test(native): cover TCP-failure-rate sampler math; wire up its dead registration test

[lotgon]

Why

The native TCP connection failure-rate sensor (.computer/Network/Connection failures rate, MIB_TCPSTATS.dwAttemptFails, IPv4+IPv6) shipped with only a registration smoke test — and that test was never registered in CTest (it existed only in the in-binary dispatch table), so nothing about this sensor ran in CI. The sampler's baseline/delta/wrap/quiet-interval math was completely untested.

What

• Extract TcpFailureRateAccumulator — the OS-free baseline/delta math pulled out of WindowsTcpFailureSampler. Behavior-preserving; the Windows sampler is now a thin GetTcpStatisticsEx wrapper over it. This is the seam that makes the logic unit-testable off-Windows.
• Add 9 cross-platform cases (tcp_failure_accumulator_*) covering every branch:
  • first-tick baseline seed → nullopt
  • growing counter → per-tick delta
  • IPv4 + IPv6 deltas summed
  • quiet interval → nullopt (rate stays 0)
  • counter reset/wrap contributes 0 and re-baselines (no false spike)
  • reset in one family keeps the other family's delta
  • unreadable family contributes 0 and keeps its own baseline (resumes without a spike — the anti-poisoning invariant)
  • both families unreadable → nullopt, baselines preserved
  • independent per-family seeding
• Wire the pre-existing native_tcp_failure_rate_sensor_registers into CTest (Windows-only) so it actually runs.
• Update the native-collector feature doc.

Verification

Full native suite green locally (VS 2022, Debug): 128/128 (was 118 — +9 accumulator, +1 newly-wired registration).

No behavior/ABI change (internal refactor + tests only), so no collector version bump per AGENTS.md §Versioning.

[github-actions]

PR #1257 Review — test/native-tcp-failure-sampler

Summary

This PR extracts the baseline/delta/wrap/quiet math out of the Windows-only WindowsTcpFailureSampler into a portable, OS-free TcpFailureRateAccumulator, leaving WindowsTcpFailureSampler as a thin GetTcpStatisticsEx wrapper. It adds 9 cross-platform unit tests for the extracted logic and — importantly — actually wires the pre-existing native_tcp_failure_rate_sensor_registers test into CTest (it previously lived only in the in-binary dispatch table and never ran in CI).

Verdict: LGTM. This is a well-motivated, low-risk change. The extraction is a faithful move of the logic (I diffed the moved code line-by-line against the original), the public Sample() interface is unchanged so the sole call site in hsm_collector.cpp:RunTcpFailureRateLoop is unaffected, and it converts previously-untestable Windows-only code into logic verifiable on every platform. Test coverage of the branches is genuinely thorough (seed, delta, per-family sum, quiet interval, reset/wrap, per-family reset masking, unreadable-family blackout, both-unreadable, independent seeding).

Correctness

No bugs found. Spot checks:

• Logic parity. AccumulateFamily reproduces the old sample_family lambda exactly: unreadable → early return keeping baseline; first readable → seed + return; current >= prev → add delta; else (reset/wrap) → contribute 0 and re-baseline. The any_readable/total_delta short-circuit in Accumulate matches the old post-loop logic.
• No overflow. total_delta is the sum of at most two 32-bit dwAttemptFails deltas into a uint64_t — cannot overflow.
• Wrap handling. dwAttemptFails is a 32-bit DWORD stored/compared as uint64_t; a 32-bit wrap reads as current < prev and is correctly treated as a reset (contributes 0, re-baselines), matching the documented behavior.
• Test/dispatch/CMake consistency. All 9 new accumulator tests appear in both the dispatch table and NATIVE_REGRESSION_TESTS (cross-platform); the Windows-only registration test is gated by both #if defined(_WIN32) and if(WIN32) consistently.

Security

Nothing security-relevant. No new I/O, allocation, or untrusted-input handling; the OS call surface (GetTcpStatisticsEx) is unchanged.

Performance

No concerns. Same per-tick cost as before — the refactor adds only a couple of trivial by-value FamilyReading structs and a static function call per tick.

Minor observations (non-blocking)

• RequireTcpDelta uses == on double. This is safe here because all expected values are small exact integers cast to double, so no precision issue arises — just noting it in case future cases introduce fractional expectations, where a tolerance-based compare would be needed.
• Doc-comment duplication. The "first call seeds the baseline … returns std::nullopt on a counter reset/wrap, a read error, or a zero delta" description now appears on both TcpFailureRateAccumulator::Accumulate and WindowsTcpFailureSampler. Harmless, and arguably intentional since each documents its own contract.
• Coverage note is accurate. The feature doc correctly states the GetTcpStatisticsEx read is now the only untested part — a fair characterization of the residual gap.

Nice cleanup: turning dead-in-CI Windows-only logic into portable, unit-tested code and closing the CTest wiring gap is exactly the right direction.