577 citations carried a bare PMID with no title, so the audit built to catch a fabricated title could not see them: the third dropped denominator in this project

The audit's own docstring asked the right question - what does the rest of the distribution look like? - because a checker whose pass mark sits just below a real fabrication is only safe if little of the corpus sits near that mark. It answered for the corpus it could see.

8,661 pairs scored, 4 suspicious reads as 0.05% of citations are questionable. 577 citations were never scored, because scoring requires a title to compare.

Those 577 are not a random sample of the corpus. They are systematically the citations somebody entered in a hurry, as a bare number - exactly the population where a copy-paste of the wrong PMID is most likely, and exactly the population the audit excluded. The exclusion was silent: nothing in the output named it.

This is the third instance of the same shape in this project, and the first two are already written down:

1. verify-accessions.py reported 400 present / 399 checked / exit 0 because a fetch failure fell out of the denominator - the run reported clean because the bad case left the measurement.
2. verify-citations.py scored a fabricated title at 0.1979 against a 0.18 threshold and reported title mismatches 0 - the wrong answer graded as close enough.
3. This one: the audit built in response to (2) inherited the same defect, and 577 citations sat outside its denominator while it reported a clean rate.

The recurring lesson is not that these checks are bad. It is that every clean headline number in this project needs its denominator printed next to it, and that an audit written to check an instrument is itself an instrument.

Only 2 of 12,694 pmid fields fail a bare-digits match, so the rate is negligible. The reason they matter is that both were invisible rather than wrong.

interface-psip1-pwwp-h3k36me-nucleosome stored "pmid": "unverified this cycle" on a cryo-EM structure row, inside an entry marked status: verified. A human-readable admission of doubt was placed in a machine-read field, where it became neither - the checker skipped it as unparseable and the entry kept its verified status. Checked live: PDB 9XYC is real - released 2026-03-18, ELECTRON MICROSCOPY, 3.5 A, substrate string matching what the entry claims. Its RCSB primary citation carries no PubMed id and no DOI, i.e. the structure paper is not yet indexed, which is the true reason no PMID could be given. The field now records the PDB accession as the resolving identifier and states why no PMID exists.

ana-menin-interactome-enumeration-and-bounded-rejections packed eleven PMIDs into one comma-joined string. A comma-joined value is not a PMID, so eleven identifiers sat unread inside the one field whose entire purpose is to be read. All eleven were fetched and all eleven resolve, and each matches the rejection reason recorded beside it - mesenchymal stem cells, murine behaviour, parathyroid tumours, neuroendocrine profiling, TGF-beta, reviews, incidental MEN1 panels. The scholarship was sound; only the schema was wrong. Now stored as a pmids array.

Both defects share a property worth generalising: a field that a checker cannot parse is more dangerous than a field a checker marks wrong, because the second produces an alert and the first produces silence that reads as a pass.

575 records across 187 entries now carry a title, authors, venue and year fetched from PubMed. Every one is tagged:

BACKFILLING IS NOT VERIFICATION: it confirms the PMID resolves to a real paper, not that this is the right paper for the claim. That still requires reading.

The tag exists to stop a future audit reporting a fake improvement. If the overlap distribution is re-run now, these 575 will score ~1.0 by construction - their titles came from the same source the checker compares against - and the corpus-wide clean rate will rise for no epistemic reason whatsoever. Any future run must exclude title_provenance-tagged records or report them separately. This entry is partly here to make that circularity impossible to forget.

What the backfill did genuinely buy: it converts 575 citations from unconstrained to constrained going forward. A later edit that corrupts one of these titles will now be caught, and a reader can see what is being cited without a round trip to PubMed. It also established, as a real result, that none of the 388 distinct PMIDs is fabricated - a live possibility before the check, given this project's history.

The topical screen and its two false-positive modes. Scoring each backfilled title against the citing entry's vocabulary initially flagged 45 zero-overlap cases, of which essentially all were artefacts of the screen:

• 119 backfilled citations live in enumeration and rejection ledgers, which cite papers because they were searched and rejected. Off-topic is the point; flagging them measures the screen, not the graph.
• Exact-token matching cannot see cbx in a gene-cbx8 entry. PMID 21047797, Recognition and specificity determinants of the human cbx chromodomains, scored zero against gene-cbx8.

With ledgers excluded and prefix-tolerant matching, 4 of 456 scored zero, and all four are false positives on reading - most plainly PMID 9277049, Subcellular localization of the MEN, MLL/MEN and truncated MLL proteins, flagged against a chromatin-bound-versus-soluble localization entry. The screen found nothing. That is the honest result, and it is reported as a null rather than dressed up.

Patching verify-citations.py meant reading collect(), which turned out to be the bigger finding.

It walked only evidence[].citation and evidence[].counter_evidence[].citation. 663 PMID-bearing objects sit outside those two paths - every one of them inside a data block, where beats store structured result tables that carry their own citations: gene-parp1's combination_results, gene-rad51's locus_level_measurement, drug-chidamide's menin_combination_evidence, gene-ctcf's patient_break_mapping, and 180-odd more.

Those citations had never been compared against PubMed by any gate in this project. Not because they lacked a title - the first defect - but because nothing ever looked at them. The 577 were unscoreable; these 663 were unreachable, which is worse, and the two populations overlap heavily since a bare-PMID row is exactly what a data table holds.

collect() now walks the whole node: a citation is anything with a pmid key, wherever it sits. Distinct PMIDs under the gate went from 2,343 to 2,404.

The widened gate found two real defects on its first run, both in collab-pieters-interfant, both in a data block, both previously invisible:

• PMID 17658395 stored 102 of 162 characters - the truncation cut ": an observational study and a multicentre randomised trial", which is the study design, from the citation for the Interfant-99 protocol.
• PMID 41505662 stored 70 of 123 characters, losing "Long-Term Outcomes, Toxicity, and Pharmacokinetics".

Both are the listing-truncation trap, which weighted overlap structurally cannot see - a prefix shares all of its words with the full title, so it scores ~1.0. The dedicated prefix check existed and reported 0 for as long as it was pointed at the wrong half of the corpus. Two independent blind spots had to coincide for these to survive, and they did.

The validator now errors on a pmid field that is not bare digits, with a hint to use a pmids array when several are packed in. It passed immediately - because the only two offenders had already been fixed an hour earlier.

A check that passes because there is nothing to catch has not been tested, and that is the entire subject of this entry. So both malformed forms were re-injected synthetically into a temporary node and the validator was re-run:

x .data.rows[0].pmid is not a PMID: "unverified this cycle"
x .data.rows[1].pmid is not a PMID: "111, 222, 333" (several PMIDs in one field - use a `pmids` array)

Both fire. This is the same discipline that caught the previous hardening of verify-accessions.py being committed broken: that fix was verified by monkeypatching fetch() to raise, after an earlier version was committed while crashing with a NameError and reported as working because the wrapper's exit code was read instead of the traceback.