---
title: "crab-status-observation — Mova code model"
description: "Mova code model of tools/crab/src/status_observation.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/crab/src/status_observation.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/crab/src/status_observation.rs.groupant/>

# crab-status-observation

The groupant beside tools/crab/src/status_observation.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/crab/src/status_observation.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/crab/src/status_observation.rs)
- **source SHA-256:** `865ef38a625e3972…`
- **repository folder:** [`tools/crab/src/status_observation.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/crab/src/status_observation.rs.groupant)
- **repository commit:** `48f2e6f74146`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | source derived partial | [Forward vidtvorant](#forward-vidtvorant) |
| **ast** | partial | `syntax.json` |
| **composition** | source derived partial | [Evidence and composition](#evidence-and-composition) |
| **cost** | source derived partial | [Invariant and cost](#invariant-and-cost) |
| **descriptant** | present | [descriptant](#descriptant) |
| **invariant** | source derived partial | [Invariant and cost](#invariant-and-cost) |
| **tests** | finite native checks | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | source derived with finite native checks | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | source derived with finite native checks | [reverse_reconstruction](#reverse-reconstruction) |
| `identity_withholding` | observation_exclusion | source derived with finite native checks | [identity_withholding](#identity-withholding) |
| `temporal_partition` | error_partition | source derived with finite native checks | [temporal_partition](#temporal-partition) |
| `bounded_information_projection` | information_loss | source derived with finite native checks | [bounded_information_projection](#bounded-information-projection) |
| `artifact_failure_partition` | partial_exclusion | source derived with finite native checks | [artifact_failure_partition](#artifact-failure-partition) |

## Model text


### descriptant

#### Status observer epoch

A real operational gap motivated this module: a controller's fixed legacy status
paths do not automatically observe newer independently supervised native workers.
Overwriting old failed snapshots would hide history rather than connect the new
pipeline. The generic fix adds an immutable, explicit read-only attachment catalog.
Concrete worker paths, campaigns and identities remain outside public code.

Counters are projected before arbitrary receipt details can consume a generic
object-key truncation budget. Missing kinds/configuration identities stay visible
as a compatibility gap. Future heartbeat values are distinct from age zero. A
status report never grants marker authority, proves process health, or admits
training. Root may invoke this public module directly before a deliberate daemon
reload; no worker or active consultant must be interrupted merely for observation.

The first native fixtures pass without models, training, DBs or live terminal
calls. Repeated output at a supplied fixed time is identical. These are finite
structural/refusal checks, not semantic accuracy or hostile-filesystem guarantees.

### model

## Bounded status observations

### Forward vidtvorant

Subject: the exact adjacent Rust source. Domain: a trusted catalog of at most
eight entries, each with a unique ASCII ID and kind of at most 64 bytes, absolute
UTF-8 path of at most 1024 bytes without parent traversal, and lowercase SHA256
configuration identity. Observation input (a,t,F) comprises one attachment,
supplied read time and encountered ordinary Linux filesystem state.

validate(A) refuses invalid catalogs without opening files. observe(a,t) repeats
single-entry validation, opens read-only with O_NONBLOCK/O_NOFOLLOW, requires a
regular file and reads at most B+1 bytes, B=262144. Metadata size and actual read
length have independent caps. A bounded parsed JSON object reaches the projection
only if kind and config_sha256 equal the configured pair exactly.

Let P retain only the source-declared unsigned scalars, three Boolean flags,
bounded state/current_page strings and at most sixteen valid unsigned counters
from each of counts/source_counts. Truncation is explicit. Prompts, nested objects
and other fields or invalid types are omitted rather than repaired or set to zero.
The output includes SHA256(read bytes) and H(t,h): unknown for no unsigned h,
future for h>t, stale for h<=t and t-h>120, fresh otherwise. Age is null for future
or missing timestamps. Health, control and training admission always remain false.

This is an exact source-derived partial categorical model, not a measured faster
emulator or percentage-bounded approximant. JSON parser and filesystem behavior
remain premises; no numerical approximation metric is admitted.

### Invariant and cost

The module cannot write files, signal or launch processes, touch models/DBs or
request training. A projected value requires a bounded object and exact identity.
Future timestamps cannot become fresh zero-age observations. Counter units remain
producer-declared: target counts are not jobs, facts or approved training records.

For n<=8 and cap B, byte work is O(nB), plus bounded projection. Allocations are
bounded by the input cap and parser limits. Filesystem latency is not constant.
Crab's separate aggregate serialized-response budget still applies. No measured
speedup, global liveness or hostile-filesystem isolation theorem is claimed.

### behavior_complement

Type: behavior_complement. Universe U contains declared (a,t,F,output) tuples;
R is the forward relation and C=U minus R is the exact target. Source-derived
partial exclusions: mismatched identity cannot yield value; malformed, oversized
or special files cannot yield observed; future timestamps cannot yield fresh;
prompt/details cannot appear in P. Invalid configuration cannot open its path.
Counterexample to "fresh implies healthy": a matching current status can outlive
its process. Evidence: native local refusal/projection/time fixtures, not health.

### reverse_reconstruction

Type: reverse_reconstruction. R^-1(o) retains all compatible inputs/states.
Projection cannot recover omitted prompts, artifact paths or ID membership. Two
objects differing only in prompt have equal P and different source digests.
SHA256 constrains read bytes assuming collision resistance, but neither reconstructs
them nor authenticates a writer. Evidence: source-derived fiber and projection
fixtures; no unique inverse or complete reconstruction implementation.

### identity_withholding

Type: observation_exclusion. Domain: bounded parsed objects and configured pair
(kind,config hash). Let E be exact pair equality. not E excludes every output
with value, even if heartbeat/counters look plausible. Missing identity also fails.
Counterexample to freshness-only admission: wrong-config file with current heartbeat
remains identity_mismatch. Evidence: kind and hash substitution controls.

### temporal_partition

Type: error_partition. Domain: unsigned t and optional unsigned h. The four H
branches are disjoint and complete. At t=1000: h=1001 future/null age; h=880 fresh/120;
h=879 stale/121; absent/invalid heartbeat unknown/null. Saturating subtraction alone
would falsely make the future timestamp age zero. Evidence: native exact boundary
fixture. Scope is reported time, not verified clock synchronization or process life.

### bounded_information_projection

Type: information_loss. Domain: identity-admitted objects. P forgets unknown fields
and types; each counter map keeps deterministic first-sixteen valid numeric entries
and declares overflow. Omission is not zero. Counts cannot reconstruct source IDs:
two different validated sets may both have count12. Evidence: finite counter/label
budgets and prose omission; no semantic-quality or corpus-coverage inference.

### artifact_failure_partition

Type: partial_exclusion. Domain: admitted paths and ordinary open/read/parse
observations. Invalid_configuration, missing, read_error, not_regular, oversized,
malformed and identity_mismatch are distinct states, selected by encountered
operations. Metadata cannot authorize an uncapped read. Final symlinks fail, and
FIFO opens cannot wait for a writer. Counterexample: treating every readable path
as regular data permits blocking on a FIFO. Evidence: bounded local missing,
malformed, directory, symlink, FIFO and oversized controls. Parent replacement,
mount aliases, device/kernel latency and concurrent writes remain outside proof.

### Evidence and composition

Six native module tests cover these finite controls and repeat equality at fixed
time. Two native angel integration tests cover default-empty compatibility,
immutable loaded catalog and legacy marker separation. Wrong-ID artifacts remain
unknown observations, not silently attached workers. A reported training_authorized
flag cannot override the observation's training_admission=false coordinate.

Live use is a separate checkpoint: read-only calls can inspect pinned worker
identities without starting a server; Crab must reload deliberately to gain a
new catalog. No reviewed observation establishes the old role controls govern
another pipeline. Syntax projection is partial and does not expand macros or
resolve semantics. All evidence is finite; no universal verification is inferred.

### tests

#### Evidence

2026-11-02: six actual native module tests and two angel integration tests passed
within the focused `angel::` family: 27 passed, 49 unrelated library tests filtered.
The command used the owning public Crab crate, offline/locked dependencies, at
most two build jobs and an isolated target. No teacher, model, DB, signal, worker
restart or terminal UI action was invoked.

Module fixtures cover exact identity and fixed projection, wrong kind/hash,
future/stale/unknown heartbeat boundaries, malformed/missing/oversized/directory
and final-symlink artifacts, nonblocking FIFO rejection, invalid catalogs and
counter/label output limits. A fixed supplied read time yields byte-identical
observation values on repeat. Integration fixtures preserve omitted-list response
shape, frozen loaded catalogs and separate legacy marker effects.

A source mutation removed the complete identity check. The exact native identity
partition test then failed with exit 101: a wrong identity became observed.
The original source was restored byte-for-byte and the focused family rerun.
This red/green evidence tests a real refusal boundary, not linguistic truth.

A separate external harness invoked this exact public module read-only on two
native Fish status artifacts and their page producer, checking expected config
hashes against actual configuration bytes. All three were identity-matching fresh
observations at that dated snapshot. An older Eel status lacked identity fields
and was retained as identity_mismatch, without projection or relaxed admission.
The observation did not attach anything to the running Crab or control a worker.
Private paths, current counts and raw receipts remain in the external worklog.

Syntax projection is repeated byte-identically for each owned Rust source. Source
and composition guards establish binding/structure only; central ancestors remain
root-integrated. All fixtures and live observations are finite evidence, not a
process-health, security-isolation, semantic-quality or training-admission proof.