---
title: "modelcheck-library-syntax-envelope — Mova code model"
description: "Mova code model of tools/modelcheck/src/lib.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/syntax-envelope.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/syntax-envelope.groupant/>

# modelcheck-library-syntax-envelope

The groupant beside tools/modelcheck/src/lib.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial
- **source:** [`tools/modelcheck/src/lib.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/modelcheck/src/lib.rs)
- **source SHA-256:** `0a09fdb807efa690…`
- **covers:** Projection selection and exact envelope (bytes 28825–30648)
- **part of:** [modelcheck-library-fragment-validation](https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/)
- **repository folder:** [`tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/syntax-envelope.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/modelcheck/src/lib.rs.groupant/fragment-validation.groupant/syntax-envelope.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [Forward](#forward) |
| **ast** | partial | `../../syntax.json` |
| **cost** | partial | [Cost](#cost) |
| **descriptant** | partial | [Descriptant](#descriptant) |
| **invariant** | partial | [Invariant](#invariant) |
| **tests** | partial | [Tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial relational specification | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial relational specification | [reverse_reconstruction](#reverse-reconstruction) |
| `integrity_before_selection` | integrity_before_selection | partial relational specification | [integrity_before_selection](#integrity-before-selection) |
| `permutation_quotient` | permutation_quotient | partial relational specification | [permutation_quotient](#permutation-quotient) |
| `unselected_damage_dependency` | unselected_damage_dependency | partial relational specification | [unselected_damage_dependency](#unselected-damage-dependency) |
| `gap_preservation` | gap_preservation | partial relational specification | [gap_preservation](#gap-preservation) |

## Model text


Subject: current manifest source SHA and exact UTF-8 range [27698,29521). The observation is one completed scoped call with adequate resources; source-derived relations are partial specifications. Filesystem checks describe sequential reads, not an atomic snapshot.

### Forward

Absent syntax_nodes returns success. Otherwise confine and reread/decode the selected artifact through the file-tree reader, fully validate current source and all nodes, then require a nonempty distinct unsigned ID list. Lookup each node by validated index, accumulate min start/max end, and compare exactly with fragment byte_range.

### Invariant

The selection cannot use duplicate/missing IDs or a wider/narrower range. Memo reuse is decoding only; integrity checks precede selected ID consumption on every call.

### Cost

Artifact read/equality O(B), validation O(source bytes + N), selection O(S log S), with one O(B+N) decode on each memo miss. S selected IDs do not replace whole-artifact validation.

### Descriptant

Wave34, 2026-10-31: deeper scope retained under its existing parent without replacing historical views. Decode reuse was proposed before edits and checked against actual reference decoding; behavioral controls and repeated native receipts remain finite evidence. No numerical surrogate is justified for categorical validation outcomes; no percentage accuracy or complete semantic proof is claimed.

### Tests

Exact native test: groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source. Parent tests additionally exercise integration and failure order. Current evidence is in ../../wave34-evidence.md; old evidence remains explicitly historical in wave33-evidence.md at the source root.

### behavior_complement

Exclude success for opted-in anchors whose selected set is empty/nonunique, whose IDs do not exist, or whose range differs from extrema. Invalid unselected nodes also exclude success because validation runs before selection.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source. Finite observations do not establish universal completeness.

### reverse_reconstruction

Given envelope [a,b), compatible ID sets have minimum start a and maximum end b and are nonempty and distinct. Interior nodes, overlapping nodes and permutations remain ambiguous; root inclusion is allowed if it yields the envelope.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source. Finite observations do not establish universal completeness.

### integrity_before_selection

The observation order is artifact admission and full integrity, then IDs, then final equality. A stale projection paired with duplicate IDs reports artifact staleness first.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source. Finite observations do not establish universal completeness.

### permutation_quotient

For a fixed valid projection, permuting a distinct selected list preserves extrema and acceptance. Adding a duplicate changes acceptance despite preserving extrema.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source. Finite observations do not establish universal completeness.

### unselected_damage_dependency

Hold selected nodes fixed and corrupt another projection node. The full-artifact gate still rejects, so an envelope-valid subset cannot hide artifact damage.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source. Finite observations do not establish universal completeness.

### gap_preservation

A selection of disjoint nodes takes their enclosing interval, including gaps. This does not assert the model covers the omitted source or reconstruct internal statements.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: groupant_tests::fragment_syntax_anchors_bind_envelopes_and_current_source. Finite observations do not establish universal completeness.