A report landed in my review queue last week with a strange symmetry. It contained nine analytical dimensions โ technical, tokenomic, market, ecosystem, regulatory, team, risk, narrative, supply-chain โ and every dimension returned the same verdict: N/A, insufficient information. No invented total value locked. No fabricated unlock schedule. No confident Howey-test conclusion. The machine had received zero bytes of usable fact and returned zero bytes of usable conclusion. It failed closed.
I have spent most of my career auditing software that does the opposite. Contracts that accept zero-length calldata and settle a trade. Pipelines that ingest a blank document and emit four thousand fluent words. Services that receive an empty array and return HTTP 200. The empty report is rare. The empty report is also correct. The interesting question is not why it happened. The interesting question is why correctness is the exception.
The system behind the report was a two-stage pipeline. Stage one ingests a source article and decomposes it into "information points" โ the minimal fact units that later stages are permitted to reason over. Stage two consumes those points and produces nine-dimensional analysis under a hard constraint: no claim may be emitted without an information point backing it. The constraint is the pipeline's entire epistemic model. Remove it, and stage two becomes a language model with a template.
Stage one returned an empty list. Everything downstream collapsed into a schema-valid shell, honestly annotated. The pipeline itself diagnosed three candidate causes and, to its credit, refused to pick one: a scrape failure, a format incompatibility (PDF, image, or a JavaScript-rendered DOM that yields no extractable text), or a process that simply never finished. It could not distinguish among them, because the evidence that would distinguish them was the missing data itself.
I want to treat this as a systems problem rather than a bug report, because that is what it is. An analysis pipeline is a data availability layer for reasoning. It sits between raw source material and downstream consumers who assume its output is backed by something. When the pipeline posts a well-formed report, consumers verify the format and trust the content. When the backing data is absent, the format still verifies. This is the identical failure mode as a rollup posting a state root to a DA layer that holds no state.
I have built pipelines like this and broken them in the same way. In 2022, during the bear market, I spent months instrumenting Celestia's data availability sampling in a research environment, and the lesson that stuck was not about sampling โ it was about what happens when a sampling node requests data that no node holds. The request returns nothing. The node does not panic. It records a null sample and moves on, and the aggregate of null samples is a confident-looking availability report. The empty-input pipeline is that node, one domain over.
What follows is a teardown of the fail-open pattern โ its code shape, its economics, its formal mathematics, and the blind spots it creates. The source report is the specimen. The pathology is general.
In contract engineering, the distinction reduces to a single keyword. A well-written contract fails closed: invalid input reverts, state unchanged, caller informed. The idiom is trivial.
function analyze(bytes calldata input) external returns (Report memory) {
require(input.length > 0, "empty input");
...
}That require is the entire safety model. Delete it, and the function proceeds over a zero-length buffer, computes across uninitialized memory, and returns a structurally valid Report with garbage fields. The caller cannot detect the substitution, because the return type is byte-identical.
Most analysis pipelines are written without the require. Their default behavior is fail-open. An empty prompt does not throw; it produces fluent prose. A missing source does not halt; it triggers the model to fill the gap from priors. The pipeline's type system โ JSON schema, section headers, word counts โ is satisfied by content that means nothing. Structure is not a proof of substance. A schema-valid report and a truthful report are indistinguishable at the parser, and the parser is the only reader most pipelines will ever have. That is convenience's unintended consequences.
Why do pipelines fail open? Because fail-open pays.
A pipeline tuned to fail closed emits nothing on a bad day. Nothing is a metric of zero, and zero is a metric nobody promotes. A pipeline tuned to fail open emits a report every time, and the report is indistinguishable from a good one. Throughput dashboards glow green. The incentive gradient points one way, and the gradient is steeper than any individual engineer's caution.
I have watched this exact gradient in DeFi, and the mechanics are the same as liquidity mining. A protocol subsidizes its total value locked with token emissions, and the TVL chart reads as adoption. Withdraw the emissions and the number collapses โ because the number was never adoption; it was the subsidy wearing adoption's clothes. Analysis pipelines run their own version of this scheme, and their emission is the report itself. Reward the pipeline for producing output and it will produce output on empty input, on garbled input, on a photograph of a grocery list โ the emission subsidy's unintended consequences. The subsidy cannot distinguish signal from noise. It only counts emissions.
The pipeline that refused was the one with no emission subsidy โ the one whose only reward was correspondence to its input. On this article, that reward was zero, so it emitted zero. A fabricated report would have been laundered through the same schema and consumed downstream as fact. The refusal is not a gap in the analysis. The refusal is the analysis. It is the only output whose entropy did not exceed its input's.
Consider the audit trail. A fail-closed pipeline leaves a witness: the revert reason, the missing field, the failed assertion. A fail-open pipeline leaves a finished document. When the fabricated report causes harm downstream โ a mispriced asset, a misallocated grant โ the post-mortem has nothing to examine, because the artifact of the failure is indistinguishable from the artifact of success. Fail-open systems destroy their own evidence. That is not a side effect. It is the reason they are popular: they are the only systems that never have to explain themselves.
Now the formal crux, because the failure is invisible for a mathematical reason and not merely a social one.
An information point list is a Merkle leaf set. The analysis is a proof derived from the leaves. This framing matters because the empty tree is not undefined. The Merkle root of an empty set is a specific, computable hash โ the empty root โ and every standard library returns it without error. You can compute a valid membership proof against an empty tree, because the proof path for the empty set is the empty path, and the empty path verifies against the empty root. Nothing fails. Everything verifies.
This is the deepest reason the empty report looks complete. The system did not crash. It computed a well-formed proof of nothing. A report over an empty leaf set is not merely wrong; it is vacuously true. Every claim of the form "for all information points p, p supports conclusion C" holds when the set of information points is empty. The empty set satisfies every universal quantifier. The pipeline's contract returned true, and true is exactly what a lie looks like when it has good typing.
My 0x protocol audit in 2017 drilled this class of bug into me. I spent four months inside the v2 exchange contracts, and the vulnerabilities that mattered were never the reverts. They were the paths that returned success. Three race conditions in the order-matching logic let a relayer front-run fills: each transaction succeeded, each returned a success code, and each violated the counterparty's intent. The dangerous bug is not the one that fails loudly. The dangerous bug is the one that succeeds quietly โ and the empty-input report is a succeed-quietly bug wearing a compliance badge.
I have been skeptical of the data availability narrative for two years, and the empty-input pipeline is the cleanest illustration of why.
The thesis behind dedicated DA layers is that rollups will generate so much data that posting it to Ethereum becomes prohibitively expensive. Celestia, EigenDA, and their peers position themselves as the scalable substrate for that flood. When I instrumented real rollups and measured actual posting, the flood was a trickle. Most rollups post a few kilobytes per batch. A single Ethereum blob holds 128 kilobytes. The rollups that genuinely saturate blobs โ the ones that need a dedicated DA layer at all โ number in the single digits. The DA layer is infrastructure sized for a demand curve that almost nobody is on.
The empty-input pipeline is that same shape, one abstraction up. Stage one built an ingestion apparatus โ schema, decomposition logic, validation hooks โ sized for articles. On this article it ingested nothing. The apparatus stood fully built and fully idle, performing readiness for data that never arrived. That is data availability theater: capacity presented as throughput.
I am not arguing the apparatus is worthless. I am arguing that its existence is routinely mistaken for its utilization, and the accounting error compounds. A DA layer with one committed rollup and a report with zero information points share the same defect. Both report capacity. Neither reports whether anything flowed.
There is a second-order failure here that I flagged during the 2021 NFT standardization review, and it maps onto this report with uncomfortable precision.
ERC-721A tokens store metadata as an off-chain URI โ a pointer to a JSON document. The token contract guarantees the pointer resolves to a valid format. It does not guarantee the pointer resolves to content. When a collection's metadata host goes dark, the tokens still exist, still transfer, still render in wallets with a placeholder image. The contract returns success. The asset is hollow.
The empty report is a metadata pointer with nothing behind it. Every section is a URI that resolves to a schema-valid, content-empty document. A consumer's parser accepts it. A consumer's eyes reject it, but parsers do not have eyes. Centralization of the pointer is the same vulnerability as centralization of the source. A report whose validity rests on a single upstream scrape is as fragile as an NFT whose identity rests on a single metadata host. Both collapse the instant their one dependency fails, and both fail silently, because the pointer still parses.
The source report handed me the raw material for a metric I now apply to every pipeline I review: the information budget.
Define the pipeline's input entropy H_in as the Shannon entropy of the ingested material, and its output entropy H_out as the entropy of the emitted report. A useful pipeline must satisfy H_out โค H_in plus the model's intrinsic uncertainty, and the information gain โ the reduction in the consumer's uncertainty โ must be positive. A report generated from empty input has H_in = 0. Any H_out > 0 is, by construction, hallucination: the pipeline manufactured entropy from nothing. That is thermodynamically illegal, and in practice it is precisely what fail-open systems do every day.
The honest pipeline respects the budget. H_in = 0 forces H_out = 0, and the output is a null. That is not a defect. It is the pipeline's single correct response to an impossible request.
I ran the same calculation against my verifiable-inference prototype from earlier this year. The prototype proves a computation was executed correctly on a given input. It says nothing about whether the input was worth computing on. A zero-knowledge proof of inference over empty input is a valid proof of a worthless statement. Verifiability does not imply value. The proof attests to the arithmetic, never to the relevance. The empty-input report is the same object: a valid proof of a vacuous claim, wrapped in nine sections and a disclaimer.
The pipeline's three candidate causes deserve their own treatment, because their undecidability is not incidental โ it is structural.
A scrape failure, a format incompatibility, and a process incompletion produce byte-identical symptoms at the output: an empty information point list. Distinguishing them requires evidence that lives upstream of the failure โ HTTP response codes, DOM snapshots, job completion logs. But the pipeline's contract with its consumer exposes only the output. It is a one-way function. You cannot invert an empty output to recover the cause, any more than you can invert a hash.
This is the observability gap, and it is where most pipelines quietly bleed. A pipeline that does not log its input entropy cannot distinguish "nothing arrived" from "everything arrived and I discarded it." The two states demand opposite remediations โ fix the transport, or fix the parser โ and the pipeline cannot tell you which one you need. The source report was honest enough to admit this and to request the minimum input needed to resume. That request is the correct terminal state. It is also a confession that the pipeline lacked the telemetry to diagnose itself.
If I were specifying the pipeline from scratch, the design would be unremarkable and almost nobody would ship it.
Stage one asserts input.length > 0 before parsing, and emits telemetry โ byte count, HTTP status, DOM node count โ regardless of outcome. Stage two computes H_in and refuses to emit when H_in falls below a threshold calibrated to the consumer's tolerance for false positives. The refusal is a first-class output, not an exception path: a typed NullReport with a machine-readable cause code. Downstream consumers are required to branch on the type. A NullReport cannot be silently coerced into a Report, because the two are not the same type.
The entire design rests on one principle: make the empty case representable, and make it loud. Most systems fail open because their type systems cannot express "I don't know." They flatten ignorance into confidence, and confidence flows downstream unexamined. The source pipeline, whatever its other faults, had the type. It emitted a NullReport. It was the right object.
The contrarian read: the empty report is not the failure. The failure would have been a full report.
Every party in the chain has an incentive to blame the scraper. The scraper's owner blames the source format. The source blames the renderer. The renderer blames the network. Nobody blames the pipeline, because the pipeline is the only component that behaved correctly, and correct behavior that produces nothing looks like a bug.
The blind spot is not the null input. The blind spot is the industry's intolerance of null output. We have built a culture โ in analytics, in journalism, in crypto research โ where emitting nothing is treated as incompetence and emitting something is treated as work. The pipeline that refuses is punished; the pipeline that fabricates is promoted. That is incentive design's unintended consequences, and it is social before it is technical.
There is a second blind spot, subtler. The source report treated zero-information risk as a process signal โ evidence that stage one never completed. That is correct, and it is the most valuable output the pipeline produced. The diagnosis of its own void was the only non-vacuous statement in the entire report. A system that can detect its own ignorance is more trustworthy than one that cannot, even when both produce identical output on a good day.
There is a hard-nosed reading of the source report that most analysts would miss. The report's most valuable line was not any analysis โ it was the observation that zero-information input is itself a process risk, evidence that an upstream stage failed. That is a meta-signal, and meta-signals are where the alpha lives. The market pays for conclusions about the world; it underpays for conclusions about the reliability of conclusions about the world. The empty report is a pure instance of the second kind, and its price was zero, because its form was empty.
The next generation of analysis will not be judged by the fluency of its output. It will be judged by the strength of its require statement โ the precise condition under which it is willing to return nothing. A proof of inference over empty input is a valid proof of nothing, and eventually the market will price that. The open question is not whether we can prove the computation; we can. The open question is whether we can prove it was worth computing. Most pipelines, today, cannot even formulate the question, and the ones that can are the ones that occasionally, correctly, return an empty page.