vfs-journal

The groupant beside vfs/src/journal.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

Facts

Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

Components

component	label	where
approximant	partial	approximant
ast	partial	`syntax.json`
composition	partial	composition
cost	partial	Cost
descriptant	present	descriptant
invariant	partial	Invariant
tests	executed bounded checks	tests

Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

id	type	label	where
`behavior_complement`	behavior_complement	partial source derived model	behavior_complement
`reverse_reconstruction`	reverse_reconstruction	partial source derived model	reverse_reconstruction
`retention_budget`	retention_budget	partial source derived model	retention_budget
`counter_conservation`	counter_conservation	partial source derived model	counter_conservation
`tsv_loss`	tsv_loss	partial source derived model	tsv_loss
`reset_projection`	reset_projection	partial source derived model	reset_projection

Model text

descriptant

vfs-journal

Bounded trace retention and counters.

Prospective epoch

2026-10-31: source reviewed before edits; prospective review retained under $MOVA_DATA/runs/octopus-wave31-vfs-2026-10-31/prospective.md. Predicted order/cost: O(path bytes) per retained record amortized, O(1) dropped record; memory O(sum retained path bytes+min(events,2cap)); TSV/summary output proportional to retained serialization.

Observation epoch

Bounded actual calls and compiled negative controls are recorded in tests.md. Production behavior bytes unchanged; only focused test blocks added. Snapshot constant-time wording is conditional on cwd and destruction; recursive operations may partially commit.

Unsupported approximants

No executable percentage surrogate is claimed for these categorical/state/effect observations. Future 1%,2%,5%,10% require a useful metric, explicit domain and exact reference.

approximant

Forward relation

Bounded trace retention and counters.

record first increments seq and classified error counters; room=cap for success or saturating_mul(cap,2) for error. If len>=room drop++, else append Entry(seq,time,op,path,bytes,errno). clear resets counters while retaining cap.

Domain: bounded inputs with available allocation and nonoverflowing counters unless checked explicitly. The relation is partial and source-derived.

composition

Composition

Bounded trace retention and counters. Shared state and order: record first increments seq and classified error counters; room=cap for success or saturating_mul(cap,2) for error. If len>=room drop++, else append Entry(seq,time,op,path,bytes,errno). clear resets counters while retaining cap.

Scoped children project this same source. Their domains and effects remain conditional; source execution connects these clauses rather than independently proving their wiring. Before u64 overflow, total=retained+dropped; errors/denied/limited count dropped events too. Retained seq increases but may have gaps. cap0 drops even errors.