vfs-path

The groupant beside vfs/src/path.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

Facts

Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

Components

component	label	where
approximant	partial	approximant
ast	partial	`syntax.json`
composition	partial	composition
cost	partial	Cost
descriptant	present	descriptant
invariant	partial	Invariant
tests	executed bounded checks	tests

Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

id	type	label	where
`behavior_complement`	behavior_complement	partial source derived model	behavior_complement
`reverse_reconstruction`	reverse_reconstruction	partial source derived model	reverse_reconstruction
`failure_precedence`	failure_precedence	partial source derived model	failure_precedence
`byte_coordinates`	byte_coordinates	partial source derived model	byte_coordinates
`cwd_transport`	cwd_transport	partial source derived model	cwd_transport
`textual_helpers`	textual_helpers	partial source derived model	textual_helpers

Model text

descriptant

vfs-path

Lexical path validation and normalization.

Prospective epoch

2026-10-31: source reviewed before edits; prospective review retained under $MOVA_DATA/runs/octopus-wave31-vfs-2026-10-31/prospective.md. Predicted order/cost: O(path bytes+cwd bytes) time/storage; join/child/base_name linear in observed string lengths.

Observation epoch

Bounded actual calls and compiled negative controls are recorded in tests.md. Production behavior bytes unchanged; only focused test blocks added. Snapshot constant-time wording is conditional on cwd and destruction; recursive operations may partially commit.

Unsupported approximants

No executable percentage surrogate is claimed for these categorical/state/effect observations. Future 1%,2%,5%,10% require a useful metric, explicit domain and exact reference.

approximant

Forward relation

Lexical path validation and normalization.

check rejects empty, NUL, then length>4096 in that order. normalize starts at [] for absolute else cwd clone; drops empty/dot; dotdot pops or escapes unless clamp; other components checked<=255 bytes. join([])=/.

Domain: bounded inputs with available allocation and nonoverflowing counters unless checked explicitly. The relation is partial and source-derived.

composition

Composition

Lexical path validation and normalization. Shared state and order: check rejects empty, NUL, then length>4096 in that order. normalize starts at [] for absolute else cwd clone; drops empty/dot; dotdot pops or escapes unless clamp; other components checked<=255 bytes. join([])=/.

Scoped children project this same source. Their domains and effects remain conditional; source execution connects these clauses rather than independently proving their wiring. Successful normalization under clamp=false never pops above root. UTF8 lengths are bytes; lexical normalization does not resolve links. Caller-provided cwd is assumed canonical.