Applying a module document proves exactly one thing: the document is coherent. It does not prove the library file exists, that the token is present, that the PIN resolves, or that the appliance is reachable. Those questions have a button: Test connection, on each custody editor. It touches no CA key and no PIN-protected session, so it is safe to click, and it returns a verdict plus what to do next.
Read the states precisely. ok means the backend answered. error means it ran and failed — the fix is named: a wrong library path, a rejected credential, an unreachable device. unavailable is a fact about the binary or process — no PKCS#11 bridge in this build, or no database in this process — and is never a statement about your device.
For an applied module the test goes past connectivity and verifies the login end to end, naming the reference it used — proof it exercised the document's own pinRef, not some session that happened to be open. And Save is test-gated: the button appears only under a green test, because an unproven backend does not fail at Save — it fails at the first signature, days later.
Now I can prove a module works before anything depends on it.