---
title: "twin-ledger-tests — Mova code model"
description: "Mova code model of tools/twin/tests/ledger.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/>

# twin-ledger-tests

The groupant beside tools/twin/tests/ledger.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/twin/tests/ledger.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/twin/tests/ledger.rs)
- **source SHA-256:** `cdc737ccddf5645b…`
- **repository folder:** [`tools/twin/tests/ledger.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/twin/tests/ledger.rs.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | `model.md` |
| **ast** | partial | `syntax.json` |
| **composition** | partial | [Composition](#composition) |
| **cost** | partial | [invariant-and-cost](#invariant-and-cost) |
| **descriptant** | present | [descriptant](#descriptant) |
| **invariant** | partial | [invariant-and-cost](#invariant-and-cost) |
| **tests** | bounded or representation | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial source derived model | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial source derived model | [reverse_reconstruction](#reverse-reconstruction) |
| `forecast_order` | forecast_order | partial source derived model | [forecast_order](#forecast-order) |
| `tamper_scope` | tamper_scope | partial source derived model | [tamper_scope](#tamper-scope) |
| `failure_partition` | failure_partition | partial source derived model | [failure_partition](#failure-partition) |
| `scratch_lifetime` | scratch_lifetime | partial source derived model | [scratch_lifetime](#scratch-lifetime) |

## Parts

- [twin-ledger-failure-witness](https://md.groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/failure-witness.groupant/)

## Model text


### descriptant

#### twin-ledger-tests

##### Epoch 2026-10-31

Prospective inspection identified this relation before additions: Scratch creates unique PID/nanosecond temp directory with best-effort Drop cleanup. spec builds bounded /bin/sh workload. Tests assert forecast before launch, parent-chain count and immutability, reuse/domain/tamper rejection; failed/timeout/missing/mutated-input runs do not train; predict never launches command.

The production implementation is unchanged; only selected inline tests are appended. Source-bound syntax is generated twice and compared. Native checks exercise bounded helpers; entry orchestration, teacher calls, models and corpora remain source-derived. Partial syntax is not semantic proof. Preserve failure prefixes and ambiguity when refining this model.

### approximant

## Forward relation

Scratch creates unique PID/nanosecond temp directory with best-effort Drop cleanup. spec builds bounded /bin/sh workload. Tests assert forecast before launch, parent-chain count and immutability, reuse/domain/tamper rejection; failed/timeout/missing/mutated-input runs do not train; predict never launches command.

### Composition

Actual tests call mova-twin run/report/predict binary via Cargo executable binding. This is independent from cycle training; common forecast/attempt terminology does not create runtime call edges.

### catalog

## Typed observations: twin-ledger-tests

Subject: tools/twin/tests/ledger.rs, SHA-256 cdc737ccddf5645b0273733f6c6b9acda530a84d544917d1ba080628a8d14ac9. Domain: bounded source inputs, declared filesystem/environment state and normal allocations. Each view is a partial source-derived relation, not a universal proof. Observation is one helper call or the explicitly described trace. Checks are in tests.md; unexecuted effects remain gaps.

### behavior_complement

Predict witness excludes launched marker on its synthetic fixture. Failure witnesses exclude updated.json for exit/timeout/missing output and changed input; finite evidence not all workloads.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### reverse_reconstruction

Passing assertions admit many elapsed runtimes, model coefficients and unobserved artifacts. Forecast bytes identity constrains previous record only, not all filesystem state.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### forecast_order

Shell tests forecast exists and observation absent before echo; success witnesses launch ordering on one run, parent observations-before=1 and updated n=2 on next.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### tamper_scope

Changing theta rejects parent; replacing observation with {} rejects parent. Test does not enumerate all tamper fields or prove cryptographic validity.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### failure_partition

Exit 7, timeout sleep, missing 'complete', and modified input each constrain acceptance/update behavior. These are separate subprocess paths with different failure effects.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### scratch_lifetime

Unique path uses PID+nanoseconds and create_dir; collision panics. Drop ignores cleanup failure, so passing test is not proof of no residual files.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### tests

#### Checks and limits

forecast_precedes_execution_and_parent_chain_is_prospective; failed_timeout_invalid_output_and_changed_input_do_not_train; prediction_does_not_launch_the_command. All bodies inspected, safe synthetic temp roots.

Exact native outcomes and command metadata are retained in the external wave33 cycle receipt bundle. Selected names run twice in debug and release; syntax is independently regenerated twice. Compiled mutations and source restoration receipts distinguish behavior changes from assertion-only controls. These claims are finalized in evidence.md. No live teacher, real model/corpus, benchmark CLI or lesson-learning CLI is run.

### evidence

#### Wave33 evidence — 2026-10-31

Across this nine-source slice, 14 exact native names passed twice in debug and twice in release (56 runs); sorted target-qualified outcomes agree. Six compiled behavior controls fail named assertions and exact restored bytes pass again. One exploratory parser-count control failed by unwrap panic; it was restored and replaced by a form-column assertion control. No assertion-only control is counted.

Nine syntax projections were generated twice and byte compared. Production source prefixes match the base exactly; four files append only formatted cfg(test) blocks. Local groupants validation reports valid=true, zero diagnostics. Counts: nine source roots, ten scoped children, 114 typed views.

See tests.md for this source's precise executed or representation-only coverage. Native evidence does not apply to ignored live teacher or lesson execution. No teacher/API, model/corpus, learning or benchmark CLI was run. Receipts retain numeric statuses, exact names, log/source hashes, original backups, unique mutation replacements and restoration assertions. The external bundle is named octopus-wave33-cycle-2026-10-31.

### invariant-and-cost

#### Invariant and cost

These are synthetic CLI integration witnesses, not production workload performance evidence. Shell timeout uses one-second declared limit around sleep 10; no corpus/network. Parent/tamper checks assert failure and selected artifacts, not every failure detail.

Finite scratch file/process operations; timeout workload bounded by twin timeout enforcement, with external OS scheduling. Counts and timing not universal throughput bounds.

No executable percentage surrogate is claimed: effects, categorical acceptance and report text have no justified approximate metric here. Future profiles require a useful metric, zero case, reference and evidence at caps 1/2/5/10%.