---
title: "twin-ledger-failure-witness — Mova code model"
description: "Mova code model of tools/twin/tests/ledger.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/failure-witness.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/failure-witness.groupant/>

# twin-ledger-failure-witness

The groupant beside tools/twin/tests/ledger.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial source bound model
- **source:** [`tools/twin/tests/ledger.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/twin/tests/ledger.rs)
- **source SHA-256:** `cdc737ccddf5645b…`
- **covers:** Run exit/timeout/missing-output specs and assert failure, forecast presence, accepted=false and no updated; separately modify declared input during command and assert no update plus changed-during error. (bytes 3417–4466)
- **part of:** [twin-ledger-tests](https://md.groupants.elamur.ai/free/en/mova/tools/twin/tests/ledger.rs.groupant/)
- **repository folder:** [`tools/twin/tests/ledger.rs.groupant/failure-witness.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/twin/tests/ledger.rs.groupant/failure-witness.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [approximant](#approximant) |
| **ast** | partial | `../syntax.json` |
| **cost** | partial | [invariant-and-cost](#invariant-and-cost) |
| **descriptant** | present | [descriptant](#descriptant) |
| **invariant** | partial | [invariant-and-cost](#invariant-and-cost) |
| **tests** | bounded or representation | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial source derived model | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial source derived model | [reverse_reconstruction](#reverse-reconstruction) |
| `exit_gate` | exit_gate | partial source derived model | [exit_gate](#exit-gate) |
| `timeout_gate` | timeout_gate | partial source derived model | [timeout_gate](#timeout-gate) |
| `output_gate` | output_gate | partial source derived model | [output_gate](#output-gate) |
| `input_binding` | input_binding | partial source derived model | [input_binding](#input-binding) |

## Model text


### descriptant

#### twin-ledger-failure-witness

##### Epoch 2026-10-31

Prospective inspection identified this relation before additions: Run exit/timeout/missing-output specs and assert failure, forecast presence, accepted=false and no updated; separately modify declared input during command and assert no update plus changed-during error.

The production implementation is unchanged; only selected inline tests are appended. Source-bound syntax is generated twice and compared. Native checks exercise bounded helpers; entry orchestration, teacher calls, models and corpora remain source-derived. Partial syntax is not semantic proof. Preserve failure prefixes and ambiguity when refining this model.

### approximant

#### Forward relation

Run exit/timeout/missing-output specs and assert failure, forecast presence, accepted=false and no updated; separately modify declared input during command and assert no update plus changed-during error.

##### Composition

This fragment isolates the stated helper relation; parent composition retains surrounding effects and failures.

### catalog

## Typed observations: twin-ledger-failure-witness

Subject: tools/twin/tests/ledger.rs, SHA-256 cdc737ccddf5645b0273733f6c6b9acda530a84d544917d1ba080628a8d14ac9. Domain: bounded source inputs, declared filesystem/environment state and normal allocations. Each view is a partial source-derived relation, not a universal proof. Observation is one helper call or the explicitly described trace. Checks are in tests.md; unexecuted effects remain gaps.

### behavior_complement

On these four fixtures successful training update is excluded despite echo complete in exit/mutation cases.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### reverse_reconstruction

No updated file alone admits many rejection causes. Error substring narrows mutated-input witness but not exact file contents or time.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### exit_gate

Nonzero status is sufficient rejection even with expected stdout; not a parser-only output gate.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### timeout_gate

sleep 10 with one-second timeout witnesses timeout rejection, not deterministic exact latency.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### output_gate

Zero exit with echo wrong rejects required contains marker. This does not test sha256 output constraints.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### input_binding

Declared fixture starts old then child writes changed; changed-during substring and no updated bind input stability. No other input types tested.

Scope: the bound source interval and stated assumptions. Evidence: source inspection plus the checks explicitly named in tests.md; no finite check establishes all inputs.

### tests

#### Checks and limits

failed_timeout_invalid_output_and_changed_input_do_not_train invoked exactly, twice per profile.

Exact native outcomes and command metadata are retained in the external wave33 cycle receipt bundle. Selected names run twice in debug and release; syntax is independently regenerated twice. Compiled mutations and source restoration receipts distinguish behavior changes from assertion-only controls. These claims are finalized in evidence.md. No live teacher, real model/corpus, benchmark CLI or lesson-learning CLI is run.

### invariant-and-cost

#### Invariant and cost

All paths operate in fresh scratch. Failure still preserves forecast evidence; update absence is the admission boundary observation.

Four child runs and bounded temp-file operations, one timeout path; no fixed wall time guarantee.

No executable percentage surrogate is claimed: effects, categorical acceptance and report text have no justified approximate metric here. Future profiles require a useful metric, zero case, reference and evidence at caps 1/2/5/10%.