A corpus that audits its own claims still has a shape it cannot see. On 24 August 2026 this one produced, in a single afternoon, four instances of the same identifier defect — one of them created by the fix logged as having corrected it, one invisible to both auditors for structural reasons each of them was right to have, one that survived the sweep untouched, and one that reproduced six days later outside the tree either auditor reads. This paper reports them as a case study and draws the general form: an audit's coverage is not what it checks. It is what it checks, minus the seams between its tools, minus everything outside the tree it reads.
This is n = 1. One corpus, one author, one toolchain, one afternoon. Nothing here is a frequency claim about audits in general, and no measurement is offered of how often these failures occur elsewhere. What the case supports is an existence claim — that these failure modes are real, are reachable by ordinary competent practice, and are structurally invisible rather than merely overlooked — and a proposed discipline that follows from it. VALUE PREMISE We hold that a method paper whose evidence is its author's own mistakes is worth more than one whose evidence is hypothetical.
The corpus deposits its volumes on Zenodo. Zenodo issues two kinds of DOI: a version DOI,
which pins one deposited state forever, and a concept DOI, which resolves to whichever version
was deposited most recently. For some years this corpus mislabelled
10.5281/zenodo.19117399 as a “Series DOI” — a phantom identifier that has
since been withdrawn from the corpus, and which is quoted here only as the object of study.
DATA
That is wrong twice over. 19117399 is the concept DOI of Principia Orthogona, Volume I — one book, not the series. And a concept DOI pins nothing even for that book: cite it today and cite it next year and you may be citing different documents. There is no series-level DOI. The series-level pointer is a Zenodo community, which is not a DOI and cannot occupy a DOI field. MODEL
On 18 August 2026 a sweep corrected this. The audit log records the result precisely:
“23 labels changed across 16 files, plus 2 in AMonster/monsterlaw.html. ‘Series DOI’,
‘Series Root’, ‘Zenodo series’, ‘DOI (series)’ → ‘Vol I concept DOI’ / ‘Vol I on Zenodo’.” The
entry is headed FIXED. DATA
It was not fixed. What follows is what a re-audit found six days later.
The sweep was a find/replace on the displayed text of the link. In three files the
displayed text sat inside an anchor whose href was built from the identifier, and the
replacement changed the text while leaving the target standing. The result, live in three published
working papers: DATA
A doi.org URL whose path is the phrase Zenodo community. It resolves to nothing.
It renders as a perfectly ordinary blue link that a reader will click and a crawler will follow. And
its text now reads correctly — which is precisely what made it survive: anyone re-reading the page to
check the sweep would see the right words.
A correction applied to a representation of an identifier does not correct the identifier. Link text and link target are two representations of one claim, and a sweep that edits one and not the other converts a visible wrong claim into an invisible broken one. The second is worse: the first was legible to any reader, and the second is legible only to a machine that follows the link — and, as §4 shows, no machine in this corpus was following it. MODEL
A fourth file, ch-ocio.html, carried the original mislabelling entirely unmutated —
<a href="…zenodo.19117399">Series DOI ↗</a>, the withdrawn label still
live — through the sweep and out the other side. DATA
The sentence above originally described the defect in neutral analytical vocabulary —
“carried the original defect entirely unmutated” — and claims.py flagged the
paper for asserting the very label it was documenting. The suppression that exists for exactly this
case works by keyword proximity, and defect, unmutated and survived are
not among its markers. The tool was right to be suspicious and wrong about this instance, and the
fix was to write mislabelling and withdrawn into the prose, which is more accurate
anyway. Recorded because it is §4's seam one level up: a heuristic tuned to catch a corpus
documenting its own defects has its own blind spot, and the blind spot is neutral description.
DATA
This is the ordinary failure and the least interesting one: a sweep enumerated its targets and the
enumeration was short. It is worth reporting only because of what it does to the log entry. “23 labels
changed across 16 files” is true. It is a faithful account of what the sweep did. It is not
an account of what the corpus contains, and the word FIXED at the head of the entry
silently converts the first into the second.
An audit-log entry records a sweep, not a corpus. “n instances changed in m files” is a statement about the actor; “the defect is gone” is a statement about the world, and only a re-run of a detector that can see the defect establishes it. An entry that reports the first under a heading that asserts the second is a category error, and it is the most comfortable error in the practice, because it is written in the moment of greatest confidence. MODEL
Consequence. A fix entry should close with the detector that verified it, or state that none exists. If none exists, the fix is unverified by construction and the entry should say so.
This corpus carries two audit tools, deliberately split. tools/audit.py checks
structure: tags balance, files close, internal links and anchors resolve.
tools/claims.py checks assertion: that a DOI quoted beside a title resolves to
that title, that withdrawn claims are gone, that status claims have not decayed. The split has a
documented origin — audit.py certified a book clean while a chapter in it attributed
Volume I's DOI to a different work, because a correctly-formed DOI pointing at the wrong record is
invisible to a structural auditor. DATA
Neither tool could see doi.org/Zenodo community. Both had a good reason.
| Auditor | What it does with this link | Why that is correct |
|---|---|---|
audit.py | Skips it — external URL | A structural auditor that fetched every outbound link would be a crawler, slow and network-dependent. Not fetching external URLs is the right design. |
claims.py | Skips it — not DOI-shaped | Its DOI rules work by resolving the identifier and comparing the result to the surrounding text. Zenodo community is not a DOI, so there is no record to fetch and nothing to compare. The rule cannot fire on a string it cannot look up. |
The defect was not missed through negligence. It fell into the gap between two correct scopes: too external for the structural tool, too malformed for the semantic one. The semantic auditor's entire method — resolve, then compare — presupposes a resolvable identifier, so the one input it structurally cannot handle is an identifier broken badly enough not to be one. MODEL
Generalised: a validator that works by dereferencing is blind to inputs too damaged to dereference. Every such tool needs a well-formedness check standing in front of it, because the failure mode it is least able to see is the one nearest to hand.
Added to claims.py on 24 August 2026 as DOI-MALFORMED: any
href on doi.org whose path does not match 10.\d{4,9}/\S+. It
requires no network, resolves nothing, and takes one regular expression.
DATA It flags all three mutations, plus the empty
doi.org/ and the tutorial placeholder doi.org/[your DOI]; it passes real
DOIs and the dx.doi.org host. Corpus clean on the rule as of 24 August.
CLOSED 2026-08-24
The rule's docstring in claims.py records the sweep that produced the defect, the
two auditors that could not see it, and the six days it was live. This is the house pattern: every
rule carries the incident that caused it. A rule without its origin is a rule that a future
maintainer will delete as noise, and the deletion will look like cleanup.
VALUE PREMISE
The strongest finding is the last. On 24 August 2026 — six days after the sweep — a new
deposit went to Zenodo. Its metadata carried the same identifier, in the same wrong role:
Is part of · 10.5281/zenodo.19117399, which asserts that a Volume VI working paper is
part of Volume I. DATA
Both auditors were clean on the file. Both auditors read HTML in the working tree. The deposit form is not in the working tree. So the defect did not survive the sweep — it reproduced, from a metadata template that no tool in the repository can reach, into a public record indexed by OpenAIRE, where a reader meets it before ever seeing the corpus.
Let T be the tree an auditor reads and P the set of artefacts the project publishes. Every claim in P \ T is unaudited by construction, and no amount of cleanliness on T constrains it. A corpus can be certified clean and its public record still carry the exact defect the certificate is about. MODEL
Consequence. Any statement that a defect is "fixed" is implicitly scoped to T and must name that scope. For this corpus: identifier claims in deposited metadata, in the three sibling sites off-domain, and in the GitHub repository descriptions are all in P \ T. At least one of them — an off-domain hub still labelling 19117399 a "Series DOI" — is known and unfixed. OPEN
FIXED.
├── 3 files: link text corrected, href left → new defect created
├── 1 file (ch-ocio): not enumerated → original defect survives
└── ~52 files: correctly repaired
2026-08-18 → 24 Defect live. audit.py clean (external URL, skipped).
claims.py clean (not DOI-shaped, unresolvable).
2026-08-24 WP-35 deposited. HTML file containing the broken href attached
to the record. Metadata form independently supplies
Is part of · 19117399 → defect reproduces outside T.
2026-08-24 Re-audit. 4 files repaired. DOI-MALFORMED added to claims.py.
Deposited copy still carries it — file changes need a new version.
This corpus tags its claims inline: DATA for the observed, MODEL for the derived, OPEN for what is not yet established. The discipline is real and it is unusual — most writing states its claims at one confidence level and lets the reader guess.
As of 24 August 2026 the corpus carries 68 OPEN tags across 21 files. DATA None is numbered. None is dated. None records what would close it. And the legend has no closed state — an OPEN item that gets resolved has nowhere to become resolved, so it stays on the page looking unresolved forever, indistinguishable from one nobody has touched.
An OPEN tag is a promise to return. A register is the thing you return to. Without identity — a number, a date, a stated closing condition — the tag marks honesty at the moment of writing and provides no mechanism for that honesty to be redeemed. It is a commitment made in a system with no way to record its discharge. MODEL
The tags are already in the markup. A hand-maintained register would immediately drift from them —
which is the same class of error as the audit log entry in §3, a record of an action standing in for a
state. The register should therefore be harvested: a rule in claims.py that
walks every OPEN tag, emits file, line, the sentence it governs, and the file's
last-modified date, and reports the whole set on every run.
| Field | Why |
|---|---|
| id | Stable handle so another paper can cite the open item rather than restate it. |
| opened | An open claim with no age cannot be triaged. Age is the signal. |
| closes-when | The condition that would discharge it. An open item with no stated closing condition is not open — it is vague, and should be rewritten or dropped. |
| status | OPEN / CLOSED + date. The state the current legend lacks. |
This paper adopts the CLOSED tag in its own legend, and uses it once, in §4. That is the whole of the demonstration.
1 · Representations. Correcting one representation of an identifier does not correct the identifier. Sweeps must target the claim, not its rendering — and a sweep that improves what a reader sees while breaking what a machine follows has made the defect harder to find, not easier.
2 · Logs. An audit-log entry records a sweep, not a corpus. It should close with the detector that verified it, or state that none exists.
3 · Seams. Tools with correct, complementary scopes have a gap between them, and defects live there. In particular, any validator that works by dereferencing is blind to inputs too damaged to dereference, and needs a well-formedness gate in front of it.
4 · Boundaries. Everything the project publishes but does not read is unaudited by construction. "Fixed" is always scoped to the tree, and must name it.
Read together these are one claim: the coverage of an audit is not the set of things it checks. It is that set, less the seams between the tools, less everything outside the tree they read. Both subtractions are invisible from inside — a clean run reports what the tools examined, and says nothing about what no tool was positioned to examine. The only thing that surfaces either one is a defect that escapes and is caught downstream, which is what happened here. MODEL
(1) If the three link mutations turn out to be detectable by an off-the-shelf HTML link checker that any project would ordinarily run, then §4's "seam" is not a seam but a missing standard tool, and the proposition weakens to an argument for using one. OPEN — not tested here.
(2) If deposit-time metadata can in fact be pulled into the audited tree — Zenodo exposes record metadata through an API — then P \ T is not a structural boundary for this class of artefact but an unimplemented feature, and Proposition 4 narrows accordingly. OPEN — the right next build, and it would have caught the 24 August reproduction on the day it happened.
(3) If a second corpus, audited the same way, shows none of these four modes, the existence claim survives but its generality does not. OPEN
Method lineage. WP-29 and
WP-31B · How to Audit established the audit standard this corpus holds
itself to; this paper applies that standard to the audit apparatus itself, which is the one target
the earlier papers could not take. WP-31 · The Calibration
Pipeline governs the move from a claim to a checkable function of data; the register proposed in
§7 is that move applied to claim status. Tooling. tools/audit.py and
tools/claims.py are in the repository and are the evidence for every
DATA tag above; the DOI-MALFORMED rule and its docstring
can be read there. Case material. The deposit discussed in §5 is
WP-35 · Retiring the Advisor
(doi:10.5281/zenodo.21710763); the metadata corrections drafted against it and two earlier records are
in book6/ZENODO-metadata-corrections.md, undeposited, because amending a published record
is the author's call.
This paper contains no formal results. Its contribution is a set of four negative propositions about verification practice, each grounded in a defect this corpus produced, and a proposal for making the open-claim tags redeemable.