---
title: "modelcheck-syntax-decode-memo — Mova code model"
description: "Mova code model of tools/modelcheck/src/syntax.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/syntax.rs.groupant/decode-memo.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/modelcheck/src/syntax.rs.groupant/decode-memo.groupant/>

# modelcheck-syntax-decode-memo

The groupant beside tools/modelcheck/src/syntax.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial
- **source:** [`tools/modelcheck/src/syntax.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/modelcheck/src/syntax.rs)
- **source SHA-256:** `35c315cc9b581bea…`
- **covers:** Bounded exact-byte JSON decode memo (bytes 21794–22989)
- **part of:** [modelcheck-syntax](https://md.groupants.elamur.ai/free/en/mova/tools/modelcheck/src/syntax.rs.groupant/)
- **repository folder:** [`tools/modelcheck/src/syntax.rs.groupant/decode-memo.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/modelcheck/src/syntax.rs.groupant/decode-memo.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [Forward](#forward) |
| **ast** | partial | `../syntax.json` |
| **cost** | partial | [Cost](#cost) |
| **descriptant** | partial | [Descriptant](#descriptant) |
| **invariant** | partial | [Invariant](#invariant) |
| **tests** | partial | [Tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial relational specification | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial relational specification | [reverse_reconstruction](#reverse-reconstruction) |
| `byte_identity_over_metadata` | byte_identity_over_metadata | partial relational specification | [byte_identity_over_metadata](#byte-identity-over-metadata) |
| `error_preserves_slot` | error_preserves_slot | partial relational specification | [error_preserves_slot](#error-preserves-slot) |
| `capacity_transition` | capacity_transition | partial relational specification | [capacity_transition](#capacity-transition) |
| `validation_independence` | validation_independence | partial relational specification | [validation_independence](#validation-independence) |

## Model text


Subject: current manifest source SHA and exact UTF-8 range [21794,22989). The observation is one completed scoped call with adequate resources; source-derived relations are partial specifications. Filesystem checks describe sequential reads, not an atomic snapshot.

### Forward

Read artifact bytes on every call. In memo mode return the immutable saved Value only on full byte equality. Otherwise decode with serde_json; on success retain one entry only at <=8 MiB, clearing on oversized/reference success. Read or parse errors propagate without replacing the slot. New reads in reference mode always decode.

### Invariant

Returned Value equals decoding the just-read bytes; no validation result or filesystem metadata is cached. One source-tree reader is dropped after traversal. Byte cap bounds serialized retention, not serde Value allocator overhead.

### Cost

For m equal B-byte references, one O(B+N) parse plus O(mB) reads/equality and O(1) Rc clones replaces m JSON decodes. Full source/node validation still runs O(m(S+N)); a miss can temporarily retain old and new trees. Retained byte cap is 8 MiB.

### Descriptant

Wave34, 2026-10-31: deeper scope retained under its existing parent without replacing historical views. Decode reuse was proposed before edits and checked against actual reference decoding; behavioral controls and repeated native receipts remain finite evidence. No numerical surrogate is justified for categorical validation outcomes; no percentage accuracy or complete semantic proof is claimed.

### Tests

Exact native test: syntax::wave34_tests::artifact_decode_memo_matches_reference_and_observes_file_changes. Parent tests additionally exercise integration and failure order. Current evidence is in ../wave34-evidence.md; old evidence remains explicitly historical in wave33-evidence.md at the source root.

### behavior_complement

Exclude returning saved JSON for unequal bytes, missing files, read errors or malformed fresh JSON. Exclude retaining oversized successful input; a saved valid slot cannot convert a failed read into success.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: syntax::wave34_tests::artifact_decode_memo_matches_reference_and_observes_file_changes. Finite observations do not establish universal completeness.

### reverse_reconstruction

For returned Value v, compatible just-read bytes are all serde_json encodings decoding to v. A hit further constrains bytes to saved bytes; a miss does not uniquely identify previous slot. Whitespace/object spelling can differ within the decoded fiber.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: syntax::wave34_tests::artifact_decode_memo_matches_reference_and_observes_file_changes. Finite observations do not establish universal completeness.

### byte_identity_over_metadata

Cache identity is full Vec byte equality, with no path/mtime/length-only shortcut. Same-size edited JSON must decode anew. Equal bytes from different paths are safe only because each caller still confines and rereads its path.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: syntax::wave34_tests::artifact_decode_memo_matches_reference_and_observes_file_changes. Finite observations do not establish universal completeness.

### error_preserves_slot

A read or decode failure leaves previous memo state unchanged but returns error. A later exact restoration can hit; the error itself is never memoized or suppressed.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: syntax::wave34_tests::artifact_decode_memo_matches_reference_and_observes_file_changes. Finite observations do not establish universal completeness.

### capacity_transition

For a successful miss with B<=8388608 retain (bytes,Rc<Value>); for B>8388608 clear. Reference mode also clears and cannot hit. This is a retention policy, not a maximum admitted artifact size.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: syntax::wave34_tests::artifact_decode_memo_matches_reference_and_observes_file_changes. Finite observations do not establish universal completeness.

### validation_independence

Consumers call validate_artifact after every read, including hits. Fresh source hash and all node guards remain active, so a source edit with unchanged artifact JSON still rejects. Across source-tree calls no memo is reused.

Assurance: source-derived partial relation; fixed source revision and stated scope. Oracle: syntax::wave34_tests::artifact_decode_memo_matches_reference_and_observes_file_changes. Finite observations do not establish universal completeness.