Most people read a nine-dimension due diligence report and check the score. They should check the nulls.
Last quarter, a research desk I advise shipped a full framework output on a tokenized asset: technical positioning, tokenomics, market structure, ecosystem role, regulatory exposure, team and governance, risk matrix, narrative-versus-fundamentals, and supply-chain transmission. Nine sections. Consistent formatting. Confidence labels. A PDF with a footer.
Every field read N/A โ insufficient information.
Not "no risk identified." Not "within tolerance." N/A. The upstream parser had returned empty strings for the title, the source, the project name, and the entire array of extracted information points. The analyst declined to fill the template. She wrote a diagnostic, tagged each dimension as evidence-free, and halted the pipeline.
The downstream reader opened the PDF, saw nine completed sections, and logged the asset as "reviewed."
No exploit. No rug. No governance attack. A type-coercion bug in human attention, and it nearly moved capital.
The failure that matters is the one that returns exit code zero.
Software engineers have a name for this: silent failure. A function that throws is a gift โ it stops the caller. A function that returns null and lets the null propagate through six layers of arithmetic is a liability, because every downstream consumer assumes the value exists. Research pipelines inherit the same pathology. A parser that errors gets fixed in an hour. A parser that returns an empty array gets absorbed into a report that looks finished.
The report's own diagnosis was the most useful paragraph in it: N/A does not represent a neutral judgment; it represents the absence of a basis for judgment. That distinction is the entire game. In the memo, six of the nine dimensions were null. A reader who compresses null into "nothing found" has just converted an unmeasured risk into a measured zero.
Null is not zero. It is not even a number.
In most dashboard stacks, the coercion happens silently. Number(null) evaluates to 0. An empty field sorts to the bottom of the risk table. A blank severity column renders as green because green is the default CSS class. I have watched a listing committee approve an asset whose oracle dependency was recorded as an empty string โ not "unaudited," not "single-provider," just blank โ because the row was visually quiet and the meeting was running long.
The mechanic is not stupidity. It is throughput. A committee reviewing forty assets a week has roughly eleven minutes per asset. Eleven minutes is not enough to read an evidence chain. It is exactly enough to read a color.
The incentives explain why the blanks survive.
Research is priced on coverage, not on falsifiability. An analyst who produces forty pages of plausible structure and an analyst who produces one page saying "insufficient data" are paid from the same budget line, and only one of them gets invited to the next call. The marginal return on fabrication is positive and immediate. The marginal return on refusal is negative and deferred โ you find out it was correct eighteen months later, when the thing you declined to rate collapses and nobody remembers you declined.
This is not an AI problem. Sell-side equity research ran this exact playbook for thirty years before anyone pointed a language model at it. What changed is throughput: a template-driven pipeline can now generate nine dimensions of confident-sounding prose from a single press release in under four seconds. The failure mode scaled; the gate did not.
This is not theoretical either. I spent part of 2022 reverse-engineering the TerraUSD mechanism, and the instability was legible in the code months before it was legible in the price: a reflexive dual-token loop with no exogenous collateral and a mint-burn path that widened exactly when liquidity thinned. The evidence sat in the contract, not in the community. It stayed unpriced not because the data was missing, but because the dashboards tracking it had no column for reflexivity โ and an absent column reads exactly like a zero.
The gate is cheap. Build it.
The report proposed a minimum viable context rule: if the extracted information-point array contains fewer than three entries, reject the input at the pipeline boundary and never render a report. That is correct, and it is not enough. Three points is a floor, not a standard.
What actually works is a checksum on prose. Every conclusion must carry a traceable identifier pointing back to a specific information point. If a sentence cannot be traced, it is deleted โ not softened, not hedged, deleted. I ran this discipline during a 2025 technical review of an AI-content platform backed by an institutional sponsor. The deck had sixty slides; the model was a thin wrapper over a deprecated checkpoint; the blockchain integration existed to make the slide deck legible to a crypto-native audience. None of that was visible in the narrative layer. It was visible the moment every claim had to resolve to an artifact โ an API latency measurement, a token unlock schedule, a contract address.
Read the code, ignore the roadmap. In research terms: read the evidence chain, ignore the executive summary. The summary is the roadmap.
Where the bulls are right.
The reflexive bull response โ coverage breadth has value, you cannot deep-dive nine hundred tokens โ is correct, and I have been too slow to concede it. Screening is a legitimate function. Knowing which assets you are not going to underwrite is real information, and a firm that reviews everything shallowly and labels it as screening is behaving rationally.
The error is taxonomic, not economic. Screening output must be labeled as screening. The moment a screening score is rendered in the same visual grammar as a diligence memo โ same nine sections, same confidence labels, same footer โ the distinction is destroyed at the point of consumption, which is the only point that matters. Volatility is just unpriced risk; so is a null field that nobody labeled.
The other thing the bulls get right: refusal is a product. A signed "I don't know" from a desk with reputational capital at stake is worth more than a hundred pages of hedged structure. Logic doesn't lie. Templates do.
The next blowup is already filed.
It will be an asset that scored low risk on a dashboard where six of nine dimensions were null, approved by a committee that read colors, audited by a firm that got paid per report. When the postmortem lands, the question will not be who missed the vulnerability. It will be who signed the document that said there wasn't one โ and whether they can produce the evidence ID. Accountability in research is not a tone. It is an audit trail. The desks that survive the next cycle will not be the ones with the widest coverage. They will be the ones that can prove, line by line, where every number came from.
