I built a small auditor that checks a marketing email against the CAN-SPAM rules and quotes the regulation for every finding. Every quote was verified, so I thought it was safe. The judges' feedback found the hole in one line: "a citation that resolves but points at the wrong thing is the exact failure this competition is hunting." My checker confirmed each quote existed somewhere in the reference files. It never checked that the quote sat under the section the finding cited. Cite the wrong section, keep the right words, and it still printed "quote verified". The rebuild checks each quote only inside the provision its citation names. Before writing any code, I committed eight questions taken from the feedback, so the test couldn't drift toward the answer. The original passes 2 of 8 and the rebuild passes 8 of 8. Those are questions I wrote myself, so the score isn't independent, and the repo says so. The results file also lists what's still weak. One check is a word list, and it gets "your account number is not needed" wrong because it can't read negation. I'd rather publish that than have someone find it. If you're running any AI step that cites a source (a policy, a contract, a style guide), the same hole is probably there. Checking that the words exist is the easy test. The useful one checks that they're where the citation says. Try it yourself: take one cited output, change only the section number, and run your check again. If it still passes, you're checking existence, not location. Question for the comments: what are you citing in your builds, and how do you check it? Free, MIT, nothing to sign up for: https://github.com/NFTYoginis/can-spam-auditor-rebuild