modelcheck-library-child-admission

The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

Facts

Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

Components

component	label	where
approximant	partial	Forward
ast	partial	`../../syntax.json`
cost	partial	Cost
descriptant	partial	Descriptant
invariant	partial	Invariant
tests	partial	Tests

Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

id	type	label	where
`behavior_complement`	behavior_complement	partial relational specification	behavior_complement
`reverse_reconstruction`	reverse_reconstruction	partial relational specification	reverse_reconstruction
`id_reservation_trace`	id_reservation_trace	partial relational specification	id_reservation_trace
`load_failure_cut`	load_failure_cut	partial relational specification	load_failure_cut
`preorder_slot_stability`	preorder_slot_stability	partial relational specification	preorder_slot_stability
`depth_budget_preimage`	depth_budget_preimage	partial relational specification	depth_budget_preimage

Model text

Subject: current manifest source SHA and exact UTF-8 range [21538,27611). The observation is one completed scoped call with adequate resources; source-derived relations are partial specifications. Filesystem checks describe sequential reads, not an atomic snapshot.

Forward

Read declarations; require an array and composition before depth admission. For each declaration reserve its ID, enforce a single normal .groupant path, require real immediate directory and regular manifest, canonicalize containment, then decode manifest. A preorder report slot is reserved even when loading fails. A failed load skips source/range/recursive validation and emits a child-manifest diagnostic.

Invariant

No admitted child escapes its direct parent; failed loads remain visible. ID insertion precedes filesystem admission, so malformed children can consume IDs and affect later duplicate diagnostics.

Cost

For K children, O(K log I) ID/path comparisons plus filesystem canonicalization and manifest decoding bytes. Successful children recursively add their own costs; the scope includes traversal and must not be added again to its parent estimate.

Descriptant

Wave34, 2026-10-31: deeper scope retained under its existing parent without replacing historical views. Decode reuse was proposed before edits and checked against actual reference decoding; behavioral controls and repeated native receipts remain finite evidence. No numerical surrogate is justified for categorical validation outcomes; no percentage accuracy or complete semantic proof is claimed.

Tests

Exact native test: groupant_tests::groupant_validation_negative_controls_and_open_extensions. Parent tests additionally exercise integration and failure order. Current evidence is in ../../wave34-evidence.md; old evidence remains explicitly historical in wave33-evidence.md at the source root.

behavior_complement

Over declaration/filesystem/report triples exclude available children reached through multi-component paths, symlink directories or symlink manifests. Also exclude descent at depth 64 for a nonempty list. This is a source-derived inner exclusion relation, with concurrent path replacement outside the claim.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::groupant_validation_negative_controls_and_open_extensions. Finite observations do not establish universal completeness.

reverse_reconstruction

A report slot with parent P and depth d admits declarations in that parent's original order, including failed loads. A load-error observation leaves source contents unconstrained because no source-specific child validation ran; valid slots additionally constrain real direct directory identity.

id_reservation_trace

Fix previous ID set I and declaration id x. The updated set is I union {x} whenever x is nonempty, even if the path later fails. Two equal IDs therefore cause the later duplicate independently of filesystem validity.

load_failure_cut

Partition traces at name, metadata, canonical containment, regular manifest and JSON decode gates. The first failing gate determines load error; later fragment range and syntax errors are unreachable on that child.

preorder_slot_stability

The slot index is reports.len before recursive descent, and descendants append later. Filling the saved index after recursion preserves parent-before-child report order even on nested errors.

depth_budget_preimage

For an observed depth diagnostic, compatible states have a nonempty declarations array and depth >=64 after composition checks. Empty lists at that depth return without the depth error.

This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/child-admission.groupant/

📐modelcheck-library-child-admission

Facts

Components

Obernants

Model text

Forward

Invariant

Cost

Descriptant

Tests

behavior_complement

reverse_reconstruction

id_reservation_trace

load_failure_cut

preorder_slot_stability

depth_budget_preimage

modelcheck-library-child-admission