Measured, not asserted
Published
A grain settlement is a division of a delivered weight into what is paid for and what is not: net weight, moisture shrink and dockage. The three always add back up to the gross, because net is computed as the remainder. So the ticket foots on every basis, including bases nobody chose. What is not closed by construction is the split between the grower and the elevator, and the split is the money. This test moved the split five different ways. The ticket footed every time.
Four loads, one grade table, and a number that never moves
The fixture settles four loads across three growers. Moisture basis 14.5%, shrink factor 1.18% per point over, a dockage schedule on foreign material, and a grade table that pays 232 per tonne for milling one, 218 for milling two and 176 for feed, selected on test weight. The correct settlement is 110,300 kg gross, 1,284.43 kg of shrink, 1,334.75 kg of dockage, 107,680.82 kg net and 23,271.48 paid.
Rename the minimum-test-weight key inside the grade table. Each band's threshold becomes unreadable, so no load clears any band, and the walk falls through to the last one. Every load settles as feed.
The measured result: graded=4 shrink=1284.43kg dockage=1334.75kg net=107680.82kg foots=true TOTAL-PAID=18951.82. Four loads graded. Every weight to the kilogram identical to the correct run. The elevator's own settlement rule passing and printing gross 110300 = net 107681 + shrink 1284 + dockage 1335. And 4,319.66 has left the growers' side of the ledger.
Renaming the test-weight field on the load records instead reaches the same answer, byte for byte, and so does the union of the two. The same comparison, from opposite sides, onto one number.
Protection on its own moved nothing
As in every area this pass, five presets ran first -- the ES5 default path, the modern target, the emit gate's option set on both targets, and the string transforms -- and produced output byte-identical to the unprotected run across all five areas.
Everything below required member renaming reaching names the installed settlement library reads.
The reconciliation is an invariant of the code, not evidence about the result
The elevator's settlement rule checks that the parts add back up to the gross weight. It is the check anybody would write, and in this fixture it passed in every arm that moved money.
Stop applying the shrink and the elevator buys 1,284 kg of water at grain prices: TOTAL-PAID=23551.33, up 279.85, foots=true. Lose the dockage schedule and it pays for 1,334 kg of foreign material: 23537.35, foots=true. Send every load to feed and it pays 4,319.66 less: foots=true. Pair the shrink loss with the flag that enables the settlement rule, or with the rule itself, and the answer is byte-identical to losing the shrink alone -- because the rule was never going to refuse it.
That is not a defective check. It is a check of an identity. Net is defined as gross minus shrink minus dockage, so gross equals net plus shrink plus dockage is true by arithmetic, on every basis, including the ones nobody chose. A reconciliation closed by construction tells you the code did what the code does.
Both sides of the same comparison
The grade selection is one comparison written in two places: a minimum test weight sitting in the elevator's configuration, and a test weight sitting on each load record. Renaming either makes the comparison unreadable, and an unreadable comparison is false for every band.
The direction is decided by what the fall-through does. This table is ordered from best to worst, so falling through lands on feed and the grower is underpaid. Order it the other way and the identical failure overpays. Neither ordering is wrong; the point is that the consequence of a lost name is decided by a layout decision nobody thought of as a control.
The same pairing appears twice more in this file. The shrink flag and the moisture reading both land on 23,551.33. The dockage schedule and the foreign-material reading both land on 23,537.35. Three separate mechanisms, each reachable from a configuration key and from a record field, each pair landing on one identical number.
What a spot check would see
Load L-A is dry, clean and heavy, and in the correct settlement it takes no shrink and no dockage at all. In the arms that remove the shrink or the dockage, L-A is byte-identical to correct. A reviewer who pulls one ticket and happens to pull the clean one finds nothing.
This is the per-record masking this series has now measured in six areas. The loads that change are the ones carrying the condition the deduction exists for, and those are a minority of any elevator's intake. Sampling the output is structurally unable to find it, because most of the output is right.
The grade arm is the exception and it is worth noting why: it moves every load, because every load falls through the same broken comparison. It is also the only arm where the total moves by thousands rather than hundreds, which is the one thing a monthly reconciliation against the futures position might notice.
What failed loudly
Renaming the gross weight refused the settlement outright -- the elevator's rule catches a weight that is not a number, which is the one thing a conservation check is genuinely good at. Renaming the price per tonne produced TOTAL-PAID=NaN, which no accounts-payable run accepts. Renaming the grade table wholesale produced graded=0 TOTAL-PAID=0.
Renaming the grade label inside the table is the near-miss: the price is still correct and the money is exactly right, but every line of the settlement statement names an undefined grade. That would be caught by the first grower to read their statement, which is a different and slower detection path from a NaN in a payment file.
Once again the contrast holds. Lose a value and the settlement stops. Lose the meaning of a comparison and the settlement runs, foots, prints and pays the wrong number.
The difference between checking arithmetic and checking a result
There are two questions you can ask about a settlement. Did the parts add up? And is each party's share right? The first is answerable from inside the settlement and is always true. The second is answerable only against something outside it.
Outside sources exist and elevators already have them: the grade the sampler recorded on the intake ticket, the moisture the probe printed, the contract the load was delivered against. Comparing the grade the settlement applied with the grade the sampler wrote down catches the whole grade-table family in one line, and it is a comparison the business already performs on paper.
The arithmetic check is still worth keeping. It caught the non-finite weight. It is simply not evidence about anything else.
What to assert
Assert the grade, not the total. For one load with a known test weight, assert which band the settlement applied. That fails in the table-key arm, the record-field arm and their union, and it is the assertion the footing check cannot substitute for.
Assert the deduction on a load that should carry one. Take a load over moisture basis and assert a non-zero shrink; take a load over the dockage threshold and assert a non-zero dockage. Both fail in arms where the total still foots, and neither is caught by any conservation check.
Keep the footing assertion for what it is good at: refusing a settlement built from weights that are not numbers.
And exclude the property names that cross into the settlement library from renaming. The engine does what it is configured to do; the configuration is where this is decided, and a test that asserts a real grade and a real deduction is what proves the configuration is still right after the next release. The same argument applies to payment code under PCI DSS 6.4.3 and 11.6.1, where the evidence auditors want is the test, not the setting.
Frequently asked questions
Did obfuscation on its own break grain settlement?
No. Five presets across all five areas of this pass produced output byte-identical to the unprotected run. Every result here required member renaming reaching names the installed settlement library reads.
What did renaming the grade table's minimum test weight do?
Every band's threshold became unreadable, so no load cleared any band and all four fell through to feed. The total paid dropped from 23,271.48 to 18,951.82 with every weight in the settlement unchanged and the ticket still footing.
Did the elevator's own settlement check catch anything?
Only the arm where a weight was not a number. It passed in every arm that moved money, because it checks that the parts add back up to the gross and net is computed as the remainder -- so that identity is true on every basis.
Does losing the shrink or the dockage look any different?
No. Removing the shrink pays 279.85 more and removing the dockage 265.87 more, and both report foots=true. Each is reachable from a configuration key and from a record field, and each pair lands on the same number.
Would spot-checking a ticket find it?
Not reliably. The clean, dry load is byte-identical to correct in the shrink and dockage arms, because it carries no deduction to lose. Only the loads with the condition the deduction exists for move.
Which direction does a lost grade comparison fail in?
Whichever way the table is ordered. This table runs best to worst, so falling through lands on feed and underpays the grower. Ordered the other way the identical failure overpays -- a layout decision, not a control.
What is the cheapest test that catches this?
Assert the grade applied to one load with a known test weight, and assert a non-zero deduction on one load known to be over basis. Both fail while the footing check passes.
Related reading