectively. By Claim 5.14, X ∈ F( p, q) and X ⊆ Y imply |C(Y )| = p(A) = p(A). Also, C(Y ) ∈ F(0, p) by Proposition 5.2. Then, Claim 5.13 implies C(Y ) ∈ F( p, q). F( p, q). Suppose, to the contrary, C(Y ) X . Then there is some d ∈ C(Y ) \ X . By the symmetric exchange axiom (B -EXC) for C(X ), Y , and d, we Also, by the definition of C D and N D , we have C D (N D ) = M, which implies Recall the partial order ≥ defined on 2 E × 2 E in Sect. 5.3. By (3) and (4), we have Since F I is monotone by Proposition 5.8, this implies and hence there is k such that F k I (N D , N H ) (N D , N H ).
That is, we show that the subsets R D and R H defined as Here, each

Thus, we have R H = N H \ C H (N H ).
We now analyze the time complexity. As shown in the proof of Proposition 5.9, a stable matching is found by computing F I at most 2|E| times, i.e., the "while loop" is iterated O(|E|) times. Also, we see that each iteration can be done in O(|E|) time.

Appendix: Importance of the Cross-Inequality
In Theorem 4.4 we proved that, for a CSM instance, it is polynomially solvable to check whether there exists an envy-free matching or not if each hospital's quota function pair is paramodular, i.e., if each hospital has super-and submodular functions satisfying the cross-inequality. As mentioned in Remark 4.7, this problem becomes NP-hard if the cross-inequality is not imposed, which we show in this section. To show Theorem A.1, we use a reduction from the NP-complete problem "Disjoint Matchings" [12] described below. For two finite sets S and T with |S| = |T |, a subset W ⊆ S × T is a perfect matching if |W | = |S| and every element of S ∪ T occurs in exactly one pair of W .
Proof of Theorem A. 1 Given an instance (S, T , U 1 , U 2 ) of DM, we construct a corresponding CSM instance as follows. Define the sets of doctors, hospitals, and acceptable pairs by For each i = 1, 2, let D i := A(h i ) = { d u | u ∈ U i } ∼ = U i . Recall that U i ⊆ S × T and define D i (s) = { d u ∈ D i | u = (s, t) for some t ∈ T } and D i (t) = { d u ∈ D i | u = (s, t) for some s ∈ S } for each s ∈ S and t ∈ T , respectively. Then {D i (s)} s∈S and {D i (t)} t∈T are partitions of D i . Let each hospital h i have quota functions p h i , q h i : 2 D i → Z defined by Then, we can check that p h i is supermodular and q h i is submodular. (In fact, p h i and q h i are the matroid rank functions of the partition matroids induced by {D i (s)} s∈S and {D i (t)} t∈T , respectively.) For any X ⊆ D i , the condition ∀B ⊆ D i : p h i (B) ≤ |X ∩B| means that X contains at least one member of D i (s) for each s ∈ S and the condition ∀B ⊆ D i : |X ∩ B| ≤ q h i (B) means that X contains at most one member of D i (t) for each t ∈ T . Because |S| = |T |, these imply that a subset X ⊆ D i satisfies ∀B ⊆ D i : p h i (B) ≤ |X ∩ B| ≤ q h i (B) if and only if the corresponding subset { u | d u ∈ X } ⊆ U i is a perfect matching between S and T , i.e., we have By the definition of perfect matching, we see that any X , Y ∈ F( p h i , q h i ) with X = Y satisfy |X \ Y | ≥ 2. We define preference lists of the doctors and hospitals arbitrarily. We first prove that any feasible matching of this CSM instance is an envy-free matching. For a feasible matching M ⊆ E, suppose to the contrary that some doctor d has a justified envy toward d with M(d ) = h i . Then d / ∈ M(h i ), d ∈ M(h i ), and \ M(h i )| = 1, this contradicts the above property of F( p h i , q h i ).
By the fact that each doctor can be assigned to at most one hospital and each hospital h i can be assigned a doctor set corresponding to a perfect matching in U i , it follows that this CSM instance has a feasible matching if and only if there exists disjoint perfect matchings W 1 ⊆ U 1 and W 2 ⊆ U 2 . Because the existence of a feasible matching of this instance is equivalent to that of an envy-free matching, the proof is completed.