Module self_check 

The calibration: prove the instrument can report the opposite, for every fault it claims to have.

A mock is an instrument, and an instrument nobody has calibrated is a source of greens rather than a source of measurements. The failure this module exists to make impossible is the one this estate committed nine times in one day: a check that could only ever say “clean”, run, seen to say “clean”, and believed. Behaviour 38 is the same defect written down as a fault — Estate::detach had no path that answered 200 without removing the device, so every sweep driven against this mock passed a test the mock could not fail.

So: for every variant in Fault::ALL, drive the mock twice — once with the fault DISARMED and once with it ARMED — and compare the two observations.

• They differ → the fault is expressible. The instrument can report both the healthy world and the faulty one, and a green from a caller driven against it means something.
• They are identical → the fault is inexpressible. The variant exists, the wire name parses, --arm accepts it, and nothing downstream changes. That is a fault that cannot be provoked, and self_check NAMES it and FAILS. It does not skip it: a fault the mock cannot express is worse than a fault it does not have, because the first one advertises a coverage it does not possess.
• Identical AND Fault::seeded_rate_per_mille is 0 → reported as a hypothesis: a rate of 0 is this crate’s own mark for “asked for by name, never arrives as weather, not a measurement of the provider” (Fault::WithholdCreatedField, Fault::CloneSyncsLikeImport). It is not a failure — but it is LISTED, with its observation printed, because absent capability is an answer and never an empty value.

Every probe runs IN PROCESS against an Estate or a Mock: no socket, no child process, nothing shelled out. The two runs are separate estates built from the same seed, so the only difference between them is the fault. The base is Faults::quiet rather than Faults::none on purpose — none() arms Fault::StaleVncPort and Fault::UdpInboundDropped because they are the provider’s normal, and a control that already had the fault armed would compare a thing with itself.

Structs

Report

Every fault’s calibration, and whether the whole thing passed.

Row

What one fault’s two runs observed.

Enums

Verdict

What a row means.

Functions

self_check

Run the calibration. Every variant in Fault::ALL, twice.