Make the probe build-identity test say it cannot tell, rather than fail, when both probe crates share a version

crates/windows-platform-probes/DESIGN-NOTES.md

@@ -2574,7 +2574,22 @@ one commit agree while their sources may differ; the capture README is still the
 built for those, and for every capture taken before this. And the build identity does not replace
 the scripts' refusal of byte-identical runs: it names the build, which every run in a capture shares.
 
-**Scheduled work:** none.
+**A test cannot tell this crate's stamps from the placement probe's on a day both are released.** The
+engineer, 2026-10-22, choosing the first of three options put to him. `this_build()` is stamped under this
+crate's names and the placement probe's `BuildIdentity::current()` under its own, and the one test that
+holds the two apart reads the crates' versions. Both crates are calendar-versioned, so a release of both
+on one day gives them one version, and the release pull request of that day failed on it (the test
+asserted the versions differ). The test now asks a pure function, `whose_stamps`, whether the versions
+can say, and when they coincide it prints that it cannot tell and passes; `whose_stamps` is tested in
+both directions. What this leaves unchecked on such a day is `this_build()` being rewired to the
+placement probe's `BuildIdentity::current()`: the compiler already refuses the other crate's stamp
+variables, so that rewiring is the one way left to read the wrong crate. The skip is visible only with
+the test's output shown. **What would change the answer** is a crate name in `BuildIdentity`, so that
+the check holds on every date; that is a change to `windows-placement-probe`'s public type and to what a
+report renders, and was not chosen. No sabotage entry covers the rewiring, for the reason in
+[sabotage.json](sabotage.json)'s `notCoveredHere`.
+
+**Scheduled work:** none; the crate name in `BuildIdentity` is not scheduled.
 
 ## Every probe's normal run emits a row of raw data
 

crates/windows-platform-probes/sabotage.json

@@ -1,6 +1,7 @@
 {
   "description": "Sabotage manifest for windows-platform-probes. Each entry is a defect that was actually run by hand while building M3; the manifest exists so those one-off verifications stop being discarded. See CHECKLIST.md M2.14.1. Run with --all-features because the corpus target, tests/a_real_report_agrees_with_itself.rs, requires oracle-in-renderer: with default features it is not built, so an entry only that target catches -- a wrong arm in its codes_for, for one -- would be scored as surviving.",
   "package": "windows-platform-probes",
+  "notCoveredHere": "this_build() reading windows-placement-probe's stamps in place of this crate's has no entry here, because whether a test can see it depends on the date: the two crates are calendar-versioned, the version is all that tells their identities apart, and on a day both are released they carry one version, so the test that holds it (build_identity::tests::this_crate_reads_its_own_stamps_not_the_placement_probes) says it cannot tell and passes. An entry would be caught on most days and survive on those, so a sweep's result would follow the calendar and not the code. The compiler already refuses the wrong crate's stamp variables, which leaves the rewiring to the placement probe's BuildIdentity::current() as the one way to read it. What would close it is a crate name in BuildIdentity, which the design notes record.",
   "testArgs": ["-p", "windows-platform-probes", "--locked", "--all-features"],
   "sabotages": [
     {

crates/windows-platform-probes/src/build_identity/tests.rs

@@ -33,16 +33,85 @@ fn the_build_script_stamped_a_commit_exactly_when_a_repository_was_there() {
     }
 }
 
+/// Whose stamps a build identity read, as far as the crates' versions can say.
+#[derive(Debug, PartialEq, Eq)]
+enum Reading {
+    /// The identity carries this crate's version.
+    Ours,
+    /// The identity carries the placement probe's version, so it read the wrong crate's stamps.
+    Theirs,
+    /// The two crates' versions coincide, so the version cannot say whose stamps were read.
+    CannotTell,
+}
+
+/// What `identity` says about whose stamps it is, given this crate's version and the placement
+/// probe's. Both crates are calendar-versioned, so released on one day they carry the same version,
+/// and then nothing in a `BuildIdentity` tells them apart.
+fn whose_stamps(identity: &str, ours: &str, theirs: &str) -> Reading {
+    if ours == theirs {
+        Reading::CannotTell
+    } else if identity == ours {
+        Reading::Ours
+    } else if identity == theirs {
+        Reading::Theirs
+    } else {
+        panic!("an identity carrying neither crate's version: {identity}")
+    }
+}
+
+#[test]
+fn a_reading_is_ours_theirs_or_unknowable_by_the_two_versions() {
+    assert_eq!(
+        whose_stamps("2026.1022.0", "2026.1022.0", "2026.1021.0"),
+        Reading::Ours
+    );
+    assert_eq!(
+        whose_stamps("2026.1021.0", "2026.1022.0", "2026.1021.0"),
+        Reading::Theirs
+    );
+    // The two directions of the same fact: equal versions cannot be told apart whichever way the
+    // identity was read, so neither answer is given.
+    for identity in ["2026.1022.0", "2026.1021.0"] {
+        assert_eq!(
+            whose_stamps(identity, "2026.1022.0", "2026.1022.0"),
+            Reading::CannotTell,
+            "{identity}"
+        );
+    }
+}
+
+#[test]
+#[should_panic(expected = "carrying neither crate's version")]
+fn an_identity_carrying_neither_version_is_an_error_not_a_reading() {
+    whose_stamps("2026.1020.0", "2026.1022.0", "2026.1021.0");
+}
+
 #[test]
 fn this_crate_reads_its_own_stamps_not_the_placement_probes() {
     // The two crates are stamped by the same code under different names, so
     // reading the wrong crate's stamp would compile and report a plausible
-    // identity. The version is what tells them apart.
+    // identity. The version is what tells them apart -- and only while they differ:
+    // both crates are calendar-versioned, so a release of both on one day gives
+    // them one version, and then this test cannot tell, which is a fact about the
+    // versions and not a failure of the build. It says so rather than failing, and
+    // the design notes record what that leaves unchecked.
     let placement = windows_placement_probe::build_identity::BuildIdentity::current();
-    assert_ne!(
+    let reading = whose_stamps(
         this_build().crate_version,
+        env!("CARGO_PKG_VERSION"),
         placement.crate_version,
-        "the two crates' versions coincide, so this test cannot tell them apart"
     );
+    match reading {
+        Reading::Ours => {}
+        Reading::Theirs => panic!(
+            "this crate's build identity carries the placement probe's version, so it read the \
+             placement probe's stamps"
+        ),
+        Reading::CannotTell => eprintln!(
+            "the two probe crates share the version {}, so this test cannot tell whose stamps \
+             this_build() read",
+            env!("CARGO_PKG_VERSION")
+        ),
+    }
     assert_eq!(this_build().crate_version, env!("CARGO_PKG_VERSION"));
 }