Measured Behaviour
Published
Every failure this site has measured so far leaves a hole: a value missing, a row not selected, a party not counted. A voluntary corporate action has no hole available to it. The offer closes, the shares must become something, and a holder who says nothing is designed to receive the default - so the tabulation is complete in every run, including the ones that are wrong.
An offer where silence is a valid answer
The fixture is a cash-or-stock offer over a register of sixty holders. Forty-eight wrote in before the book closed, eight wrote in after it, and four never wrote at all. The offer pays 58.00 in cash or 1.35 acquirer shares, the acquirer funds 45 per cent of the offer in cash with the rest settled in stock, holders of under a hundred shares are exempt from that cut-back, and a holder who says nothing receives stock.
The correct run records forty-eight elections and twelve defaults, cuts the cash leg back by a factor of 0.7464, pays 2,556,521.10 in cash and issues 72,728.62 acquirer shares.
Twelve defaulted holders out of sixty is an entirely normal number for an offer of this size, and that is the fact the rest of this page turns on.
Protection with default settings, on all five profiles, was byte-identical.
One deadline, and every instruction in the file becomes silence
The library defaults electionDeadlineDay to zero. That is not a missing deadline. It is a deadline that every response ever written is after.
Rename the member and all forty-eight signed, unambiguous, on-time instructions are read as having arrived after the book closed. Elections by holder went from forty-eight to zero, defaults from twelve to sixty. The cash leg went from 2,556,521.10 to 0.00 and 132,233.85 acquirer shares were issued instead of 72,728.62.
Every share in the company was rolled into acquirer stock on behalf of people who asked, in writing and on time, to be paid in cash.
And here is the part that makes this a different shape from every other failure on this site. The tabulation reported sixty holders, sixty elections, unelected=0, and the agent's own rule passed with the words every holder accounted for. Nothing is missing. There is no hole to find. Each holder ended the offer with exactly one election, and that election is a legitimate outcome of the offer they were sent.
Why no reconciliation can see it
The natural controls here are the ones an exchange agent really writes: every holder must carry exactly one election, and the elected shares must foot to the register. Both are closed by construction. The resolver assigns exactly one outcome per holder, and the shares are partitioned, so both clauses are true in every arm.
The deeper problem is that the error is indistinguishable from a customer's own choice. A defaulted holder is not an error state; it is the state the offer document promises. The only party who knows that a particular default was wrong is the holder, and what the holder receives is a statement showing the outcome - which is a legitimate outcome.
Two more names reach the same place from the record side. Renaming elected or respondedDay on the holder records produced numbers identical to the deadline arm in every figure. Three independent names, one answer, and the answer is a complete and internally consistent tabulation.
The arm that moved twenty thousand shares and not one cent
^(defaultElection)$ reverts this offer's stock default to the library's cash. Cash-elected shares went from 59,001 to 79,201 and stock-elected from 38,950 to 18,750: twenty thousand two hundred shares changed what their holders receive.
The cash paid was 2,556,521.10 in both runs, to the cent.
That is not a coincidence. The acquirer funds a fixed proportion of the offer in cash, so more cash elections simply mean a harsher cut-back for everybody who asked for cash. The pool is the pool. A treasurer reconciling the cash outlay against the funding commitment sees a perfect match while a fifth of the register receives the wrong instrument.
^(prorationPct)$ is the other direction and it is loud in money terms: the library assumes the whole offer is fundable in cash, so the cut-back disappears and the acquirer pays 3,422,058.00 instead of 2,556,521.10 - 865,536.90 more cash than it agreed to fund.
The two names together, and the money reconciles to the cent
The deadline and the default election are adjacent lines on the same object, so one broad pattern reaches both. That union is the sharpest result in this measurement, and it runs the opposite way to what either half suggests.
With both renamed, all sixty holders default - and the default is now the library's cash. Cash-elected shares read 97,951 and stock-elected zero. The cash paid was 2,556,521.10 and the shares issued 72,728.62: identical, to the cent and to two decimal places, to the correct run.
So the arm in which not one of sixty holders received a recorded election they actually made is the arm whose payment file reconciles perfectly against the correct one. The half - the deadline alone - paid 0.00 in cash and would have been noticed by the end of the day. The union is invisible in every financial figure the offer produces.
The mechanism is the fixed cash pool again. The acquirer funds a set proportion of the offer, so the total cash is a property of the offer rather than of the elections, and the cut-back absorbs any change in who asked for what. Test the halves and the union separately: here the wider pattern is the quieter one, and the quieter one is not the safer one.
A promise in the offer document, quietly dropped
Holders of under a hundred shares are exempt from the cut-back. That exemption is a promise printed in the offer document, and it exists because a small holder cannot usefully be handed a fraction.
Renaming oddLotProtection reverts it to the library's false. The cut-back factor moves from 0.7464 to 0.7471 and the number of holders cut back rises from thirty-five to thirty-seven. The cash paid is identical to the cent.
Two small holders were promised something in writing and did not get it, and there is no figure on the tabulation that is wrong. This is the smallest result in the pass and one of the more instructive: the size of a breach and its visibility are unrelated.
What was loud, and one arm that only moved the audit trail
^(shares)$ on the holder records made a holding non-finite and the tabulation refused before doing anything. ^(cashPriceUsd)$ reverted the cash price to zero, so the cash leg paid 0.00 - a number nobody misses. ^(stockRatio)$ reverted 1.35 to 1 and under-issued 18,855 acquirer shares.
^(optionsOffered)$ is the odd one. The library assumes a cash-only offer, so the eleven holders who asked for stock asked for something not on offer and were routed to the default - which is stock. They received exactly what they asked for. Elections fell from forty-eight to thirty-seven and defaults rose from twelve to twenty-three, and not one share or cent moved.
That arm is worth keeping in mind when reading any audit trail produced by software: the record of why a party got something is a separate artifact from what they got, and the two can diverge without any money moving.
The unanimous offer sees none of it
The same file runs the same sixty holders on an offer where everybody wrote in on time asking for the same thing. With nobody defaulting and nobody cut back, the deadline, the default election, the list of what is on offer and the odd-lot promise decide nothing, and every arm above is inert.
An offer with no defaulted holders is not a realistic offer, which is exactly why a fixture built from one is blind to this entire class.
What to do about it
The base measurement is clean: protection alone changed nothing on any profile. The exposure comes from RenameMembers reaching option keys and record fields that an installed tabulation library reads. Scope MemberRegexp to names your bundle owns on both sides - Protect Members covers how the pattern is applied.
In the design, the change that helps most is to stop treating a default as a silent outcome. Count the holders who actually responded and assert that count against the mail you received, not against the tabulation you produced. A jump from twelve defaults to sixty is trivially detectable if anything anywhere is watching the response rate - and nothing was.
For a public issuer, the disclosure angle is covered in SEC cyber disclosure and your front-end JavaScript.
More generally: when a control's failure mode is a valid outcome rather than an error, no completeness check will help you, because completeness is what the design guarantees. The check has to compare against something outside the system - the instructions as received, the register as the agent holds it, the funding commitment as the acquirer signed it.
Frequently asked questions
Can obfuscation change what a shareholder is recorded as electing?
Not through protection alone - all five profiles produced byte-identical behaviour. With member renaming pointed at the election deadline, all forty-eight holders who wrote in on time were recorded as having said nothing, and every one of them received the default election instead.
Why is this harder to detect than other failures?
Because there is nothing missing. The offer closes and every share must become something, so a holder who says nothing is designed to receive the default. The tabulation reported sixty holders, sixty elections and nothing outstanding in both the correct and the broken run, and the agent's own rule passed in both.
Would a reconciliation have caught it?
No. The two clauses an exchange agent would really write - every holder carries exactly one election, and the elected shares foot to the register - are both closed by construction. They are true in every arm, including the one that discarded every instruction received.
Did the amount of money change?
In the deadline arm, yes: the cash leg went from 2,556,521.10 to 0.00. But renaming the deadline and the default election together - which one broad pattern does - produced a cash total of 2,556,521.10 and 72,728.62 shares issued, identical to the correct run to the cent, while every one of the sixty holders held a recorded election none of them made. The acquirer funds a fixed proportion of the offer, so the cut-back absorbs any change in who asked for what.
What is the odd-lot result?
Renaming the odd-lot protection flag reverted it to the library's false. Two holders of under a hundred shares lost an exemption printed in the offer document, the cut-back factor moved from 0.7464 to 0.7471, and the cash total did not change by a cent.
What check would actually detect this?
One defined outside the tabulation. Count the instructions you physically received and assert that count against the number of holders recorded as having elected. A move from twelve defaults to sixty is obvious against the incoming mail and invisible against the output.
Does the failure differ between the ES5 and modern targets?
No. Both targets were measured on every arm and agreed throughout. The base column with no member renaming was byte-identical to the unprotected run on both targets plus the two emit-gate profiles and the string-encoding profile.
Related reading