Measured Behaviour
Published
A statement of fitness usually says fit for duty. Sometimes it says fit for duty, except. We measured what a rename does to the word except, and the answer is that it produces a clearance which is genuine, current, correctly dated and broader than the doctor wrote it.
Fit for duty, except
We built a day's roster the way one arrives: sixteen placements, a table of what each role exposes somebody to, a table of recall periods per surveillance programme, a restriction vocabulary saying what each code on a fitness statement actually excludes, and fourteen clearances on file.
Five of those clearances carry a restriction. A beard that breaks a tight-fitting respirator seal. A shoulder that will not take a harness. A heat-intolerance finding. A lifting limit. A solvent sensitisation. There is nothing wrong with any of these records - each is a real examination, on a real date, inside its recall period, signed by a named clinician. Each simply carries a qualifier.
The correct run places eight and refuses eight. Six refusals are restriction matches: the respirator wearer who cannot wear a tight-fitting mask, the rigger who cannot work at height, the furnace operator with the heat restriction, a second rigger whose lifting limit excludes manual handling, the solvent-line worker with the sensitisation, and the crane operator whose vision is corrected-only. One refusal is a genuinely lapsed clearance and one is a worker with nothing on file.
Protected with default settings on all five profiles, behaviour was identical. Nothing below came from obfuscation on its own.
Three names, one identical result
Rename the restriction list on the clearance records and placed rises from eight to fourteen. Refused falls from eight to two. The counter for workers stopped by a restriction goes from six to zero. All six restricted workers go into the exact role their restriction names.
Rename the restriction vocabulary instead - the table that gives the codes their meaning - and you get the same fourteen, the same two, the same zero. Rename the flag that says whether to honour restrictions at all and you get it a third time. So do both unions we measured.
Five arms, one identical outcome, and in every one of them the site's fitness check passes printing: sixteen placements, fourteen placed, two refused, zero stopped by a restriction. Every figure true. A roster with nobody blocked reads like a healthy workforce, which is the trap - the sentence gets better as the control gets worse.
It is worth noticing that scoping a member pattern to spare the configuration object buys nothing here. The record field and the two option keys land on the same fourteen. If the record shapes are still in the pattern, the careful narrowing has bought you the identical failure from the other end.
The same silence, reached a different way
This article is the pair to worker certification currency, and the two are worth reading together because they lose different things and arrive at the same place.
There, what goes missing is a separate record whose entire content is that an earlier record is void - a suspension, a revocation. Nothing that survives is wrong; what survives is a certificate that should not exist.
Here, what goes missing is a field on the positive record itself. The examination happened. The date is right. The programme is right. The recall period is right. The clearance is genuine and current. It has simply become broader than it was written, and a clearance without an exception is indistinguishable from a clearance that never had one.
Both are the same class of failure and neither has a wrong value anywhere in it. A retraction and a qualifier are the two ways a record can be narrowed after the fact, and losing either leaves an output in which every remaining figure is correct.
Identical to the fixture you would have written
We ran the same sixteen placements against clearances in which nobody carries a restriction, because nobody has anything wrong with them. That run places fourteen and refuses two, with the restriction counter at zero.
Those are the same numbers as every failing arm above. Not similar - identical, on every counter we print.
That is the finding to take seriously, and it is the same one article A reports for withdrawals. Constructed test data is healthy test data. When you write a fixture you invent workers and clear them; you do not usually invent a worker, clear them, and then have a doctor attach a restriction that keeps them off one of your roles. So the fixture most teams would build produces byte-identical output to the broken run, and will stay green through every arm here.
The loud contrast is one field away, as usual. Rename the examination day or the surveillance programme and placed collapses from eight to two: fourteen of sixteen refused because no clearance can be dated. Nobody works, and it is fixed the same morning.
What to do about it
Make the qualifier a visible bucket in the output rather than an absence of a refusal. Report how many restrictions were read and matched on each run, print them per placement, and fail when a vocabulary you believe is loaded resolves nothing. An assertion over the restriction count fails in every arm above; an assertion over placements fails in none of them.
Reconcile against the occupational-health provider rather than against your own configuration. The provider wrote the restrictions and can tell you how many are currently in force; your own deployment cannot, because the thing that went missing is the thing you would be asking.
And phrase the record so that losing a name fails closed. A clearance that carries an explicit list of roles it covers stops matching when the list is lost; a clearance that carries a list of roles it excludes covers everything when the list is lost. That is a design decision that costs nothing at the time and decides the direction of every later failure.
On the protection side, scope the member pattern so it reaches neither the vocabulary nor the clearance records. Protect Members documents how MemberRegexp matching works. If the clearances themselves are health records, HIPAA and your JavaScript covers what may sit in a browser bundle at all.
Frequently asked questions
Did obfuscation change any placement on its own?
No. On all five profiles - the ES5 target, the modern target, both emit-gate configurations and the string-encoding profile - the protected bundle behaved identically to the original. Every difference came from member renaming reaching the surveillance configuration or the clearance records.
What did renaming the restriction list do?
It placed six workers into the exact role their clearance excluded them from. Placed rose from eight to fourteen, refused fell from eight to two, and the counter for workers stopped by a restriction fell from six to zero.
Is renaming the records safer than renaming the settings object?
No. The restriction list on the record, the restriction vocabulary and the honour flag all produce identical output - sixteen placements, fourteen placed, two refused, zero stopped by a restriction - and so do both unions we measured.
Did the site's fitness check catch it?
No, and it read better in the failing arm. It printed sixteen placements, fourteen placed, two refused, zero stopped by a restriction, which is a truthful sentence describing what looks like a healthy workforce.
How is this different from a lapsed clearance?
A lapsed clearance is a wrong date and it fails loudly - renaming the examination day dropped placements from eight to two. A lost restriction is not a wrong value at all: the clearance is genuine, current and correctly dated, and only the word except is gone.
Why does a normal test fixture miss this?
Because constructed test data is healthy. We ran the same sixteen placements against clearances in which nobody had a restriction and got fourteen placed and two refused - identical to every failing arm on every counter.
What should we change in the record design?
Carry the roles a clearance covers rather than the roles it excludes. An allowlist stops matching when a name is lost, so it fails closed; a list of exclusions covers everything when it is lost, so it fails open.
Related reading