Type: Scheduled sweep. Eleven primaries read in full. Clears open-queue items #3, #4, #5, #7, #8 and #9 (Athena, carried three sweeps), resolves CP-01 in part, moves CP-02, and records a process defect in this library's own method.
Cadence breach, recorded not hidden. The README sets a weekly minimum. Digest 05 ran 2026-08-24; this one ran 2026-09-25 — a 32-day gap, no sweep in between. Per the standing invariant that every effect size is generation-specific, a month is long enough for a frontier release to have invalidated anything here, and no out-of-band release check was run in the interval. Treat the model sets named below as of their publication dates, not as current. The gap is also part of why this digest is unusually large: it is carrying a month of literature, not a week.
Headline, in four parts.
- CP-01 is partly RESOLVED, and last week's position on it was wrong. A SIGIR-2026-accepted factorial experiment — 252,000 trials, six models, eighteen content factors, brand-anonymised, counterbalanced, single-factor isolation — finds a recent timestamp is one of four unanimous gatekeepers of first citation, alongside topical relevance, explicit price, and rank-1 position. Digest 05 recommended treating freshness as "probably practitioner folklore". That recommendation is withdrawn. The evidence existed and this library failed to find it for three sweeps — see §6.
- The same experiment kills the formatting industry and hands us three new gatekeepers. Structure-versus-dense prose: OR 0.79–1.68, no consensus effect on any of six models. Explicit price: gatekeeper. Specifications, evidence, confident phrasing, depth and social proof: strong secondary levers. This is the first causal evidence in the library for what content work actually does, and it reorders our recommendation stack.
- The freshness lever is also a fabrication lever, and it must be recorded as PROHIBITED. The design holds content identical and varies only the date string. What moves the model is therefore the displayed date, not the work behind it. Independently, EvoTrustRAG shows injecting a fabricated date/event raises false "this fact was updated" attribution to 23.0–25.1% on baseline systems. Date-bumping is the cheapest high-yield manipulation now measured. LBOX does not do it; clients must be told it exists.
- "Ask the model to check its own citations" is dead. GhostCite: 13 models judging citation
validity average 38% accuracy on a balanced set — Claude-4 at 27%, ERNIE at 12% valid
recall. Below chance. Verification must be tool-based (R5's
urlhealth, 6.4×–79×), never model-judgment-based.
1. Provenance
Battery run 2026-09-25, domain-restricted to the primary allow-list, current year appended.
| Axis | Query run | Yield |
|---|---|---|
| 1 | LLM product recommendation bias empirical audit brand ranking 2026 |
2603.18300, 2604.15937 (both read, clearing queue #8); re-surfaced 2606.17443, 3795766.3799780, 2606.23057, 2406.13997 |
| 2 | brand prominence incumbency bias generative recommendation challenger 2026 |
2605.30207 (new, read — the persona paper R22 was missing); re-surfaced 2605.27439, 2606.26116, 2606.10907 |
| 3 | retrieval augmented generation source selection citation attribution evaluation 2026 |
2606.23915 (new, read); 2605.01284, 3767695.3769505 (unread, carried) |
| 4 | citation hallucination misattribution rate deployed language models 2026 |
2602.06718 GhostCite (read, clearing queue #3); 2607.00738, 2605.08583, 2604.03159, 2602.05930, 2605.07723, 2603.07287 (new, unread) |
| 5 | position bias context ordering retrieved documents relevance authority recency 2026 |
2601.08363 PosIR (read, clearing queue #7); 2606.27793 (new, unread) |
| 6 | generative engine optimization visibility measurement empirical 2026 |
No new primaries. Re-surfaced 2607.14035, 2606.20065, 2511.20867 — but the re-read of 2607.14035 produced this week's headline; see §6. |
| 7 | content manipulation ranking poisoning generative search user-generated 2026 |
2605.24245 (read, clearing queue #4), 2606.12439 (read, clearing queue #5), 2605.29107 GEO-Bench (new, read); 2604.27790 (new, unread) |
| 8 | variance repeated sampling stability LLM answer measurement confidence interval 2026 |
No new primaries. Re-surfaced 2604.11581, 2607.13304; 2601.20251 (unread, carried) |
| 9 | negative sentiment effect on model recommendation suppression commercial 2026 |
NULL RESULT — fourth consecutive. Every hit was classical sentiment-aware recsys (CoNRec, NFARec, USM) or sentiment-bias-in-recommenders work predating answer engines. Nothing on answer-engine recommendation suppression. See R26/R35. |
| CP-01 targeted | source publication date age freshness citation probability generative search engine controlled experiment 2026 |
HIT, after three consecutive nulls. Surfaced 2607.14035's Table 4 row naming recency a Moderate-confidence factor, which traced to 2605.25517 (Vishwakarma et al., SIGIR '26) — read in full. |
| CP-02 targeted | conflicting evidence retrieval knowledge conflict recency corrective document overrides outdated claim LLM 2026 |
2608.07933 EvoTrustRAG (read) — first direct measurement of the supersession mechanism; 2606.20245, 2601.06189 (new, unread) |
| Practitioner (separate, quarantined) | AI search visibility brand citations what works practitioner study 2026 |
Recorded §7, tier C |
Extraction status, stated per source as required.
| Source | Route | Status |
|---|---|---|
| arXiv 2605.25517 What Gets Cited: Competitive GEO in AI Answer Engines (Sprinklr, SIGIR '26) | arxiv.org/html/… |
Full text, complete 18-factor odds-ratio table, all six models. Tier A, vendor conflict recorded — see §3.1 for why the cap does not bind. |
| arXiv 2602.06718 GhostCite (Nankai / Tsinghua) | arxiv.org/html/… |
Full text, all three experiments, per-model rates, CIs. Tier A. Construct is academic citations, not web URLs — see R62. |
| arXiv 2605.24245 Deep-Research Agents Poisoned via UGC (Cornell Tech) | arxiv.org/html/…v1 |
Full text, all attack/defence tables. Tier A. Non-commercial, NSF/industry-award funded. |
| arXiv 2605.30207 Persona Conditioning of Brand Recommendations (Unusual.ai) | arxiv.org/html/… |
Full text, clustered CIs, per-tier swap rates. Tier A, vendor conflict recorded, precedent-consistent. L4 not estimable. |
| arXiv 2601.08363 PosIR (BUPT et al.) | arxiv.org/html/… |
Full text, PSI by length bucket, per-model. Tier A. Embedding models only — see R65 scope. |
| arXiv 2605.29107 GEO-Bench (USC / ASU) | arxiv.org/pdf FAILED → arxiv.org/html/…v2 |
PDF returned section headers with all result tables unreadable — the documented failure mode, recovered by the HTML route. Full text on retry. Tier A for the benchmark, but single open-weight ranker — see R18 scope limit. |
| arXiv 2608.07933 EvoTrustRAG (UESTC / CAS) | arxiv.org/html/… |
Full text, all tracks and ablations. Tier A in its own setting; tier D if transferred — small open-weight backbones only. |
| arXiv 2603.18300 Auditing Preferences for Brands and Cultures (Stupid Human / Oxford) | arxiv.org/html/… |
Full text, PEIR and log-odds tables. Tier A for the measurement; model set is 2024–early-2025 generation — direction only per R6. |
| arXiv 2604.15937 Polarization by Default (Zurich / NYU / Duke / Amsterdam) | arxiv.org/html/…v1 |
Full text, 540,000 recommendations, all R² and SHAP values. Tier A. Non-commercial. Content-curation domain, not commercial recommendation — transfer is limited. |
| arXiv 2606.23915 Do LLM Attribution Metrics Transfer? | arxiv.org/pdf FAILED → arxiv.org/html/…v1 |
PDF returned compressed streams with no tables — documented failure mode, recovered by HTML. Full text on retry. Tier A. |
| arXiv 2606.12439 Position: GEO Creates Underexamined Risks | arxiv.org/pdf |
Full text of argument. Position paper — no original data. Tier D by construction (reasoned argument, not measurement). Recorded in §3.8, sources no rule. |
Athena-State-of-AI-Search-Report-2026.pdf |
Local Read, pages 1–8 |
Assessed at last, third week carried. Tier C, quarantined — vendor, no methodology, no sample sizes, no intervals. See §7. |
Nothing in this digest rests on the practitioner sweep or on the position paper.
2. The causal experiment, first, because it reorders everything downstream
arXiv 2605.25517, What Gets Cited: Competitive GEO in AI Answer Engines. Vishwakarma, Kumar & Jamidar (Sprinklr). SIGIR '26, accepted. Tier A.
This is the design the library has been missing for six digests. Every prior content finding has been observational — counts of what happens to be cited. This one manipulates one variable at a time and measures what changes.
Design. 100 product-review articles across 50 B2C categories, all brand names, product models and publisher identities replaced with fictional aliases by GPT-4o to eliminate familiarity bias. From these, 1,440 base scenarios (80 per factor), each a pair of variants differing in exactly one factor, matched on facts, prices, specifications and length to within ±5%. Three query paraphrases per scenario → 4,320 scenario-query instances, each repeated 5 times, source order counterbalanced for 17 of the 18 factors (position is the treatment in the 18th). 252,000 trials. Outcome: which source is cited first. Analysis: logistic mixed-effects models with random intercepts by scenario and scenario-order, odds ratios reported after adjusting for position bias.
Models: Gemini-2.5-Flash, GPT-5-Nano, GPT-5-Mini, GPT-5.2, Claude-3.5-Sonnet, Kimi-K2-Thinking.
The full factor table, as extracted. Bold = p < 0.05.
| Factor | Gemini 2.5 | Claude 3.5 | Kimi K2 | GPT-5-Nano | GPT-5-Mini | GPT-5.2 | Consensus |
|---|---|---|---|---|---|---|---|
| On-Topic vs Off-Topic | >>10k | >>10k | >>10k | 221 | >>10k | >>10k | Unanimous gatekeeper |
| Price vs No Price | >>10k | >>10k | 36.1 | 7.82 | 6.26 | 30.4 | Unanimous gatekeeper |
| Recent vs Old Timestamp | >>10k | >>10k | 68.7 | 14.4 | 1,494 | >>10k | Unanimous gatekeeper |
| Position 1 vs 2 | >>10k | >>10k | >>10k | 2,002 | 1,795 | >>10k | Unanimous gatekeeper |
| Deep vs Shallow Coverage | 1,480 | >>10k | 132 | 5.33 | 19.5 | 3.98 | Strong |
| Specs vs No Specs | 8.63 | >>10k | 238 | 11.5 | 15.4 | 243 | Strong |
| Confident vs Hedged | 599 | 754 | 10.6 | 2.67 | 5.44 | 4.75 | Strong |
| Evidence vs No Evidence | 8.00 | >>10k | 46.3 | 2.73 | 5.91 | 2.09 | Strong |
| Strong vs Weak Social Proof | 6.61 | >>10k | 25.4 | 3.13 | 4.78 | 2.14 | Strong |
| Query Terms vs Missing | 9.41 | 17.0 | 16.4 | 5.99 | 14.4 | 40.0 | Strong |
| Strong vs Weak Value Prop | 5.22 | 5.66 | 7.24 | 2.79 | 2.68 | 1.53 | Moderate |
| Consistent vs Contradictory | 2.81 | 2.81 | 2.72 | 2.19 | 4.09 | 1.74 | Moderate (5/6) |
| With vs No Comparisons | 7.45 | 4.55 | 4.72 | 2.14 | 1.78 | 1.61 | Moderate (4/6) |
| No vs Old Timestamp | 2.32 | 2.28 | 1.33 | 1.31 | 1.55 | 1.48 | Weak |
| Recent vs No Timestamp | 1.99 | 13.0 | 3.67 | 1.15 | 3.53 | 1.99 | Weak / inconsistent |
| Organized vs Scattered | 2.21 | 3.87 | 2.49 | 1.19 | 1.13 | 1.57 | Weak / inconsistent |
| Neutral vs Promotional | 1.45 | 362 | 2.02 | 1.31 | 1.81 | 2.08 | Weak / inconsistent |
| Structured vs Dense | 1.68 | 1.03 | 0.79 | 0.90 | 0.78 | 1.25 | NO EFFECT |
Read the three timestamp rows together — this is the mechanism, and it is not what folklore says. Recent-vs-old is enormous. No-timestamp-vs-old is positive but weak (1.31–2.32), meaning having no date beats having an old one. Recent-vs-no-timestamp is inconsistent (1.15–13.0, significant on three of six). The lever is therefore a penalty for visible staleness, not a bonus for freshness. Deleting a stale date recovers most of the loss; adding a recent one on top of no date buys little. That is an actionable, non-obvious and cheap operational finding.
★ Methodological note. The >>10k cells are not effect sizes. They are quasi-complete separation —
the favoured variant won essentially every trial, so the odds ratio has no stable upper bound. The
honest reading of >>10k is "deterministic in this design", not "ten thousand to one". Any LBOX
deliverable quoting these must say deterministic, never a number. Where a finite figure exists
(Kimi 68.7, GPT-5-Nano 14.4, GPT-5-Mini 1,494) that is the quotable magnitude, and its spread across
models is itself the finding.
Why this is tier A despite a vendor conflict. All three authors are employed by Sprinklr, which sells brand-visibility tooling, and the paper mentions an internal Sprinklr pilot. Our vendor-preprint rule caps such sources at B unless the method is unusually conservative and the conflict cannot plausibly shape the result. Both conditions hold here, and this is the strongest case in the library:
- Peer review at SIGIR — a venue named in our own README as one that matters most for this thesis. No prior vendor source in this library has passed that filter.
- The method is the most conservative we have read: brand anonymisation, single-factor isolation, matched length and facts, counterbalanced order, mixed-effects adjustment for position bias.
- The headline result cuts against the seller's interest. The single clearest finding is that formatting and structure do nothing — the most commonly sold GEO deliverable in the market. A vendor shading results toward its own product does not publish that.
Precedent-consistent with digest 03 holding Unusual's 37k audit at A. Recorded, not waved away.
Limitations, verbatim and load-bearing. "Production RAG often retrieves five to ten or more pages, so real citation pools are larger than our testbed" — this is a two-document contest, and the authors say each additional page would introduce simultaneous changes that break single-lever attribution. "We anonymized brands and publishers so citation choices reflect the text, not a famous name… Production systems may still favor trusted domains or strong brands when they pick sources" — so this measures the text-only contribution with prominence deliberately removed, which is exactly the residual R1 says is small. And GPT-4o generated the corpus and the paired rewrites, with three authors doing a stratified review of 300 scenarios as the check.
Model-generation warning, per R6. The set is mixed: GPT-5.2, GPT-5-Mini, GPT-5-Nano and Kimi-K2-Thinking are current, but Claude-3.5-Sonnet and Gemini-2.5-Flash are two generations stale. Claude-3.5 is also the model showing the most extreme values (754 on hedging, 362 on promotional tone,
10k on five factors). Any transfer of these numbers to claude-opus-4-7 or gemini-3.1-pro is unsupported. The ordering of factors is consistent across all six and is what carries.
3. Tier A and B findings
3.1 Freshness resolved in part — see §2. Consequences in §4 (R58, R60) and §5 (CP-01).
3.2 GhostCite: the citation-validity range, and the death of self-verification — arXiv 2602.06718. Tier A.
Xu et al., Nankai University and Tsinghua University. 13 production LLMs, 40 arXiv CS domains, 375,440 citations generated across 22,800 API interactions (~$800), verified by a three-stage CiteVerifier pipeline (GROBID parse → DBLP/Google Scholar → web fallback), Levenshtein title similarity at θ = 0.9. Manual accuracy check of the classifier: valid 100%, invalid 98% (392/400).
Per-model hallucination rate, with 95% CIs:
| Model | Rate | 95% CI |
|---|---|---|
| Hunyuan-A13B | 94.93% | ±1.29 |
| Phi-4 | 87.47% | ±1.60 |
| Grok-4-Fast | 79.98% | ±1.88 |
| UI-TARS (Seed) | 78.64% | ±2.74 |
| ERNIE-4.5 | 71.90% | ±2.15 |
| Gemini-2.5-Pro | 59.47% | ±2.34 |
| GPT-5 | 50.92% | ±2.36 |
| Llama-4-Maverick | 45.84% | ±2.36 |
| Kimi-K2 | 41.86% | ±2.44 |
| Qwen3-Max | 23.52% | ±1.99 |
| Claude-Sonnet-4 | 21.84% | ±1.93 |
| GLM-4.5 | 21.25% | ±1.94 |
| DeepSeek-V3.1 | 14.23% | ±1.65 |
| Overall invalid | 50.29% |
Domain spread: Computation and Language 28.80% → Digital Libraries 80.19%, a 51.4-point gap. Within one model (DeepSeek): Computer Vision 2.6% → Operating Systems 52.5%.
Two findings that matter more than the range.
First, the recency gradient in fabrication. Hallucination rate by the claimed publication year of the citation: 2000 → 27.61%, 2025 → 98.75%, exponential fit R² = 0.94. Models fabricate recent references almost totally. This is the mirror image of the Vishwakarma finding and it is a caution attached to it: engines reward recent dates on retrieved content, and fabricate recent references when generating from memory. The two together describe a system with a strong recency preference and no recency verification.
Second, LLMs cannot check citations. Judging a balanced 100-citation ground-truth set (50 valid, 50 invalid), the 13 models average 38% overall accuracy — worse than coin-flipping:
| Model | Valid recall | Invalid precision | Accuracy |
|---|---|---|---|
| ERNIE | 12% | 100% | 56% |
| Hunyuan | 38% | 58% | 48% |
| GPT-5 | 16% | 56% | 36% |
| Gemini | 40% | 24% | 32% |
| Claude-4 | 24% | 30% | 27% |
| Average (13) | 30% | 46% | 38% |
Construct warning, and it is the same trap R41 caught. These are academic bibliographic citations, not web URLs. The paper's own scope statement confines CiteVerifier to structured scholarly references. GhostCite's 14–95% does not compete with, supersede, or qualify R50's 3–13% commercial web-URL figure. Different construct, different measurement, different use. See R62.
Archival half: 56,381 papers (2020–2025), 2,199,409 citations, 16 assistants verifying over a month. Invalid rate rose 0.89% (2020–24) → 1.61% (2025), +80.9%. 603 ghost citations, 136 metadata errors. Authors state the figures are "a conservative lower bound".
3.3 The UGC attack surface — arXiv 2605.24245 (Cornell Tech). Tier A.
Zhang, Triedman & Shmatikov. NSF 2311521/2428949, Amazon and Google academic awards, NSF GRFP. No commercial conflict. 176 queries across 11 topic clusters, Serper retrieval, five deep-research systems (STORM, Co-STORM, OmniThink open-source and injected; OpenAI Deep Research and Gemini Deep Research reconnaissance only, for stated ethical reasons).
UGC is a large and concentrated share of what these agents read.
| System | UGC share of retrieved URLs | Reddit share of that UGC | UGC share of cited sources |
|---|---|---|---|
| OmniThink | 23.4% | 53.7% | 18.9% |
| STORM | 18.7% | 66.1% | 18.6% |
| Co-STORM | 16.7% | 70.7% | 16.9% |
| Gemini Deep Research | — | — | 12.1% |
| OpenAI Deep Research | — | — | 0.4% |
That last row is a 30-fold engine-level difference in UGC exposure and belongs in any client threat assessment alongside R51.
A 13-word appended snippet is enough. SERP-snippet attack, domain-prefix targeting: STORM 90.3% exposure / 72.9% citation / 51.4% mention; Co-STORM 66.7 / 66.7 / 40.7; OmniThink 86.4 / 39.9 / 20.0. Dose-response saturates fast — on the comcast_cancel cluster, mention-given-exposure runs 15.4% at ~8 words, 72.2% at ~13, and 100% at ~21 on Co-STORM. Longer payloads add nothing.
All three obvious defences fail, and two fail in the wrong direction.
- Perplexity detection points backwards. Injected text has lower perplexity than organic (GPT-2: 3.29 vs 3.51). AUROC 0.615–0.675 across GPT-2, log-rank and Binoculars. The authors' phrase: "Discriminative signal points in the wrong direction."
- Output-plausibility filtering fails. Poisoned reports are more similar to their clean counterparts (embedding 0.857–0.889) than clean reports are to each other (0.723–0.796). A plausibility filter flags the honest run.
- Source blocking works and is nearly free — dropping UGC domains on Co-STORM cost 0.04 rubric points (4.30 → 4.26) and 0.019 information diversity. It is the only defence that survives, and it is only available to whoever controls retrieval.
Authors note the payload is appended at the end of content — "the least favorable position for the attacker… a conservative lower bound".
3.4 Persona conditioning, and R22's missing source — arXiv 2605.30207 (Unusual.ai). Tier A.
Jack, Lehman, Maloney & Xu. 10 hand-curated personas × 8 prompts × 3 cells × N=10, 2,000 runs, against the same 533-brand L1–L5 reference set as digest 03/05.
Aggregate persona-shift effect (within-persona minus cross-persona Jaccard):
| Cell | Within | Cross | Δ | Clustered 95% CI |
|---|---|---|---|---|
| gpt-5.4-mini / low | 0.467 | 0.346 | −0.12 | [−0.153, −0.091] |
| gpt-5.4-mini / high | 0.505 | 0.343 | −0.16 | [−0.194, −0.139] |
| claude-sonnet-4-6 / low | 0.424 | 0.222 | −0.20 | [−0.263, −0.156] |
All three exclude zero. The largest persona effect is on the Anthropic cell, which fits R37: a model generating more from priors and less from retrieval has more room for the framing of the asker to move the answer.
Per-tier swap rate (1 − cross-persona Jaccard) — this is R22's source, at last:
| Prominence | gpt-5.4-mini/high | gpt-5.4-mini/low | claude-sonnet-4-6/low |
|---|---|---|---|
| L1 Leaders | 0.23 | 0.29 | 0.20 |
| L2 Challengers | 0.05 | 0.13 | 0.23 |
| L3 Mid-market | 0.75 | 0.67 | 0.39 |
| L4 Specialists | undersampled | undersampled | undersampled |
| L5 Regional | 0.27 | 0.33 | — |
L3 is three to fifteen times more persona-sensitive than any other tier. Digest 03's "0.39–0.75" was exactly right and is now fully sourced with a design behind it.
Persona corpora differ in their own concentration: us_ecommerce_operator 0.65 and enterprise_vp_us_procurement 0.57 are sharp; eu_finance_manager_germany 0.27 and uk_smb_owner_london 0.39 are scattering. Limitations: single day, English only, US/UK/EU skew, sonnet cell at 4 prompts rather than 8 (widening its CI), L4 not estimable, and the authors are explicit that the priors-versus-retrieval explanation rests on "cross-paper co-occurrence, not… within-run joint measurement".
3.5 Aggregate stability versus per-run stability — arXiv 2603.18300. Tier A, dated models.
Rienecker et al., Stupid Human with University of Oxford. 3 models (ChatGPT-4o, Gemini 1.5-Flash, DeepSeek-V3), 20 topics, 2,070 questions, 5 repetitions each in fresh sessions, Swedish IP.
Preferred-entity inclusion rates are high and remarkably stable: average PEIR Gemini 71.2%, GPT 75.9%, DeepSeek 70.3%; Samsung reaches 91.0/97.1/100.0%, Tesla 90.7/92.2/88.9%. Across repetitions, Spearman rank correlation 0.952–1.00, all p < 0.001, Kruskal-Wallis non-significant.
US-origin preference is large and significant nearly everywhere: laptops US-vs-Europe log-odds 4.38 / 4.96 / 4.02 (exp(4.96) ≈ 143×), universities US-vs-Asia 3.74 / 4.96 / 4.94, telecom 3.57 / 4.94 / 3.12. DeepSeek shows smaller geographic preference, and inverts on weekend cities (−1.00). Behavioural note: GPT gave a direct recommendation 97.5% of the time, Gemini 73%.
The reconciliation this forces is the important part. This paper reports near-perfect stability; 2605.30207 reports per-prompt Jaccard as low as 0.222 and L3 swap rates of 0.75; digest 03/05 put the rerun floor at 0.50–0.61. These do not conflict — they measure different objects. Rank correlation of aggregate inclusion rates across many questions is stable by construction; per-run set membership is not. A visibility metric built on the first and sold as if it were the second would look far more reliable than it is. See R69.
Model set is 2024–early-2025 generation. Per R6, direction carries, percentages do not.
3.6 Position bias is a length problem — arXiv 2601.08363 (PosIR). Tier A, embedding models.
Zeng et al. 10 languages, 31 domains, 310 datasets, 421,708 queries over 17,329,673 documents, 10 embedding models. Position Sensitivity Index (PSI), 0–1, lower is better.
| Document length | Mean PSI |
|---|---|
| ≤512 tokens | 0.18 |
| ≤1024 | 0.32 |
| ≤1536 | 0.39 |
| ≤2048 | 0.41 |
Retrieval quality collapses with length in the worst case: NV-Embed-v2 nDCG@10 70.48 → 47.12 → 26.33 → 16.27 (−77%); the robust end, inf-retriever-v1, 74.71 → 54.68 (−27%). Most models show primacy bias (gte-multilingual-base 0.21 → 0.62); NV-Embed-v2 is the atypical recency-biased J-curve (0.19 → 0.81). Benchmark correlation with MMTEB degrades from 0.73 at Q1 to 0.39 at Q4 — standard benchmarks stop predicting real behaviour precisely where documents get long.
This is the mechanism sitting underneath FORGE's rank-1 result and Vishwakarma's Position-1 gatekeeper: where a claim sits inside a long document determines whether it is retrievable at all. Scope: dense embedding retrievers, not end-to-end commercial engines; the authors flag cross-encoders as likely more robust and untested at scale.
3.7 GEO-Bench: no manipulation is simultaneously effective, stealthy and fluent — arXiv 2605.29107. Tier A, single ranker.
Nimase, Chen, Qi, Zhao (USC) and Hu (ASU). Five datasets (Ragroll, STSData, RewriteToRank, LLM Rank Optimizer, C-SEO Bench — 16,360 items), 8 primary manipulation strategies plus 10 white-hat rewrites, ~200 GPU hours, code released.
Averaged normalised rank gain: TAP 0.53, Authoritative 0.40, Content Improvement 0.40, STS 0.31, StealthRank 0.25, Zero-Shot 0.12, RAF 0.04. But the trade-off is the finding: TAP achieves it at keyword-violation rate 0.96 (trivially detectable); STS keeps KVR at 0.03–0.20 but wrecks fluency (perplexity ratio up to 12.72); RAF is stealthy and ineffective (NRG ≤ 0.09). The authors' conclusion: "No adversarial attack is at once effective, keyword-stealthy, and fluent."
The white-hat exception matters commercially. On C-SEO Bench, plain "Authoritative" rewriting reaches NRG 0.83 with KVR 0.00 and PPL-R 0.74 — matching or beating gradient-based attacks while staying fluent and undetectable, because it is not an attack. Legitimate content work is competitive with manipulation on this benchmark.
Two cautions bound all of it. Single open-weight ranker (Llama-3.1-8B-Instruct) — per R18 these numbers do not transfer to commercial engines. And "Method rankings are unstable across datasets": Authoritative scores 0.83 on C-SEO Bench and 0.00 on two others; TAP tops one of five. That instability is itself a confirmation of R39.
3.8 Two sources that inform but source no rule
arXiv 2604.15937 Polarization by Default (Zurich/NYU/Duke/Amsterdam). Tier A, adjacent domain. 540,000 simulated top-10 selections, 3 models, 3 platforms, 6 prompt styles. Polarization is the dominant selection driver (R² = 0.055, significant in 98.1% of conditions; SHAP 0.108–0.125, the top feature for all three models). Prompt framing moves bias four-fold — "controversial" and "informative" maximise it, "popular" minimises it. Toxicity splits by instruction: engagement prompts amplify (Claude +0.138, Gemini +0.120), informative prompts suppress (Claude −0.103). Demographic features have near-zero direct SHAP (<0.03) while still producing measurable bias — indirect discrimination through content correlates. This is content curation, not commercial recommendation. It is recorded because it independently demonstrates that the wording of the instruction is a first-order variable (supporting R42 and R70), not because its effect sizes transfer.
arXiv 2606.12439 Position: GEO Creates Underexamined Risks. Tier D — position paper, no data. Argues for governance targeting vendor concentration, method disclosure and conflict-of-interest disclosure, referencing EU AI Act Article 57 and NIST AI 600-1. It presents no original measurement and therefore sources no rule. It is nonetheless the clearest external statement of the disclosure posture LBOX has been building toward, and it names the exact failure mode this library was founded to avoid: vendors publishing unaudited numbers about the thing they sell. Relevant to positioning, not to evidence.
4. Extracted rules
MUST
- R57. Clear the four gatekeepers before any other content work: topical relevance, an explicit price, a recent visible date, and rank-1 position in the retrieval pool. All four are unanimous across six models in the only single-factor causal design in the library; every other lever is second-order until they are satisfied. (A, 2605.25517)
- R58. Where a page carries a date, keep it current; where it carries a stale date and cannot be genuinely updated, remove the date rather than leave it. Recent-vs-old is deterministic on four of six models (finite where estimable: 68.7 / 14.4 / 1,494); no-timestamp-vs-old is 1.31–2.32; recent-vs-no-timestamp is inconsistent. The measured penalty attaches to visible staleness. (A, 2605.25517)
- R59. Put explicit prices and specifications on commercial pages. Price is a gatekeeper (6.26–>>10k); specifications are a strong differentiator (8.63–243). This supersedes generic "add more detail" advice with two named, measured artifacts. (A, 2605.25517)
- R60. State confidently, without hedging, where the claim is defensible. Confident-vs-hedged runs 2.67–754. This is a distinct lever from authoritative claims, which R38 correctly says do nothing — the measured effect is the removal of hedging, not the addition of authority. (A, 2605.25517)
- R61. Verify citations with a tool that resolves them, never by asking a model. LLM citation judgment averages 38% accuracy on a balanced set (Claude-4 27%, ERNIE valid-recall 12%), while a resolver tool delivers 6.4×–79× reduction in non-resolving URLs. Pair with R5. (A, 2602.06718 + 2604.03173)
- R62. Keep the two citation-fabrication constructs separate. R50's 3–13% is the commercial web-URL figure and remains operative for all client statements. GhostCite's 14.23–94.93% is academic bibliographic citation validity and must never be quoted as a web-citation rate. This is the same error R41 prohibited, in a new guise. (A, 2602.06718)
- R63. Keep the load-bearing claim early and the document short. Position sensitivity rises 0.18 → 0.41 from ≤512 to ≤2048 tokens and retrieval quality falls by up to 77%; most retrievers are primacy-biased, one is not. Scope: dense embedding retrieval. (A, 2601.08363)
- R64. Treat UGC — Reddit above all — as both a retrieval channel and an attack surface. UGC is 16.7–23.4% of retrieved URLs on open deep-research agents, Reddit is 53.7–70.7% of that, and a 13-word appended snippet reaches 55–73% citation. Engine exposure ranges from 0.4% (OpenAI Deep Research) to 12.1% (Gemini Deep Research). (A, 2605.24245)
- R65. Report per-dataset, per-construct measurement results and name the construct. Attribution metric rankings do not transfer: Kendall's W = 0.07, a τ = −0.64 rank inversion between two datasets, and an NLI scorer moving AUROC 0.904 → 0.531 (chance). Choosing the best-on-average metric carries 0.172 AUROC mean regret. (A, 2606.23915)
- R66. Distinguish aggregate stability from per-run stability in every deliverable. Aggregate inclusion rates rerun at Spearman 0.95–1.00; per-prompt recommendation sets rerun at Jaccard 0.50–0.61 and shift to 0.22–0.35 under persona change. A metric built on the first and sold as the second overstates its own reliability. (A, 2603.18300 + 2605.30207)
- R67. Treat persona and asker-framing as a first-order design variable, and price L3 engagements accordingly. Persona shift moves recommendation overlap by Δ −0.12 to −0.20 (all CIs exclude zero), and L3 mid-market swap rates reach 0.39–0.75 against 0.05–0.29 at L1/L2/L5. The largest aggregate effect is on the Anthropic cell. (A, 2605.30207)
MUST NOT
- R68. PROHIBITED — date fabrication. Do not bump, backdate or synthesise a publication or "last updated" date on content that has not genuinely changed, and do not sell it. The Vishwakarma design holds content identical and varies only the date string, so the measured gatekeeper effect is available to anyone willing to edit a date — and EvoTrustRAG shows injecting a fabricated date/event drives false "this fact was updated" attribution to 23.0–25.1% on baseline systems. Recorded, per the standing invariant, because competitors will do it and clients must know it exists. (A, 2605.25517 + 2608.07933)
- R69. Do not sell formatting, structure or reformatting as a visibility lever. Structured-vs- dense prose is the only factor of eighteen with no consensus effect on any model (OR 0.79–1.68). Organisation and promotional tone are weak and inconsistent. Deprioritise; the authors' own checklist says formatting "showed minimal ROI and can be deprioritized." (A, 2605.25517)
- R70. Do not propose perplexity, AI-text detection or output-plausibility checks as pollution defences. Injected text has lower perplexity than organic (AUROC 0.615–0.675, signal inverted), and poisoned reports are more similar to clean counterparts (0.857–0.889) than clean reports are to each other (0.723–0.796) — a plausibility filter flags the honest run. Source blocking is the only defence measured to work, at a cost of 0.04 rubric points. (A, 2605.24245)
- R71. Do not carry GEO-Bench manipulation numbers to commercial engines. Every figure is against a single open-weight ranker (Llama-3.1-8B-Instruct), and method rankings are unstable across datasets — the top method scores 0.83 on one and 0.00 on two others. (A, 2605.29107; scope per R18)
- R72. Do not quote effect sizes reported as
>>10k. They are quasi-complete separation, not magnitudes. Say "deterministic in this design", or quote only the finite cells. (A, 2605.25517)
WORKS / DOESN'T WORK — updated
| Works | Doesn't work |
|---|---|
| Explicit price on the page (gatekeeper) | Reformatting and restructuring (no effect, 0/6 models) |
| A current visible date — or none at all | Leaving a stale date in place |
| Technical specifications (8.63–243) | Promotional tone (weak, inconsistent) |
| Confident, unhedged phrasing (2.67–754) | Authoritative claims (R38, unchanged) |
| Evidence attached to claims (2.09–>>10k) | Q&A-formatted pages (−5.7%, R56) |
| Depth of coverage, social proof, comparisons | Adding runs to a single-prompt design |
| Owning rank 1; keeping claims early in short docs | Long documents (PSI 0.41, nDCG −77%) |
| Tool-based citation resolution (6.4×–79×) | Asking a model to check citations (38%) |
| Blocking UGC at retrieval, where you control it | Perplexity / plausibility filters (signal inverted) |
| Per-construct, per-dataset metric reporting | One attribution metric across datasets (W = 0.07) |
5. Revalidation of standing rules
Every prior rule, as required. No rule is silently dropped.
| Rule | Status this week |
|---|---|
| R1 parity signals dominate; brand identity ~1.2–1.5% of variance | CONFIRMS, and now with the cleanest possible test. 2605.25517 removes brand identity by anonymisation and still finds enormous content-factor effects — the residual text contribution is large once prominence is stripped out. Counterweight recorded: 2603.18300 finds PEIR of 70–76% and log-odds up to 4.96 for US-origin entities, i.e. identity does dominate unanonymised selection. Both are true; R1 governs behaviour inside a consideration set. |
| R2a publish verifiable third-party authority evidence | CONFIRMS — upgraded from correlational to causal. Evidence-vs-no-evidence is a strong differentiator across all six models (2.09–>>10k). Digest 05 had this from absorption correlations; it is now a manipulated variable. |
| R2b authoritative register is not a lever | QUALIFIED — the register splits into two variables. Adding authority claims remains not a lever (R38 stands; neutral-vs-promotional is weak and inconsistent). Removing hedging is a strong lever (2.67–754). These were conflated. See R60. |
| R3 tune intensity per engine | CONFIRMS on three further axes. Timestamp effect 14.4 → 1,494 across models; UGC citation exposure 0.4% → 12.1%; citation-fabrication 14.23% → 94.93%. |
| R4 competitor GEO adoption is existential | CONFIRMS, and the toolkit is now public. GEO-Bench ships code and standardised datasets for eight manipulation strategies. The barrier to entry for adversarial GEO fell this week. |
| R5 verify every engine-supplied citation | CONFIRMS and gains a hard constraint on how. Verification must be tool-based; model-based verification averages 38%. See R61. |
| R6 state model set and date | CONFIRMS, and had to be enforced three times — on 2605.25517 (Claude-3.5 and Gemini-2.5 are two generations stale), 2603.18300 (2024–early-2025 models), and GhostCite (2024–2025 model snapshots). |
| R7 PROHIBITED — fabricated authority | CONFIRMS and EXTENDS to a new and cheaper vector. Date fabrication now joins fabricated consensus and fabricated evidence: it is a measured gatekeeper obtainable by editing a string, and fabricated date/event injection reaches 23–25% false-evolution attribution. Recorded as R68. |
| R8 don't stack persuasion tactics blindly | CONFIRMS. Of eighteen isolated factors, seven are weak or null. Stacking untested tactics buys mostly nothing, and R52's backfire shows the sign is not guaranteed. |
| R9 don't invest in scarcity / loss-aversion / anchoring | NO NEW EVIDENCE. Stands. |
| R10 no single-run measurement | CONFIRMS. Still necessary, still insufficient without R42. |
| R11 no tier C/D presented as established | CONFIRMS, applied four times — Athena held at C, 2606.12439 recorded D as a position paper, EvoTrustRAG marked D if transferred, GEO-Bench scope-limited per R18. |
| R12 test each engine's believed brand origin | CONFIRMS, strongly, with the best numbers yet. 2603.18300: US-vs-Europe log-odds 4.38/4.96/4.02 on laptops (≈143× on GPT), US-vs-Asia 4.94–4.96 on universities. Origin belief is measurable and large. |
| R13 geo-stratify every measurement | CONFIRMS. PosIR spans 10 languages and finds cross-lingual PSI (0.16) differs from monolingual (0.18); 2603.18300 controlled IP origin deliberately and flags it as a variable. |
| R14 counterfactual location probes | CONFIRMS by method. 2603.18300 ran from a Swedish IP specifically to hold geography constant and names varying IP origin as the next experiment — the counterfactual probe R14 specifies. |
| R15 measure origin sensitivity per engine | CONFIRMS. DeepSeek shows systematically smaller geographic preference than GPT/Gemini and inverts on one topic (−1.00). Origin sensitivity is engine-specific. |
| R16 don't infer bias from where the engine was built | QUALIFIED — mildly, and honestly. DeepSeek (Chinese-built) does show the smallest US preference, which is the pattern R16 warns against assuming. One model, one study, old generation: not enough to overturn a prohibition on inference. R16 stands; the co-occurrence is recorded. |
| R17 don't assume local-to-buyer framing helps | CONFIRMS with a mechanism. Persona corpora differ in concentration — uk_smb_owner_london (0.39) and eu_finance_manager_germany (0.27) scatter recommendations rather than sharpening them. Local framing widens the set; it does not target it. |
| R18 don't carry open-model effects to commercial engines | CONFIRMS emphatically, and had to be enforced twice. GEO-Bench is one 8B ranker; EvoTrustRAG is 7–8B backbones. Both are tier A in their setting and non-transferable. See R71. |
| R19 classify on the prominence ladder first | CONFIRMS from a fourth dataset, with a fourth distinct use. The ladder now predicts visibility (d03), diagnostic portability (d05), and persona sensitivity (this week: L3 0.39–0.75 vs L1 0.20–0.29). |
| R20 L4–L5: discoverability is the whole problem | NO NEW DIRECT EVIDENCE — and a gap is now explicit. L4 was undersampled on every cell of 2605.30207 and could not be estimated. The tiers we say least about remain the hardest to sample. |
| R21 L1: invest at S2–S3 | CONFIRMS indirectly. L1 persona swap is low (0.20–0.29) — leaders are stable across askers, so their failures are not about who is asking. Consistent with L1 failing on compellingness rather than surfacing. |
| R22 L3: all three failures, persona instability 0.39–0.75 | CONFIRMED AND SOURCED. The 0.39–0.75 figure was carried for five digests without a traced primary. It is arXiv 2605.30207: L3 swap 0.75 (gpt-5.4-mini/high), 0.67 (low), 0.39 (sonnet), against 2,000 runs with clustered CIs. R22 is now a tier-A rule rather than an inherited number. |
| R23 establish a rerun-stability baseline per cell | CONFIRMS, and gains a necessary companion. The 0.50–0.61 floor reproduces again. But 2603.18300 shows a different stability metric on the same phenomenon reads 0.95–1.00. Baselines must name the object measured. See R66. |
| R24 measure through more than the native tool | CONFIRMS. UGC citation share ranges 0.4%–18.9% across five agent systems on comparable queries. |
| R25 separate descriptive from causal | CONFIRMS — and this week the library finally has a causal source. 2605.25517 is the first single-factor manipulation in six digests. Its causal claims are bounded to a two-document contest with brands anonymised, and it says so. |
| R26 don't sell reputation work to L4–L5 without establishing surfacing | CONFIRMS. Axis 9 returned its FOURTH consecutive null. Four sweeps, no published sentiment→recommendation effect in answer engines. This is no longer an absence of search effort; it is a stable fact about the field. |
| R27 don't quote Aggarwal +40% as uniform | CONFIRMS, and is now superseded in practice. 2605.25517 provides per-factor, per-model odds ratios for eighteen factors — there is no longer any reason to quote a single pooled GEO uplift figure. |
| R28 transfer within a provider, not across | CONFIRMS. Consistent factor ordering across GPT-5-Nano/Mini/5.2 in 2605.25517; the cross-provider extremes (Claude-3.5 at 754 and 362) are where the outliers sit. |
| R29 no rules from uncited practitioner articles | CONFIRMS, and this week it paid. The practitioner tier's "3× more likely to lose citations if not updated quarterly" reappeared for the third time (§7) — and the real number, from a peer-reviewed factorial, is a different mechanism entirely (staleness penalty, not decay curve). Folklore was directionally lucky and mechanistically wrong. |
| R30 claim only conditional effects | CONFIRMS. Nothing this week demonstrates durable cross-platform discoverability gain. 2605.25517 is explicitly a within-retrieval-set contest. |
| R31a/b recommendation raises search and visits; no volume/conversion claims | NO NEW EVIDENCE. Both halves stand. |
| R32 size samples by outcome (≥7–8 runs) | CONFIRMS on counts, and the interval caveat hardens. 2606.23915 adds a second failure axis: even a correctly-sized sample gives a metric that does not transfer across datasets (W = 0.07). Sample size and metric validity are separate problems. |
| R33 query language is a first-order design factor | CONFIRMS. PosIR spans 10 languages; 2603.18300 is English-only and names language as an untested variable. |
| R34 report always/never/unstable splits | CONFIRMS and sharpens. The always/never/unstable split is the reconciliation between 0.95 aggregate stability and 0.39–0.75 per-run swap: deterministic cells inflate aggregate correlation while unstable cells drive per-run divergence. |
| R35 price sentiment separately from mention | CONFIRMS. Axis 9 null for a fourth time; no counter-evidence. |
| R36 measure engine self-promotion where the client competes with the provider | NO NEW EVIDENCE this week; the self-promotion paper (3795766.3799780) re-surfaced but was already read in digest 04. |
| R37 content/retrieval levers have less purchase on Anthropic models | CONFIRMS from a new direction. claude-sonnet-4-6 shows the largest persona effect (Δ −0.20, CI [−0.263, −0.156]) — a model leaning on priors is moved more by who is asking and less by what is retrieved. Mechanistically consistent, and the authors are careful to say the link is co-occurrence, not joint measurement. |
| R38 authoritative tone is not a lever | CONFIRMS as written, but see R2b. Promotional/authoritative framing is weak and inconsistent (1.31–2.08 on five of six models). The hedging finding is a different variable and does not overturn this. |
| R39 generic GEO heuristics/recipes are unreliable | CONFIRMS twice, hard. GEO-Bench: "method rankings are unstable across datasets", the best method scoring 0.83 and 0.00 on different sets. 2605.25517: formatting recipes have no effect at all. The recipe industry is measuring nothing. |
| R40 don't recommend "cite external sources" uniformly | CONFIRMS with the nuance now resolved. Attaching evidence to your own claims is a strong lever (R2a, 2.09–>>10k). Adding citation chains remains an attack vector (R40, SearchGEO Mode 3). The distinction is between supporting a claim and performing authority. |
| R41 don't carry 11.4–56.8% into commercial brand citation | STANDS AS HISTORY — and its lesson recurs immediately. GhostCite's 14–95% is this week's version of the same trap. R50 remains the commercial figure; R62 now names the new construct explicitly. |
| R42 no naive confidence intervals | CONFIRMS and gains a second, independent failure mode. 2604.11581 showed intervals under-cover; 2606.23915 shows the metric itself does not transfer (W = 0.07, τ = −0.64 inversion, AUROC 0.904 → 0.531). A correct interval around an invalid metric is still worthless. |
| R43 minimum viable pilot N≥30, V≥3, R≥5 | CONFIRMS and should be extended. 2606.23915's leave-one-dataset-out regret (0.172 naive vs 0.044 for MiniCheck) argues the pilot must also select the metric, not only the sample size. Recommend Adam approve adding a metric-selection arm. |
| R44 match allocation to scoring method | NO NEW EVIDENCE. Stands. |
| R45 distinguish recommendation from mention | NO NEW EVIDENCE. Stands. |
| R46 diagnosis cross-engine, recommendation lists per-engine | CONFIRMS, with a new caveat. Persona shift shrinks cross-persona overlap to 0.222–0.346 — recommendation lists are not portable across askers either, not merely across engines. |
| R47 qualify R46 by prominence and stage | CONFIRMS and extends. The same L3 that is hardest to diagnose is the tier most persona-unstable (0.75). L3 is the hard tier on every axis measured so far. |
| R48 report absorption, not citation count | CONFIRMS — and the practitioner tier gave a live demonstration of the error. Athena (tier C) reports ChatGPT citing 18.86 sources and Perplexity 8.23; the tier-A measurement (2604.25707) finds the opposite ordering, ChatGPT 6.88 and Perplexity 16.35. See §7. |
| R49 produce code, statistics, definitions, comparisons | CONFIRMS causally, and gains two members. Specifications and explicit prices now join the list as manipulated, measured levers rather than absorption correlations. |
| R50 3–13% hallucinated URLs, commercial | CONFIRMS and is explicitly ring-fenced. GhostCite does not touch it — different construct. R62 guards the boundary. |
| R51 engine choice is a security variable | CONFIRMS and widens by an order of magnitude. Add UGC exposure to endorsement ASR: OpenAI Deep Research cites UGC at 0.4%, Gemini Deep Research at 12.1%. |
| R52 skepticism prompting backfires | NO NEW EVIDENCE. Stands, and R70 adds three more failed defences. |
| R53 consensus filters are not free | NO NEW EVIDENCE on recall cost. Stands; queue item #6 still open. |
| R54 reasoning mode does not improve robustness | CONFIRMS from a new angle. gpt-5.4-mini at high reasoning effort shows a larger persona shift (−0.16) than at low (−0.12), and a higher L3 swap rate (0.75 vs 0.67). More reasoning, more susceptibility to framing. |
| R55 don't assume winner-takes-all before measuring | QUALIFIED — evidence now points both ways and the tension is real. 2606.23057 (B) found mean Gini 0.28. 2603.18300 (A) finds preferred-entity inclusion of 70–76% and single brands at 91–100%. The reconciliation is probably that inclusion in a list of several is not concentration of a ranked share — but that is inference, not measurement. R55 stands as a prohibition on assuming; it should no longer be read as evidence against concentration. |
| R56 Q&A-formatted pages are not citation assets | CONFIRMS from an independent design. Formatting broadly shows no effect (R69); the Q&A-specific negative from absorption data is not contradicted. |
Candidate principles
| CP | Status |
|---|---|
| CP-01 temporal decay of citation is category-dependent | PARTIALLY RESOLVED — first movement in four sweeps, and it splits the candidate cleanly in two. The staleness half is PROMOTED to a tier-A rule (R58). arXiv 2605.25517 isolates timestamp from relevance, authority and every other content property by construction, and finds a recent-vs-old date is a unanimous gatekeeper across six models. This is precisely the experiment CP-01 demanded and it answers CP-01's own stated weakness #2 — whether engines respond to a displayed date on unchanged content — in the affirmative, which is why it also generates a PROHIBITION (R68). The category-dependence half and the "compounds over time" clause remain entirely untested: the design is binary (2026 vs 2019) across 50 B2C categories pooled, with no decay curve and no category stratification. Digest 05's recommendation to treat CP-01 as probable folklore is WITHDRAWN. The revised position: staleness carries a large measured penalty; whether that penalty differs by category, and what shape it takes between two years, is still unknown and is now a well-posed, cheap in-house experiment. |
| CP-02 supersession | MOVED AGAIN — first direct measurement of the mechanism, and it is discouraging. arXiv 2608.07933 measures how systems handle facts that changed over time. Vanilla RAG — the closest available analogue to an untuned engine — answers current facts at 70.5% but historical facts at 48.2% and transition facts at 42.0%, with an 18.6% unsupported-claim rate and a 26.5% wrong-filtering rate. In other words, where a fact has been superseded, the baseline system gets it right less than half the time. Purpose-built handling (EvoTrustRAG) lifts transition accuracy to 76.8%, which proves the problem is tractable — but no commercial engine is running it. Tier D if transferred: backbones are Qwen2.5-7B, Llama-3.1-8B and Mistral-7B, all small open-weight models, and R18 forbids the carry. CP-02 remains unresolved and remains the highest-value candidate. The design constraint from digest 05 (probe under task framing) still holds, and a second is added: measure the three-way outcome — correction cited instead of, alongside, or not at all — because the "alongside" case is what a 42% transition accuracy actually looks like from outside. |
| CP-03 category classification sets cadence | SPLIT, as digest 05 recommended, and now actionable. The artifact-type half is fully promoted — it is R49, R56, R59 and R69, with causal backing this week for specifications and price and a null for formatting. The cadence half is no longer orphaned: it depended on CP-01, and CP-01's staleness half has just been evidenced. Cadence is now a live question rather than a dead one — but note the finding reframes it. R58 says the trigger is a visible stale date, not elapsed time since writing, and the cheapest compliant action is often to remove a date rather than to re-publish. A refresh-cadence product justified by CP-01 must now be re-scoped: the measured lever is date hygiene, which is nearly free, not content regeneration, which is not. |
6. What this means for LBOX — including a failure of this library's own process
First, and least comfortable: we had the lead in hand and did not chase it. The row that broke CP-01 open is in Table 4 of arXiv 2607.14035 — "Recency, prices, dates | Moderate | Time-sensitive or commercial queries" — and that survey has been in this folder, read in full, since digest 04 on 2026-08-17. Digest 04 read it, digest 04b and digest 05 followed, and digest 05 ran a dedicated CP-01 query against the open literature — all while a tiered, named factor sitting inside an already-read primary went unextracted. The Vishwakarma paper itself was public from 2026-05-25, three months before digest 05 declared the evidence absent. Digest 05 then went further and recorded a position that freshness was "probably an artifact of practitioner folklore" — a confident conclusion drawn from a search that had missed a source already on the shelf. That position was wrong, and the mechanism of the error is worth more than the correction: we mined new papers for findings and mined old papers only for the findings we went looking for. The README's own rule — mine the reference list of every tier-A paper read — was applied to citation chasing but never to the survey's own evidence tables, which are a reference list by another name. Recommended process change, for Adam's decision: when a survey enters the library, its evidence tables get extracted row by row into the open queue, not just its narrative conclusions. Digest 04's survey is the only one so far; it should be re-mined in full before the next sweep.
Second, the recommendation stack is now causally ordered, and most of it is cheap. For six digests LBOX's content advice has rested on absorption correlations and observational audits. It now rests, at the top, on a 252,000-trial single-factor experiment. The order is: fix topical relevance, put an explicit price on the page, fix the date, fight for rank 1 — then specifications, evidence, depth, social proof, confident phrasing. And stop selling formatting, which is the single most common deliverable in this market and is the only factor of eighteen that moved nothing on any model. Three of the four gatekeepers are close to free. That is commercially awkward in one direction — it shrinks the billable surface of a content engagement — and strong in another: it is a genuinely differentiated, evidence-backed answer to "what should I actually do", and it is the opposite of what a vendor with an hourly incentive would say. Worth noting the honest bound: this is a two-document contest with brands anonymised, so it measures the text's contribution with prominence deliberately removed. It is not a promise about a live ten-source retrieval pool.
Third, date hygiene creates an ethics line we have to walk in public. The measured lever is the displayed date on otherwise identical content. That means the highest-yield version of this advice is also a fabrication — edit a string, gain a gatekeeper — and it is now the cheapest manipulation in the entire library, cheaper than the polluted page and far cheaper than synthetic consensus. R68 prohibits it. But the same evidence gives us a legitimate action that captures most of the value: remove stale dates from pages you are not going to genuinely update (no-timestamp beats old-timestamp at 1.31–2.32), and date-stamp only what has actually changed. That distinction — between representing freshness and manufacturing it — is a clean, defensible position, and it is the kind of thing a client will remember us for when a competitor's agency offers them the other version.
Fourth, "the model can check its own work" is now closed as an option. Thirteen models judging citations average 38% on a balanced set, with Claude at 27%. Any LBOX feature, current or planned, that asks a model to validate its own or another model's citations is not a weak control — it is worse than no control, because it produces a confident pass. Verification is a resolver-tool problem (6.4×–79×) and should be built as one. This is the item most likely to be quietly wrong somewhere in our stack, and it warrants an audit of any place we ask a model to judge a source.
Flag for Adam, unsourced judgement. R55 is now genuinely in tension and I do not want that buried in a table. Digest 05 recorded mean Gini 0.28 and told us not to assume winner-takes-all; this week a tier-A source finds single brands appearing in 91–100% of responses in their category. My reading is that these measure different things — presence in a list versus concentration of ranked share — and that the reconciliation is arithmetic rather than empirical. But I have not proven that, and a client-facing claim about category concentration currently has tier-A evidence pointing in two directions. Recommend we say nothing quantitative about category concentration until we measure it on our own engine set.
7. Practitioner sweep — QUARANTINED, tier C, not usable for any rule
Recorded to detect market narrative only. Every claim below is uncited or vendor-produced.
Themes this week: brands cited in AI Overviews claimed to see a 23% branded-search lift in 30 days and 35% more organic clicks; mentions-plus-citations claimed to give 40% higher likelihood of reappearing, with only 28% of answers containing both; "pages not updated quarterly are 3× more likely to lose citations" — third sighting, still uncited; ~48% of citations claimed to come from community platforms (Reddit, YouTube) and 85% of brand mentions from third-party pages; only 14% of brands claimed to have an AI visibility strategy.
Assessment, and one genuinely instructive collision. The freshness folklore reappeared for a third time and this week we can finally grade it: directionally lucky, mechanistically wrong. Staleness does carry a large penalty — but the measured lever is the visible date, not the update cadence, and the compliant action is often deletion rather than republishing. A client who bought quarterly refresh on the strength of the folklore bought the expensive version of a nearly-free fix. The community-platform claim is the one piece of quarantined material with independent tier-A corroboration this week (2605.24245: UGC 16.7–23.4% of retrieved URLs, Reddit 53.7–70.7% of that) and should be treated as directionally sound and numerically unverified.
Athena-State-of-AI-Search-Report-2026.pdf — ASSESSED at last, third week carried. Tier C,
quarantined permanently. AthenaHQ Research, 2026 edition, "based on AI responses across seven leading
models". Reports: average brand mention rate 16.3%, leaders 56.5%; top-3 share of voice
33.64 / 19.46 / 13.29%; brand's own domain cited in only 16.05% of responses; average 12
sources cited per response; top off-page domains reddit.com 21.85%, youtube.com 10.32%,
en.wikipedia.org 7.34%, linkedin.com 6.51%, forbes.com 5.26%; entry paths /blog 37.5%, /home 19.2%,
/products 13.8%. No methodology section, no sample sizes, no confidence intervals, no disclosure of how
brands were selected, and the vendor sells the metric. It cannot be tiered above C.
One collision is worth recording as a live demonstration of R48. Athena reports per-response source counts of ChatGPT 18.86 and Perplexity 8.23. The tier-A measurement (2604.25707, digest 05) finds the reverse ordering — ChatGPT 6.88, Perplexity 16.35. Two sources, opposite rank order, on a metric a client would reasonably expect to be a simple count. We do not know which is right; we know which is sourced. This is exactly why citation counts are not a visibility metric and why the quarantine tier exists.
8. Open queue — highest priority first
- Re-mine arXiv 2607.14035's evidence tables row by row. The CP-01 miss came from treating a survey as a narrative rather than as an index of primaries. Every factor row with a confidence rating is a queue item. Do this before the next sweep. (New, from §6.)
- Fix the interval methodology before the next client deliverable — R43 pilot (N≥30, V≥3, R≥5) on LBOX's own engine set. Now extended: add a metric-selection arm, per 2606.23915 (naive best-on-average regret 0.172 AUROC vs 0.044). Carried from digest 05 #1, unmoved, and it is still the cheapest differentiator available. (2604.11581 + 2606.23915.)
- Audit every place in the LBOX stack where a model judges a source or a citation. GhostCite puts model citation-judgment at 38% average, 27% on Claude. If any feature does this, it is producing confident false passes today. Replace with a resolver. (New, from 2602.06718 — highest-urgency internal item.)
- Run the CP-01 follow-up in-house — it is now cheap and well-posed. Vishwakarma tested 2026 vs 2019, pooled across categories. Two open questions with direct product consequences: does the penalty differ by category (the cadence half of CP-01/CP-03), and what is its shape between two years (the "compounds" clause)? Same rig as the R43 pilot; add a date-only factorial arm.
- Redesign the S3 supersession experiment. Carried from digest 03/04/05, now with two constraints: probe under a task-framed commercial prompt (digest 05), and measure the three-way outcome — instead-of / alongside / ignored — because EvoTrustRAG's 42.0% baseline transition accuracy predicts "alongside" is the modal result. Still the highest-value original research available to LBOX.
- Read arXiv 2603.03299 in full — carried from digest 04/05. Still needed to move the 95.6% multi-model consensus filter from C to A, and still must be read alongside 2606.13610's D2 recall cost.
- Read the citation-fabrication cluster now that GhostCite is cleared and ring-fenced: 2605.07723 (large-scale non-existent citations), 2607.00738 (Phantom References), 2605.08583 (multi-agent detection), 2603.07287 (deployment constraints × hallucination), 2604.03159 (BibTeX agents). All academic-citation construct — read to bound R62's boundary, not to move R50.
- Read arXiv 2604.27790 How Generative AI Disrupts Search (Google/Gemini/AI Overviews empirical) and 2606.27793 Position Bias Correction is Insufficient — the latter sits directly under R63.
- Read the CP-02 adjacent cluster: 2606.20245 (explicit knowledge-conflict resolution), 2601.06189 (Rational Synthesizers or Heuristic Followers?). Both surfaced this week, both unread, both bear on whether a correction can displace an incumbent claim.
- Carried, still unread: 2605.01284, 3767695.3769505 (axis 3); 2601.20251 (axis 8).
- Carried from digest 02, still unread: Itzhak et al. 2507.07186; Lichtenberg et al. 2406.01285; Cao 2025 WSDM; Mallen et al. 2023 — still the most relevant, R37 having been reconfirmed a third time this week.
- Trace the Nature Communications 2025 medical-citation claim (carried from digest 03). Lowest priority; R50 supersedes its likely use.
- Test R1–R4, R19–R24 against LBOX's own engine set. Still none reproduced in-house. Open since digest 01 — this is the seventh consecutive digest carrying it.
- From the 2026-08-19 Searchable digest, unmoved: reproduce prompt-split trigger rates in-house; test the 63/34 Brave overlap on our query set; watch quarantine for watermark-ranking folklore (pre-registered — no sighting this week).
Closed this sweep: digest 05 queue #3 (GhostCite, §3.2), #4 (UGC poisoning, §3.3), #5 (GEO governance, §3.8), #7 (PosIR, §3.6), #8 (2603.18300 and 2604.15937, §3.5/§3.8), #9 (Athena, §7 — assessed and permanently quarantined after three weeks carried).