Elamur Groupantsen-store-envelope
The groupant beside en/src/store.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| approximant | partial | approximant |
| ast | partial | ../syntax.json |
| descriptant | present | descriptant |
| invariant | partial | invariant |
| tests | bounded checks | tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| id | type | label | where |
|---|---|---|---|
behavior_complement | behavior_complement | partial source derived model | behavior_complement |
reverse_reconstruction | reverse_reconstruction | partial source derived model | reverse_reconstruction |
failure_precedence | failure_precedence | partial source derived model | failure_precedence |
bit_transport | bit_transport | partial source derived model | bit_transport |
resource_lengths | resource_lengths | partial source derived model | resource_lengths |
schema_scope | schema_scope | partial source derived model | schema_scope |
Model text
descriptant
store: envelope
pack prepends44-byte format/dictionary-bound header. unpack validates magic/size, version, enum sizes, fingerprint, length and checksum in that order, before typed decoding. Checksum detects ordinary corruption but is not authentication.
Epoch 2026-10-31. Exact byte range/hash in manifest. Partial lexical AST is shared with parent; no macro expansion, semantic proof or executable percent surrogate. Parent tests exercise selected reachable paths, not every statement in this fragment.
approximant
envelope forward scope
pack prepends44-byte format/dictionary-bound header. unpack validates magic/size, version, enum sizes, fingerprint, length and checksum in that order, before typed decoding. Checksum detects ordinary corruption but is not authentication.
Composition rejoins the parent at its explicit state/representation boundaries; guarantees apply only to this byte range, not unrelated parent branches.
invariant
State and cost
Ser grows output bytes; De retains borrowed bytes and cursor; Items tracks remaining typed elements. Header44 bytes binds magic/version/enum sizes/dictionary fingerprint/body length/checksum.
Invalid bool/Option tags cannot deserialize. Trailing bytes cannot be silently accepted by from_bytes. Wrong checksum prevents body parsing. Format is not self-describing and cannot skip arbitrary values. Checksum is not authentication, and varint parser does not enforce canonical encodings or reject all tenth-byte overflow patterns.
O(serialized bytes plus typed element work), output allocation proportional to body; pack copies body into header buffer. Deserialization borrows primitive strings/bytes where visitor permits but vectors allocate advertised lengths. No size cap or allocation-failure Result guarantee.
models
behavior_complement
Invalid bool/Option tags cannot deserialize. Trailing bytes cannot be silently accepted by from_bytes. Wrong checksum prevents body parsing. Format is not self-describing and cannot skip arbitrary values. Checksum is not authentication, and varint parser does not enforce canonical encodings or reject all tenth-byte overflow patterns.
reverse_reconstruction
For fixed type T and compatible dictionary/format, unpack(pack(x)) recovers serializable state under serde contracts; accepted bytes can be noncanonical and map pair iteration can differ on rewrite. Output value's compatible byte set includes equivalent map orders and varints; therefore unique original byte reconstruction is unsupported.
failure_precedence
Header magic/size precedes version, shape, fingerprint, length, checksum, then serde error/trailing-byte check.
bit_transport
f32/f64 carry raw bits including signed zero and NaN; equality of floats is weaker than bit preservation. Chunk arrays use exact LE chunks.
resource_lengths
Unknown sequence length fails serialize. Decoder varint loop at most10 bytes; conversion to usize checked, take bounds checked. Typed visitor allocation remains uncontrolled.
schema_scope
Struct names/field names omitted; enum indices and field order form wire schema. Same header does not prove target T matches payload schema.
tests
Evidence
Actual source test: store::wave27::bounded_contract. Command: cargo test -p en --lib wave27 -- --test-threads=1 (debug twice, release twice). External evidence: $MOVA_DATA/runs/octopus-wave27-structure-2026-10-31. Nine focused tests, each in its owned production module; no copied implementation.
Compiled source mutants cover construct rounded-floor boundary, parse root legality and store checksum gate. Other sources have no compiled source mutation claim. Preflight empty-model nonempty tagging failed in ptag; synthetic fixtures adjusted without production changes. Existing corpus/seeds tests not selected.
Partial source-bound model, not full proof. No useful executable percentage surrogate established for these categorical decisions/effects; budgets1/2/5/10% require a future observation metric. No corpus/API/GPU/teacher, allocation fault injection, adversarial size exhaustion or broad accuracy claim.
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/en/src/store.rs.groupant/envelope.groupant/