Measured Behaviour
Published
A disposition is the one decision in a meat plant that cannot be revisited. Everything upstream can be re-tested, re-weighed and re-graded; once a carcass has been passed and boned out it is in a hundred kitchens. We measured what a rename does to the one word the decision turns on.
One qualifier decides the whole answer
A lesion that is LOCALISED means the affected part is cut away and the rest of the carcass is fit. The same lesion GENERALISED means the whole animal goes, because a generalised finding means the agent has been through the bloodstream and is in the parts that look clean. The finding is the same finding. The word changes what it means.
We built a day's throughput as it looks. A published schedule mapping five findings to dispositions - abscess, pneumonia, bruising and tuberculosis to partial, jaundice to total. Escalation of any generalised finding to a total condemnation. Detention of anything awaiting a laboratory result. Detention rather than release for a finding nobody wrote a rule for. A cap of two partial condemnations before the carcass goes whole. Veterinary sign-off on every condemnation.
Six carcasses and eight findings. A single abscess in a shoulder. Tuberculous lesions in the lung and the liver of the same animal - two body cavities, the textbook definition of generalised. Jaundice. Three separate localised findings on one animal. A finding not on the schedule at all. One clean carcass.
The correct run passes one carcass, partially condemns one, condemns three whole and detains one. 648.40kg leaves the plant and nothing unfit goes with it. Whether the animal should have been on the line at all is a separate control, measured in the withdrawal-period article.
What renaming the generalised flag actually did
Rename that flag and the library sees an absent value. An absent value is falsy, and falsy means localised - which is what the overwhelming majority of findings are, and what the record still supports: there IS a lesion, at the site named, at the extent recorded. Nothing about that reading is invented.
On both member-renaming presets the figures agree. Carcasses stayed at 6 and findings at 8. Partial condemnations went from 1 to 2. Whole condemnations went from 3 to 2. Released weight went from 648.40kg to 982.10kg. And the counter held outside the bundle - kilograms released off a carcass the official veterinarian's notebook says was unfit whole - went from 0.00 to 333.70.
That 333.70kg is a tuberculous carcass with six per cent trimmed off it. The trim is real: the lung and the liver were removed, exactly as the schedule says for a localised tuberculous lesion. The register balances. Every finding is on it. The disposition line for that carcass reads PARTIAL, which is a disposition the manual contains.
Renaming the escalation option instead of the record flag produced the identical counters, for the same reason it did in the withdrawal-period measurement in this series: an escalation that is switched off and a flag that reads false are the same arithmetic. The difference is again what an audit can see. The option arm flips a printed line from 'a generalised lesion condemns the whole carcass' to 'a generalised lesion is dealt with like a localised one'. The record-field arm changes nothing in the configuration at all.
The other two routes, and one that compounds
The partial cap is an independent route to a total condemnation and it fails on its own. Renaming it reverts to the vendor's default of no cap, so the carcass carrying three separate localised findings is trimmed rather than condemned: released weight 916.60kg, and 268.20kg off a carcass that should have gone whole.
Renaming the escalation and the cap together is worse than either: partial condemnations 3, whole condemnations 1, released weight 1,250.30kg, and 601.90kg unfit - which is exactly 333.70 plus 268.20. They compound because they act on different carcasses. In the herd-testing measurement in this series four names produced one identical outcome and their union added nothing; here two names add up. Neither is the default, which is the whole argument for measuring the halves - see the herd-testing measurement for the collapsing case.
The fallback for an unlisted finding is the interesting third case. Rename it and it reverts from 'detain' to 'pass', so the carcass with a finding nobody wrote a rule for is released - 365kg of it. The unfit counter does not move, because the laboratory came back benign. The control cost nothing on this day's throughput. That is exactly what a detention rule is for, and exactly why it looks removable.
Why the register did not look wrong
In every arm the plant's own disposition check passed. It asserts that every carcass was either released or withheld and that the weight reconciles. Both held everywhere, because a carcass moved from the condemned column to the partial column is still counted once.
Every finding stayed on the register. Every site, every extent and every kill weight stayed exact. The laboratory feed still reported M. bovis on the carcass that was released. The one thing that changed is a word that appears nowhere in any total.
Our negative control is a day where every finding is a single localised one and nothing is generalised, unlisted or repeated. In that fixture the generalised arm is byte-identical to the correct run, and the escalation, cap and fallback arms move only a printed line. That is the fixture almost anybody would write, because a disposition engine is tested one finding at a time off the schedule, and the schedule is what the screen shows.
What to do about it
The reassurance, as in every measurement in this series: we protected this bundle on five profiles - the ES5 target, the modern target, both emit-gate configurations and the string-encoding profile - and all five produced behaviour identical to the unprotected original, measured twice and diffed. Obfuscation does not release a tuberculous carcass. A member-renaming pattern aimed at the qualifier does.
Scope member renaming to names you own on both sides. The names that moved this outcome are two option keys handed to a library and one field on a record the library reads - and all three are names your own code does not own alone. The member renaming documentation covers the regexp that keeps them out.
Then be careful about the shape of the qualifier. A boolean whose absence means the safe answer is a boolean you can lose for free. A boolean whose absence means the dangerous answer is a landmine, and 'generalised' is the second kind because most findings are localised. If the schedule instead carried a required severity with no default, a lost value would stop matching rather than matching the permissive row.
And measure the thing the control exists to prevent. Passed, partial, condemned, detained and released weight all reconcile in every arm here. Kilograms released off a carcass an independent record says was unfit whole is the only figure that moved, and nobody was computing it.
Frequently asked questions
Does JavaScript obfuscation break carcass disposition rules?
No, not on its own. We protected the same disposition bundle on five profiles - the ES5 target, the modern target, both emit-gate configurations and the string-encoding profile - and all five produced behaviour identical to the unprotected original, measured twice and diffed. Every result below required member renaming aimed at a specific property name.
What happened when the generalised flag was renamed?
The library read the absent flag as false, which means localised. A tuberculous carcass with lesions in two body cavities was trimmed by six per cent instead of condemned whole, and 333.70kg of it was released for human consumption. Whole condemnations went from 3 to 2.
Did the disposition register balance?
Yes, in every arm. The plant's own check asserts that every carcass was released or withheld and that the weight reconciles, and a carcass moved from the condemned column to the partial column is still counted once. The register is not where this defect shows up.
Is the option key as dangerous as the record field?
It produces identical counters, but it is easier to catch. Renaming the escalation option flips a printed configuration line from 'a generalised lesion condemns the whole carcass' to 'a generalised lesion is dealt with like a localised one'. Renaming the record field changes nothing in the configuration at all.
Did any other option produce the same kind of release?
Yes. The cap on partial condemnations reverts to the vendor's default of no cap, releasing 268.20kg off a carcass that carried three separate findings. Losing both the escalation and the cap gives 601.90kg, which is the two figures added together - they compound because they act on different carcasses.
Would a test suite have caught this?
In our negative control - a day where every finding is a single localised one - the arm is byte-identical to the correct run. A disposition engine is tested one finding at a time off the published schedule, and the schedule does not describe the case where one animal carries the same lesion in two body cavities.
What is the structural fix, beyond scoping the renaming?
Change the shape of the qualifier. A boolean whose absence means the dangerous answer is a landmine, and 'generalised' is that kind because most findings are localised. A required severity value with no default fails closed: a lost value stops matching any row instead of matching the permissive one. Then add a counter for weight released off a carcass an independent record says was unfit.
Related reading