Measured Behaviour
Published
An officially-free herd status is not a claim about animals. It is a claim about EVIDENCE - a clear test, at the right interval, on enough of the herd to mean anything. Every one of those is a qualifier, and the status is a boolean. We measured what happens when a qualifier goes missing and the boolean does not.
A status is the conjunction of its qualifiers
No test proves a herd is free of tuberculosis. A test that comes back clear, at the interval the herd's risk area requires, on enough of the herd to be worth anything, licenses the claim until the next one falls due. That is four conditions and a date, and what the system stores is a single word.
We built it as it looks. A programme with three intervals - six months in a high-incidence area, twelve on the edge of one, forty-eight in a low-incidence area. No grace period. An inconclusive reactor counts as a failure. Two consecutive clear tests are needed to restore a status. A test only counts if 95 per cent of the herd was tested. An overdue herd loses its status rather than keeping it.
Three herds. A four-hundred-head dairy herd in the high-incidence area, last clear on day 220 and therefore due on day 400. A hundred-and-twenty-head herd on the edge, tested on day 380 and well inside its year. A ninety-head low-incidence herd whose two most recent tests are an inconclusive one and a test of six animals out of ninety.
On day 430 the correct run certifies one herd, suspends two, and certifies 120 head. The four-hundred-head herd is thirty days overdue. The ninety-head herd has no test on file that counts. Both of those are true, and neither of them is a statement about an animal. The companion control, which decides how long a treated animal stays out of the food chain, is measured in the withdrawal-period article.
Four different names, one identical outcome
We then renamed, one name at a time, and this is where the area stopped behaving like the others in this series.
Rename the record field that says which risk area a herd sits in and the library has no basis for testing that herd more often than the baseline, so it falls to the longest interval in the table - four years. The four-hundred-head herd is now due on day 1,660 and is certified. Certified head went from 120 to 520, suspended head from 490 to 90, and the counter held outside the bundle - head certified without an entitlement - went from 0 to 400.
Rename the interval table instead and you get the same figures. Rename the grace period and you get the same figures. Rename the option that decides what happens to an overdue herd and you get the same figures again. Four names, three of them configuration and one a record field, and one identical outcome: 520 certified head, 400 of them stale.
The union of two of them is identical to either half. That surprised us - we had pre-registered it as the case where two options pulling the same way should compound. They do not, because there is exactly one herd in the fixture whose status can move, and either route alone is enough to move it. A union that is identical to one of its halves tells you which half is load-bearing; here it tells you that none of them is, because they are four doors into the same room.
The union that did compound, in the same file
The same file carries the opposite case, which is why we can be confident the first result is about the fixture's shape rather than a limitation of the method.
The ninety-head herd is suspended for two independent reasons: its recent test carried an inconclusive reactor, and the test after that covered six animals out of ninety. Rename the option that makes an inconclusive reactor a failure and nothing moves - the coverage floor still refuses the other test. Rename the coverage floor and nothing moves - the inconclusive still counts as a failure. Each half, on its own, changes only a printed configuration line.
Rename both and the herd is certified: certified head 120 to 210, and 90 head certified with no entitlement. Two arms that a reviewer would close as cosmetic, and their union is a herd waved through.
So the same file demonstrates both readings. Options compound when they act on different parts of the distribution and collapse into one another when they do not. Neither is the default. You have to measure the halves. The disposition measurement in this series carries the opposite case, where two names add up exactly.
Why nothing in the run looked wrong
In every arm above the programme's own status check passed. It asserts that every herd was either certified or suspended and that the head reconciles. Both held everywhere, because a longer interval does not unbalance a ledger; it moves a herd from one side of it to the other.
Every test on file stayed genuine. Every laboratory result was exactly what the laboratory reported. Every certificate issued in the defective run had a real clear test behind it. The test that certified 400 head on day 430 really did come back clear - on day 220, under a rule that says that covers six months.
This is the shape that makes the area worth measuring. Nothing the system can inspect about a certificate distinguishes a valid one from a stale one, because the difference is not in the certificate. It is in the relationship between its date and a rule that lives somewhere else.
Why a test suite would not have caught it
Our negative control is a programme where every herd was tested three weeks ago, whole-herd, clean and unambiguous. In that fixture every arm above is inert on every counter; the only thing that moves is a printed configuration line.
The reason has nothing to do with obfuscation. A herd tested three weeks ago is inside every interval in the table, so it makes no difference which one applies to it. A test with no inconclusive reactors is unaffected by the rule about inconclusive reactors. A whole-herd test clears any coverage floor.
And that is the fixture almost anybody would write, because it is the case the screen was designed for: a herd that has just been tested. The cases that expose the defect are the herds nobody wants to look at.
What to do about it
The reassurance first. We protected this bundle on five profiles - the ES5 target, the modern target, both emit-gate configurations and the string-encoding profile - and all five produced behaviour identical to the unprotected original, measured twice and diffed. Obfuscation does not stretch a testing interval. Member renaming pointed at the names an interval is computed from does.
Scope member renaming to names you own on both sides. The four names that moved this outcome are an option key, two more option keys, and a field on a record - and a regexp aimed at 'the options object' catches three of the four while leaving the fourth, which is enough on its own. The member renaming documentation describes how to scope it.
Then compute the expiry rather than the status. A herd record that stores 'officially free' stores a conclusion; a herd record that stores 'clear on day 220, valid to day 400' stores the evidence, and the second one is checkable by anybody with a calendar. Every arm we measured here changed the conclusion while leaving the evidence intact.
And measure the number nobody has: head certified past their own expiry, computed against a rule held outside the software. Certified and suspended reconcile in every arm. Stale-certified head is the only figure that moved, and it went from 0 to 400 - which across a national programme of forty-eight thousand herds is not a rounding difference.
Frequently asked questions
Does JavaScript obfuscation break herd testing intervals by default?
No. We protected the same testing bundle on five profiles - the ES5 target, the modern target, both emit-gate configurations and the string-encoding profile - and all five produced behaviour identical to the unprotected original, measured twice and diffed. The defect requires member renaming pointed at the names the interval is computed from.
What happened when the risk area field was renamed?
The library lost the basis for testing that herd more often than the baseline and fell back to the longest interval in the table - four years instead of six months. A herd thirty days overdue became a herd certified for another three years, and 400 head were certified officially free without an entitlement.
Why did four different names produce the same result?
Because only one herd in the fixture had a status that could move, and each of the four names is on its own sufficient to move it. That is a property of the situation rather than of the transformation: options compound when they act on different parts of the distribution and collapse into one another when they do not.
Is there a case in the same measurement where two options did compound?
Yes. A second herd was suspended for two independent reasons - an inconclusive reactor and a test that covered six animals out of ninety. Each name alone changed only a printed configuration line. Renaming both certified the herd and put 90 more head into the stale column.
Did any certificate in the defective run lack a clear test?
No, and that is the difficulty. Every certificate had a genuine clear test behind it. The test that certified 400 head on day 430 really came back clear - on day 220, under a rule that says that covers six months. Nothing about the certificate distinguishes it from a valid one.
Would our test data have found this?
Probably not. In our negative control, where every herd was tested three weeks ago whole-herd and clean, every arm is inert on every counter. A recently tested herd is inside every interval in the table, so which interval applies makes no difference.
What is the structural fix?
Store the evidence rather than the conclusion. A record that says 'clear on day 220, valid to day 400' can be checked by anybody with a calendar; a record that says 'officially free' cannot. Every arm we measured changed the conclusion and left the evidence untouched. Then scope member renaming to names you own on both sides, and add a counter for head certified past their own expiry.
Related reading