---
title: "module-overlay-composition — Mova code model"
description: "Mova code model of tools/module-overlay/composition.groupant: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/module-overlay/composition.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/module-overlay/composition.groupant/>

# module-overlay-composition

The groupant beside tools/module-overlay/composition.groupant in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_group
- **status:** partial source bound model
- **bound sources:** 3
- **repository folder:** [`tools/module-overlay/composition.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/module-overlay/composition.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial source model | [forward](#forward) |
| **ast** | not materialized |  |
| **cost** | partial source model | [cost](#cost) |
| **descriptant** | present | [epoch-memory](#epoch-memory) |
| **invariant** | partial source model | [invariant](#invariant) |
| **tests** | bounded native evidence | [checks](#checks) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `module-overlay-composition-behavior-complement` | behavior_complement | partial source model | [behavior-complement](#behavior-complement) |
| `module-overlay-composition-reverse-reconstruction` | reverse_reconstruction | partial source model | [reverse-reconstruction](#reverse-reconstruction) |
| `module-overlay-composition-publication-boundary` | publication_boundary | partial source model | [publication-boundary](#publication-boundary) |
| `module-overlay-composition-model-compatibility-join` | independent_evidence_join | partial source model | [model-compatibility-join](#model-compatibility-join) |
| `output-provenance-join` | independent_evidence_join | source derived with finite native composition controls | [output-provenance-join](#output-provenance-join) |

## Model text

### domain
Public CLI args, validated external manifest/snapshot, source trees, and a fresh output. Children are the CLI, bounded library and finite fixtures. Stable filesystem and ordinary successful IO are explicit premises.
### forward
CLI schema/load joins raw base-JSON SHA and typed snapshot equality; check joins planned replacement constraints to observed upstream metadata; stage joins those validated identities to byte copying and the final receipt. Tests observe this real composition on small independent temporary trees. Config plan data is copied, never interpreted as a worker command.
### invariant
No production child calls a shell, Cargo or an AI. A source tree plus matching groupant hash does not imply model validity. Receipt generation follows final input checks; it never records unexecuted Cargo checks as successes.
### cost
A fixed number of O(bytes+files log files) bounded inventories and copy passes; peak memory is file metadata plus one bounded file and bounded traversal entries. No unexplained cross-child speedup is claimed.
### behavior-complement
An accepted complete composition excludes stale base identity, duplicate-target priority and an existing output. The default tool cannot start the abstract Whale plan or silently make its role supported. These are scoped exclusions, not a universal publication or safety classifier.
### reverse-reconstruction
Receipt plus final tree retains custom/base commitments but not overwritten original bytes or excluded input data. Multiple physical source/output roots and multiple hidden directory states yield identical receipts. Unique reconstruction requires separately retained originals and additional information; no general inverse is asserted.
### publication-boundary
A partial directory after an IO/cleanup failure has no successful receipt. A successful fresh source tree is still not a deployable approved build: Cargo compilation, source-model registration, API compatibility and runtime behavior have separate checks. A new base snapshot alone does not bridge those gaps.
### model-compatibility-join
The byte-composition gate and source-model freshness partition are intentionally independent. It is possible to compose a valid byte tree with missing or stale groupants; receipt reports those states rather than repairing hashes. Parent/operator model guards must decide admissibility for the intended release.
### checks
Fourteen named native fixtures plus repeated actual CLI composition and a tiny explicit Cargo fixture check/test. External evidence records commands, deterministic receipt hashes and negative controls. No live tree/runtime, teacher or training call.
### epoch-memory
2026-11-01: three Rust files and one composed parent; registry fragment is ready for the main integrator to attach to the public ownership tree. No current central registry is modified by this branch.

### output-provenance-join
Domain: valid synthetic old/new base bindings with fixed replacement contents, targets and output path topology. Observation is the joint tuple (admission, composed source map, provenance receipt). The child overwrite projection can map two different bases to one source map; the parent must retain the separate base and manifest commitments. If O0=O1 for the source-only observation, it does not follow that admission to the old base or the receipts are equal. In the target-only content-drift fixture, old check yields an incompatible report and old stage creates no output. After explicit synthetic rebind, a second valid stage has the same output tree but a different receipt. An unoverridden README control changes the output itself.

This specialized evidence-join obernant excludes promoting source equality into unchanged provenance or upgrade approval. Its reverse interpretation keeps multiple possible base histories when only output is retained; receipt fields distinguish the two tested histories without recovering original bytes. Required assumptions are stable bounded inputs, valid rebinding and trusted expected commitments; no hash injectivity, API compatibility or universal source proof is established. Evidence: two focused actual library fixtures and a rejected external target-insensitive-gate mutation; existing finite tests remain separate. The receipt file is excluded from the source-tree commitment, so equal source maps do not mean identical complete physical output directories. Tests and library metadata must be rebound together in the parent; unchanged production source is not silently recertified.