Elamur Groupantsmodelcheck-library-output-table
The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| approximant | partial | forward |
| ast | partial | ../syntax.json |
| cost | partial | invariant-and-cost |
| descriptant | present | descriptant |
| invariant | partial | invariant-and-cost |
| tests | finite native evidence | tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| id | type | label | where |
|---|---|---|---|
behavior_complement | behavior_complement | partial relational specification | behavior_complement |
reverse_reconstruction | reverse_reconstruction | partial relational specification | reverse_reconstruction |
finite_domain_cover | finite_domain_cover | partial relational specification | finite_domain_cover |
row_order_fiber | row_order_fiber | partial relational specification | row_order_fiber |
write_effect_boundary | write_effect_boundary | partial relational specification | write_effect_boundary |
proof_marker_precedence | proof_marker_precedence | partial relational specification | proof_marker_precedence |
Model text
descriptant
Exclusive output creation and finite Lean table extraction groupant
Epoch 2026-10-31: materialized a scoped view after full-source review. write_new opens create_new, writes all bytes, syncs and propagates the first error. extract_table rejects proof-error markers anywhere, locates the first header, admits exactly five tab fields per nonempty trailing row, unique four-tuples in {0,1,2,3}^4 and a Boolean label, then requires 256 tuples.
Successful extraction has 257 lines and exactly the full four-dimensional domain. Row order remains input order and labels are not mathematically verified. Existing output cannot be replaced; failures after open may leave partial or complete unsynced bytes.
Useful prior epochs remain in the parent descriptant. This child uses exact byte anchors and the same whole-source hash: editing unrelated bytes also invalidates its binding. The fragment is a partial structural/behavior model, not a proof. No executable percentage surrogate is supplied: categorical gates have no defined useful loss metric; any future profile must use supported caps 1, 2, 5 or 10 percent with explicit domain and evidence.
catalog
Wave33 historical scope and evidence follow. Current source hashes and refreshed ranges are in manifest.json; wave34 refinements and evidence are at the source root.
Exclusive output creation and finite Lean table extraction typed models
Subject/revision: source SHA-256 in manifest; scope [8919 , 10442). Domain is one completed scoped call on a fixed snapshot with adequate resources, unless narrowed below. Observation includes return/error and declared filesystem effects. Models are source-derived partial relational constraints; complements are inner exclusion hypotheses, converse relations retain compatible-input ambiguity. No universal proof or inverse executor is claimed. Evidence: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths. Mutation evidence and limits are recorded in ../wave33-evidence.md.
behavior_complement
Exclude successful extraction with error/sorry markers, duplicate tuples, missing domain coverage or non-Boolean labels; exclude successful replacement by write_new under OS create_new semantics.
Oracle: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
reverse_reconstruction
An extracted table admits any prefix before its first header without forbidden markers and arbitrary blank trailing lines preserving rows. Successful output bytes do not identify destination or prior nonexistent filesystem state uniquely.
Oracle: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
finite_domain_cover
Distinct vectors in {0,1,2,3}^4 with count 256 exhaust that domain. Cardinality establishes coverage only, not truth of recommend labels.
Oracle: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
row_order_fiber
Holding ordered accepted rows fixed constrains emitted order exactly. Permuting rows yields a correspondingly permuted valid output; the parser does not canonicalize table order.
Oracle: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
write_effect_boundary
Open failure creates no new file through this call; write/sync failure after exclusive open permits a leftover artifact. No rollback or rename-based transaction is promised.
Oracle: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
proof_marker_precedence
Forbidden error/sorry strings are checked before locating the header or parsing rows, even when occurring in a prefix. Acceptance is a format/proof-log gate, not Lean execution.
Oracle: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.
tests
Native correspondence
Exact named checks: tests::lean_bridge_rejects_partial_duplicate_and_failed_output; syntax::tests::discovery_and_exclusive_output_reject_unsupported_paths.
See ../wave33-evidence.md for current repeated profiles, actual production mutants and scope limits. AST generation alone is not behavioral evidence. Each reference test body was read before execution.
forward
Scoped forward model
Exclusive output creation and finite Lean table extraction
write_new opens create_new, writes all bytes, syncs and propagates the first error. extract_table rejects proof-error markers anywhere, locates the first header, admits exactly five tab fields per nonempty trailing row, unique four-tuples in {0,1,2,3}^4 and a Boolean label, then requires 256 tuples.
invariant-and-cost
Invariant and cost
Successful extraction has 257 lines and exactly the full four-dimensional domain. Row order remains input order and labels are not mathematically verified. Existing output cannot be replaced; failures after open may leave partial or complete unsynced bytes.
For L log bytes and K rows, O(L+K log K) time plus parsing allocations, O(L+K) retained output/tuples. K=256 on success, malformed logs may be longer. Writer O(bytes) plus filesystem write/sync latency.
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/output-table.groupant/