Measured, not asserted
Published
Drug accountability is a subtraction that always balances. What was dispensed equals what came back, plus what was taken, plus what is unaccounted for -- and unaccounted for is defined as the remainder, so the ledger foots on every basis, including bases nobody chose. The figure that is not closed by construction is the split between returned and taken, and treatment compliance is computed from exactly that split. This test renamed the field carrying returns. Every subject came out at 100.0% compliance and the ledger still footed.
The reconciliation that cannot fail
Twelve kits across four subjects, twenty-eight units each. Correctly reconciled: 336 units dispensed, 55 returned, 281 taken. Three subjects are compliant. The fourth, S-007, brought back 34 of their 84 units -- 59.5% compliance against an 80% floor -- and comes out of the per-protocol analysis population.
The engine also prints foots=true, and it always will. The unaccounted figure is defined as dispensed minus returned minus taken, and taken is defined as dispensed minus returned, so the subtraction is zero by construction. A reconciliation closed by construction is an invariant of the code, not evidence about the result.
The sponsor's own accountability rule is a real rule, and a good one: every kit accounted for against a subject, and the ledger footing. It passes in every arm measured here, including the ones this article is about, and it prints its working while doing so.
Protection on its own moved nothing
All five areas ran through five presets before any renaming: the ES5 default path, the modern target, the emit gate's option set on both targets, and the string transforms. Twenty-five comparisons, all byte-identical to the unprotected run.
Nothing below is caused by protecting the code. Every result required member renaming aimed at a name that both the sponsor's kit records and the installed accountability engine read.
Both sides of the boundary reach the same wrong answer
Renaming the option that tells the engine to subtract returns -- a configuration key -- and renaming the field on the kit records that carries the returned quantity are entirely different edits. One is policy, one is data. They live in different files and belong to different owners. Renaming either produces byte-identical output:
dispensed=336units returned=0units taken=336units unaccounted=0units foots=true per-protocol=4 excluded=0, with every subject at compliance=100.0%.
S-007, who returned four out of every ten units they were given, is back in the per-protocol population and their outcome will be analysed as though they took the drug. The sponsor's rule passed and printed ledger foots at 336 dispensed = 0 returned + 336 taken. That sentence is arithmetically perfect and describes a trial that did not happen.
A rename pattern scoped to configuration and a rename pattern scoped to your own record shapes are not two independent risks here. They are two doors into one room.
Two floors, and the decisive one sounds like a detail
The fixture carries two thresholds that both read 80%: a compliance floor, used for the wording on each subject's line, and a per-protocol floor, used to decide who stays in the analysis population.
Renaming the compliance floor moves only the wording. S-007's compliance is still correctly 59.5% and they are still excluded. Renaming the per-protocol floor leaves the compliance figure exactly right at 59.5% and puts S-007 back in the population.
So the arm that changes the analysis set is the one whose name reads like a reporting preference, and the arm that reads like the important threshold is cosmetic. Severity is not a property of how load-bearing an option sounds. It is a property of which branch consults it.
What failed loudly
Renaming the dispensed quantity produced a ledger reading 0 dispensed = 55 returned + -55 taken and put every subject out of the per-protocol population at 0% compliance. Nobody ships that.
Renaming the expected quantity divided by zero expected units and set every compliance figure to 0.0%, excluding everybody -- loud in the other direction.
Renaming the subject identifier collapsed all twelve kits into a single subject: per-protocol=1, one row where there should be four. A grouping key that cannot be read does not raise; the engine creates a bucket on demand and everything joins it. That is the same shape this series has measured on family deductibles and on tenant billing, reproduced here on a drug-accountability log.
The contrast holds for the eighteenth shape running. Losing a quantity fails closed and loud. Losing the meaning of a quantity -- whether a return is a return -- fails open and silent.
Why the ledger is the wrong thing to check
The obvious control on a drug-accountability log is that it reconciles, and every team building one puts that check in. It is the first thing an auditor asks for. It passed in every arm measured in this article, and it will pass in every arm of every article, because it is checking a definition rather than a measurement.
The check that catches this compares the split against a source outside the accountability code: the returned-kit count in the pharmacy log, the tablet counts on the drug-accountability form, the subject's own diary. Any one of those is external evidence about how much came back, and none of them moves when a property name moves.
This is a control in the ISO 27001 sense as much as a GCP one -- the integrity of a computed value that feeds a regulatory submission. If that computation runs in a browser, the change-control and integrity evidence an ISO 27001 or SOC 2 programme already collects is the right home for the answer: pin the build, and assert the output.
What to do about it
Assert one known subject's compliance to a tenth of a percent, and assert who is in the per-protocol population by name. Both fail in every silent arm here.
Reconcile the returns against something the accountability code does not compute. A ledger that foots proves the code is self-consistent and nothing else.
And treat a kit record with no returned quantity as an open query rather than a return of zero. Those are very different clinical statements, and only one of them is a claim you can defend to an inspector.
Frequently asked questions
Did obfuscation change any accountability figure on its own?
No. Five areas ran through five presets with every protected output byte-identical to the unprotected run. Every failure here required member renaming aimed at a name the installed accountability engine also reads.
What happened when returned units were renamed?
Every unit dispensed was recorded as taken. All four subjects came out at 100.0% compliance, the subject who actually took 59.5% went back into the per-protocol population, and the ledger footed at 336 dispensed = 0 returned + 336 taken.
Did the option route and the record route differ?
No, and that is the point. Renaming the configuration key that enables return counting and renaming the field on the kit records that carries the returns produced byte-identical output. Policy and data are two doors into one room.
Did the reconciliation catch it?
No, and it never can. Unaccounted units are defined as the remainder of the subtraction, so the ledger foots on every basis. A reconciliation closed by construction is an invariant of the code, not evidence about the result.
Which threshold actually decided the analysis population?
The per-protocol floor, not the compliance floor. Renaming the compliance floor moved only the wording on each line; renaming the per-protocol floor left the 59.5% figure correct and put the subject back in the population.
What failed loudly?
The quantities. Renaming dispensed units produced a negative taken figure; renaming expected units set every compliance figure to zero. Renaming the subject identifier collapsed twelve kits onto one subject.
What is the cheapest test that would have caught this?
Assert one known subject's compliance percentage and the membership of the per-protocol population by name. That fails in every silent arm here. Asserting that the ledger foots passes in all of them.
Related reading