Measured, not asserted
Published
An emergency call arrives carrying several location fixes at once and they disagree. A handset-derived fix is good to a few metres, a network triangulation to a few hundred, a cell sector to a kilometre or more. All three are genuine measurements, each correct inside its own stated uncertainty. Choosing between them is not a question of validity -- nothing here is invalid -- it is a question of precedence, and the precedence is a list. This test renamed that list against a real obfuscation engine. Every call was still answered. Every call still landed inside a published jurisdiction. Two of six landed in the wrong one, and the authority's own route check reported six of six.
The metric the system is judged on does not move
The fixture routes six emergency calls to three dispatch centres by containment: pick a location fix, find the published service area that contains it, hand the call to that centre. Each call carries up to three fixes from different sources, and on two of the calls the fixes disagree about which side of a district line the caller is on. That is the ordinary case near a boundary, not a contrived one.
Correct answer: six calls, all six inside a published jurisdiction, none misrouted.
What makes this area worth measuring is that the number an emergency network is actually judged on -- calls answered, and how fast -- is unchanged in every single arm below. The overflow desk is a real desk with real people who really do pick up. A call routed to the wrong centre is answered, described, and then transferred, and the transfer is the delay. From inside the routing engine, nothing failed.
Renaming the precedence list makes the coarsest fix win
Rename the option holding the accuracy order and the library falls back to its own default, which is no ordering at all: the first fix offered wins. That is whatever order the switch happened to assemble them in, and in this fixture it is frequently the cell sector.
The result is in-published-area=6 on-overflow=0 MISROUTED=2. Two calls are routed on a fix that is real, is inside its own stated uncertainty of about 1.7 kilometres, and is on the wrong side of a district line. The authority's route rule -- no call may be closed on the overflow desk while a named jurisdiction exists for it -- prints route-check(6 of 6 call(s) reached a named jurisdiction). That sentence is true. Six calls did reach a named jurisdiction. Two reached the wrong one, and the rule was never asked about that.
Renaming the source field on the fix records instead of the option that orders them produced the identical answer. The configuration route and the record route reach the same place, which is worth knowing when scoping a pattern: excluding the options object is not sufficient if the records carry the same names.
The accuracy guard is inert, and that is the honest result
The fixture also carries an uncertainty limit: a fix whose stated error exceeds two kilometres may not be routed on. Renaming it changed nothing -- MISROUTED=0 -- and so did renaming the uncertainty figure on the fixes themselves.
The reason is that every fix in this fixture is inside the limit. The coarsest cell sector is 1,900 metres and the limit is 2,000. The guard is doing nothing because there is nothing for it to do, and a guard that is inert on your data is not a guard that will be inert on tomorrow's data.
Renaming the limit together with the precedence list was byte-identical to renaming the precedence list alone, for the same reason. It is a clean example of why an inert-looking arm is not evidence of anything: the arm is inert because of the values in the fixture, not because of the name.
Losing the geometry is loud; losing the choice is silent
The contrast in this area is unusually clean because the geometry and the choice sit in the same configuration object.
Rename the service areas, or the latitude, or the longitude, or the bounding-box edges: every one of those refuses the run outright. No containment test can be performed, every call falls to the overflow desk, and the authority's rule stops the batch. Those are the arms a control room notices in one shift.
Rename the precedence list and every containment test runs perfectly against genuine coordinates. That is the entire difference. Losing the ability to place a caller produces a loud, immediate, visible failure; losing the rule about which of several placements to believe produces a confident answer that happens to be wrong twice out of six.
One further arm is worth quoting because it is the quietest in the area. Rename psap, the field naming each published centre. The run reports in-published-area=6 and the route check passes, because every call genuinely was contained inside a published area -- an area whose name is now undefined. MISROUTED=6. Every call is handed to a centre that does not exist, and the containment metric is perfect.
The counter and the thing it counts
As in the portability area, this fixture carries the answer each decision is trying to reproduce so it can count misroutes, and a real system would not have that field to hand.
Rename the precedence list and the ground-truth field in one pattern: MISROUTED=0, with two calls in the wrong jurisdiction. The counter is not lying; it is comparing two values that both moved.
Rename the flag that enables the authority's route rule together with the precedence list and the misroute count stays at two with no check running at all -- the familiar shape where a quiet failure switches off the loud control in front of it. Renaming the rule function itself does the same, with the library substituting a builtin that accepts any route.
Renaming the callback number is inert for routing and worth a separate thought: the call goes to the right centre and the dispatcher cannot ring back if it drops. Public-safety systems procured under federal programmes tend to require evidence that such controls function rather than merely exist; that expectation is the same one described in our FedRAMP and CMMC notes.
What to change, whether or not you obfuscate
Assert which fix was used, not just that one was. Log the source and uncertainty of the fix each call was routed on, and alarm when the distribution shifts -- a sudden jump in the share of calls routed on cell sector is the signature of this failure and of several non-obfuscation causes too.
Make an absent precedence an error. A routing engine that cannot establish which of several disagreeing measurements to believe should refuse to choose rather than take the first one it was handed. That single change converts every arm in this area from silent to loud.
Reconcile against the far side. Count calls transferred out of each centre, by receiving centre. That number is written by the receiving control room, not by your routing engine, and it moves the moment jurisdiction assignment drifts.
And scope renaming patterns to exclude both the configuration object and the record fields that mirror it. This area is the clearest demonstration in the pass that excluding one and not the other buys nothing.
How this was measured
Five telecommunications areas were driven through the real obfuscation engine on five presets -- the ES5 default, the modern target, the emit gate's option set on both targets, and the string transforms. All twenty-five combinations produced output byte-identical to the unprotected run, so protection on its own changed nothing.
The member-renaming column is ninety-six patterns on two presets, one hundred and ninety-two verdicts, one hundred and seventy-eight of which moved the output. The fourteen that did not are the seven deliberately pinned controls measured on both presets; two of the seven are in this area.
Before the renaming column, every option key and record field was deleted in the unprotected world to confirm it changes the answer. The ground-truth field in this area was structurally blind on the first run -- it cannot move an answer that already reads zero misroutes -- and the fixture was changed to print the basis of the comparison rather than only its verdict, which is what made the arm readable.
Every figure quoted was read by executing the protected artifact.
Frequently asked questions
Did obfuscation on its own break emergency call routing?
No. Five presets -- the ES5 default, the modern target, the emit gate's option set on both targets, and the string transforms -- all produced output byte-identical to the unprotected run across all five areas measured this pass.
What actually broke it, then?
Member renaming reaching the list that orders location sources by accuracy, or the field on each fix that names its source. Both produced the same two misroutes.
Were any calls dropped?
No. Every call in every arm was answered. That is what makes this area worth measuring: the metric the network is judged on does not move, and the jurisdiction does.
Why did the authority's route check pass?
Because it asks whether each call reached a named jurisdiction, and each call did. It was never asked whether that jurisdiction was the right one.
Did the accuracy limit protect anything?
Not here. Every fix in the fixture was inside the two-kilometre limit, so renaming the limit was inert -- which is a fact about the fixture's data, not evidence that the guard is safe.
What is the single highest-value change?
Make an absent precedence an error rather than a fallback to whichever fix arrived first. That converts every silent arm in this area into a loud one.
Can I still obfuscate a routing client?
Yes, with the configuration object and the matching record fields excluded from any member-renaming pattern. Identifier renaming, string encoding and control-flow transforms are unaffected.
Related reading