---
title: "en-store-envelope — Mova code model"
description: "Mova code model of en/src/store.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/en/src/store.rs.groupant/envelope.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/en/src/store.rs.groupant/envelope.groupant/>

# en-store-envelope

The groupant beside en/src/store.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant_fragment
- **status:** partial source bound model
- **source:** [`en/src/store.rs`](https://github.com/ElamurAI/mova-free/blob/main/en/src/store.rs)
- **source SHA-256:** `4d2334d78a3ae22b…`
- **covers:** envelope source scope; see parent composition for interaction (bytes 18768–21426)
- **part of:** [en-store](https://md.groupants.elamur.ai/free/en/mova/en/src/store.rs.groupant/)
- **repository folder:** [`en/src/store.rs.groupant/envelope.groupant`](https://github.com/ElamurAI/mova-free/tree/main/en/src/store.rs.groupant/envelope.groupant)
- **repository commit:** `48f2e6f74146`

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **approximant** | partial | [approximant](#approximant) |
| **ast** | partial | `../syntax.json` |
| **descriptant** | present | [descriptant](#descriptant) |
| **invariant** | partial | [invariant](#invariant) |
| **tests** | bounded checks | [tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| id | type | label | where |
|---|---|---|---|
| `behavior_complement` | behavior_complement | partial source derived model | [behavior_complement](#behavior-complement) |
| `reverse_reconstruction` | reverse_reconstruction | partial source derived model | [reverse_reconstruction](#reverse-reconstruction) |
| `failure_precedence` | failure_precedence | partial source derived model | [failure_precedence](#failure-precedence) |
| `bit_transport` | bit_transport | partial source derived model | [bit_transport](#bit-transport) |
| `resource_lengths` | resource_lengths | partial source derived model | [resource_lengths](#resource-lengths) |
| `schema_scope` | schema_scope | partial source derived model | [schema_scope](#schema-scope) |

## Model text


### descriptant

#### store: envelope

pack prepends44-byte format/dictionary-bound header. unpack validates magic/size, version, enum sizes, fingerprint, length and checksum in that order, before typed decoding. Checksum detects ordinary corruption but is not authentication.

Epoch 2026-10-31. Exact byte range/hash in manifest. Partial lexical AST is shared with parent; no macro expansion, semantic proof or executable percent surrogate. Parent tests exercise selected reachable paths, not every statement in this fragment.

### approximant

#### envelope forward scope

pack prepends44-byte format/dictionary-bound header. unpack validates magic/size, version, enum sizes, fingerprint, length and checksum in that order, before typed decoding. Checksum detects ordinary corruption but is not authentication.

Composition rejoins the parent at its explicit state/representation boundaries; guarantees apply only to this byte range, not unrelated parent branches.

### invariant

#### State and cost

Ser grows output bytes; De retains borrowed bytes and cursor; Items tracks remaining typed elements. Header44 bytes binds magic/version/enum sizes/dictionary fingerprint/body length/checksum.

Invalid bool/Option tags cannot deserialize. Trailing bytes cannot be silently accepted by from_bytes. Wrong checksum prevents body parsing. Format is not self-describing and cannot skip arbitrary values. Checksum is not authentication, and varint parser does not enforce canonical encodings or reject all tenth-byte overflow patterns.

O(serialized bytes plus typed element work), output allocation proportional to body; pack copies body into header buffer. Deserialization borrows primitive strings/bytes where visitor permits but vectors allocate advertised lengths. No size cap or allocation-failure Result guarantee.

### models

### behavior_complement

Invalid bool/Option tags cannot deserialize. Trailing bytes cannot be silently accepted by from_bytes. Wrong checksum prevents body parsing. Format is not self-describing and cannot skip arbitrary values. Checksum is not authentication, and varint parser does not enforce canonical encodings or reject all tenth-byte overflow patterns.

### reverse_reconstruction

For fixed type T and compatible dictionary/format, unpack(pack(x)) recovers serializable state under serde contracts; accepted bytes can be noncanonical and map pair iteration can differ on rewrite. Output value's compatible byte set includes equivalent map orders and varints; therefore unique original byte reconstruction is unsupported.

### failure_precedence

Header magic/size precedes version, shape, fingerprint, length, checksum, then serde error/trailing-byte check.

### bit_transport

f32/f64 carry raw bits including signed zero and NaN; equality of floats is weaker than bit preservation. Chunk arrays use exact LE chunks.

### resource_lengths

Unknown sequence length fails serialize. Decoder varint loop at most10 bytes; conversion to usize checked, take bounds checked. Typed visitor allocation remains uncontrolled.

### schema_scope

Struct names/field names omitted; enum indices and field order form wire schema. Same header does not prove target T matches payload schema.

### tests

#### Evidence

Actual source test: store::wave27::bounded_contract. Command: cargo test -p en --lib wave27 -- --test-threads=1 (debug twice, release twice). External evidence: $MOVA_DATA/runs/octopus-wave27-structure-2026-10-31. Nine focused tests, each in its owned production module; no copied implementation.

Compiled source mutants cover construct rounded-floor boundary, parse root legality and store checksum gate. Other sources have no compiled source mutation claim. Preflight empty-model nonempty tagging failed in ptag; synthetic fixtures adjusted without production changes. Existing corpus/seeds tests not selected.

Partial source-bound model, not full proof. No useful executable percentage surrogate established for these categorical decisions/effects; budgets1/2/5/10% require a future observation metric. No corpus/API/GPU/teacher, allocation fault injection, adversarial size exhaustion or broad accuracy claim.