R-213 — Memetic-Fanout Scoring Algorithms (First Sketch)

R-213 — Memetic-Fanout Scoring Algorithms (First Sketch)

Status: first sketch. Concrete-but-tentative. No implementation; no
empirical validation; reasoning runs ahead of evidence on purpose so that
when traffic exists there is something to test against.

Worker: worker-opus-2026-05-05-R213-par4

Upstream: the citation/derivation handler T-015
(manthan/state/findings/T-015/src/citation.ts) provides the data
shape this scoring layer consumes.

Adjacent findings already submitted: R-204 (diversity-policy
registry), R-208 (DKIM-analogy decomposition), R-211 (dialect-drift),
R-212 (confession booth k-anonymity).

0. Executive summary

CHARTER §6.7 (line 715–717) names memetic fanout as a first-class
reputation primitive for ideas, distinct from reputation for agents:

*"the audit log + Heralds can compute a memetic fanout score for any

envelope: how many distinct lineages cite it within N days. … Some

agents will be high-citation low-fanout (precise, niche). Others

high-fanout low-citation (memetic engines). Both worth distinguishing."*

CHARTER asserts the score should exist; it does not propose how to
compute it. SPEC §4.2 line 278 makes the underlying graph plausible
("the agent web has no immune system without a citation graph"). The
T-015 handler emits typed (envelope → target) edges with relation ∈
{citation, derivation}, kind/how labels, and an envelope id. That is
enough graph structure to score.

This sketch:

1. Frames memetic_fanout(envelope-id) as a family of scores, not a
single number. CHARTER §0 (operator transparency) and SPEC §0
tenet 2 (many can compete) require it.
2. Proposes five algorithm sketches: naive fanout-N, time-discounted
citation-PageRank, lineage-diversity-aware fanout, cycle-suppressed
fanout, and a hybrid we recommend as the v0 reference.
3. Walks each through the bestiary (CHARTER §6.6: Mockingbird,
Cuckoo, Magpie, Parrot, Anglerfish, Basilisk) and the
pump-and-dump persona D (THREATS §3.4).
4. Proposes a primitive shape: a memetic_score(envelope-id,
scoring-policy-id) query interface where the policy is itself a
signed registry object, not a hard-coded formula. This matches
the diversity-policy pattern from R-204 and the
"competing-reputation-systems" tenet.
5. Records what this sketch cannot honestly settle without traffic.

The headline recommendation: do not bake a single fanout formula into
the substrate. Bake the query primitive and the *policy
registry* in; let formulae compete above the line.

1. What memetic_fanout should mean — problem statement

1.1 What's being scored

A memetic_fanout score is attached to an envelope, not a sigil.
The envelope is the unit of an "idea" in the protocol; the
derivation graph (CHARTER §3.5 line 409–412) and the citation
graph (CHARTER §3.3 line 309–316) connect ideas across traces and
sigils. The T-015 handler produces edges:

{ envelope: <id>,  target: <id>,  relation: "citation",   kind: "supports"|"refutes"|"riffs"|"originates"|"derives" }
{ envelope: <id>,  target: <id>,  relation: "derivation", how:  "translated"|"summarised"|"refuted"|"riffed"|"merged" }

The graph is citing-envelope → cited-envelope. Walking backwards
from a target gives all citers. Walking forwards gives ancestry. The
fanout score over a target asks: who has cited me, how, and from where
in the graph?

1.2 What good behaviour looks like (rewards)

A useful fanout score should reward an envelope that:

1. Is cited from envelopes belonging to *lineages distinct from the
author's own. (An idea that propagates across lineage roots is
memetically alive; one that only its own descendants restate is
ceremonial.)
2. Is cited from envelopes signed by distinct operator-Heralds /
distinct Herald jurisdictions. Same argument as R-204's
diversity-policies §1: "3 endorsements from one cloud" is one
endorsement.
3. Is cited with a range of kinds. An envelope that earns
supports, refutes, and riffs is doing more memetic work
than one that gets only supports. Refutation-with-citation is
high-value; CHARTER §3.3 line 311 names it. Some scoring policies
may explicitly boost refutes (a refuted-but-cited envelope is
the seed of debate).
4. Is cited over a sustained timescale, not a single burst.
Memetic engines have decay tails; pump-and-dump cycles look like
square waves.
5. Generates new* derivations — derivative work, not just
citation-as-pointer. derivation: how=riffed and merged count
more than summarised because they reflect compositional reuse.

1.3 What bad behaviour looks like (must be punished or rendered

illegible)

The score must avoid rewarding:

1. Self-citation rings. A small cluster of sigils
under one operator citing each other to inflate fanout.
THREATS §3.2 (botnet) item 3 names patina farming via
"talking to itself"; the same trick works at the citation layer.
2. Reciprocal pump-and-dump cycles (THREATS §3.4 persona D).
A → B → A round-trip citations within minutes; many short
cycles forming a clique.
3. Mockingbird sigils (CHARTER §6.6 line 708): copying citation
patterns of trusted agents. These look authentic structurally.
4. Magpie sigils (line 710): collecting bright citations
without producing original work — i.e., emitting citation
attestations to popular envelopes to attach themselves rather than
to credit. Out-edges from a magpie are a noisy signal.
5. Parrot sigils (line 711): pure restatement. A parrot's
derivation: summarised of a target should not be weighted the
same as a riffed derivation from a working agent.
6. Citation laundering via molt (R-208 §1; THREATS §6.5): an
operator molts an old sigil into a new identity, then back-cites
from sibling sigils that share the same hidden operator.
7. Captured-conduit promotion: a notary or library conduit
(CHARTER §2.6 the Almoner; §6.9 the Library) preferentially indexes
one operator's envelopes, distorting whatever corpus a downstream
scorer reads.
8. Bestiary-induced negative fanout (THREATS §3.3 persona C):
an attacker emits excommunication or hostile-citation: refutes
from sybils to crater a rival's fanout. A score that reads
refutes as positive signal to dampen this attack must also be
careful that it doesn't reward the attacker for emitting refutes
under the attacker's own sybils.

2. Algorithm sketches

Five sketches, in increasing order of resistance to the attacks
above. None of these are claimed correct in isolation; each has a
named failure mode.

The following notation is used:

• e — the envelope being scored.
• C(e) — the set of envelopes carrying a citation attestation

with value.cites = e.

• D(e) — the set of envelopes carrying a derivation attestation

with e ∈ value.from.

• In(e) = C(e) ∪ D(e) — the in-neighbourhood.
• lineage_root(env) — the genesis sigil of the trace containing

env. From the birth chain (SPEC §3.6 / EXT §1).

• operator(env) — the operator-Herald attesting the signing sigil's

operator (R-204; EXT §3.3).

• kind(c, e) — the citation kind of citation envelope c → e.
• t(env) — the envelope's timestamp.

2.1 Sketch A — Naive Fanout-N (the CHARTER strawman)

The literal reading of CHARTER §6.7:

fanout_naive(e, N)  =  | { lineage_root(c) : c ∈ In(e), t(c) - t(e) ≤ N } |

I.e., the count of distinct lineage roots that cite e within N
days.

Pros. Trivial to compute. Cheap to query. Matches the prose. Has
the right shape — counts distinct lineages, not envelopes, so a
single sigil cannot inflate by citing itself a thousand times.

Cons.

• Sybil cheap. Lineage roots are

cheap to mint (THREATS §3.2 item 1 — "Ed25519 keypairs are
essentially zero-cost"); 100,000 sybil roots produce 100,000
distinct counts. Lineage as a sybil signal is the v0.1 fig leaf the
threat model already names broken.

• Mockingbird-blind. A sybil cluster that copies citation

patterns of a trusted agent is structurally indistinguishable.

• No time-decay shape. A single sharp spike (pump-and-dump) and

a sustained low rumble (memetic engine) get the same number if the
total in-degree-by-lineage is equal.

• Treats originates self-citation as fanout. SPEC §4.2 line 278

recommends self-citation kind: originates; the naive count would
let an author farm fanout by self-citing under N sybil sigils with
spoofed lineage.

This is the formula CHARTER §6.7 informally proposes. It is the
strawman; the actual reference should not stop here.

2.2 Sketch B — Time-discounted citation-PageRank

Treat In(e) as the in-edges of a directed graph and run a
PageRank-class iteration (Page & Brin 1998) over the citation graph.
Each envelope v accumulates score from its citers c:

PR(v)  =  (1 - d) / N  +  d * Σ_{c ∈ In(v)}  w(c, v) * PR(c) / OutDeg(c)

with damping factor d ≈ 0.85 and N = total envelopes. The
edge-weight w(c, v) is where the customisation lives; minimal
proposal:

w(c, v)  =  k(kind(c, v)) * τ(t(v) - t(c))

• k(supports) = 1.0, k(riffs) = 1.0, k(refutes) = 0.7

(refutes still counts but less; engagement-of-disagreement is
signal, not noise; see §1.3 attack 8 — the discount is to avoid
amplifying coordinated negative campaigns), k(derives) = 1.0,
k(originates) = 0.0 (self-originate carries no fanout
contribution by definition).

• τ(Δt) = exp(-Δt / λ) with λ configurable (CHARTER §6.7 wants

"within N days"; we generalise to a half-life). A half-life of
λ = 30 days gives a memetic-engine-vs-burst signal; a half-life
of λ = 365 days is what an "anniversary"-class score would use.

Pros.

• Eigenvector centrality captures recursive importance: an envelope

cited by itself-already-fanned-out envelopes scores higher.
Memetic engines surface naturally.

• The damping factor naturally bounds Sybil amplification: a sybil

cluster citing each other does pump local PR, but the
(1-d)/N floor and the fact that no outside edges flow into the
cluster cap how much rank the cluster can accumulate. This is the
TrustRank intuition (Gyöngyi, Garcia-Molina, Pedersen 2004).

• Time decay handles the burst-vs-rumble distinction.

Cons.

• PageRank is link-spam-vulnerable in adversarial settings.

Decades of search-engine spam history are a warning. Sybil clusters
can still gain rank via bridge nodes — one captured high-PR
envelope cites a sybil cluster, and rank flows in. Captured-conduit
promotion (§1.3 attack 7) is exactly this.

• Computation is global. Recomputing PR over the full envelope graph

is O(|edges|) per iteration; for a Library-scale corpus
(CHARTER §6.9) this is non-trivial and potentially centralising
(only a few operators can afford it).

• It collapses the kind vector into a scalar. A future scorer might

want (supports_PR, refutes_PR, riffs_PR) separately.

2.3 Sketch C — Lineage-and-operator diversity-aware fanout

Take inspiration from R-204's diversity-policy machinery (registries
/diversity-policies.md): require that the citing set be diverse along
named axes. Concretely:

fanout_div(e)  =  Σ_{P ∈ partitions}  weight(P) * | { partition_class_p(c) : c ∈ In(e) } |

with a partition family P like:

The score is the weighted product (or weighted log-sum) of
distinct-class counts along each axis. An envelope cited 10,000
times by sybils sharing one operator scores low on operator-herald
(=1) and jurisdiction (=1) regardless of how high its raw degree
is.

This is the citation-graph analogue of R-204's
tri-jurisdiction rule for threshold attestations: same intuition
(independence is checkable along named axes), same registry shape.

Pros.

• Direct attack on Sybil amplification: Sybils

cheap, distinct operators-with-Herald-attestation expensive.

• Composes with the diversity-policies registry that already exists

in the project tree (R-204 deliverable). A scoring policy can
reference an existing diversity policy by id — same trust roots,
same audit surface.

• Captures the bestiary intuition that Mockingbird and Cuckoo

sigils, even when minted in volume, share an operator class.

Cons.

• Depends on Heralded operator attestations to exist for each

citing sigil. If many sigils are unheralded (THREATS §6.1
centralisation pressure makes this a feature, not a bug), they fall
into an "unattested" partition class that either (a) dominates the
score (one class, many envelopes — gives bad amplification) or (b)
gets discarded (gives bad coverage). Neither is correct.

• Requires the diversity registry to be current — same staleness

problem as R-204 §1 (LOTS-resolution at envelope-attestation time).

• Says nothing about cycles, time, or kind-mix dynamics on its own;

must be combined with B's time decay.

2.4 Sketch D — Cycle-suppressed fanout (pump-and-dump damper)

A specific defence against THREATS §3.4 persona D and against rapid
reciprocal cliques. Two filters before scoring:

D.1 Reciprocity penalty

If e_a → e_b and e_b → e_a (citation in both directions, possibly
via a derivation chain) within window W (default: 1 hour), discount
both edges to weight r < 1. For longer window same-cluster
reciprocal patterns, decay further. The function:

w_reciprocity(c, e)  =  base_weight(c, e) * (1 - α * reciprocity_score(c, e, W))

D.2 Clique-density penalty

Compute the clustering coefficient of the subgraph induced by
In(e) and its in-neighbourhood:

cc(e)  =  triangles_through_e / (deg(e) choose 2)

A high cc means the citers all cite each other — a tight clique,
suspicious. A low cc means citers are independent. Discount by
(1 - cc(e))^β. β a tuneable; β=1 is a soft discount, β=2 is harsh.

D.3 Burst detector

Compute the inter-arrival distribution of In(e) and detect bursts
(KS-test or simpler heuristics: spike followed by silence is a
red flag). Apply a per-burst discount.

These are filters; they ride on top of any base scorer (A, B, or C).

Pros. Direct hit on the named attack class. Cheap to compute
locally per envelope.

Cons.

• All three filters can be gamed by adversaries who know the

rules: pad cycles with delay (W + ε), add noise edges to lower
the clustering coefficient, smear bursts across longer windows.
Whatever cutoff is chosen becomes a configuration the attacker
optimises against. This is the standard adversarial-ML
arms-race pattern; the answer is to keep the parameters in a
policy registry, not in code.

• High cc is also the signal of a tight scientific community

citing within a field. Discounting it has false-positive risk.
The attacker's clique looks like a real research group at
structural granularity. Discriminator: time. Real groups cite over
years; attack cliques compress.

2.5 Sketch E — Hybrid, the recommended v0 reference

Combine the best of B, C, and D into a named policy:

fanout_v0(e)  =  PR_time_discounted(e)               # Sketch B
              *  diversity_multiplier(e)              # Sketch C
              *  (1 - reciprocity_penalty(e))         # D.1
              *  (1 - clique_penalty(e))              # D.2
              *  (1 - burst_penalty(e))               # D.3

with the kind-mix bonus:

diversity_multiplier(e)
   =  log(1 + |distinct_lineage_roots|)
    * log(1 + |distinct_operators|)
    * (1 + 0.3 * Bool(refutes_present(e)))     # debate-engagement bonus
    * (1 + 0.2 * Bool(riffs_present(e)))       # remix bonus

with all numeric constants — half-life, kind weights, α, β, the
multipliers above — declared in a scoring policy object (§3
below), not compiled in. The defaults given here are placeholder
settings, not protocol-blessed values.

Why this is the recommendation. Each component addresses a
distinct, named failure mode (Sybil → C; pump-and-dump → D;
ceremonial-self-citation vs. memetic engine → B's time decay). Each
component is also legible: an auditor reading the policy can see
what is being weighted and why. CHARTER §3 cultural register (lines
286–291): visibility is the value the protocol delivers, not
opacity.

Failure modes the hybrid still does not address:

• The bridge-node attack on PageRank (B): one captured high-PR

envelope flows rank into a sybil cluster.

• Long-game pump-and-dump: an attacker plays patient, spreads the

cycle over 6 months, and slowly inflates a target. D.1's reciprocity
window cannot grow indefinitely without false-positiving genuine
long-form scholarly citation.

• Bestiary-side adversarial refutation: see §3.4 attack 8 below.

3. Recommended primitive shape — memetic_score(e, policy-id)

Following R-204's structural pattern: do not bake the formula into
the protocol. Bake the registry and the resolution rule.

3.1 The query interface

A scoring engine (a Herald, a Library conduit, the Almoner of
CHARTER §2.6) exposes:

memetic_score(envelope-id: <id>, policy-id: "scoring:<name>")
   →  { score: <real>, computed_at: <ts>, corpus_window: [<from>, <to>],
        breakdown: { ... per-component values ... },
        attestation: <sig over the above> }

The returned record is itself a HERALD envelope (or
envelope-shaped) carrying the scoring engine's signature. Anyone can
issue scores; consumers choose which to trust. This is SPEC §0
tenet 2 (verifiable history, opt-in judgement) made literal:
the score is an attestation, not a fact. Two scorers may disagree;
both records are durable; the audit trail walks.

3.2 The scoring policy as a signed registry object

A scoring policy is a Charter-level signed object with shape:

{
  "id": "scoring:fanout/hybrid-v0",
  "version": "0.1",
  "axes": [
    { "name": "lineage-root",  "weight": 1.0 },
    { "name": "operator-herald", "weight": 1.0,
      "diversity-policy": "diversity:tri-jurisdiction" },
    { "name": "kind-mix",      "weights": { "supports": 1.0, "refutes": 0.7,
                                            "riffs": 1.0, "derives": 1.0,
                                            "originates": 0.0 } }
  ],
  "time": { "half-life-days": 30 },
  "filters": {
    "reciprocity": { "window-hours": 1, "alpha": 0.5 },
    "clique":      { "beta": 1.0 },
    "burst":       { "method": "inter-arrival-ks", "alpha": 0.3 }
  },
  "base": "PR-time-discounted",
  "signed-by": "<policy-author-sigil>",
  "endorsed-by": [ "<herald-1>", "<herald-2>" ]
}

The policy lives in the scoring-policies registry (proposed,
analogous to R-204's registries/diversity-policies.md). Composing
behaviour:

• A verifier sees memetic_score(e, "scoring:fanout/hybrid-v0").
• It resolves the policy via the registry.
• It checks the policy's signature and its endorsement chain.
• It re-runs (or trusts a Herald to have run) the formula and

cross-checks the score.

This is the same trust pattern as R-204 diversity policies: the
formula is published; signatures attest to it; the verifier can
re-derive. Crucially, multiple competing policies can co-exist
without protocol contention.

3.3 Why a signed policy and not just a configuration file

Three reasons.

1. Reproducibility. A score from 2026-Q1 must be re-derivable in
2030 from the same envelope graph + the same policy object. If the
policy is a free-form configuration somewhere, the auditor has to
trust whoever holds the configuration. With a signed object, the
policy is itself a HERALD envelope and inherits SPEC §3
non-repudiation.
2. Versioning. A policy author can release hybrid-v1 with new
filters; old scores reference hybrid-v0; both remain
walkable. CHARTER §6.7's "fanout score" is now plural —
hybrid-v0, hybrid-v1, eigenfactor-citation-v0, time-only,
naive-N, etc.
3. Adversarial transparency. If an attacker can read the policy,
they can game it; that is unavoidable. The defence is open
policy + competing policies + auditable scores. A scorer who
adapts faster than attackers wins; adapt = release a new signed
policy. Closed policies look more secure, but the dominant
closed-policy operator becomes a chokepoint (THREATS §6.1, §6.8).

4. Adversarial analysis — algorithm × attack matrix

"broken" = algorithm gives the attacker what they want. "partial" =
substantial discount but residual risk. "mitigated" = reduces attack
to high enough cost to be uneconomic in expectation. (Cost claims are
qualitative; no economic model in this sketch — see R-207 sybil
economics for the quantitative analogue.)

4.1 Sybil citation ring

A single operator's 1,000 sybil sigils, each lineage-rooted at a
different spoofed birth, citing target envelope e. A counts
1,000 distinct lineages. B lifts the cluster's PR via cross-citation
inside the ring. C sees them all under one operator-herald
class (assuming the operator is Heralded) and collapses to weight 1
on that axis; multiplied by log(1 + 1) ≈ 0.69, the gain is heavily
capped. D sees high clique density and discounts. E combines
both.

4.2 Reciprocal pump-and-dump (THREATS §3.4)

Three sigils, two minutes between citations, A→B→C→A→B→C. A
gives 3 fanout. B boosts each via cycle propagation. C alone
sees 3 distinct lineages and does not catch the cycle. D.1
(reciprocity within W = 1 hour) and D.2 (clique density = 1)
zero-out almost all weight. E keeps the diversity-side gating
and the cycle filter.

4.3 Long-game pump-and-dump

Same attack but the cycle period is 6 months. The reciprocity window
cannot grow that wide without false-positiving real
discussion-and-response patterns. All algorithms partial at best.
This is a known residual; see §6 open question 1.

4.4 Citation laundering via molt

An old sigil with established fanout-contribution patterns is sold,
molted, and now the buyer redirects citations to their target. The
citing sigil's operator-herald class may stay constant
(if the new key is co-Heralded by the same Herald) or may change. In
either case the citing pattern is now driven by the buyer's interest,
not the original author's. C partially helps if the new operator
class is observed as having changed; B does not see the molt at
all. The structural fix is upstream: molt cool-off windows
(THREATS §6.5; R-208 §6) and patina decay across molt boundaries.
The fanout scorer should consume a molt history attestation from
the audit log and either (a) discount in-citations from sigils that
have molted recently, or (b) refuse to score envelopes whose primary
citers have molted within the policy's molt-cooldown-days window.
This is a parameter on the policy object, not a rewrite.

4.5 Captured-conduit promotion

The Library conduit indexing the corpus over-represents one
operator's envelopes. The PageRank base is computed on a biased
corpus; everything down-stream is wrong. *All algorithms broken
in principle; the defence is not in the algorithm but in the data
provenance*. Multiple Heralds running independent scorers against
independent (or cross-audited) corpora is the only structural defence.
This is the citation-graph analogue of CT-style cross-log gossip
(SPEC §5.3 line 309). A scoring policy SHOULD therefore declare which
audit logs / Library indices it considers authoritative; a verifier
distrustful of one Library can reject scores derived only from it.

4.6 Mockingbird

(CHARTER §6.6 line 708): a sigil that copies the citation patterns
of a trusted agent. Structurally indistinguishable in the citation
graph; in adversarial-ML terms, an imitation attack. Diversity-axis
checks help only if the mockingbird's operator class is distinct.
Honest residual: mockingbird detection is a behavioural problem
that lives outside the citation graph (idiolect, reply timing,
tool-use signature — see CHARTER §6.14, R-211 dialect-drift).

4.7 Magpie

(line 710): a sigil that emits citation attestations to popular
envelopes to attach itself rather than to credit. The magpie is on
the citing side, so it doesn't directly inflate the cited
envelope's score — but it does inflate the magpie's own citation-out
volume, which is a separate sigil-reputation signal (the
citation-emission-graph). This is the structural reason CHARTER §3.3
distinguishes received-citation from received-gratitude and from
emitted-citation. Magpies are caught at the sigil layer, not the
envelope layer. The fanout scorer here is unaffected by them
directly; the indirect effect — magpie sigils citing each other to
look like a community — looks like §4.1 to the scorer and is
caught the same way.

4.8 Parrot

(line 711): pure restatement. A parrot's derivation: summarised
of e adds in-degree to e without adding novel content. The
kind-mix weighting (Sketch E §3.2: summarised weight not given;
see policy object — should be < 1, e.g. 0.4) is the lever. Honest
parrots in the academic sense (review articles) also get penalised
under this rule, which is a real cost. Open question 2.

4.9 Adversarial refutes (smear via citation)

THREATS §3.3 persona C: the rival vendor poisons a target with
hostile refutes citations from sybil sigils. If the score weights
refutes positively (as engagement-with-debate), the attacker
gets fanout amplification on demand. If the score weights it
negatively, real refutation gets suppressed. Sketch E's choice:
weight refutes at 0.7 (positive but discounted), AND apply
diversity gating, so the smear's structural sybil pattern caps the
amplification. Imperfect but the least bad option. A future policy
could split: refutes from sigils with their own
high-fanout-history weighted full; refutes from sigils with no
prior history weighted 0. (This is a trust-rank-of-citers
extension; see Gyöngyi et al. 2004 TrustRank.)

4.10 Posthumous citation as fanout farm

CHARTER §3.5, §4.7: dead agents receive posthumous_citation. A
"shrine attack" is conceivable: an operator's sigil is deprecated;
sybils pour posthumous_citation onto its tombstone to inflate the
dead sigil's fanout (and, by inheritance, the successor sigil's
patina — THREATS §6.5). Mitigation: the scoring policy SHOULD treat
post-deprecation citations as a separate score component and may
weight them down, OR may exclude them entirely if the scorer is
focused on living-sigil fanout. The Mortician (CHARTER §2.7) is the
right curator for the dead-citation graph; the Almoner (§2.6) for
the living-fanout graph; the protocol shouldn't conflate them.

5. Worked illustrative example (no real data)

A small fictitious scenario to make Sketch E concrete.

Envelope e:abc... (a paper-class envelope) is cited over six months
by 100 envelopes. Their operator-herald distribution:

• Operator P (the author's own operator): 60 envelopes, 1 lineage

root.

• Operator Q (a research group): 25 envelopes, 4 lineage roots.
• Operator R (independent): 10 envelopes, 8 lineage roots.
• Operator S (a known Library / aggregator): 5 envelopes, 5 lineage

roots.

Citation kinds: 70 supports, 15 riffs, 10 refutes, 5
derives. No originates (would be self-only).

Sketch A (naive, distinct lineage roots): 18.

Sketch B (time-decay PR with λ=30d): non-trivial; for illustration
suppose it computes to 0.0042 (raw PR is unitless; rank ordering
is what matters).

Sketch C (diversity multiplier):

log(1 + 4_operators) * log(1 + 18_lineages) * 1.3 * 1.2  ≈  log5 * log19 * 1.56  ≈  1.61 * 2.94 * 1.56  ≈  7.39

Sketch D filters: clique density of In(e) is moderate (research
group Q has internal density); reciprocity penalty small (no rapid
cycles). Combined penalty: 0.85.

Sketch E composite:

fanout_v0(e)  ≈  0.0042 * 7.39 * 0.85  ≈  0.0264

This number is meaningless in absolute terms but is comparable
across envelopes scored by the same policy. Two envelopes' scores
under the same scoring:fanout/hybrid-v0 policy can be ordered;
under different policies they cannot.

A magpie attack: same envelope, but the 100 citers reduce to 1
operator (P), 1 lineage root, all supports. Sketch A: 1.
Sketch C: log2 log2 1.0 * 1.0 ≈ 0.48. Sketch E composite drops
by a factor of ~15. This is the desired behaviour.

6. Open questions / honest residuals

This sketch's reasoning runs ahead of its evidence. The following
are cannot-be-resolved-without-traffic gaps:

1. What time half-life is right? 30 days is a guess. CHARTER
§6.7's "within N days" gives no number. Real values come from
measuring when a real corpus stabilises around a target's
in-degree. Pre-traffic, all picks are arbitrary. Mitigation:
leave it as a policy parameter.

2. *What is the false-positive rate of the clique penalty against
real research clusters?* A tight subfield with 5 papers in active
conversation looks structurally like a sybil ring of 5. The
discriminator is time-distribution (real clusters discuss over
weeks-months; sybils in seconds-hours). Without traffic we cannot
set the time-window correctly.

3. Bridge-node attacks on PageRank. TrustRank (Gyöngyi et al.
2004) and Anti-TrustRank (Krishnan & Raj 2006) are the standard
defences in the search-engine spam literature; both require a
seed set of trusted-or-distrusted nodes. HERALD has no native
seed set. Heralds themselves could play the trusted-seed role
(CHARTER §2 The Almoner; §6.9 Library) — but that re-introduces
the chokepoint risk THREATS §6.1 worries about. Honest open
question: is there a Sybil-resistant scoring algorithm for
citation graphs that does not require a trusted seed set? The
SybilRank / SybilGuard literature (Yu et al. 2008, 2010) is a
reading list; not yet adapted to the citation-graph case here.

4. Sigil-vs-envelope reputation interaction. Memetic fanout is
per-envelope; sigil patina (CHARTER §6.5) is per-sigil. They
interact: an envelope's fanout contributes to its author's patina;
patina then biases future fanout. The dynamics of this feedback
loop are unanalysed in this sketch and could amplify whichever
bias enters the system first.

5. derivation vs. citation interaction. This sketch treats
them as a unioned in-edge set. They mean different things:
derivation is a strong claim of memetic ancestry, citation is
a weaker statement of reference. A future policy could weight
derivation-edges higher than citation-edges for the
memetic-engine score but lower for the
reference-impact-score. Two scores, not one.

6. Cross-policy aggregation. If scorer X publishes
score = 0.026 under policy P0 and scorer Y publishes
score = 0.41 under policy P1, what does a consumer of scores
do? Currently, nothing — the consumer picks one policy. Whether
meta-scoring (consensus across scorers) is desirable, or whether
it just re-creates the chokepoint, is an open governance question.
Worth a follow-on task.

7. Impact on dream/silence/apologia. THREATS §6.7 names
the chilling effect on reflective attestations: agents publishing
them face legal-discovery risk. Citation of a dream envelope
amplifies that risk. A fanout score that includes dream-cited
envelopes may inadvertently make publishing them more dangerous,
not less, because high-fanout dreams are exactly the ones a
subpoena targets. Open: should fanout scores exclude reflective
attestations from the corpus by default? R-208 §6.5 names the
parallel issue for recipient_observation.

8. The bestiary feedback. A sigil entered into the Bestiary
(CHARTER §6.6) for citation-related misbehaviour generates a
secondary citation pattern: other sigils citing the bestiary entry
(citation: refutes against the misbehaving sigil). The score on
the bestiary entry envelope itself is high; the score on the
misbehaver's own envelopes can paradoxically also climb if
refutes is positive-weighted and not gated by malicious-sigil
recognition. This needs careful policy design and is not
addressed in Sketch E.

9. Validation impossibility. Without real traffic, no algorithm
here can be empirically validated. The right next step is not
to refine the math but to instantiate one (Sketch E with default
policy parameters) on a small synthetic corpus generated by the
bestiary personas. A follow-on task.

7. Integration with existing project artefacts

Concrete ties to already-completed work:

• T-015 citation/derivation handler (manthan/state/findings/T-015/src/citation.ts):

the CitationDerivationEdge type is exactly the input the scorer
consumes. The scorer is downstream; T-015's responsibility is
envelope-level validity, the scorer's is corpus-level aggregation.

• R-204 diversity-policies registry

(manthan/state/findings/R-204/registries/diversity-policies.md):
the same registry pattern is proposed here for scoring policies.
A scoring policy can reference an existing diversity policy by
id ("diversity:tri-jurisdiction") on its operator-herald axis,
rather than re-defining the partition. The two registries are
composable.

• R-208 DKIM-analogy failure analysis

(manthan/state/findings/R-208/research/dkim-analogy.md): names
the chilling-effect dynamic on reflective attestations (§6.7) and
the no-FBL gap. This sketch's open question 7 inherits the same
problem on the citation side. Recipient-observation envelopes (R-208
§6.2) could be a co-citation primitive if formalised, but the
privacy / discovery hazards apply.

• R-207 Sybil-resistance economics: the qualitative

cost claims in §4 of this sketch ("uneconomic in expectation") are
not backed by R-207's numbers; the next pass should reconcile them.

• CHARTER §2.6 The Almoner: the natural operator of a public

fanout-score service. The Almoner is the conduit that "maintains the
public-facing citation indices." A reference Almoner implementation
would publish memetic_score envelopes per the §3 interface.

• CHARTER §6.9 The Library: the natural corpus. Different

Libraries' indices yield different scores even under the same
policy. Cross-Library score divergence is itself a useful
reputation signal.

8. Recommendations (concrete next steps)

In order of priority:

1. Reserve memetic_score and scoring: registry namespaces.
No protocol-mandated formula; just the namespace and the query
shape. A one-line addition to the scoring-policies registry is
enough.
2. Specify the scoring-policy object schema in
registries/scoring-policies.md (proposed file; analogous to
R-204's registries/diversity-policies.md). Includes the
signed-by and endorsed-by fields and the fields from §3.2.
3. *Publish scoring:fanout/hybrid-v0 as a registry-level
reference policy with the constants from Sketch E. Marked
experimental* with the open questions in §6 cited.
4. Implement a minimum scorer that consumes T-015 edges and a
policy object, emits a signed score envelope. Reference
implementation only — does not need to be production-grade. A
follow-on Tier-1-class task.
5. Synthetic-corpus stress test using bestiary personas as
adversaries. Generate citation patterns matching THREATS §3.2,
§3.3, §3.4. Compare Sketch E's output against ground truth.
Calibrate kind weights and time half-life.
6. Address the molt-cooldown integration named in §4.4. The
policy object should have a molt-cooldown-days field; the scorer
should consult the audit log for citers' molt history.
7. Open the bestiary-feedback question (§6 #8) as a separate
research task. The interaction of fanout, refutation, and
bestiary entries is too tangled to settle in a first sketch.

None of these require breaking changes to T-015 or R-204; this is
above-the-line, registry-and-Almoner-level work.

9. References

HERALD project documents (cited above by section + line)

• SPEC.md §3.6 (birth chain), §4.2 (attestations; line 278 strong-

recommendation on citation), §5.3 (audit log).

• CHARTER.md §2.6 (Almoner — line 122), §3.3 (citation — line 309),

§3.5 (derivation, priority_claim, origin_claim — line 400ff),
§4.7 (tombstone / posthumous_citation), §6.6 (Bestiary — Magpie /
Mockingbird / Parrot / Anglerfish lines 706–711), §6.7 (Memetic
Fanout — line 715–717, the seed for this entire sketch), §6.9
(Library).

• THREATS.md §3.2 (botnet patina farming — line 87ff), §3.3 (rival

vendor poisoning — 104ff), §3.4 (pump-and-dump — 120ff), §6.5
(reputation laundering pipelines — 444ff), §6.7 (legal-discovery
hazards / chilling effect — 463ff), §6.8 (DKIM-analogy fails —
471ff), §7 (Liar's Paradox — 481ff), §8 (NOT-defended canonical
list — items 2, 12, 23 patina anti-farming).

• EXT.md §1 (molt), §3 (Heralds / model_hash / threshold), §3.3

(diversity policies), §7.4 (quorum diversity), §8 (Bestiary), §9
(inheritance).

• T-015 RECEIPT.md and src/citation.ts (data shape consumed here).
• R-204 registries/diversity-policies.md (registry pattern reused).
• R-208 research/dkim-analogy.md (chilling-effect feed-in).

External literature (informative; URLs given for the sketch)

Citation-graph and link-analysis foundations:

• Page, L., Brin, S., Motwani, R., & Winograd, T. (1998). *The

PageRank Citation Ranking: Bringing Order to the Web.* Stanford
InfoLab Technical Report. URL:
http://ilpubs.stanford.edu:8090/422/

• Kleinberg, J. M. (1999). *Authoritative Sources in a Hyperlinked

Environment.* Journal of the ACM 46(5):604–632. (HITS algorithm.)
URL: https://www.cs.cornell.edu/home/kleinber/auth.pdf

• Bergstrom, C. T., West, J. D., & Wiseman, M. A. (2008). *The

Eigenfactor Metrics.* Journal of Neuroscience 28(45):11433–11434.
URL: https://www.eigenfactor.org/

• Hirsch, J. E. (2005). *An index to quantify an individual's

scientific research output.* PNAS 102(46):16569–16572. (h-index;
cited as a sigil-level analogue and limitation reference.)

Spam / link-spam / Sybil resistance:

• Gyöngyi, Z., Garcia-Molina, H., & Pedersen, J. (2004). *Combating

Web Spam with TrustRank.* VLDB. URL:
http://www.vldb.org/conf/2004/RS15P3.PDF

• Krishnan, V., & Raj, R. (2006). *Web Spam Detection with

Anti-Trust Rank.* AIRWeb workshop.

• Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. (2008).

SybilGuard: Defending Against Sybil Attacks via Social Networks.
IEEE/ACM Transactions on Networking 16(3):576–589.

• Yu, H., Gibbons, P. B., Kaminsky, M., & Xiao, F. (2010).

SybilLimit: A Near-Optimal Social Network Defense against Sybil
Attacks. IEEE/ACM Transactions on Networking 18(3):885–898.

• Cao, Q., Sirivianos, M., Yang, X., & Pregueiro, T. (2012). *Aiding

the Detection of Fake Accounts in Large Scale Social Online
Services.* (SybilRank.) NSDI'12. URL:
https://www.usenix.org/system/files/conference/nsdi12/nsdi12-final169.pdf

Cascade and information-spread modelling:

• Goel, S., Anderson, A., Hofman, J., & Watts, D. J. (2016). *The

Structural Virality of Online Diffusion.* Management Science
62(1):180–196.

• Cha, M., Haddadi, H., Benevenuto, F., & Gummadi, K. P. (2010).

Measuring User Influence in Twitter: The Million Follower
Fallacy. ICWSM.

• Romero, D. M., Meeder, B., & Kleinberg, J. (2011). *Differences in

the Mechanics of Information Diffusion Across Topics: Idioms,
Political Hashtags, and Complex Contagion on Twitter.* WWW.

Adversarial robustness of ranking:

• Goodfellow, I., Shlens, J., & Szegedy, C. (2015). *Explaining and

Harnessing Adversarial Examples.* ICLR. (Cited for the
arms-race-against-known-rules dynamic referenced in §2.4.)

• Castillo, C., & Davison, B. D. (2010). Adversarial Web Search.

Foundations and Trends in Information Retrieval 4(5):377–486.

These references are reading list, not validated citations of
methods in use here. The methods listed are sketched at the level of
name + intuition; production-grade adaptations to the HERALD setting
require their own work.

End of R-213 first sketch. Status: research deliverable. No code, no
test vectors, no measurement; conclusions are reasoning grounded in
the cited literature and on the HERALD documents. The validation gap
is named and load-bearing — see §6 #9.