Function assert_uses_codec_error_envelope 

pub fn assert_uses_codec_error_envelope<E, D>()
where
    E: EncoderConfig<Error = At<CodecError>>,
    E::Job: EncodeJob<Error = At<CodecError>>,
    <E::Job as EncodeJob>::Enc: Encoder<Error = At<CodecError>>,
    D: DecoderConfig<Error = At<CodecError>>,
    for<'a> D::Job<'a>: DecodeJob<'a, Error = At<CodecError>>,
    for<'a> <D::Job<'a> as DecodeJob<'a>>::Dec: Decode<Error = At<CodecError>>,

Statically assert a codec returns the shared At<CodecError> envelope from every encode/decode trait boundary — the Pattern-B error contract.

A zero-cost compile-time gate: it takes no arguments and runs no code. A codec invokes it once — assert_uses_codec_error_envelope::<MyEncoderConfig, MyDecoderConfig>() — and the bounds below make it a compile error for any codec whose type Error is its own native enum instead of At<CodecError> (Pattern A).

Why it matters: a native-enum type Error classifies only on the typed path. The moment it is erased — the BoxedError every Dyn* dispatch method produces, an anyhow::Error, a mapped wrapper — all you hold is a dyn Error, and you cannot downcast that to a dyn CategorizedError; the ErrorCategory and codec name are gone. At<CodecError> is one concrete type, so it survives any erasure by a downcast. check_decode_error_envelope is the runtime companion that proves the category actually flows through erasure.

It bounds the config, job, and leaf executor on both sides. The optional stub associated types (AnimationFrameEnc, StreamDec, AnimationFrameDec) are intentionally not bound: a still-only codec legitimately uses () / Unsupported, whose Error is UnsupportedOperation, not the envelope.

Not part of check_all — the testkit’s own reference codec is a deliberate Pattern-A foil, so this is opt-in for codecs that have adopted the envelope.