kobako 0.13.0 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 405db05c3ccf4250860f660bb571458adcedfeb3107120ab1cd87f7150e0b977
-  data.tar.gz: e3d85aab1c493c3b2545c94bcdd47928d3d07eea8870f269d1107cbe8115b5cc
+  metadata.gz: f89723d7b8cc8160176c299eaf28548ff9c7efda380ce545a7676d5d7f7cfdb6
+  data.tar.gz: 3494ee4ff50aef160504b53eb75b0192e9e9c7108d165db39b3903fb4e7343df
 SHA512:
-  metadata.gz: 6bd3b70b07a03d947b2b6142ec476bbba3f66699d1228ae0f26e148e6d7b9fbe0b4b2124a4033c4816008fd89254e7f971b87624d6a93e26f92cd16e070c6cb5
-  data.tar.gz: 79a961448a3db38cd4a662159eb0f6df1aebdf628a54f0d1e1896f9095d668e71998926f610268cf31fe1f0a0c7091a4f31a970485f67e5f4d152852ad8f014f
+  metadata.gz: 26c982a047b82e32dcd4017ce603d6c4094bb6d4cd34f38e1df6eacba253cdb9589a8092fe0558e0ddcb64f9acacb4ef191f51916c37dffebf4f1ee0bc52a4fb
+  data.tar.gz: b593374ee6c18e132535813aa046a7059aca5a9f0d16c6b32519f8154a6d76b2fc5e7b2b4791e5213e26b7828748f64f3ec61b00029a9bb6cf0cc6336a48fdf0

data/.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.13.0","wasm/kobako-core":"0.7.0","wasm/kobako":"0.7.0","wasm/kobako-io":"0.7.0","wasm/kobako-json":"0.7.0","wasm/kobako-regexp":"0.7.0","wasm/kobako-baker":"0.7.0","crates/kobako-codec":"0.7.0","crates/kobako-runtime":"0.7.0","crates/kobako-wasmtime":"0.7.0"}
+{".":"0.14.0","wasm/kobako-core":"0.8.0","wasm/kobako-mruby":"0.8.0","wasm/kobako-io":"0.8.0","wasm/kobako-json":"0.8.0","wasm/kobako-regexp":"0.8.0","wasm/kobako-baker":"0.8.0","crates/kobako-codec":"0.8.0","crates/kobako-runtime":"0.8.0","crates/kobako-wasmtime":"0.8.0","crates/kobako":"0.8.0"}

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [0.14.0](https://github.com/elct9620/kobako/compare/v0.13.0...v0.14.0) (2026-07-08)
+
+
+### Features
+
+* **codec:** add the Run invocation envelope to the wire tier ([dbdd760](https://github.com/elct9620/kobako/commit/dbdd760ddc258681669f7f620f63b75f36322687))
+* **crates:** add the kobako host SDK skeleton ([8a99d09](https://github.com/elct9620/kobako/commit/8a99d09ef7068a6738d44f1a735d39516b24156b))
+* **crates:** add the parity runner to the kobako SDK ([998f059](https://github.com/elct9620/kobako/commit/998f059abd308ef921c295658aaf8377febb44e2))
+* **crates:** grow the SDK capability-Handle table ([f93fe8f](https://github.com/elct9620/kobako/commit/f93fe8f3dce2509cfa527229f8f593f4d816b940))
+* **crates:** grow the SDK Member block-yield seam ([4404713](https://github.com/elct9620/kobako/commit/44047130f309a2c935198077fb4f7f86839355e7))
+* **crates:** grow the SDK preload and run invocation seams ([d8d5fe2](https://github.com/elct9620/kobako/commit/d8d5fe268a56d45dad4f8b35a25e942a559dcd5f))
+* **crates:** honor the respond_to_guest narrowing on the SDK Member seam ([0f5eff1](https://github.com/elct9620/kobako/commit/0f5eff16a1e9f2229ad9d9c9316bf94e92035301))
+* **crates:** let a resolved Handle recover its concrete member type ([abd5502](https://github.com/elct9620/kobako/commit/abd55029a44a7631d323c3aec3b625d9692f9c5b))
+* **crates:** mark the SDK Error taxonomy non_exhaustive ([001fc69](https://github.com/elct9620/kobako/commit/001fc69e637d2c046f55cb517f9d9cf931793715))
+* **examples:** add the guest→host dispatch half to the Rust host ([5cdde68](https://github.com/elct9620/kobako/commit/5cdde68824352c5685aaa94ae464e909705a4648))
+* **examples:** assemble a minimal Rust host on the published crates ([6b98680](https://github.com/elct9620/kobako/commit/6b98680bcb625f9790f44df839035427a576e266))
+* **tasks:** add a rails-stats-style rake stats size report ([c02d530](https://github.com/elct9620/kobako/commit/c02d530d43a85594323b7801fdbe75aa95ae7f8c))
+* **tasks:** gate parity coverage over the CORE anchor manifest ([d26972c](https://github.com/elct9620/kobako/commit/d26972c1ad51e05df951643e17d66a6c811ba862))
+
+
+### Bug Fixes
+
+* **crates:** give SetupError a Display so Error::Setup reads cleanly ([bc8b128](https://github.com/elct9620/kobako/commit/bc8b128c9e296319c7fef47441b412d2ce345dff))
+* **crates:** keep the no-timeout epoch deadline within range ([a3255df](https://github.com/elct9620/kobako/commit/a3255df98a77825bb39b571a60fe6ff83d269d19))
+* **crates:** reject trailing bytes on Request and Run decode ([8e4929b](https://github.com/elct9620/kobako/commit/8e4929b64f3ea690f38211888070c2511da84754))
+* **lib:** close the Data #with seam on Handle construction ([c0b50ae](https://github.com/elct9620/kobako/commit/c0b50aec659e32a72c905aaf94c939ac009ad621))
+* **release:** resume the gem push loop past already-live versions ([170ee9b](https://github.com/elct9620/kobako/commit/170ee9bae6da3a65b4016040259e31e4721dfcfb))
+* **release:** treat a yanked-only version as unpublished when publishing ([3111cc0](https://github.com/elct9620/kobako/commit/3111cc072a7c9d18b129fd2762f267d855b48d55))
+* **transport:** fold fault messages to UTF-8 before they ride the wire ([0be8d40](https://github.com/elct9620/kobako/commit/0be8d4068dc5647f86746e80b356b0b9d52051f7))
+
 ## [0.13.0](https://github.com/elct9620/kobako/compare/v0.12.2...v0.13.0) (2026-07-03)
 
 

data/Cargo.lock

@@ -929,7 +929,7 @@ dependencies = [
 
 [[package]]
 name = "kobako"
-version = "0.13.0"
+version = "0.14.0"
 dependencies = [
  "kobako-runtime",
  "kobako-wasmtime",
@@ -938,11 +938,11 @@ dependencies = [
 
 [[package]]
 name = "kobako-runtime"
-version = "0.7.0"
+version = "0.8.0"
 
 [[package]]
 name = "kobako-wasmtime"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "kobako-runtime",
  "libc",

data/README.md

@@ -302,10 +302,10 @@ sandbox.run(:Greeter, name: "world") # => "hello, world"
 
 | Form     | Signature                            | Snippet name source                   | Validation timing                                                          |
 |----------|--------------------------------------|---------------------------------------|----------------------------------------------------------------------------|
-| Source   | `preload(code: "...", name: :Const)` | The `name:` keyword                   | Trial-compiled at preload; compile errors raise immediately                |
-| Bytecode | `preload(binary: bytes)`             | Read from the bytecode's `debug_info` | Deferred to first invocation; failure raises `Kobako::BytecodeError`       |
+| Source   | `preload(code: "...", name: :Const)` | The `name:` keyword                   | First invocation's replay; compile errors raise `Kobako::SandboxError`     |
+| Bytecode | `preload(binary: bytes)`             | Read from the bytecode's `debug_info` | First invocation's replay; structural failure raises `Kobako::BytecodeError` |
 
-Use the source form for snippets authored in your repo (compile errors fail fast at `#preload`); use the bytecode form when snippets ship as build artifacts from a separate `mrbc` pipeline. Both replay through the same per-invocation path.
+Use the source form for snippets authored in your repo; use the bytecode form when snippets ship as build artifacts from a separate `mrbc` pipeline. Both replay through the same per-invocation path, so no snippet content failure surfaces at `#preload` — force the first replay with a no-op invocation (e.g. `sandbox.eval("nil")`) when you want validation before real traffic.
 
 ## Security
 

data/ROADMAP.md

@@ -0,0 +1,26 @@
+# Roadmap
+
+kobako is a Ruby gem providing an in-process Wasm sandbox for untrusted mruby
+code: a wasmtime host runs a precompiled `kobako.wasm` guest, with host↔guest
+Transport over a MessagePack wire. Features cover one-shot `#eval`, preload +
+`#run` dispatch, Service injection through Namespaces / Members, opaque
+Capability Handles, block yield re-entry, three-class error attribution,
+output capture, and a warm Sandbox pool.
+
+| Feature | Entry Points | Notes |
+|---------|-------------|-------|
+| ✅ [F-01 Sandbox instantiation](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | B-22 (per-Thread isolation) is exercised only indirectly through the pool contention tests; no test cites it |
+| ✅ [F-02 Namespace declaration](docs/behavior/registration.md) | [lib/kobako/catalog/namespaces.rb](lib/kobako/catalog/namespaces.rb) | — |
+| ✅ [F-03 Member binding](docs/behavior/registration.md) | [lib/kobako/namespace.rb](lib/kobako/namespace.rb) | — |
+| ✅ [F-04 Synchronous mruby source execution (`#eval`)](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-05 Guest-initiated Transport dispatch](docs/behavior/dispatch.md) | [lib/kobako/transport/dispatcher.rb](lib/kobako/transport/dispatcher.rb) | — |
+| ✅ [F-06 Capability Handle encoding and referencing](docs/behavior/dispatch.md) | [lib/kobako/catalog/handles.rb](lib/kobako/catalog/handles.rb) | — |
+| ✅ [F-07 Three-class error attribution and raising](docs/behavior/errors.md) | [lib/kobako/outcome.rb](lib/kobako/outcome.rb) | E-26 (guest-entry envelope decode failure) has no exercising test — not reachable through the public API |
+| ✅ [F-08 Guest output capture](docs/behavior/lifecycle.md) | [lib/kobako/capture.rb](lib/kobako/capture.rb) | — |
+| ✅ [F-09 Host–guest message codec](docs/wire-codec.md) | [lib/kobako/codec/](lib/kobako/codec/) | — |
+| ✅ [F-10 Reproducible build pipeline](SPEC.md#code-organization) | [tasks/wasm/build.rake](tasks/wasm/build.rake) | Verified by build-time gates (`rake anchors`, double-bake byte-identity, gemspec whitelist), not `test/` |
+| ✅ [F-11 Multi-layer test and benchmark suite](SPEC.md#testing-style) | [test/](test/) | Benchmarks live in [benchmark/](benchmark/) with the gate in `tasks/bench/`; the anchor baseline advances only by deliberate re-bless |
+| ✅ [F-12 Guest block reception and yield re-entry](docs/behavior/yield.md) | [lib/kobako/transport/yielder.rb](lib/kobako/transport/yielder.rb) | — |
+| ✅ [F-13 Snippet preloading (`#preload`)](docs/behavior/invocation.md) | [lib/kobako/catalog/snippets.rb](lib/kobako/catalog/snippets.rb) | — |
+| ✅ [F-14 Synchronous entrypoint dispatch (`#run`)](docs/behavior/invocation.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-15 Warm Sandbox pool checkout (`Kobako::Pool`)](docs/behavior/runtime.md) | [lib/kobako/pool.rb](lib/kobako/pool.rb) | — |

data/crates/kobako-runtime/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.7.0...kobako-runtime-v0.8.0) (2026-07-08)
+
+
+### Bug Fixes
+
+* **crates:** give SetupError a Display so Error::Setup reads cleanly ([bc8b128](https://github.com/elct9620/kobako/commit/bc8b128c9e296319c7fef47441b412d2ce345dff))
+
 ## [0.7.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.6.1...kobako-runtime-v0.7.0) (2026-07-03)
 
 

data/crates/kobako-runtime/Cargo.toml

@@ -13,7 +13,7 @@
 
 [package]
 name = "kobako-runtime"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2021"
 description = "Engine-neutral host runtime contract for embedding kobako Wasm guests."
 license = "Apache-2.0"

data/crates/kobako-runtime/README.md

@@ -26,7 +26,7 @@ map the neutral types onto their own language surface.
 
 ```toml
 [dependencies]
-kobako-runtime = "0.7.0" # x-release-please-version
+kobako-runtime = "0.8.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-runtime/src/error.rs

@@ -62,3 +62,11 @@ impl fmt::Display for Trap {
         f.write_str(msg)
     }
 }
+
+impl fmt::Display for SetupError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let (SetupError::ModuleNotBuilt(msg) | SetupError::Dead(msg) | SetupError::Intact(msg)) =
+            self;
+        f.write_str(msg)
+    }
+}

data/crates/kobako-wasmtime/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.7.0...kobako-wasmtime-v0.8.0) (2026-07-08)
+
+
+### Bug Fixes
+
+* **crates:** keep the no-timeout epoch deadline within range ([a3255df](https://github.com/elct9620/kobako/commit/a3255df98a77825bb39b571a60fe6ff83d269d19))
+
 ## [0.7.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.6.1...kobako-wasmtime-v0.7.0) (2026-07-03)
 
 

data/crates/kobako-wasmtime/Cargo.toml

@@ -15,7 +15,7 @@
 
 [package]
 name = "kobako-wasmtime"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2021"
 description = "wasmtime implementation of the kobako host runtime contract."
 license = "Apache-2.0"
@@ -28,7 +28,7 @@ categories = ["wasm", "virtualization"]
 # The engine-neutral contract this crate implements. The version pin
 # rides the linked release group; the path keeps in-tree builds (and
 # the Ruby gem, which ships both crates) resolving locally.
-kobako-runtime = { version = "0.7.0", path = "../kobako-runtime" }
+kobako-runtime = { version = "0.8.0", path = "../kobako-runtime" }
 # wasmtime — host-side embedder for kobako.wasm. We disable default-features
 # and opt back in only what kobako needs: a Cranelift-backed runtime that can
 # compile a pre-built wasm32-wasip1 module on the host triple, plus the `wat`

data/crates/kobako-wasmtime/README.md

@@ -24,7 +24,7 @@ SDK consumes the same surface.
 
 ```toml
 [dependencies]
-kobako-wasmtime = "0.7.0" # x-release-please-version
+kobako-wasmtime = "0.8.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-wasmtime/src/driver.rs

@@ -183,7 +183,7 @@ impl Driver {
             }
             None => {
                 store.data_mut().set_deadline(None);
-                store.set_epoch_deadline(u64::MAX);
+                store.set_epoch_deadline(trap::NO_TIMEOUT_EPOCH_DELTA);
             }
         }
         let baseline = match exports.memory {

data/crates/kobako-wasmtime/src/frames.rs

@@ -225,7 +225,7 @@ mod tests {
             profile,
         };
         let mut store = WtStore::new(engine, Invocation::new(None));
-        store.set_epoch_deadline(u64::MAX);
+        store.set_epoch_deadline(crate::trap::NO_TIMEOUT_EPOCH_DELTA);
         install_wasi_frames(&mut store, &config, &[]).expect("WASI context must install");
 
         let mut linker: Linker<Invocation> = Linker::new(engine);

data/crates/kobako-wasmtime/src/instance_pre.rs

@@ -70,12 +70,13 @@ fn build_linker() -> Result<Linker<Invocation>, SetupError> {
     // `__kobako_dispatch` host import. Signature per docs/wire-codec.md
     // § ABI Signatures:
     //   (req_ptr: i32, req_len: i32) -> i64
-    // Decodes the Request bytes, dispatches via the Ruby-side
-    // dispatch Proc (bound per-Sandbox through `Runtime#on_dispatch=`),
-    // allocates a guest buffer through `__kobako_alloc`, writes
-    // the Response bytes there, and returns the packed
-    // `(ptr<<32)|len`. The dispatcher returns 0 on any wire-layer
-    // fault (including no Proc bound); see `dispatch::handle`.
+    // Reads the Request bytes from guest memory and hands them —
+    // undecoded — to the bound `DispatchHandler` (the frontend's
+    // dispatch bridge, e.g. a Ruby Proc), then allocates a guest
+    // buffer through `__kobako_alloc`, writes the handler's Response
+    // bytes there, and returns the packed `(ptr<<32)|len`. The
+    // dispatcher returns 0 on any wire-layer fault (including no
+    // handler bound); see `dispatch::handle`.
     linker
         .func_wrap(
             "env",

data/crates/kobako-wasmtime/src/invocation.rs

@@ -318,10 +318,9 @@ impl ResourceLimiter for MemoryLimiter {
 
 /// Marker error returned from `MemoryLimiter::memory_growing` when the
 /// per-invocation memory cap is exceeded. Downcast from the wasmtime
-/// trap error to surface as
-/// `Kobako::MemoryLimitError` on the Ruby side. Callers use the
-/// `Display` impl below — no field is read directly — so the inner
-/// state stays private.
+/// trap error to classify the failure as a memory-limit `Trap`. Callers
+/// use the `Display` impl below — no field is read directly — so the
+/// inner state stays private.
 #[derive(Debug)]
 pub(crate) struct MemoryLimitTrap {
     desired: usize,
@@ -354,7 +353,7 @@ impl std::error::Error for MemoryLimitTrap {}
 
 /// Marker error returned from the epoch-deadline callback when the
 /// wall-clock deadline is exceeded. Downcast from the wasmtime trap
-/// error to surface as `Kobako::TimeoutError` on the Ruby side.
+/// error to classify the failure as a timeout `Trap`.
 #[derive(Debug)]
 pub(crate) struct TimeoutTrap;
 

data/crates/kobako-wasmtime/src/trap.rs

@@ -1,12 +1,13 @@
 //! Trap classification for the run path.
 //!
-//! Maps a `wasmtime` run error to the right top-level `Kobako::*` Ruby
-//! exception (`TimeoutError` / `MemoryLimitError` / `TrapError`), and
-//! hosts the epoch-deadline callback that raises the wall-clock
-//! `TimeoutTrap`. The classification is a pure function over the error's
-//! downcast chain so it can be exercised from `cargo test` without the
-//! magnus surface; the trap marker types themselves live in
-//! `crate::invocation` (where the limiter / callback construct them).
+//! Classifies a `wasmtime` run error into the engine-neutral `Trap`
+//! kind (`Timeout` / `MemoryLimit` / `Other`) that each frontend maps
+//! onto its own error surface, and hosts the epoch-deadline callback
+//! that raises the wall-clock `TimeoutTrap`. The classification is a
+//! pure function over the error's downcast chain so it can be exercised
+//! from `cargo test` without any frontend; the trap marker types
+//! themselves live in `crate::invocation` (where the limiter / callback
+//! construct them).
 
 use std::time::Instant;
 
@@ -15,43 +16,48 @@ use wasmtime::{StoreContextMut, UpdateDeadline};
 use crate::invocation::{Invocation, MemoryLimitTrap, TimeoutTrap};
 use kobako_runtime::error::{SetupError, Trap};
 
+/// Epoch delta that keeps the deadline effectively unreachable when no
+/// wall-clock cap is configured. Half the epoch range rather than
+/// `u64::MAX`: wasmtime adds the delta to the engine's current epoch,
+/// which the process-wide ticker advances for the engine's whole
+/// lifetime, so the full range overflows the sum (a panic under debug
+/// overflow checks).
+pub(crate) const NO_TIMEOUT_EPOCH_DELTA: u64 = u64::MAX / 2;
+
 /// Epoch-deadline callback installed on every Store. Read the per-run
 /// wall-clock deadline from `Invocation` and trap with
 /// `TimeoutTrap` once the deadline has passed; otherwise extend the
 /// next check by one tick of the process-wide epoch ticker. When the
 /// deadline is `None` the callback should not fire under the normal
 /// `Driver` invoke flow because
-/// `set_epoch_deadline(u64::MAX)` is used; returning a long extension
-/// keeps the callback inert as a defence in depth.
+/// `NO_TIMEOUT_EPOCH_DELTA` is primed; returning the same long
+/// extension keeps the callback inert as a defence in depth.
 pub(crate) fn epoch_deadline_callback(
     ctx: StoreContextMut<'_, Invocation>,
 ) -> wasmtime::Result<UpdateDeadline> {
     match ctx.data().deadline() {
         Some(deadline) if Instant::now() >= deadline => Err(wasmtime::Error::new(TimeoutTrap)),
         Some(_) => Ok(UpdateDeadline::Continue(1)),
-        None => Ok(UpdateDeadline::Continue(u64::MAX / 2)),
+        None => Ok(UpdateDeadline::Continue(NO_TIMEOUT_EPOCH_DELTA)),
     }
 }
 
 /// Configured-cap path classification for a wasmtime error. The
-/// downcast logic stays in a pure helper so the
-/// `Kobako::TimeoutError` / `MemoryLimitError` /
-/// `Kobako::TrapError` mapping can be exercised from `cargo test`
-/// without the magnus surface.
+/// downcast logic stays in a pure helper so the `Trap` kind routing
+/// can be exercised from `cargo test` without any frontend.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum TrapClass {
     /// Wall-clock cap path.
     Timeout,
     /// Linear-memory cap path.
     MemoryLimit,
-    /// Any other wasmtime error — surfaces as the base
-    /// `Kobako::TrapError`.
+    /// Any other wasmtime error — surfaces as the base `Trap::Other`.
     Other,
 }
 
-/// Inspect a wasmtime error to decide which top-level `Kobako::*` trap
-/// class it should map to. Pure function — operates on the error's
-/// downcast chain only, no magnus / Ruby state required.
+/// Inspect a wasmtime error to decide which neutral trap kind it
+/// belongs to. Pure function — operates on the error's downcast chain
+/// only, no frontend state required.
 fn classify_trap(err: &wasmtime::Error) -> TrapClass {
     if err.downcast_ref::<TimeoutTrap>().is_some() {
         TrapClass::Timeout
@@ -123,8 +129,23 @@ pub(crate) fn instantiate_err(err: wasmtime::Error) -> SetupError {
 
 #[cfg(test)]
 mod tests {
-    use super::{classify_trap, other_trap_message, TrapClass};
-    use crate::invocation::{MemoryLimitTrap, TimeoutTrap};
+    use super::{classify_trap, other_trap_message, TrapClass, NO_TIMEOUT_EPOCH_DELTA};
+    use crate::invocation::{Invocation, MemoryLimitTrap, TimeoutTrap};
+
+    // The no-timeout priming delta is added to the engine's current
+    // epoch inside wasmtime, and the process-wide ticker advances that
+    // epoch from the first `shared_engine` call on — so the sum must
+    // stay in range for a long-lived engine, not just a fresh one.
+    // `increment_epoch` stands in for the ticker to make the ticked
+    // state deterministic; under debug overflow checks an overflowing
+    // delta panics right here.
+    #[test]
+    fn no_timeout_delta_survives_a_ticked_engine_epoch() {
+        let engine = crate::cache::shared_engine().expect("shared engine must be constructible");
+        engine.increment_epoch();
+        let mut store = wasmtime::Store::new(engine, Invocation::new(None));
+        store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
+    }
 
     #[test]
     fn classify_trap_routes_timeout_trap_to_timeout() {

data/ext/kobako/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "kobako"
-version = "0.13.0"
+version = "0.14.0"
 edition = "2021"
 authors = ["Aotokitsuruya <contact@aotoki.me>"]
 license = "Apache-2.0"

data/lib/kobako/catalog/handles.rb

@@ -95,7 +95,7 @@ module Kobako
         end
       end
 
-      # Guard {#alloc} against issuing an ID past the cap. Returns +nil+
+      # Guard #alloc against issuing an ID past the cap. Returns +nil+
       # on success; raises +Kobako::HandleExhaustedError+ at exhaustion.
       def ensure_capacity!
         cap = Kobako::Handle::MAX_ID
@@ -107,7 +107,7 @@ module Kobako
       end
 
       # Single source of truth for the "unknown Handle id" raise used by
-      # {#fetch}. Returns +nil+ on success; raises +Kobako::SandboxError+
+      # #fetch. Returns +nil+ on success; raises +Kobako::SandboxError+
       # when +id+ is not currently bound.
       def require_bound!(id)
         return if @entries.key?(id)

data/lib/kobako/catalog/namespaces.rb

@@ -71,7 +71,7 @@ module Kobako
       end
 
       # Encode the preamble as msgpack bytes for stdin Frame 1 delivery.
-      # Routes through {Kobako::Codec::Encoder} like every other host-side
+      # Routes through Kobako::Codec::Encoder like every other host-side
       # wire encode so there is a single codec path; the preamble carries
       # only Strings and Arrays, so none of the kobako ext types actually
       # fire. Structure: +[["Namespace", ["MemberA", "MemberB"]], ...]+.
@@ -106,7 +106,7 @@ module Kobako
         self
       end
 
-      # Returns +true+ when {#seal!} has been called, +false+ otherwise.
+      # Returns +true+ when #seal! has been called, +false+ otherwise.
       def sealed?
         @sealed
       end

data/lib/kobako/catalog/snippets.rb

@@ -43,7 +43,7 @@ module Kobako
       #
       # The bytes are memoized — the table is replayed verbatim on every
       # invocation after sealing, so Frame 3 never changes between
-      # encodes; {#register} drops the memo while the table is still open.
+      # encodes; #register drops the memo while the table is still open.
       # Unlike +Catalog::Namespaces#encode+, which gates its memo on the
       # seal, this one can fill eagerly and invalidate in +#register+
       # because every mutation funnels through that single method — there is

data/lib/kobako/codec/decoder.rb

@@ -12,23 +12,23 @@ module Kobako
     # ({docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type Mapping).
     #
     # Translates msgpack gem exceptions into the kobako error taxonomy
-    # ({Truncated}, {InvalidType}, {InvalidEncoding}, {UnsupportedType}) so
+    # (Truncated, InvalidType, InvalidEncoding, UnsupportedType) so
     # callers can pattern-match on the SPEC's wire-violation categories
     # without leaking the gem's internal exception classes.
     #
-    # Public API is a single function — {.decode}. The decoder is
+    # Public API is a single function — +.decode+. The decoder is
     # stateless; the +MessagePack::Unpacker+ instance is built per call
     # because callers always decode exactly one wire value at a time.
     module Decoder
       # Decode +bytes+ into one Ruby value and validate transitively
-      # against the SPEC type mapping. Raises {Truncated}, {InvalidType},
-      # or {InvalidEncoding} on wire violations.
+      # against the SPEC type mapping. Raises Truncated, InvalidType,
+      # or InvalidEncoding on wire violations.
       #
       # When a block is given, the decoded value is yielded and the block's
       # result is returned — wire Value Objects use this to build themselves
       # from the decoded payload. The block runs inside this method's
       # rescue, so a Value Object's +ArgumentError+ invariant failure
-      # surfaces as {InvalidType} without a separate {Utils.with_boundary}
+      # surfaces as InvalidType without a separate Utils.with_boundary
       # wrapper at the call site.
       def self.decode(bytes)
         value = Factory.load(bytes.b)
@@ -37,7 +37,7 @@ module Kobako
       # msgpack gem raises the format/type errors below; +ArgumentError+
       # comes from our ext-type validators (Handle id range, Exception type
       # whitelist) and from a yielded block's Value Object invariants — both
-      # are wire violations, so both map to {InvalidType}.
+      # are wire violations, so both map to InvalidType.
       rescue ::MessagePack::UnknownExtTypeError, ::MessagePack::MalformedFormatError,
              ::MessagePack::StackError, ::ArgumentError => e
         raise InvalidType, e.message
@@ -53,7 +53,7 @@ module Kobako
       # Encoding Rules). The msgpack gem returns UTF-8-tagged Strings for
       # str family but does not validate the bytes; +bin+ family decodes
       # to ASCII-8BIT. Walk the tree once and reject invalid UTF-8 in any
-      # str-typed leaf via {Utils.assert_utf8!}. {Kobako::Fault}
+      # str-typed leaf via Utils.assert_utf8!. Kobako::Fault
       # payloads are validated transitively: +Factory.unpack_fault+
       # feeds the inner ext-0x02 bytes back through this Decoder, so their
       # +str+ fields are already covered by the time control returns here.

data/lib/kobako/codec/encoder.rb

@@ -14,9 +14,9 @@ module Kobako
     # strings, arrays, and maps go through the gem's narrowest-encoding
     # logic; the three kobako-specific ext types (0x00 Symbol, 0x01
     # Capability Handle, 0x02 Exception envelope) are registered on
-    # the cached {Kobako::Codec::Factory} singleton.
+    # the cached Kobako::Codec::Factory singleton.
     #
-    # Public API is a single function — {.encode}. The codec is stateless;
+    # Public API is a single function — +.encode+. The codec is stateless;
     # there is no buffer accumulator and no streaming write API. Callers
     # that need to concatenate multiple encodings build the bytes
     # themselves.

data/lib/kobako/codec/error.rb

@@ -7,11 +7,11 @@ module Kobako
     # The wire codec implements the binary contract pinned in
     # {docs/wire-codec.md}[link:../../../docs/wire-codec.md] § Type Mapping.
     # Every wire violation surfaces as a
-    # subclass of {Error} so callers can pattern-match on the specific
+    # subclass of Error so callers can pattern-match on the specific
     # fault while still rescuing all codec faults via this base class.
     #
     # Higher layers (e.g. the Sandbox dispatch loop) translate these into
-    # the public {Kobako::SandboxError} / {Kobako::TrapError} taxonomy.
+    # the public Kobako::SandboxError / Kobako::TrapError taxonomy.
     class Error < StandardError; end
 
     # Input ended before the type prefix or payload was fully consumed.
@@ -21,7 +21,7 @@ module Kobako
     # type mapping (e.g. an unknown ext code, or a reserved msgpack tag).
     class InvalidType < Error; end
 
-    # A msgpack `str` payload was not valid UTF-8, or an ext 0x00 Symbol
+    # A msgpack +str+ payload was not valid UTF-8, or an ext 0x00 Symbol
     # payload was not valid UTF-8 — both are wire violations per SPEC.
     class InvalidEncoding < Error; end
 

data/lib/kobako/codec/factory.rb

@@ -16,7 +16,7 @@ module Kobako
     # § Ext Types).
     #
     # The factory is the single place in the host gem that touches the
-    # msgpack API — both {Encoder} and {Decoder} delegate through it, so
+    # msgpack API — both Encoder and Decoder delegate through it, so
     # the three kobako ext codes (0x00 Symbol, 0x01 Capability Handle,
     # 0x02 Exception envelope) are configured exactly once at first use.
     #
@@ -93,11 +93,11 @@ module Kobako
       end
 
       # Validate the ext-0x00 payload as UTF-8 and intern. Raises
-      # {InvalidEncoding} on invalid bytes — SPEC forbids the
+      # InvalidEncoding on invalid bytes — SPEC forbids the
       # binary-encoding fallback that msgpack-gem's default unpacker
       # would otherwise apply. The re-tag step lives here because the
       # msgpack ext-type unpacker hands us binary bytes; the assertion
-      # itself is shared with {Decoder} via {Utils.assert_utf8!}. The
+      # itself is shared with Decoder via Utils.assert_utf8!. The
       # +"Symbol"+ label keeps the error message in Ruby vocabulary
       # rather than wire-ext-code vocabulary.
       def unpack_symbol(payload)
@@ -125,7 +125,7 @@ module Kobako
       # Peel off the fixext-4 frame, hand the bytes to the
       # Host-Gem-internal +Kobako::Handle.restore+ factory, and
       # translate the +ArgumentError+ raised by Handle's invariants
-      # into a wire-layer +InvalidType+ via {Codec::Utils.with_boundary}.
+      # into a wire-layer +InvalidType+ via Codec::Utils.with_boundary.
       # The Value Object owns the id-range contract; this method only
       # owns the frame shape.
       def unpack_handle(payload)
@@ -136,11 +136,11 @@ module Kobako
         Codec::Utils.with_boundary { Kobako::Handle.restore(id) }
       end
 
-      # Encode the inner ext-0x02 map via {Encoder} (not +factory.dump+) so
+      # Encode the inner ext-0x02 map via Encoder (not +factory.dump+) so
       # the embedded payload flows through the same boundary as a top-level
       # encode — nested kobako values (Handle, nested Fault) reach the
       # registered ext-type packers via the cached singleton. A +details+
-      # chain nested past {MAX_EXT_DEPTH} has no wire representation and
+      # chain nested past MAX_EXT_DEPTH has no wire representation and
       # surfaces as +UnsupportedType+.
       def pack_fault(fault)
         within_ext_frame(UnsupportedType) do
@@ -149,12 +149,12 @@ module Kobako
       end
 
       # Peel the embedded msgpack map and hand it to +Kobako::Fault.new+
-      # inside {Decoder.decode}'s block form, so the value-object's
+      # inside Decoder.decode's block form, so the value-object's
       # +ArgumentError+ invariants surface as +InvalidType+ through the
-      # decoder boundary. Inner decode goes through {Decoder} (not
+      # decoder boundary. Inner decode goes through Decoder (not
       # +factory.load+) so the embedded +str+ payloads flow through the
       # same UTF-8 validation as a top-level decode. A nested ext 0x02 in
-      # +details+ re-enters this method, so {#within_ext_frame} bounds the
+      # +details+ re-enters this method, so #within_ext_frame bounds the
       # chain depth to keep it from exhausting the native stack.
       def unpack_fault(payload)
         within_ext_frame(InvalidType) do
@@ -167,7 +167,7 @@ module Kobako
       end
 
       # Track ext-envelope re-entry depth and refuse a chain past
-      # {MAX_EXT_DEPTH}, raising +over_limit+ so the failure lands in the
+      # MAX_EXT_DEPTH, raising +over_limit+ so the failure lands in the
       # caller's existing wire-error class. The counter is thread-scoped and
       # balanced by the +ensure+, so a raise mid-chain still unwinds it to
       # its entry value.