---
title: "modelcheck-library-fragment-validation — Mova code model"
description: "Mova code model of tools/modelcheck/src/lib.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/>

# modelcheck-library-fragment-validation

The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial
- **source:** [`tools/modelcheck/src/lib.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/modelcheck/src/lib.rs)
- **source SHA-256:** `0a09fdb807efa690…`
- **covers:** Recursive child directory admission, range inheritance and syntax-envelope validation (bytes 22278–31958)
- **part of:** [modelcheck-library](https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/)
- **repository folder:** [`tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [forward](#forward) |
| **ast** | partial | `../syntax.json` |
| **composition** | partial | [wave34-composition](#wave34-composition) |
| **cost** | partial | [invariant-and-cost](#invariant-and-cost) |
| **descriptant** | present | [descriptant](#descriptant) |
| **invariant** | partial | [invariant-and-cost](#invariant-and-cost) |
| **tests** | finite native evidence | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial relational specification | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial relational specification | [reverse_reconstruction](#reverse-reconstruction) |
| `ancestor_range_meet` | ancestor_range_meet | partial relational specification | [ancestor_range_meet](#ancestor-range-meet) |
| `preorder_error_propagation` | preorder_error_propagation | partial relational specification | [preorder_error_propagation](#preorder-error-propagation) |
| `depth_resource_boundary` | depth_resource_boundary | partial relational specification | [depth_resource_boundary](#depth-resource-boundary) |
| `selection_extrema_fiber` | selection_extrema_fiber | partial relational specification | [selection_extrema_fiber](#selection-extrema-fiber) |

## Parts

- [modelcheck-library-child-admission](https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/child-admission.groupant/)
- [modelcheck-library-syntax-envelope](https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/syntax-envelope.groupant/)

## Model text


### descriptant

#### Recursive child directory admission, range inheritance and syntax-envelope validation groupant

Epoch 2026-10-31: materialized a scoped view after full-source review. For each declared child reserve a preorder report slot, require one real immediate .groupant directory and regular manifest, validate same source and kind, check ID, range and optional syntax envelope, recurse and propagate errors. Reject nonempty child traversal at depth>=64.

IDs are globally unique; descendants under a range declare contained nonempty UTF-8 intervals. Siblings may overlap or leave holes. Syntax node selection is distinct/nonempty and its extrema equal declared range. Failed child loading remains a diagnostic report slot.

Useful prior epochs remain in the parent descriptant. This child uses exact byte anchors and the same whole-source hash: editing unrelated bytes also invalidates its binding. The fragment is a partial structural/behavior model, not a proof. No executable percentage surrogate is supplied: categorical gates have no defined useful loss metric; any future profile must use supported caps 1, 2, 5 or 10 percent with explicit domain and evidence.

### catalog

Wave33 historical scope and evidence follow. Current source hashes and refreshed ranges are in manifest.json; wave34 refinements and evidence are at the source root.

## Recursive child directory admission, range inheritance and syntax-envelope validation typed models

Subject/revision: source SHA-256 in manifest; scope [20962 , 30536). Domain is one completed scoped call on a fixed snapshot with adequate resources, unless narrowed below. Observation includes return/error and declared filesystem effects. Models are source-derived partial relational constraints; complements are inner exclusion hypotheses, converse relations retain compatible-input ambiguity. No universal proof or inverse executor is claimed. Evidence: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Mutation evidence and limits are recorded in ../wave33-evidence.md.

### behavior_complement

Exclude available_partial fragments with unsafe paths, symbolic child directories/manifests, foreign/stale source, duplicate IDs, invalid inherited range or mismatched syntax envelope.

Oracle: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### reverse_reconstruction

For a valid fragment report, compatible declarations preserve parent IDs, order, source hash and ranges. All node subsets with the same min start/max end share an envelope; model semantics and interior coverage are not recoverable.

Oracle: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### ancestor_range_meet

For child [a,b) and every ranged ancestor [p,q), require p<=a<b<=q with UTF-8 endpoints. range.or(ancestor_range) preserves inherited constraint even across a locally missing or invalid range, while recording its error.

Oracle: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### preorder_error_propagation

Reserve parent slot before recursing, then fill its final status. Descendant diagnostics are included in parent child_errors, so an invalid descendant makes every reached owning parent invalid.

Oracle: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### depth_resource_boundary

At depth 64 a nonempty children list emits the depth error and loads no further child. Exactly 64 fragment levels can be reported; depth is a declaration-tree bound, not Rust syntax recursion protection.

Oracle: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### selection_extrema_fiber

For distinct selected IDs S, envelope=[min starts,max ends). Reordering S preserves envelope; duplicates are invalid; selecting root may cover the file without proving complete semantic modeling.

Oracle: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions. Fixed source scope and the stated domain are required; finite checks do not establish untested generality.

### tests

#### Native correspondence

Exact named checks: groupant_tests::fragment_utf8_ranges_and_depth_guard; groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source; groupant_tests::groupant_validation_negative_controls_and_open_extensions.

See ../wave33-evidence.md for current repeated profiles, actual production mutants and scope limits. AST generation alone is not behavioral evidence. Each reference test body was read before execution.

### forward

#### Scoped forward model

Recursive child directory admission, range inheritance and syntax-envelope validation

For each declared child reserve a preorder report slot, require one real immediate .groupant directory and regular manifest, validate same source and kind, check ID, range and optional syntax envelope, recurse and propagate errors. Reject nonempty child traversal at depth>=64.

### invariant-and-cost

#### Invariant and cost

IDs are globally unique; descendants under a range declare contained nonempty UTF-8 intervals. Siblings may overlap or leave holes. Syntax node selection is distinct/nonempty and its extrema equal declared range. Failed child loading remains a diagnostic report slot.

O(F log F + R + A) logical work for F fragments, selected-node counts R and repeated artifact validation A; path canonicalization and repeated JSON/source reads dominate bytes. Stack depth<=64 for declared recursion; report retains F manifests and nested diagnostics.

### wave34-composition


#### child-admission

Read declarations; require an array and composition before depth admission. For each declaration reserve its ID, enforce a single normal .groupant path, require real immediate directory and regular manifest, canonicalize containment, then decode manifest. A preorder report slot is reserved even when loading fails. A failed load skips source/range/recursive validation and emits a child-manifest diagnostic.

The child refines the parent call at this exact source range. Shared source identity and error order remain coupled; this view does not add a second execution or independent cost. No admitted child escapes its direct parent; failed loads remain visible. ID insertion precedes filesystem admission, so malformed children can consume IDs and affect later duplicate diagnostics.

#### syntax-envelope

Absent syntax_nodes returns success. Otherwise confine and reread/decode the selected artifact through the file-tree reader, fully validate current source and all nodes, then require a nonempty distinct unsigned ID list. Lookup each node by validated index, accumulate min start/max end, and compare exactly with fragment byte_range.

The child refines the parent call at this exact source range. Shared source identity and error order remain coupled; this view does not add a second execution or independent cost. The selection cannot use duplicate/missing IDs or a wider/narrower range. Memo reuse is decoding only; integrity checks precede selected ID consumption on every call.