Security teams and researchers often pick knowledge‑graph extractors for threat reports based on reported triple‑F1 scores, even though those scores depend heavily on how predicted triples are matched to gold annotations. We could faithfully re‑implement the matching rule for only five of twelve examined systems. Re‑scoring ten system outputs on shared documents under eight protocols flipped eleven of forty‑five pairwise orderings, and a single fixed prediction set yielded F1 values ranging from 0.16 to 0.70. On GRID’s external 378‑item calibration set, the best mechanical matcher—lexical, embedding, or entailment—reached at most 71% agreement, while an LLM judge achieved 86%. To isolate component effects from matcher incentives, we built CTIForge, whose deterministic validation layer can be swapped while keeping extraction byte‑identical. Across seven deployment configurations, validation raised precision for all four hosted backbones but lowered it for all three offline backbones. Because backbone, decoding, and backend‑specific prompting covary, this pattern reflects a descriptive split rather than an isolated serving effect. It coincides with roughly a 2.8‑fold rise in actions explicitly disputing entity type, consistent with hand‑written rules that encode the extractor’s conventions. We release the full pipeline, protocol suite, and per‑triple audit records. Review