---
title: "fish-pages-closure-checkpoint — Mova code model"
description: "Mova code model of tools/fish-pages/src/lib.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/fish-pages/src/lib.rs.groupant/closure-checkpoint.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/fish-pages/src/lib.rs.groupant/closure-checkpoint.groupant/>

# fish-pages-closure-checkpoint

The groupant beside tools/fish-pages/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial source bound model
- **source:** [`tools/fish-pages/src/lib.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/fish-pages/src/lib.rs)
- **source SHA-256:** `284d3d93e75b0b65…`
- **covers:** sealed_prefix/step/quiescent: bounded history, source counters, prefix checkpoints and safe boundaries
- **part of:** [fish-pages-library](https://md.groupants.elamur.ai/free/en/mova/tools/fish-pages/src/lib.rs.groupant/)
- **repository folder:** [`tools/fish-pages/src/lib.rs.groupant/closure-checkpoint.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/fish-pages/src/lib.rs.groupant/closure-checkpoint.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial source derived | [forward](#forward) |
| **ast** | partial | `../syntax.json` |
| **composition** | partial source derived | [composition](#composition) |
| **cost** | partial source derived | [cost](#cost) |
| **descriptant** | partial source derived | [domain](#domain) |
| **invariant** | partial source derived | [invariant](#invariant) |
| **tests** | finite checks | [checks](#checks) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior-complement` | behavior_complement | source derived finite checks | [behavior-complement](#behavior-complement) |
| `reverse-reconstruction` | reverse_reconstruction | source derived finite checks | [reverse-reconstruction](#reverse-reconstruction) |

## Model text


### domain
Source scope: sealed_prefix, Pager::step/status and quiescent in the parent Rust file. Observations are native closed histories, page seals, checkpoint/counters and safe physical boundaries. The shared partial syntax covers the source file; it is not a composed semantic AST.

### forward
Reuse imported native closed-receipt predicates; seal a fully closed current page before advancing its cursor. Reconstruct a verified prefix after restart and inspect the unsealed page's original attempts before any boundary. Active monitoring keeps parent status unsafe until the step thread drains. Read-only quiescence rechecks source counts and completed/current histories.

### behavior-complement
An orphan, false/null closure, changed identity, cursor ahead of seals, malformed checkpoint or inconsistent source count excludes progress/quiescence. STOP or expiry cannot erase uncertainty. Fresh paused+PAUSE differs from terminal state requiring unheld leases. Counterexample: an accepted model call can remain active after the wall cutoff, so expiry alone is not a no-call proof. Evidence: orphan-first, active-drain, actual flock and corrupt-state controls.

### reverse-reconstruction
A valid seal constrains the compatible local history to exact pinned intent/admission/receipt bytes, but still admits different remote execution and linguistic states. An unreceipted reservation has multiple compatible preimages and cannot authorize replay. A stale checkpoint behind an already synced verified seal can be rebuilt without repeating a paid page; a corrupt checkpoint is refused. Assumptions: cooperative immutable files and collision resistance; no remote billing/exactly-once theorem.

### invariant
Known-closed invalid reviews remain quarantine, not gold; preparation gaps remain pending review. Parent active status is published before starting the worker thread. Every claimed safe boundary follows history audit, while the ordinary job path avoids rereading all sealed pages.

### cost
Current-page audit is bounded by its queue/task/receipt bytes. Restart and observer checks scale with all completed history bytes; these costs are intentionally separate from ordinary paid steps. Scheduler and provider timing are outside a formal bound here.

### composition
Native closed attempt -> current-page summary -> source-bound seal -> checkpoint -> next source ownership. The public observer joins this evidence with fresh marker/identity and lease conditions; it never launches work.

### checks
Shares eight parent fake Rust controls, particularly restart, quarantine, orphan, active pause/drain, terminal lease and changed closure/checkpoint. These are finite interface observations, not semantic assurance.