---
title: "vfs-gates-fault-controls — Mova code model"
description: "Mova code model of vfs/tests/vfs.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/vfs/tests/vfs.rs.groupant/fault-gates.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/vfs/tests/vfs.rs.groupant/fault-gates.groupant/>

# vfs-gates-fault-controls

The groupant beside vfs/tests/vfs.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial source bound model
- **source:** [`vfs/tests/vfs.rs`](https://github.com/ElamurAI/mova-free/blob/main/vfs/tests/vfs.rs)
- **source SHA-256:** `698bd9736a44e424…`
- **covers:** Runtime fault-injection gate family. (bytes 16824–19904)
- **part of:** [vfs-gates](https://md.groupants.elamur.ai/free/en/mova/vfs/tests/vfs.rs.groupant/)
- **repository folder:** [`vfs/tests/vfs.rs.groupant/fault-gates.groupant`](https://github.com/ElamurAI/mova-free/tree/main/vfs/tests/vfs.rs.groupant/fault-gates.groupant)
- **repository commit:** `855da7bd4a7b`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [approximant](#approximant) |
| **ast** | partial | `../syntax.json` |
| **composition** | partial | [composition](#composition) |
| **cost** | partial | [Cost](#cost) |
| **descriptant** | present | [descriptant](#descriptant) |
| **invariant** | partial | [Invariant](#invariant) |
| **tests** | executed bounded checks | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial source derived model | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial source derived model | [reverse_reconstruction](#reverse-reconstruction) |
| `escape_oracle` | escape_oracle | partial source derived model | [escape_oracle](#escape-oracle) |
| `quota_oracle` | quota_oracle | partial source derived model | [quota_oracle](#quota-oracle) |
| `clock_oracle` | clock_oracle | partial source derived model | [clock_oracle](#clock-oracle) |
| `host_oracle` | host_oracle | partial source derived model | [host_oracle](#host-oracle) |

## Model text


### descriptant

#### vfs-gates-fault-controls

Runtime fault-injection gate family.

##### Prospective epoch

2026-10-31: source reviewed before edits; prospective review retained under $MOVA_DATA/runs/octopus-wave31-vfs-2026-10-31/prospective.md. Predicted order/cost: Finite small trees and100000-byte populate blob; four gate evaluations plus five faulted evaluations.

##### Observation epoch

Bounded actual calls and compiled negative controls are recorded in tests.md. Production behavior bytes unchanged; only focused test blocks added. Snapshot constant-time wording is conditional on cwd and destruction; recursive operations may partially commit.

##### Unsupported approximants

No executable percentage surrogate is claimed for these categorical/state/effect observations. Future 1%,2%,5%,10% require a useful metric, explicit domain and exact reference.

### approximant

#### Forward relation

Runtime fault-injection gate family.

gate_escape requires NotCapable; gate_limits checks FBig/DQuot; gate_snapshot compares dump; gate_dirfs requires confinement errors. Test requires normal gates Ok and five deliberate fault gates Err.

Domain: bounded inputs with available allocation and nonoverflowing counters unless checked explicitly. The relation is partial and source-derived.

### composition

#### Composition

Runtime fault-injection gate family. Shared state and order: gate_escape requires NotCapable; gate_limits checks FBig/DQuot; gate_snapshot compares dump; gate_dirfs requires confinement errors. Test requires normal gates Ok and five deliberate fault gates Err.

Scoped children project this same source. Their domains and effects remain conditional; source execution connects these clauses rather than independently proving their wiring. All injected faults are bounded synthetic fixtures. Runtime faults exercise actual source but are counted separately from compiled mutants.

### models

## Typed source models

Source-bound partial relations; no universal finite-test proof.

### behavior_complement

Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.

Operator: A deliberate fault cannot pass the corresponding named gate on its fixture and still satisfy this test.

Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.

### reverse_reconstruction

Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.

Operator: Gate failure admits multiple implementations and states violating expected error/dump, without unique diagnosis.

Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.

### escape_oracle

Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.

Operator: ClampDotDot changes errno trace when popping empty root.

Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.

### quota_oracle

Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.

Operator: NoLimits permits oversized/new node write that gate expects rejected.

Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.

### clock_oracle

Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.

Operator: RestoreForgetsClock yields different dump after mutating.

Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.

### host_oracle

Subject: vfs-gates-fault-controls. Domain: Runtime fault-injection gate family. Valid allocations, bounded counters, Fault=None unless explicitly named. Observation: one call or the stated finite trace.

Operator: NoConfine reads only synthetic outside sibling fixture; no real host secrets.

Approximation: source-derived partial relation; complement is an inner excluded-behavior claim under these premises, converse retains compatible antecedents. Evidence: tests.md; unobserved concurrency/resource failures remain unknown.

### tests

#### Checks and limitations

Exact named observations: escape_by_dotdot_is_denied, symlinks_cannot_lead_outside, bad_names_and_paths, limits_fire_with_clear_errors_and_leave_state_unchanged, limits_parse, snapshot_changes_restore_is_byte_identical, snapshot_is_isolated_copy_on_write, restore_after_failed_ops_and_limits, posix_like_semantics, virtual_clock_is_deterministic, journal_records_ops_errors_and_denials, import_export_round_trip, dirfs_confines_to_root, gates_green_and_negative_controls_red, wave31_sparse_copy_and_partial_directory_failure.

Fresh receipts: $MOVA_DATA/runs/octopus-wave31-vfs-2026-10-31; run.sh retains four profile/repetition sets with raw logs and numeric statuses. native-commands.json and source-test-map.json disambiguate targets. Compiled mutations and exact restoration are separately retained in mutation-summary.json.

These finite observations are not semantic completeness. Source syntax generated twice and compared byte-for-byte. Host effects are limited to owned TMPDIR fixtures. Existing absolute_paths_never_reach_the_host and open_modes are skipped; snapbench main is skipped. Standalone helpers/reexports are only observed through named callers or representation checks; RealFs effect methods unexecuted.

### invariant-and-cost

## Invariant and cost

### Invariant

All injected faults are bounded synthetic fixtures. Runtime faults exercise actual source but are counted separately from compiled mutants.

### Cost

Finite small trees and100000-byte populate blob; four gate evaluations plus five faulted evaluations.

No timing or numerical error guarantee is inferred from finite tests.