Module injection 

RCH_*_INJECT_* test-injection env-var registry (br-62u24.13 — MVP).

This module is the single source of truth for the names of every debug/test injection environment variable consumed by RCH binaries. The bead spec for 62u24.13 calls out the foundation problem:

In the cross-agent code-review work (commits 68fcb7c + d6d086e and the 21 sibling beads in epics 2s99h, 62u24, zcecy), every e2e test script and many unit tests reference debug-only env-var hooks and rch debug * subcommands that don’t exist in the codebase yet. Without a foundational bead defining the contract for these primitives, each task-bead implementer will arbitrarily reinvent its own conventions — resulting in inconsistent naming, duplicate functionality, missing #[cfg(debug_assertions)] gates, and accidental release-build leakage.

By defining the canonical names HERE as pub const NAME_OF_VAR: &str = "RCH_..." items, downstream tests can write std::env::var(injection::RCH_DOCTOR_INJECT) instead of std::env::var("RCH_DOCTOR_INJECT") — a typo in the latter is a silent no-op, but the former is a compile error.

Discipline (the contract this module enforces)

1. All injection env-var names are pub const NAME: &str items here. Adding a new injection point requires adding the const, not coining a new name at the consumer site.
2. All names match the regex RCH_[A-Z][A-Z0-9_]*_INJECT(_[A-Z0-9_]+)?. The RCH_ prefix is owned by us; the _INJECT segment is the discriminator that lets release-build audits grep for “did any injection name leak into the binary?”.
3. ALL_INJECTION_VARS enumerates every defined const. The unit tests at the bottom of this module assert (a) no duplicate values, (b) every value matches the naming regex, (c) the slice length equals the number of pub const items in this file. Adding a new const without updating ALL_INJECTION_VARS is a test failure.
4. Release-build gate is the consumer’s responsibility. This module exports names, not behavior. Each call site that reads one of these env vars must gate the read with #[cfg(debug_assertions)] (or document an explicit reason if a release-build read is intentional). This module’s name-only surface is itself safe to compile in release.

Scope of this MVP delivery

Lands the registry surface (names + enumeration + naming validator) that every other bead can immediately consume. The companion deliverables from 62u24.13 — rch debug subcommand convention, request_id propagation, tracing-capture test helper, the #[cfg(debug_assertions)] gate audit — are filed as follow-up scope. Each is independently substantial; the registry is the minimum that unblocks the rest.

Constants

ALL_INJECTION_VARS

Every injection env-var name registered in this module. Consumed by release-build leak audits, fuzzers, and the rch debug (TBD) subcommand’s introspection surface.

RCH_DEBUG_INJECT_PANIC

Trigger an intentional panic at a designated code path (value 1). Used by the hook fail-open regression suite to confirm that classifier panics are caught and the hook still exits 0 (the project’s #1 invariant per AGENTS.md).

RCH_DEBUG_INJECT_TIMING_SAVE_FAIL

Force the timing-cache save path to fail (value 1) so tests can confirm the hook’s fail-open behavior under disk-error conditions.

RCH_DOCTOR_INJECT

Inject a synthetic reliability-doctor diagnostic at the named code path. Value is a free-form discriminator (e.g., disk_pressure_warn, topology_circuit_open) interpreted by the consumer; an empty/unset value disables the injection.

RCH_DOCTOR_INJECT_SLOW_PROBE

Inject artificial latency into a specific reliability probe. Value format: <probe_name>=<delay_ms> (e.g., helpers=10000). Used to exercise the per-probe timeout path (bd-62u24.8 parallelism).

RCH_DOCTOR_INJECT_STATUS_CIRCUIT

Inject a specific status-circuit state for a synthetic worker (e.g., open_forced). Used by reliability-doctor tests that need to exercise the partial-outage code path without spinning up a real fleet.

RCH_FIX_INJECT_POST_FAIL

Force the fix executor’s post-validation step to fail even when remediation succeeded, so tests can exercise the FailedPostValidation outcome branch.

RCH_FIX_INJECT_UNSAFE

Inject a remediation step whose dry_run_safe == false so the --fix executor exercises the SkippedNotSafe outcome path without a real unsafe remediation in the registry.

RCH_QC_INJECT_STALL

Inject a synthetic stall on a specific worker’s quick-check probe. Value is the worker ID (e.g., w1).

RCH_QC_INJECT_STALL_ALL

Force every worker’s quick-check probe to stall (value 1). Used by integration tests that need the “everything timing out” branch of the status surface.

Functions

is_injection_var

Returns true if name is one of the registered RCH injection env-var names. Used by audit tools that scan process environments for stray injection settings and by the (TBD) rch debug list-injections introspection surface.

is_well_formed_injection_name

Returns true if name is shape-compatible with the project’s injection naming policy: starts with RCH_, contains _INJECT somewhere after the prefix, and consists only of ASCII uppercase / digits / underscores. Used by the unit tests below to enforce the naming regex without pulling in the regex crate (this is a const-friendly check on a small alphabet).