Elamur Groupantsvfs-gates-fault-controls
The groupant beside vfs/tests/vfs.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| approximant | partial | approximant |
| ast | partial | ../syntax.json |
| composition | partial | composition |
| cost | partial | Cost |
| descriptant | present | descriptant |
| invariant | partial | Invariant |
| tests | executed bounded checks | tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| id | type | label | where |
|---|---|---|---|
behavior_complement | behavior_complement | partial source derived model | behavior_complement |
reverse_reconstruction | reverse_reconstruction | partial source derived model | reverse_reconstruction |
escape_oracle | escape_oracle | partial source derived model | escape_oracle |
quota_oracle | quota_oracle | partial source derived model | quota_oracle |
clock_oracle | clock_oracle | partial source derived model | clock_oracle |
host_oracle | host_oracle | partial source derived model | host_oracle |
Model text
descriptant
vfs-gates-fault-controls
Runtime fault-injection gate family.
Prospective epoch
2026-10-31: source reviewed before edits; prospective review retained under $MOVA_DATA/runs/octopus-wave31-vfs-2026-10-31/prospective.md. Predicted order/cost: Finite small trees and100000-byte populate blob; four gate evaluations plus five faulted evaluations.
Observation epoch
Bounded actual calls and compiled negative controls are recorded in tests.md. Production behavior bytes unchanged; only focused test blocks added. Snapshot constant-time wording is conditional on cwd and destruction; recursive operations may partially commit.
Unsupported approximants
No executable percentage surrogate is claimed for these categorical/state/effect observations. Future 1%,2%,5%,10% require a useful metric, explicit domain and exact reference.
approximant
Forward relation
Runtime fault-injection gate family.
gate_escape requires NotCapable; gate_limits checks FBig/DQuot; gate_snapshot compares dump; gate_dirfs requires confinement errors. Test requires normal gates Ok and five deliberate fault gates Err.
Domain: bounded inputs with available allocation and nonoverflowing counters unless checked explicitly. The relation is partial and source-derived.
composition
Composition
Runtime fault-injection gate family. Shared state and order: gate_escape requires NotCapable; gate_limits checks FBig/DQuot; gate_snapshot compares dump; gate_dirfs requires confinement errors. Test requires normal gates Ok and five deliberate fault gates Err.
Scoped children project this same source. Their domains and effects remain conditional; source execution connects these clauses rather than independently proving their wiring. All injected faults are bounded synthetic fixtures. Runtime faults exercise actual source but are counted separately from compiled mutants.
models
Typed source models
Source-bound partial relations; no universal finite-test proof.
behavior_complement
Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.
Operator: A deliberate fault cannot pass the corresponding named gate on its fixture and still satisfy this test.
Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.
reverse_reconstruction
Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.
Operator: Gate failure admits multiple implementations and states violating expected error/dump, without unique diagnosis.
Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.
escape_oracle
Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.
Operator: ClampDotDot changes errno trace when popping empty root.
Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.
quota_oracle
Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.
Operator: NoLimits permits oversized/new node write that gate expects rejected.
Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.
clock_oracle
Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.
Operator: RestoreForgetsClock yields different dump after mutating.
Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.
host_oracle
Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.
Operator: NoConfine reads only synthetic outside sibling fixture; no real host secrets.
Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.
tests
Checks and limitations
Exact named observations: escape_by_dotdot_is_denied, symlinks_cannot_lead_outside, bad_names_and_paths, limits_fire_with_clear_errors_and_leave_state_unchanged, limits_parse, snapshot_changes_restore_is_byte_identical, snapshot_is_isolated_copy_on_write, restore_after_failed_ops_and_limits, posix_like_semantics, virtual_clock_is_deterministic, journal_records_ops_errors_and_denials, import_export_round_trip, dirfs_confines_to_root, gates_green_and_negative_controls_red, wave31_sparse_copy_and_partial_directory_failure.
Fresh receipts: $MOVA_DATA/runs/octopus-wave31-vfs-2026-10-31; run.sh retains four profile/repetition sets with raw logs and numeric statuses. native-commands.json and source-test-map.json disambiguate targets. Compiled mutations and exact restoration are separately retained in mutation-summary.json.
These finite observations are not semantic completeness. Source syntax generated twice and compared byte-for-byte. Host effects are limited to owned TMPDIR fixtures. Existing absolute_paths_never_reach_the_host and open_modes are skipped; snapbench main is skipped. Standalone helpers/reexports are only observed through named callers or representation checks; RealFs effect methods unexecuted.
invariant-and-cost
Invariant and cost
Invariant
All injected faults are bounded synthetic fixtures. Runtime faults exercise actual source but are counted separately from compiled mutants.
Cost
Finite small trees and100000-byte populate blob; four gate evaluations plus five faulted evaluations.
No timing or numerical error guarantee is inferred from finite tests.
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/vfs/tests/vfs.rs.groupant/fault-gates.groupant/