kobako 0.13.0 → 0.15.0

data/lib/kobako/transport/run.rb

@@ -51,7 +51,7 @@ module Kobako
       # Encode this Run to the msgpack bytes the guest's +__kobako_run+
       # entry point consumes as its command-buffer payload
       # ({docs/wire-codec.md Invocation channels}[link:../../../docs/wire-codec.md]).
-      # Walks +args+ / +kwargs+ through {Codec::HandleWalk.deep_wrap} so
+      # Walks +args+ / +kwargs+ through Codec::HandleWalk.deep_wrap so
       # any non-wire-representable leaf is allocated into +handler+ and
       # replaced with a +Kobako::Handle+; the
       # +handler+ argument is the Sandbox's table, sharing the same

data/lib/kobako/transport/yield.rb

@@ -10,9 +10,9 @@ module Kobako
     # First byte of the YieldResponse for the success branch — body is
     # the block's return value encoded as a single msgpack value.
     TAG_OK = 0x01
-    # First byte for `break val` — body is the break value.
+    # First byte for +break val+ — body is the break value.
     TAG_BREAK = 0x02
-    # Reserved for future `return val` support; both sides reject this
+    # Reserved for future +return val+ support; both sides reject this
     # tag as a wire violation (YieldResponse envelope contract).
     TAG_RESERVED = 0x03
     # First byte for an error / fault outcome — body is a
@@ -58,7 +58,7 @@ module Kobako
         [tag].pack("C") + Codec::Encoder.encode(value)
       end
 
-      # Decode +bytes+ into a {Yield}. Rejects empty input, the reserved
+      # Decode +bytes+ into a Yield. Rejects empty input, the reserved
       # tag 0x03, and any tag outside +LIVE_TAGS+ by raising
       # +Kobako::Codec::InvalidType+ — these are wire violations per the
       # SPEC's YieldResponse envelope contract.
@@ -70,7 +70,10 @@ module Kobako
         body = bytes.byteslice(1, bytes.bytesize - 1) # : String
 
         reject_dead_tag!(tag)
-        new(tag: tag, value: Codec::Decoder.decode(body))
+        # A YieldResponse is a payload position: an ext 0x02 Fault in its
+        # value is a wire violation (the Response fault field is the
+        # envelope's only home).
+        new(tag: tag, value: Codec.forbid_faults { Codec::Decoder.decode(body) })
       end
 
       def self.reject_dead_tag!(tag)

data/lib/kobako/transport/yielder.rb

@@ -13,7 +13,7 @@ module Kobako
     # Each guest call that carries +block_given: true+ gets a Yielder
     # that the Dispatcher hands to the Service method as +&block+. The
     # Service method observes it as an ordinary Ruby Proc through
-    # {#to_proc}; +yield val+ / +block.call(val)+ invokes {#yield}, which
+    # #to_proc; +yield val+ / +block.call(val)+ invokes #yield, which
     # serialises the positional args, re-enters the guest via the injected
     # +yield_to_guest+ lambda, and reifies the +YieldResponse+ into Ruby
     # control flow:
@@ -24,13 +24,13 @@ module Kobako
     #   * +tag 0x04+ error — raise the +{class, message}+ payload at the
     #     Service's yield site
     #
-    # The Dispatcher calls {#invalidate!} from its +ensure+ block once
+    # The Dispatcher calls #invalidate! from its +ensure+ block once
     # dispatch completes; any later call to a stashed Yielder then raises
     # +LocalJumpError+ — the observable shape of an escaped Yielder.
     class Yielder
       # +yield_to_guest+ is a +String → String+ callable (the ext's
       # per-dispatch +Kobako::Runtime::GuestYielder+) that
-      # {#yield} invokes to re-enter the guest; +break_tag+ is the +catch+
+      # #yield invokes to re-enter the guest; +break_tag+ is the +catch+
       # throw tag the Dispatcher matches against to unwind the Service on
       # +tag 0x02+. +handler+ is the Sandbox's +Kobako::Catalog::Handles+,
       # used to restore a Capability Handle in the block's ok value back to
@@ -44,7 +44,7 @@ module Kobako
 
       # Re-enter the guest with +args+ and reify the YieldResponse into
       # Ruby control flow. Raises +LocalJumpError+ if called after
-      # {#invalidate!}. The ok value is consumed by the host Service
+      # #invalidate!. The ok value is consumed by the host Service
       # method, so a Capability Handle in it is restored to its host object.
       # The break value unwinds past the Service back to the guest
       # Member call, so it passes through verbatim — a Handle stays a
@@ -52,22 +52,28 @@ module Kobako
       def yield(*args)
         raise LocalJumpError, "guest block invoked after host dispatch frame returned" unless @active
 
-        response = Kobako::Transport::Yield.decode(@yield_to_guest.call(Kobako::Codec::Encoder.encode(args)))
-        return restore(response.value) if response.ok?
+        # Yield arguments are a payload position: a +Kobako::Fault+ among
+        # them has no wire representation, so the encode refuses it at
+        # this call site. The tracking bracket below opens only around the
+        # decode: the guest re-entry may run nested dispatches whose own
+        # brackets would otherwise pollute the signal.
+        bytes = @yield_to_guest.call(Kobako::Codec.forbid_faults { Kobako::Codec::Encoder.encode(args) })
+        response, carried_handle = Kobako::Codec.track_handles { Kobako::Transport::Yield.decode(bytes) }
+        return restore(response.value, carried_handle) if response.ok?
 
         throw @break_tag, response.value if response.break?
 
         raise yield_failure(response.value, default: "yield error")
       end
 
-      # The Proc the Dispatcher passes as +&block+, binding {#yield} so a
+      # The Proc the Dispatcher passes as +&block+, binding #yield so a
       # Service method's +yield+ / +block.call+ drives the round-trip.
       def to_proc
         method(:yield).to_proc
       end
 
       # Mark this Yielder dead. Called by the Dispatcher's +ensure+ block
-      # when the originating dispatch frame returns; any later {#yield}
+      # when the originating dispatch frame returns; any later #yield
       # call then raises +LocalJumpError+.
       def invalidate!
         @active = false
@@ -78,10 +84,12 @@ module Kobako
       # Restore any Capability Handle in a block's ok value to its host
       # object via the injected +Catalog::Handles+. Only the
       # ok path calls this — host code consumes the ok value, whereas a
-      # break value returns to the guest and stays a Handle. Walks nested
-      # Array / Hash one level at a time; a plain value passes through
-      # unchanged.
-      def restore(value)
+      # break value returns to the guest and stays a Handle. A response
+      # whose decode carried no Handle resolves to itself, so the walk is
+      # skipped entirely.
+      def restore(value, carried_handle)
+        return value unless carried_handle
+
         Kobako::Codec::HandleWalk.deep_restore(value, @handler)
       end
 

data/lib/kobako/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kobako
-  VERSION = "0.13.0"
+  VERSION = "0.15.0"
 end

data/release-please-config.json

@@ -29,28 +29,28 @@
         }
       ]
     },
-    "wasm/kobako": {
-      "component": "kobako-rs",
+    "wasm/kobako-mruby": {
+      "component": "kobako-mruby",
       "release-type": "rust",
       "extra-files": [
         {
           "type": "toml",
           "path": "/wasm/Cargo.lock",
-          "jsonpath": "$.package[?(@.name=='kobako')].version"
+          "jsonpath": "$.package[?(@.name=='kobako-mruby')].version"
         },
         {
           "type": "toml",
-          "path": "/wasm/kobako/Cargo.toml",
+          "path": "/wasm/kobako-mruby/Cargo.toml",
           "jsonpath": "$.dependencies['kobako-core'].version"
         },
         {
           "type": "toml",
-          "path": "/wasm/kobako/Cargo.toml",
+          "path": "/wasm/kobako-mruby/Cargo.toml",
           "jsonpath": "$.dependencies['kobako-codec'].version"
         },
         {
           "type": "generic",
-          "path": "/wasm/kobako/README.md"
+          "path": "/wasm/kobako-mruby/README.md"
         }
       ]
     },
@@ -178,13 +178,43 @@
           "path": "/crates/kobako-wasmtime/README.md"
         }
       ]
+    },
+    "crates/kobako": {
+      "component": "kobako-sdk",
+      "release-type": "rust",
+      "extra-files": [
+        {
+          "type": "toml",
+          "path": "/crates/Cargo.lock",
+          "jsonpath": "$.package[?(@.name=='kobako')].version"
+        },
+        {
+          "type": "toml",
+          "path": "/crates/kobako/Cargo.toml",
+          "jsonpath": "$.dependencies['kobako-codec'].version"
+        },
+        {
+          "type": "toml",
+          "path": "/crates/kobako/Cargo.toml",
+          "jsonpath": "$.dependencies['kobako-runtime'].version"
+        },
+        {
+          "type": "toml",
+          "path": "/crates/kobako/Cargo.toml",
+          "jsonpath": "$.dependencies['kobako-wasmtime'].version"
+        },
+        {
+          "type": "generic",
+          "path": "/crates/kobako/README.md"
+        }
+      ]
     }
   },
   "plugins": [
     {
       "type": "linked-versions",
       "groupName": "kobako crates",
-      "components": ["kobako-codec", "kobako-core", "kobako-rs", "kobako-io", "kobako-json", "kobako-regexp", "kobako-baker", "kobako-runtime", "kobako-wasmtime"]
+      "components": ["kobako-codec", "kobako-core", "kobako-mruby", "kobako-io", "kobako-json", "kobako-regexp", "kobako-baker", "kobako-runtime", "kobako-wasmtime", "kobako-sdk"]
     }
   ],
   "extra-files": [

data/sig/kobako/catalog/services.rbs

@@ -0,0 +1,25 @@
+module Kobako
+  module Catalog
+    class Services
+      NAME_PATTERN: Regexp
+
+      def initialize: (?handler: Kobako::Catalog::Handles) -> void
+
+      def bind: (Symbol | String path, untyped object) -> self
+
+      def lookup: (Symbol | String target) -> untyped
+
+      def encode: () -> String
+
+      def seal!: () -> self
+
+      def sealed?: () -> bool
+
+      private
+
+      def validate_path!: (Symbol | String path) -> String
+
+      def collision?: (String path) -> bool
+    end
+  end
+end

data/sig/kobako/codec/ext_types.rbs

@@ -0,0 +1,31 @@
+module Kobako
+  module Codec
+    module ExtTypes
+      EXT_SYMBOL: Integer
+      EXT_HANDLE: Integer
+      EXT_ERRENV: Integer
+
+      def self?.build_factory: () -> MessagePack::Factory
+
+      def self?.pack_symbol: (Symbol symbol) -> String
+
+      def self?.unpack_symbol: (String payload) -> Symbol
+
+      def self?.pack_handle: (Kobako::Handle handle) -> String
+
+      def self?.unpack_handle: (String payload, State state) -> Kobako::Handle
+
+      def self?.pack_fault: (Kobako::Fault fault, State state) -> String
+
+      def self?.unpack_fault: (String payload, State state) -> Kobako::Fault
+
+      def self?.register_symbol: (MessagePack::Factory factory) -> void
+
+      def self?.register_handle: (MessagePack::Factory factory) -> void
+
+      def self?.register_fault: (MessagePack::Factory factory) -> void
+    end
+
+    FACTORY: MessagePack::Factory
+  end
+end

data/sig/kobako/codec/handle_walk.rbs

@@ -5,9 +5,9 @@ module Kobako
 
       def self?.representable?: (untyped value) -> bool
 
-      def self?.deep_wrap: (untyped value, Kobako::Catalog::Handles handler) -> untyped
+      def self?.deep_wrap: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.deep_restore: (untyped value, Kobako::Catalog::Handles handler) -> untyped
+      def self?.deep_restore: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
       def self?.primitive_type?: (untyped value) -> bool
 

data/sig/kobako/codec/state.rbs

@@ -0,0 +1,20 @@
+module Kobako
+  module Codec
+    class State
+      MAX_EXT_DEPTH: Integer
+      STATE_KEY: Symbol
+
+      def self.current: () -> State
+
+      def track_handles: [T] { () -> T } -> [T, bool]
+      def record_handle!: () -> void
+      def forbid_faults: [T] { () -> T } -> T
+      def faults_forbidden?: () -> bool
+      def within_ext_frame: [T] (singleton(Kobako::Codec::Error) over_limit) { () -> T } -> T
+
+      private
+
+      def initialize: () -> void
+    end
+  end
+end

data/sig/kobako/codec.rbs

@@ -1,4 +1,18 @@
 module Kobako
   module Codec
+    def self.track_handles: [T] { () -> T } -> [T, bool]
+    def self.forbid_faults: [T] { () -> T } -> T
+
+    # The Handle allocator/resolver a wire walk works against: alloc
+    # registers a non-wire-representable object and returns its Handle,
+    # fetch resolves a wire Handle id back to the live object. The
+    # Sandbox's Kobako::Catalog::Handles is the production conformer;
+    # modelled structurally so the Codec and Transport tiers need no
+    # upward dependency on Catalog.
+    interface _HandleTable
+      def alloc: (untyped object) -> Kobako::Handle
+
+      def fetch: (Integer id) -> untyped
+    end
   end
 end

data/sig/kobako/handle.rbs

@@ -9,8 +9,6 @@ module Kobako
 
     def self.restore: (Integer id) -> Handle
 
-    def with: (?id: Integer) -> Handle
-
     def ==: (untyped other) -> bool
 
     def hash: () -> Integer

data/sig/kobako/sandbox.rbs

@@ -29,7 +29,7 @@ module Kobako
 
     attr_reader usage: Kobako::Usage
 
-    def define: (Symbol | String name) -> Kobako::Namespace
+    def bind: (Symbol | String path, untyped object) -> Kobako::Sandbox
 
     def preload: (code: String, name: Symbol | String) -> Kobako::Sandbox
                | (binary: String) -> Kobako::Sandbox

data/sig/kobako/transport/dispatcher.rbs

@@ -12,9 +12,9 @@ module Kobako
 
       CALLABLE_ALLOW: Array[Symbol]
 
-      def self?.dispatch: (String request_bytes, Kobako::Catalog::Namespaces namespaces, Kobako::Catalog::Handles handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
+      def self?.dispatch: (String request_bytes, Kobako::Transport::_ServiceRegistry services, Kobako::Codec::_HandleTable handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
 
-      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Catalog::Handles handler) -> [Array[untyped], Hash[Symbol, untyped]]
+      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Codec::_HandleTable handler, bool carried_handle) -> [Array[untyped], Hash[Symbol, untyped]]
 
       def self?.encode_caught_error: (StandardError error) -> String
 
@@ -24,17 +24,17 @@ module Kobako
 
       def self?.reject_unexposed!: (untyped target, Symbol name) -> void
 
-      def self?.resolve_arg: (untyped value, Kobako::Catalog::Handles handler) -> untyped
+      def self?.resolve_arg: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Catalog::Namespaces namespaces, Kobako::Catalog::Handles handler) -> untyped
+      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Transport::_ServiceRegistry services, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_path: (String path, Kobako::Catalog::Namespaces namespaces) -> untyped
+      def self?.resolve_path: (String path, Kobako::Transport::_ServiceRegistry services) -> untyped
 
-      def self?.require_live_object!: (Integer id, Kobako::Catalog::Handles handler) -> untyped
+      def self?.require_live_object!: (Integer id, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.encode_ok: (untyped value, Kobako::Catalog::Handles handler) -> String
+      def self?.encode_ok: (untyped value, Kobako::Codec::_HandleTable handler) -> String
 
-      def self?.wrap_as_handle: (untyped value, Kobako::Catalog::Handles handler) -> Kobako::Handle
+      def self?.wrap_as_handle: (untyped value, Kobako::Codec::_HandleTable handler) -> Kobako::Handle
 
       def self?.encode_error: (String type, String message) -> String
     end

data/sig/kobako/transport/run.rbs

@@ -11,7 +11,7 @@ module Kobako
 
       def initialize: (entrypoint: Symbol | String, ?args: Array[untyped], ?kwargs: Hash[untyped, untyped]) -> void
 
-      def encode: (Kobako::Catalog::Handles handler) -> String
+      def encode: (Kobako::Codec::_HandleTable handler) -> String
 
       private
 

data/sig/kobako/transport/yielder.rbs

@@ -3,10 +3,10 @@ module Kobako
     class Yielder
       @yield_to_guest: Kobako::Transport::_GuestYielder
       @break_tag: Symbol
-      @handler: Kobako::Catalog::Handles
+      @handler: Kobako::Codec::_HandleTable
       @active: bool
 
-      def initialize: (Kobako::Transport::_GuestYielder yield_to_guest, Symbol break_tag, Kobako::Catalog::Handles handler) -> void
+      def initialize: (Kobako::Transport::_GuestYielder yield_to_guest, Symbol break_tag, Kobako::Codec::_HandleTable handler) -> void
 
       def yield: (*untyped args) -> untyped
 
@@ -16,7 +16,7 @@ module Kobako
 
       private
 
-      def restore: (untyped value) -> untyped
+      def restore: (untyped value, bool carried_handle) -> untyped
 
       def yield_failure: (untyped payload, default: String) -> RuntimeError
     end

data/sig/kobako/transport.rbs

@@ -8,5 +8,13 @@ module Kobako
     interface _GuestYielder
       def call: (String) -> String
     end
+
+    # The Service registry a dispatch resolves constant-path targets
+    # against. The Sandbox's Kobako::Catalog::Services is the
+    # production conformer; modelled structurally so the Transport
+    # layer needs no upward dependency on Catalog.
+    interface _ServiceRegistry
+      def lookup: (String target) -> untyped
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kobako
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.15.0
 platform: ruby
 authors:
 - Aotokitsuruya
@@ -53,6 +53,7 @@ files:
 - Cargo.toml
 - LICENSE
 - README.md
+- ROADMAP.md
 - SECURITY.md
 - crates/kobako-runtime/CHANGELOG.md
 - crates/kobako-runtime/Cargo.toml
@@ -91,19 +92,19 @@ files:
 - lib/kobako/capture.rb
 - lib/kobako/catalog.rb
 - lib/kobako/catalog/handles.rb
-- lib/kobako/catalog/namespaces.rb
+- lib/kobako/catalog/services.rb
 - lib/kobako/catalog/snippets.rb
 - lib/kobako/codec.rb
 - lib/kobako/codec/decoder.rb
 - lib/kobako/codec/encoder.rb
 - lib/kobako/codec/error.rb
-- lib/kobako/codec/factory.rb
+- lib/kobako/codec/ext_types.rb
 - lib/kobako/codec/handle_walk.rb
+- lib/kobako/codec/state.rb
 - lib/kobako/codec/utils.rb
 - lib/kobako/errors.rb
 - lib/kobako/fault.rb
 - lib/kobako/handle.rb
-- lib/kobako/namespace.rb
 - lib/kobako/outcome.rb
 - lib/kobako/outcome/panic.rb
 - lib/kobako/pool.rb
@@ -129,19 +130,19 @@ files:
 - sig/kobako/capture.rbs
 - sig/kobako/catalog.rbs
 - sig/kobako/catalog/handles.rbs
-- sig/kobako/catalog/namespaces.rbs
+- sig/kobako/catalog/services.rbs
 - sig/kobako/catalog/snippets.rbs
 - sig/kobako/codec.rbs
 - sig/kobako/codec/decoder.rbs
 - sig/kobako/codec/encoder.rbs
 - sig/kobako/codec/error.rbs
-- sig/kobako/codec/factory.rbs
+- sig/kobako/codec/ext_types.rbs
 - sig/kobako/codec/handle_walk.rbs
+- sig/kobako/codec/state.rbs
 - sig/kobako/codec/utils.rbs
 - sig/kobako/errors.rbs
 - sig/kobako/fault.rbs
 - sig/kobako/handle.rbs
-- sig/kobako/namespace.rbs
 - sig/kobako/outcome.rbs
 - sig/kobako/outcome/panic.rbs
 - sig/kobako/pool.rbs

data/lib/kobako/catalog/namespaces.rb

@@ -1,115 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "handles"
-require_relative "../codec"
-require_relative "../errors"
-require_relative "../namespace"
-
-module Kobako
-  module Catalog
-    # Kobako::Catalog::Namespaces — per-Sandbox registry of
-    # +Kobako::Namespace+ entities. Holds the Namespace / Member bindings
-    # and the preamble emitted on Frame 1.
-    #
-    # Public API:
-    #
-    #   namespaces = Kobako::Catalog::Namespaces.new
-    #   namespace = namespaces.define(:MyService)  # => Kobako::Namespace
-    #   namespace.bind(:KV, kv_object)             # => namespace (chainable)
-    #   namespaces.encode                          # => msgpack bytes for Frame 1
-    #   namespaces.lookup("MyService::KV")         # => kv_object
-    #
-    # Namespaces live at +Kobako::Namespace+. Per-dispatch routing is
-    # +Kobako::Transport::Dispatcher+'s responsibility — the Dispatcher
-    # receives this registry and the +Catalog::Handles+ as arguments from
-    # the +Runtime#on_dispatch+ Proc that +Kobako::Sandbox#initialize+
-    # installs. The registry holds an injected +Catalog::Handles+ reference so
-    # dispatch target resolution and host→guest auto-wrap share the same
-    # Sandbox-owned allocator.
-    class Namespaces
-      # Build a fresh registry. +handler+ is an internal seam that injects
-      # a pre-configured +Catalog::Handles+; tests pass one whose +next_id+
-      # is pinned near +MAX_ID+ to exercise the cap-exhaustion path
-      # without 2³¹ allocations. Production callers leave it at the default.
-      def initialize(handler: Catalog::Handles.new)
-        @namespaces = {} # : Hash[String, Kobako::Namespace]
-        @handler = handler
-        @sealed = false
-        @encoded = nil # : String?
-      end
-
-      # Declare or retrieve the Namespace named +name+ (idempotent).
-      # +name+ is a constant-form name as a +Symbol+ or +String+ (must satisfy
-      # +Namespace::NAME_PATTERN+). Returns the +Kobako::Namespace+ for that
-      # name, creating it if it does not exist. Raises +ArgumentError+ when
-      # +name+ is malformed, or when called after the owning Sandbox has been
-      # sealed by its first invocation.
-      def define(name)
-        raise ArgumentError, "cannot define after first Sandbox invocation" if @sealed
-
-        name_str = name.to_s
-        unless Namespace::NAME_PATTERN.match?(name_str)
-          raise ArgumentError,
-                "Namespace name must match #{Namespace::NAME_PATTERN.inspect} (got #{name.inspect})"
-        end
-
-        @namespaces[name_str] ||= Namespace.new(name_str)
-      end
-
-      # Resolve a +target+ path of the form +"<Namespace>::<Member>"+
-      # (e.g. +"MyService::KV"+) to the bound Host object. +target+ is a
-      # two-level path using the +::+ separator. Returns the bound Host
-      # object. Raises +KeyError+ when the namespace or the member is not
-      # bound.
-      def lookup(target)
-        namespace_name, member_name = target.to_s.split("::", 2)
-        namespace = @namespaces[namespace_name]
-        raise KeyError, "no namespace named #{namespace_name.inspect}" if namespace.nil?
-        raise KeyError, "no member in target #{target.inspect}" unless member_name
-
-        namespace.fetch(member_name)
-      end
-
-      # Encode the preamble as msgpack bytes for stdin Frame 1 delivery.
-      # Routes through {Kobako::Codec::Encoder} like every other host-side
-      # wire encode so there is a single codec path; the preamble carries
-      # only Strings and Arrays, so none of the kobako ext types actually
-      # fire. Structure: +[["Namespace", ["MemberA", "MemberB"]], ...]+.
-      # Returns a binary +String+ of msgpack bytes.
-      #
-      # Once sealed, the bytes are computed once and reused for every
-      # subsequent invocation: sealing freezes Service registration at the
-      # first invocation, so the preamble is exactly the bindings that
-      # existed at that moment — a bind reaching a +Kobako::Namespace+
-      # after the seal raises +ArgumentError+ and never alters Frame 1.
-      # The memo is gated on the seal rather than dropped per mutation (the
-      # +Catalog::Snippets#encode+ approach) because a +Member+ bind lands
-      # on a child +Kobako::Namespace+, invisible to this collection; only
-      # the seal guarantees nothing further can change.
-      def encode
-        return @encoded if @encoded
-
-        bytes = Codec::Encoder.encode(@namespaces.values.map(&:to_preamble)).freeze
-        @encoded = bytes if @sealed
-        bytes
-      end
-
-      # Mark the registry as sealed and propagate the seal to every
-      # declared +Kobako::Namespace+. Called by +Sandbox+ on the first
-      # invocation. After sealing, both #define and +Namespace#bind+
-      # raise ArgumentError. Idempotent.
-      def seal!
-        return self if @sealed
-
-        @sealed = true
-        @namespaces.each_value(&:seal!)
-        self
-      end
-
-      # Returns +true+ when {#seal!} has been called, +false+ otherwise.
-      def sealed?
-        @sealed
-      end
-    end
-  end
-end