---
title: "fish-pages-library — Mova code model"
description: "Mova code model of tools/fish-pages/src/lib.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/fish-pages/src/lib.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/fish-pages/src/lib.rs.groupant/>

# fish-pages-library

The groupant beside tools/fish-pages/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/fish-pages/src/lib.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/fish-pages/src/lib.rs)
- **source SHA-256:** `284d3d93e75b0b65…`
- **repository folder:** [`tools/fish-pages/src/lib.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/fish-pages/src/lib.rs.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial source derived | [forward](#forward) |
| **ast** | partial | `syntax.json` |
| **composition** | partial source derived | [composition](#composition) |
| **cost** | partial source derived | [cost](#cost) |
| **descriptant** | partial source derived | [domain](#domain) |
| **invariant** | partial source derived | [invariant](#invariant) |
| **tests** | finite checks | [checks](#checks) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior-complement` | behavior_complement | source derived finite checks | [behavior-complement](#behavior-complement) |
| `reverse-reconstruction` | reverse_reconstruction | source derived finite checks | [reverse-reconstruction](#reverse-reconstruction) |
| `source-ownership` | set_partition | source derived finite checks | [source-ownership](#source-ownership) |
| `replay-prefix` | monotonic_prefix | source derived finite checks | [replay-prefix](#replay-prefix) |
| `closure-boundary` | process_effect_boundary | source derived finite checks | [closure-boundary](#closure-boundary) |
| `error-partition` | error_partition | source derived finite checks | [error-partition](#error-partition) |
| `source-counts` | source_cardinality | source derived finite checks | [source-counts](#source-counts) |

## Parts

- [fish-pages-intent-accounting](https://md.groupants.elamur.ai/free/en/mova/tools/fish-pages/src/lib.rs.groupant/intent-accounting.groupant/)
- [fish-pages-closure-checkpoint](https://md.groupants.elamur.ai/free/en/mova/tools/fish-pages/src/lib.rs.groupant/closure-checkpoint.groupant/)

## Model text


### domain
Subject: Config, plans, admit, Pager and quiescent in the adjacent Rust file. The domain is a cooperative filesystem with immutable pinned source plans, intents, prepared Task/profile artifacts, a conforming pinned executor and Unix leases. Observations include source-ID partitions, parent/child configuration identities, actual attempt histories, seals/cursor, status heartbeats and review-only counters. Corpus selection and held-out policy are producer obligations, not inferred from source names. The imported prepared-swarm audit is an explicit external dependency, not source owned by this leaf. Partial syntax omits macro expansion and semantic AST analysis.

### forward
Let I_0...I_(P-1) be immutable intent source sets. Opening verifies I_j intersect I_k is empty for distinct indices and 1<=|I_j|<=256. For current page c, admit a ready queue only when the pinned Task target sets Q and explicit deferred D/rejected R form I_c=Q disjoint-union D disjoint-union R. Reuse one prepared-swarm step at a time for Q. A source-bound completed page seal commits the intent/admission, previous seal hash and reread native history audit before c increases. Restart reconstructs the verified seal prefix; the current unsealed page retains its existing native attempt ledger. A missing next ready file waits without changing the prefix. Productive steps do not impose an idle polling delay.

### behavior-complement
Domain and observations are as above. A foreign, duplicate or unaccounted source excludes admission; one ID cannot appear in both a Task and a deferred gap. Unresolved retained attempts exclude every safe-boundary claim, even if STOP or deadline is present. Unbound queue/task/profile/executor bytes exclude a launch through the prepared child. Existing history forbids automatically replaying that paid attempt. The complement is partial: valid source bindings and native structure do not exclude shared semantic mistakes. Counterexamples to stronger claims: an empty all-deferred page is exhausted with zero reviews; a second unrelated configuration could target the same external corpus unless its producer ownership policy prevents it. Evidence: duplicate/partition/gap and orphan-first Rust controls.

### reverse-reconstruction
Given cursor c and verified seal prefix, compatible histories include different paid reply texts with the same source counts and different schedules that produce the same closed receipts. A seal constrains the compatible set by exact intent/admission/config/hash and audited receipt bytes; it does not recover a unique linguistic interpretation or a remote billing history. A reservation without valid closure still admits never-started, interrupted and remotely completed histories and cannot authorize replay. Counterexample: a known-closed invalid four-target reply and a valid four-target reply have equal attempted-source cardinality but different review states. Evidence: restart and quarantine controls; no universal crash or provider proof.

### invariant
Source identity is conserved at the admission partition. Counts separate validated structural review, known-closed quarantine, local deferral and local rejection. review_pending_targets=total_sources-validated_targets, so quarantine and preparation gaps remain pending review. Only exact closed native histories permit progress; annotation_gold and training authority are never granted. The current page alone is scanned during ordinary paid work, while restart/observer audits reread the completed prefix. Status is an observation, not process-liveness proof. Publication of active/unknown precedes starting the step thread, preventing an old paused snapshot from authorizing an asynchronous launch after an I/O failure.

### source-ownership
Type: set_partition. Domain: one immutable intent and its bounded ready queue/gap arrays. Formula: Q union D union R=I and all pairwise intersections are empty; target IDs are read from the actual pinned Task JSON. Global source uniqueness holds across pinned intents at opening. Observation: admission/nonadmission and distinct source counts. Counterexample: a declared gap for an already queued ID must fail even if every Task is otherwise well formed. Assumptions: collision resistance and immutable files; no theorem about the producer's corpus completeness. Evidence: exact partition and cross-page duplicate controls.

### replay-prefix
Type: monotonic_prefix. Domain: seals written before the atomic cursor checkpoint. The authoritative prefix is the maximal contiguous verified seal sequence. A stale checkpoint behind that prefix can be reconstructed without rerunning child attempts; a cursor ahead of verified seals or mismatched counters/hash is rejected. An unsealed page recovers through its original prepared-swarm receipts and lease. A future page with retained history is not ignored. Counterexample: a crash after sealing but before checkpoint publication need not repeat the paid page; an orphan beside completed records still prevents boundary claims. Evidence: no-replay restart and corrupt-checkpoint/closure tests. Power-loss semantics beyond synced files/directories remain assumptions.

### closure-boundary
Type: process_effect_boundary. Observations: kind/config/plan identity, fresh status, parent marker, exact audited history and leases. Quiescence requires no active/unknown attempt and either fresh paused+PAUSE or persistent STOP/expired deadline with unheld parent/current-child leases. While a step thread drains, parent snapshots remain active with no-unresolved=false; child model-call uncertainty is preserved as null. Accepted work may finish after the wall cutoff within the child timeout. Counterexamples: a held terminal lease is not terminal proof; a stale paused heartbeat or removed kind identity cannot establish this boundary. Evidence: actual flock, active-drain heartbeat and orphan precedence tests. No proof about deliberately detached descendants or provider accounting is claimed.

### error-partition
Missing next admission means waiting; malformed admission or changed pins means refusal; explicit D/R means preparation gap without model call; known-closed invalid reply means quarantine and next distinct work; false/null/missing closure means uncertainty and stop. Native provider/transport errors are not ordinary inner-draft quarantine. Observation of one closed process is distinct from semantic resolution. Counterexample: an outer schema-valid reply may contain a double-encoded CoNLL-U string and must remain a rejected review rather than be silently decoded. Evidence: imported native closure predicate plus local fake-executor error controls; live provider behavior is outside these tests.

### source-counts
Type: source_cardinality. For a job targeting k sources, a complete native structural success contributes k validated sources; a closed complete-target rejection contributes k quarantined sources. D and R contribute zero validated sources. This is a declared observation metric, not an accuracy percentage or a claim of gold. Counterexample: one two-target job must not be reported as one reviewed source, and an all-deferred two-source page has review_pending=2 after exhaustion. Evidence: source-counted pagination, quarantine and gap tests.

### cost
Let N be all intended sources, P pages, M<=256 current sources, B current queue/task/receipt bytes and E one child inference lifetime. Startup ownership indexing costs O(N log N) plus pinned metadata reads; ordinary step auditing is O(B)+E with current-page scope. Heartbeat status totals traverse P intents, not their source text or completed histories. Restart and observer checks cost O(completed history bytes), deliberately outside every-job scheduling. Memory retains the intent ownership sets and one bounded page. No numerical runtime or semantic error bound is asserted; the imported native executor supplies its own time/output budgets.

### composition
CLI -> immutable Config/plan/intent ownership -> private producer's ready queue -> exact source partition -> prepared-swarm step thread -> pinned native executor -> native closed history -> page seal -> checkpoint -> next page. Producer annotation/held-out correctness, native semantic quality and observer policy remain distinct dependencies. The parent group owns this file and CLI only; the swarm is an external sibling model.

### checks
2026-11-02: eight fake Rust executor tests pass in1.51seconds; thirteen preserved prepared-swarm tests pass in11.59seconds, offline/locked with two build jobs. Tests cover restart/no replay, late ready pages, global/source partition, per-source counts, explicit gaps, known-closed quarantine, orphan-before-boundary, active drain/heartbeat, leases and malformed checkpoint/closure. Syntax is generated deterministically twice by the groupant guard. No live model, GPU, database, training or corpus assessment ran in these checks. Finite fixtures and source inspection are evidence, not a formal semantic or exactly-once theorem.

### provider-busy-state
Type error_partition (2026-11-04). When the inner swarm step returns provider_busy_backoff or provider_busy_held, the pager publishes the same state with active_model_call=false, no_unresolved_reservations=true and details.provider_busy (job, attempts, retry_after_unix), after the STOP/deadline/PAUSE boundary check. It does not advance the cursor, does not seal and does not stop the run loop: the loop polls. A limit guard that keys on "uncertain" therefore ignores provider-busy states, while usage-limit and other executor failures stay uncertain and stop the pager as before. Seals include the audit's provider_busy_attempts. Evidence: one fake pager test (busy refusal, restart during backoff, retry completes, seal records one busy attempt); nine pager tests pass.