Module faults 

Addressed faults: what can go wrong that the world’s own data cannot express.

Predicates are AND-ed and order-independent, so a miss can name the single predicate that failed. No HTTP and no Redis: matching is decided from the fault and the request’s item addresses alone.

Structs

Fault

An armed fault. Immutable: re-arming an id replaces the value and re-mints its seq.

FaultProblem

FaultSpec

FlatWhen

ItemAddress

The address keys one request item carries, after the working-set load filled in what the wire did not.

Lifetime

OwnerRef

ResolvedOwner

An owner turned into the keys the wire carries, resolved once at arm time: a fault whose meaning changed because the user linked in the meantime would be unassertable.

Enums

Effect

FaultMatch

Predicate

Stage

WhenSpec

A flat literal is sugar and desugars into the predicate list.

Functions

carries_item_level_transient 🔒

Whether the endpoint’s contract lists a transient code among its per-item results; resolve-enrolments and import carry it only in the request-level form.

is_retryable_transient_code 🔒

Read from the state machine rather than restated, so this guard cannot drift from the class it guards.

matches_item

matches_request

A request-shaped effect fires only when every item resolves to the fault’s owner: on a mixed batch it would otherwise kill rows nobody armed anything for.

owner_matches 🔒

Each half constrains only the keys the item carries, so on list-by-course — which carries no student number — the course half alone decides.

resolvable_keys 🔒

What an endpoint can resolve, not what its body carries: verify’s body holds only a submitted attainment id, and the working set reads the person behind it.

validate

Rejects a fault that could never fire, and the one combination that would fire and be wrong.