Measured, not asserted
Published
The previous round of these measurements ended by recommending that you assert an aggregate's provenance rather than its finiteness. This file was built to find out what that recommendation is actually worth.
The deposit is easy and the low point is not
An escrow account collects a twelfth of the year's tax and insurance bills each month and pays them when they fall due. Once a year the servicer projects the coming twelve months, finds the lowest balance the account will reach, compares it with the cushion the note allows, and spreads any shortage over a stated number of months.
The monthly deposit is arithmetic over the year's bills and is hard to get wrong. The low point is not. It is a walk through twelve months in order, and it is the only figure in the analysis that depends on WHEN each bill falls rather than how large it is. In this sample $7,620 of bills across three months takes the account to -$235.00 in November, and against a two-month cushion the payment becomes $760.42.
Protection alone changed none of it, on any of five presets, here or in the other four areas measured this pass.
The provenance assertion worked
The caller's rule of record in this file asks two questions, and the second one is deliberate: does the projection the low point came out of actually contain the year's bills? That is a provenance assertion rather than a sanity check on the number, and it was put here to be tested rather than recommended again.
Renaming month, the field that dates each disbursement, meant no bill could be placed in the projection. The deposit was still exactly right at $635.00, because that is computed from the records directly. The low point was not: with no outflows projected the account only ever grows, and the walk returns $1035.00.
The assertion caught it cold: projection-rejected(projection-provenance-check(bills projected must equal bills owed)). No payment was set, the analysis refused, and the fault was recoverable the same day. That is the mitigation doing exactly the job it was recommended for, against a fault that a check on the low point's finiteness or plausibility would have waved straight through -- $1,035 is a perfectly ordinary escrow balance.
And then the flag in front of it went
Renaming month and requireEscrowCheck together is the arm this file exists for. The payment came out at $654.58 instead of $760.42, a shortfall of $105.84 a month, on an account that will actually be $235 overdrawn when the county tax falls due and further behind every year after that.
The evidence was on the same line: projected disbursements $0.00 of $7620.00. The assertion had already computed the exact figures that prove the analysis was wrong. Nothing consulted them, because the flag that decides whether to consult them was reachable by the same rename pattern.
The variant beside it is quieter still. Renaming month and escrowRule -- the rule itself rather than the flag -- produced the same $654.58 and a line reading checked by library-builtin(accepts any projection). The word 'checked' survives. An auditor grepping for evidence that a check ran finds it, and what ran was the vendor's permissive default.
Two different names, one identical answer
One measurement in this file is a warning about how to read the others. Renaming cushionMonths -- an option key, on the other side of the option-versus-field split -- also produced a payment of exactly $654.58.
It got there by a completely different route. The cushion arm keeps the real low point of -$235.00 and loses the requirement, so the shortage is $235 against a required $0. The provenance arm loses the low point and keeps the requirement, so the shortage is $235 against a required $1,270 from a low of $1,035. Every intermediate figure differs and the bottom line is identical to the cent.
So a reviewer diffing only the borrower's new payment would conclude these are the same fault, and would fix one of them. The other three arms give the range: shortageSpreadMonths spreads the real $1,505 shortage over the library's five years instead of the note's twelve months, giving $660.08; the two option keys together give $638.92; and renaming any amount -- the disbursements or the opening balance -- was refused loudly before the analysis ran.
What this says about the mitigation
The provenance assertion is worth having. It was the only thing in this file that caught a fault which every plausibility-shaped check would have passed, and it caught it completely. That is a real result and it should be read as one.
But it inherits the weakness of every optional control: it is only loud while it is still reached. If the same rename pattern can take both the assertion and the flag in front of it, you get the silent outcome, not the loud one. Make the assertion unconditional where you can -- a projection that does not contain the bills it is projecting is not an analysis with a failed check, it is not an analysis -- and if it must sit behind a flag, keep that flag's name out of any pattern that can reach the data it guards.
The wider mitigation is the same one this series keeps arriving at, and it is worth having regardless of obfuscation because a dropped key over a serialisation hop produces the same miss. Scope member renaming to names your own code owns on both sides, and keep option keys and record fields read by an installed library out of it entirely.
Frequently asked questions
Does obfuscation change an escrow analysis?
Not on its own. Across five presets and five areas measured this pass, protection alone left every output identical -- twenty-five comparisons, no differences. What changed behaviour was member renaming, a separate opt-in option whose pattern you write yourself.
What did the provenance assertion actually catch?
Renaming the field that dates each disbursement left the projection with no outflows in it, so the low point came back as $1,035 instead of -$235. The assertion compared the bills projected with the bills owed, refused the analysis outright, and set no payment.
Would a plausibility check have caught the same thing?
No. A low point of $1,035 is a perfectly ordinary escrow balance -- finite, positive and unremarkable. The fault was only visible by asking where the number came from, not by asking whether it looked sensible.
So what went wrong?
The assertion sits behind an enabling flag, and renaming both by the same pattern produced a monthly payment of $654.58 instead of $760.42. The line that proves the analysis was wrong, showing $0.00 of $7,620.00 of bills projected, was printed and never consulted.
What happens if the rule is renamed instead of the flag?
The library substitutes its own permissive default and the output still reads 'checked by' -- naming the built-in rule. An audit looking for evidence that a check ran finds that evidence, and the check that ran accepts anything.
Why does the article warn about identical bottom lines?
Because two unrelated renames produced exactly $654.58 by different routes -- one loses the cushion requirement and keeps the real low point, the other loses the low point and keeps the requirement. Diffing only the final payment would make them look like one fault.
What is the practical mitigation?
Make a provenance assertion unconditional rather than optional, since a projection that does not contain the bills it projects is not an analysis at all. Then scope member renaming to names your own code owns on both sides.
Related reading