test(chaos): correct two reporting defects and state what the suite doesn't prove

The hard_cut scenario was labelled "proxy disabled 12s (TCP severed)" with
params={"disabled_s": 12}, but it passes fault_hold_s=0.0 and the harness
clears the fault the instant detection fires — so the 12s was never applied
and the number reached the published record as an unused parameter. Relabelled
to what the code actually does.

The LATEST.md renderer defaulted a missing ticks_after to 0, which published
the baseline row as "Ticks after 0 ... PASS" while that scenario's own note
recorded 7 updates in 30s. Absent counts now render as an em dash.

Also documents two real limits in CHAOS_TESTING.md that were previously left
implicit: the detection-driven scenarios validate recovery against an
already-restored network rather than a persistently broken one, and the
ticks_after > 0 pass bar is a smoke check on a stream this sparse, not a
throughput assertion.

The existing run record under docs/chaos/ is annotated rather than rewritten —
no recorded measurement is edited, and neither defect changes a pass/fail
outcome. Re-running the suite needs a live IG demo session plus toxiproxy, so
the corrections are stated against the run that actually happened.

Author: protereus

docs/CHAOS_TESTING.md

@@ -72,6 +72,19 @@ identifiers, or raw log lines — there is nothing to sanitise by design):
 - **Host-level chaos** (`iptables` DROP/REJECT, `ss -K`) still exercises the
   OS TCP stack in ways a userspace proxy cannot; §9.1's manual run remains
   the final pre-live gate.
+- **Persistent faults.** The detection-driven scenarios (`silent_stall`,
+  `hard_cut`) clear the injected fault the moment detection fires, so the
+  recovery ladder (tear down → REST re-auth → LS rebuild → re-subscribe)
+  is validated against an *already-restored* network. What these scenarios
+  prove is that the fault is detected and that the feed streams again
+  afterwards — not that recovery survives a network still broken while it
+  runs. Holding the fault across the full ladder, and asserting the retry
+  backoff behaves while it is held, is the next iteration.
+- **Tick-count assertions are weak.** The pass bar for the degradation
+  scenarios is `ticks_after > 0` against a baseline that produced single-digit
+  updates per 30 s on these instruments, so a scenario can pass on one tick.
+  Treat these as smoke-level "did not crash, still streaming" checks rather
+  than throughput measurements.
 - Markets: run against 24/7 instruments (the default epics are crypto) or
   during market hours — a closed, tickless market starves the heartbeat and
   the suite cannot distinguish injected faults from natural silence.

docs/chaos/LATEST.md

@@ -5,6 +5,25 @@ Generated 2026-07-12T09:04:07+00:00 against commit `ddac700` (env: `demo`, epics
 Metrics only — no payloads, tokens, or account identifiers are recorded.
 See `docs/CHAOS_TESTING.md` for methodology and how to reproduce.
 
+> **Corrections to this record (added after the run).** The measurements below
+> are unmodified, but two labelling defects in the harness that produced them
+> have since been fixed, and this run predates the fix:
+>
+> 1. The `hard_cut` fault is recorded as *"proxy disabled 12s"*. It was not.
+>    The scenario passed `fault_hold_s=0.0` and the harness clears the fault
+>    the instant detection fires, so the proxy was disabled for **9.4 s** here
+>    (the recorded `detected` time), not a fixed 12 s. The `12` was an unused
+>    parameter that reached the label. The scenario is now labelled
+>    *"proxy disabled until heartbeat detection"*.
+> 2. The `baseline` row reads *"Ticks after 0"*. That scenario records
+>    `ticks_baseline_10s`, not `ticks_after`, and the renderer defaulted the
+>    missing key to `0` — its own note (7 updates in 30 s) is the correct
+>    figure. Absent counts now render as `—`.
+>
+> Neither defect changes a pass/fail outcome, and no recorded number has been
+> edited. See `docs/CHAOS_TESTING.md` → "What this does not cover" for what
+> these scenarios do and do not establish.
+
 | Scenario | Fault | Detected (s) | Recovered (s) | Ticks after | HB trips | Positions unchanged | Result |
 |---|---|---|---|---|---|---|---|
 | baseline | none | — | — | 0 | 0 | yes | PASS |

tests/chaos/recorder.py

@@ -103,7 +103,7 @@ def _render_md(self, payload: dict[str, Any]) -> str:
                     fault=s["fault"],
                     det="—" if det is None else f"{det:.1f}",
                     rec="—" if rec is None else f"{rec:.1f}",
-                    ticks=s["counts"].get("ticks_after", 0),
+                    ticks=s["counts"].get("ticks_after", "—"),
                     trips=s["counts"].get("heartbeat_trips", 0),
                     pos="yes" if s["positions"].get("unchanged") else "NO",
                     res="PASS" if s["passed"] else "FAIL",

tests/chaos/test_streaming_chaos.py

@@ -199,8 +199,8 @@ async def test_hard_connection_cut_reconnects(
     """
     result = await _run_scenario(
         name="hard_cut",
-        fault="proxy disabled 12s (TCP severed)",
-        params={"disabled_s": 12},
+        fault="proxy disabled until heartbeat detection (TCP severed)",
+        params={"hold": "until_detected"},
         feed=chaos_feed,
         event_log=event_log,
         recorder=recorder,