Module faults 

The fault surface: every measured lie, armable on its own.

Two ways to arm. By NAME, in which case the fault fires every time it can — that is the mode a regression test uses, because a test that only sometimes provokes the defect is a test that only sometimes passes. Or from a SEED, in which case the whole run’s weather is derived from that one number: which faults are armed, at what rate, and for how long. A storm prints the seed of every distinct failure, and the seed alone replays it.

Sticky faults

Fault::OutOfStock and Fault::RevokedCredential are STICKY: once they fire they keep firing until disarmed. That is what was measured — on SCALEWAY, not UpCloud (both are kept as generic cloud-provider faults): Scaleway’s fr-par-1 refused poweron with 412 out_of_stock for days, and a revoked Scaleway key answered 0 servers from the moment it was revoked. A fault that fires once and clears would let a retry loop paper over both, which is precisely the bug that shipped.

Structs

Faults

The armed set plus the run’s generator.

Enums

Fault

One measured behaviour, armable.