kobako 0.27.0 → 0.28.0

data/lib/kobako/transport/run.rb

@@ -1,44 +1,15 @@
 # frozen_string_literal: true
 
+require_relative "../constant_name"
 require_relative "../handle"
 require_relative "../codec"
 require_relative "../payload"
 
 module Kobako
-  # See lib/kobako/transport.rb for the umbrella module doc; this file
-  # owns +Run+, the host-side value object for one +#run+ request — the
-  # native side frames it into the envelope +__kobako_run+ consumes.
   module Transport
-    # Host-side value object for a single +Sandbox#run+ invocation
-    # ({docs/wire-codec.md Invocation channels}[link:../../../docs/wire-codec.md]).
-    #
-    # A Run captures the host-layer concept of "a single +#run+
-    # call": the entrypoint constant name plus its positional and keyword
-    # arguments. Host pre-flight (entrypoint type / name pattern, forged
-    # Handle, kwargs-key type) is enforced at construction so the Value
-    # Object is the single source of truth — anything that passes
-    # +Run.new+ is safe to ship to the guest.
-    #
-    # +#payload+ takes the invocation's +Catalog::Handles+ and routes any
-    # non-wire-representable +args+ / +kwargs+ leaf through it as a
-    # +Kobako::Handle+ — the symmetric counterpart of the guest→host wrap
-    # path in the dispatcher. A +Kobako::Handle+ that arrives **already
-    # constructed** in the caller's +args+ / +kwargs+ is rejected at
-    # construction: legitimate Handles only enter Host App code through
-    # error fields, so a Handle reaching the call site is by definition
-    # smuggled in. +Runtime#run+ frames that payload with the entrypoint
-    # into the Run envelope the +__kobako_run+ command buffer carries.
-    #
-    # Built on the +class X < Data.define(...)+ subclass form (the
-    # Steep-friendly shape — see +.rubocop.yml+ for the rationale).
-    class Run < Data.define(:entrypoint, :args, :kwargs)
-      # Ruby constant-name pattern enforced on the +entrypoint+ Symbol.
-      # Parallel to
-      # +Kobako::Catalog::Snippets::NAME_PATTERN+; the two constants name the
-      # same regex but cover distinct surfaces (snippet identity vs.
-      # entrypoint resolution) so a future divergence stays local.
-      NAME_PATTERN = /\A[A-Z]\w*\z/
-
+    # A Handle already in the arguments is refused, since a caller never
+    # legitimately holds one.
+    class Run < Data.define(:entrypoint, :args, :kwargs) # :nodoc:
       def initialize(entrypoint:, args: [], kwargs: {})
         entrypoint = normalize_entrypoint(entrypoint)
         validate_args!(args)
@@ -46,61 +17,42 @@ module Kobako
         super
       end
 
-      # Encode this Run's arguments as the codec payload the Run
-      # envelope carries — +Runtime#run+ frames it with the entrypoint.
-      # Walks +args+ / +kwargs+ through Codec::HandleWalk.deep_wrap so
-      # any non-wire-representable leaf is allocated into +handler+ and
-      # replaced with a +Kobako::Handle+; the +handler+ argument is the
-      # invocation's table, sharing the same allocator the guest→host
-      # return path uses. A wrapped leaf rides as ext 0x01 in its
-      # original position (docs/wire/payload-msgpack.md § ext 0x01).
-      # The walk starts one level down, since +args+ and +kwargs+ ride
-      # inside the payload document the wire's nesting bound is counted
-      # from.
-      def payload(handler)
+      # A leaf with no wire form becomes a Capability Handle in the
+      # invocation's table. The walk starts one level down, since +args+ and
+      # +kwargs+ ride inside the payload document the wire's nesting bound
+      # is counted from.
+      def payload(handles)
         Payload::Arguments.new(
-          args: Codec::HandleWalk.deep_wrap(args, handler, 1),
-          kwargs: Codec::HandleWalk.deep_wrap(kwargs, handler, 1)
+          args: Codec::HandleWalk.deep_wrap(args, handles, 1),
+          kwargs: Codec::HandleWalk.deep_wrap(kwargs, handles, 1)
         ).encode
       end
 
       private
 
-      # The target must be a Symbol or String (TypeError, not
-      # ArgumentError — the wrong-type case is a Host App programming
-      # error before the run reaches the guest). After +.to_s+
-      # the value must match NAME_PATTERN (ArgumentError), rejecting
-      # +::+-segmented names and any non-constant form.
+      # A target of the wrong type raises TypeError, a Host App programming
+      # error caught before the run reaches the guest.
       def normalize_entrypoint(target)
         unless target.is_a?(Symbol) || target.is_a?(String)
           raise TypeError, "entrypoint must be a Symbol or String, got #{target.class}"
         end
 
         target_str = target.to_s
-        unless NAME_PATTERN.match?(target_str)
+        unless CONSTANT_NAME.match?(target_str)
           raise ArgumentError,
-                "entrypoint must match #{NAME_PATTERN.inspect} (got #{target.inspect})"
+                "entrypoint must match #{CONSTANT_NAME.inspect} (got #{target.inspect})"
         end
 
         target_str.to_sym
       end
 
-      # +args+ must not contain a +Kobako::Handle+. The Handle
-      # allocator lives inside the Host Gem; legitimate paths surface
-      # Handle objects only through raised error fields, so a Handle
-      # reaching +args+ is a forged or smuggled token. Non-wire-
-      # representable arguments that are not Handles are handled by
-      # auto-wrap inside +#payload+ — the reject path is reserved
-      # for Handle objects specifically.
       def validate_args!(args)
         raise ArgumentError, "arguments must be an Array" unless args.is_a?(Array)
         raise ArgumentError, forged_handle_message("arguments") if args.any?(Kobako::Handle)
       end
 
-      # Reject a non-Symbol kwargs key, and a +Kobako::Handle+ arriving
-      # as a kwargs value (same forged-token principle as the +args+
-      # branch). Both checks live here so the Host App sees the
-      # host-side error message before any encode / decode boundary.
+      # Checked here so the Host App sees the host-side message before any
+      # encode boundary.
       def validate_kwargs!(kwargs)
         raise ArgumentError, "keyword arguments must be a Hash" unless kwargs.is_a?(Hash)
 
@@ -112,12 +64,6 @@ module Kobako
         raise ArgumentError, forged_handle_message("keyword argument values") if kwargs.each_value.any?(Kobako::Handle)
       end
 
-      # Single source of truth for the forged-Handle reject message so the
-      # args and kwargs branches stay phrased identically. Message stays in
-      # caller vocabulary: it names the affected slot and the reason
-      # without leaking internal SPEC identifiers or self-referential
-      # architecture terms — the error is raised BY kobako, so saying
-      # "allocated by the Host Gem" reads as third-person about self.
       def forged_handle_message(slot)
         "#{slot} must not contain a Kobako::Handle — " \
           "Handles are created internally by the Sandbox and cannot be passed in"

data/lib/kobako/transport/yielder.rb

@@ -4,51 +4,19 @@ require_relative "../codec"
 require_relative "../errors"
 
 module Kobako
-  # See lib/kobako/transport.rb for the umbrella module doc; this file
-  # owns the host-side object that materialises a guest-supplied block as
-  # a Ruby callable the Service method can yield into.
   module Transport
-    # Host-side stand-in for a guest-supplied block.
-    #
-    # Each guest call that carries +block_given: true+ gets a Yielder
-    # that the Dispatcher hands to the Service method as +&block+. The
-    # Service method observes it as an ordinary Ruby Proc through
-    # #to_proc; +yield val+ / +block.call(val)+ invokes #yield, which
-    # serialises the positional args, re-enters the guest via the injected
-    # +yield_to_guest+ lambda, and reifies the Yield Reply into Ruby
-    # control flow:
-    #
-    #   * ok    — return the decoded value to +yield+'s caller
-    #   * break — +throw break_tag, value+ so the Dispatcher's +catch+
-    #     frame unwinds the Service method
-    #   * error — raise a BlockError at the Service's yield site,
-    #     carrying the guest's class on +#klass+
-    #
-    # The Dispatcher calls #invalidate! from its +ensure+ block once
-    # dispatch completes; any later call to a stashed Yielder then raises
-    # +LocalJumpError+ — the observable shape of an escaped Yielder.
-    class Yielder
-      # +yield_to_guest+ is the ext's per-dispatch
-      # +Kobako::Runtime::GuestYielder+, which #yield invokes to re-enter
-      # the guest: it takes the argument payload and answers the reply
-      # already split into +[arm, body, class]+. +break_tag+ is the
-      # +catch+ throw tag the Dispatcher matches against to unwind the
-      # Service on a break. +handler+ is the invocation's +Kobako::Catalog::Handles+,
-      # used to restore a Capability Handle in the block's ok value back to
-      # its host object before it reaches the Service +yield+ site.
-      def initialize(yield_to_guest, break_tag, handler)
-        @yield_to_guest = yield_to_guest
+    class Yielder # :nodoc:
+      def initialize(guest_yielder, break_tag, handles)
+        @guest_yielder = guest_yielder
         @break_tag = break_tag
-        @handler = handler
+        @handles = handles
         @active = true
         @raised = nil
       end
 
-      # The text the guest's own block failure crosses back as, or +nil+
-      # when +error+ is not the BlockError this Yielder raised. Identity
-      # rather than class: a Service that rescued the block's failure and
-      # raised its own has reported something else, and the guest must
-      # hear about that instead.
+      # Identity rather than class: a Service that rescued the block's
+      # failure and raised its own has reported something else, and the
+      # guest must hear about that instead.
       #
       # The class travels with the message because not every block failure
       # is an exception the guest holds — a block value the guest refused
@@ -60,17 +28,15 @@ module Kobako
         "#{raised.klass}: #{raised.message}"
       end
 
-      # Re-enter the guest with +args+ and reify the Yield Reply into
-      # Ruby control flow. Raises +LocalJumpError+ if called after
-      # #invalidate!. The ok value is consumed by the host Service
-      # method, so a Capability Handle in it is restored to its host object.
-      # The break value unwinds past the Service back to the guest
-      # bound-constant call, so it passes through verbatim — a Handle stays a
-      # Handle and rides back on the same id rather than churning a new one.
+      # The ok value is consumed by the host Service, so a Capability Handle
+      # in it is restored. The break value unwinds back to the guest, so it
+      # passes through verbatim and rides back on the same id rather than
+      # churning a new one.
       def yield(*args)
         raise LocalJumpError, "guest block invoked after host dispatch frame returned" unless @active
 
-        arm, body, klass = @yield_to_guest.call(encode_args(args))
+        arm, body, klass = @guest_yielder.call(encode_args(args))
+        raise UnsupportedError, "the Sandbox runtime does not support yielding to a block" if arm == :unsupported
         raise remember(BlockError.new(body, klass: klass)) if arm == :error
 
         value, carried_handle = decode_body(body)
@@ -79,26 +45,18 @@ module Kobako
         restore(value, carried_handle)
       end
 
-      # The Proc the Dispatcher passes as +&block+, binding #yield so a
-      # Service method's +yield+ / +block.call+ drives the round-trip.
       def to_proc
         method(:yield).to_proc
       end
 
-      # Mark this Yielder dead. Called by the Dispatcher's +ensure+ block
-      # when the originating dispatch frame returns; any later #yield
-      # call then raises +LocalJumpError+.
       def invalidate!
         @active = false
       end
 
       private
 
-      # Encode what the Service is yielding. Arguments outside the wire
-      # type set, or nesting past the wire's bound as one list, fail here,
-      # before the guest is re-entered, and are restated so the Service
-      # reads a refusal of its own argument rather than a codec class it
-      # never named.
+      # Restated so the Service reads a refusal of its own argument rather
+      # than a codec class it never named.
       def encode_args(args)
         Kobako::Codec::Nesting.assert_within_bound!(args)
         Kobako::Codec::Encoder.encode(args)
@@ -106,33 +64,23 @@ module Kobako
         raise YieldValueError, "Service yielded a value the block cannot receive: #{e.message}"
       end
 
-      # Hold onto the BlockError being raised so #fault_text can recognise
-      # it if it comes back unrescued, and return it so the raise site reads
-      # as one statement. Only the newest is kept: a Service that rescued
-      # an earlier one and yielded again has already handled it.
+      # Only the newest is kept: a Service that rescued an earlier one and
+      # yielded again has already handled it.
       def remember(error)
         @raised = error
       end
 
-      # Decode a value-carrying arm's payload, answering the value and
-      # whether the decode carried a Capability Handle. The tracking
-      # bracket opens only around this decode: the guest re-entry may run
-      # nested dispatches whose own brackets would otherwise pollute the
-      # signal.
+      # The tracking bracket opens only around this decode: the guest
+      # re-entry may run nested dispatches whose own brackets would
+      # otherwise pollute the signal.
       def decode_body(body)
         Kobako::Codec.track_handles { Kobako::Codec::Decoder.decode(body) }
       end
 
-      # Restore any Capability Handle in a block's ok value to its host
-      # object via the injected +Catalog::Handles+. Only the
-      # ok path calls this — host code consumes the ok value, whereas a
-      # break value returns to the guest and stays a Handle. A response
-      # whose decode carried no Handle resolves to itself, so the walk is
-      # skipped entirely.
       def restore(value, carried_handle)
         return value unless carried_handle
 
-        Kobako::Codec::HandleWalk.deep_restore(value, @handler)
+        Kobako::Codec::HandleWalk.deep_restore(value, @handles)
       end
     end
   end

data/lib/kobako/transport.rb

@@ -9,20 +9,8 @@ require_relative "transport/reflection"
 require_relative "transport/dispatcher"
 
 module Kobako
-  # Kobako::Transport — host↔guest message transport namespace. Houses the
-  # host side of one Call/Reply exchange: the call value objects +Call+
-  # (guest→host, as the native side decoded it) and +Run+ (host→guest), the
-  # +Dispatcher+ that answers a routed Call, the +Yielder+ that re-enters
-  # the guest for a block, the +Reflection+ floor a dispatch must clear, the
-  # +Exposure+ each reference authorizes a call against, and +Error+ for a
-  # wire violation the host detects. Each invocation's
-  # +Context+ composes them into the dispatch +Proc+ it passes +Runtime+ for
-  # that run.
-  #
-  # "RPC" was deliberately not chosen — it implies a cross-process boundary that
-  # kobako does not have, since host and guest share one OS thread and
-  # one wasm linear memory. See
-  # {SPEC.md Refinement → Internal Concepts}[link:../../SPEC.md].
-  module Transport
+  # The host side of the guest↔host exchange. Only Transport::Error is
+  # public; the rest serves one invocation's dispatch.
+  module Transport # :nodoc:
   end
 end

data/lib/kobako/unresolved.rb

@@ -1,17 +1,10 @@
 # frozen_string_literal: true
 
 module Kobako
-  # Kobako::Unresolved — the sentinel backing a fillable Service path: one
-  # declared with +Sandbox#bind(path)+ carrying no object. It reserves the
-  # path's Frame 1 slot so the guest sees the bound constant while the host
-  # defers the object it stands for. A guest dispatch to an unfilled fillable
-  # is refused as an unresolved target and surfaces as +Kobako::ServiceError+
-  # when the guest leaves it unrescued — the same capability-failure channel
-  # as an idiom with no backend bound.
-  #
-  # A single shared value; only its identity distinguishes it, so the dispatch
-  # layer recognises it with +equal?+. A Host App may name it at a +bind+ site
-  # to declare a fillable explicitly.
+  # Stands for the object of a fillable Service, one declared with
+  # Sandbox#bind and no object. Context#bind supplies the object for an
+  # invocation; a call to one left unfilled fails as a ServiceError. Passing
+  # it to Sandbox#bind declares a fillable explicitly.
   module Unresolved
   end
 end

data/lib/kobako/usage.rb

@@ -12,14 +12,10 @@ module Kobako
   #     cap, even when the cap was hit.
   #
   # Filled on every outcome, traps included, so a Host App that rescues a
-  # trap can read from the error's +#execution+ how much of the budget the
+  # trap reads from the error's +execution+ how much of the budget the
   # invocation used.
-  #
-  # Built on the +class X < Data.define(...)+ subclass form (the
-  # Steep-friendly shape — see +.rubocop.yml+ for the rationale).
   class Usage < Data.define(:wall_time, :memory_peak)
-    # Pre-run sentinel. A fresh +Kobako::Context+ holds it until its guest
-    # runs, so an Execution's +#usage+ is never +nil+.
+    # The usage of a run that has not started: no time, no memory.
     EMPTY = new(wall_time: 0.0, memory_peak: 0)
   end
 end

data/lib/kobako/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kobako
-  VERSION = "0.27.0"
+  VERSION = "0.28.0"
 end

data/sig/kobako/catalog/extensions.rbs

@@ -5,7 +5,7 @@ module Kobako
 
       def install: (untyped extension, snippets: Kobako::Catalog::Snippets, services: Kobako::Catalog::Services) -> self
 
-      def seal!: () -> self
+      def assert_dependencies!: () -> self
 
       def resolve: () -> Hash[String, untyped]
 
@@ -17,7 +17,7 @@ module Kobako
 
       def validate!: (untyped extension) -> void
 
-      def assert_dependencies!: () -> void
+      def unmet_dependency: () -> [untyped, untyped]?
 
       def symbolize: (untyped name) -> untyped
     end

data/sig/kobako/catalog/flags.rbs

@@ -0,0 +1,17 @@
+module Kobako
+  module Catalog
+    class Flags
+      type tuple = [String, String, bool]
+
+      def initialize: () -> void
+
+      def entries: () -> Array[tuple]
+
+      def register: (Symbol | String name, String value, advisory: bool) -> nil
+
+      private
+
+      def utf8!: (String text, String what) -> String
+    end
+  end
+end

data/sig/kobako/catalog/services.rbs

@@ -1,8 +1,6 @@
 module Kobako
   module Catalog
     class Services
-      NAME_PATTERN: Regexp
-
       def initialize: () -> void
 
       def bind: (Symbol | String path, untyped object) -> self
@@ -13,10 +11,6 @@ module Kobako
 
       def paths: () -> Array[String]
 
-      def seal!: () -> self
-
-      def sealed?: () -> bool
-
       private
 
       def validate_path!: (Symbol | String path) -> String

data/sig/kobako/catalog/snippets.rbs

@@ -1,21 +1,21 @@
 module Kobako
   module Catalog
     class Snippets
-      NAME_PATTERN: Regexp
-
       type entry = Kobako::Snippet::Source | Kobako::Snippet::Binary
 
       type tuple = [Symbol, String?, String]
 
       def initialize: () -> void
 
-      def register: (?code: String?, ?name: (Symbol | String)?, ?binary: String?) -> (Symbol | nil)
+      def register: (?code: String?, ?name: (Symbol | String)?, ?binary: String?) -> nil
 
       def entries: () -> Array[tuple]
 
+      def compile: () { (Array[tuple] entries) -> Array[String]? } -> nil
+
       private
 
-      def register_source!: (String? code, (Symbol | String)? name) -> Symbol
+      def register_source!: (String? code, (Symbol | String)? name) -> nil
 
       def ensure_source_args!: (String? code, (Symbol | String)? name) -> [String, Symbol | String]
 

data/sig/kobako/codec/ext_types.rbs

@@ -5,21 +5,23 @@ module Kobako
       EXT_HANDLE: Integer
       UNREPRESENTABLE_GUARD_ID: Integer
 
-      def self?.build_factory: () -> MessagePack::Factory
+      def self.build_factory: () -> MessagePack::Factory
 
-      def self?.pack_symbol: (Symbol symbol) -> String
+      private
 
-      def self?.unpack_symbol: (String payload) -> Symbol
+      def self.pack_symbol: (Symbol symbol) -> String
 
-      def self?.pack_handle: (Kobako::Handle handle) -> String
+      def self.unpack_symbol: (String payload) -> Symbol
 
-      def self?.unpack_handle: (String payload, State state) -> Kobako::Handle
+      def self.pack_handle: (Kobako::Handle handle) -> String
 
-      def self?.register_symbol: (MessagePack::Factory factory) -> void
+      def self.unpack_handle: (String payload, State state) -> Kobako::Handle
 
-      def self?.register_handle: (MessagePack::Factory factory) -> void
+      def self.register_symbol: (MessagePack::Factory factory) -> void
 
-      def self?.register_unrepresentable: (MessagePack::Factory factory) -> void
+      def self.register_handle: (MessagePack::Factory factory) -> void
+
+      def self.register_unrepresentable: (MessagePack::Factory factory) -> void
     end
 
     FACTORY: MessagePack::Factory

data/sig/kobako/codec/handle_walk.rbs

@@ -3,19 +3,21 @@ module Kobako
     module HandleWalk
       MSGPACK_INT_RANGE: Range[Integer]
 
-      def self?.representable?: (untyped value, ?Integer depth) -> bool
+      def self.representable?: (untyped value, ?Integer depth) -> bool
 
-      def self?.deep_wrap: (untyped value, Kobako::Codec::_HandleTable handler, ?Integer depth) -> untyped
+      def self.deep_wrap: (untyped value, Kobako::Codec::_HandleTable handles, ?Integer depth) -> untyped
 
-      def self?.guard_nesting!: (Integer depth) -> void
+      def self.deep_restore: (untyped value, Kobako::Codec::_HandleTable handles) -> untyped
 
-      def self?.deep_wrap_hash: (Hash[untyped, untyped] hash, Kobako::Codec::_HandleTable handler, Integer depth) -> Hash[untyped, untyped]
+      private
 
-      def self?.deep_restore: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
+      def self.guard_nesting!: (Integer depth) -> void
 
-      def self?.primitive_type?: (untyped value) -> bool
+      def self.deep_wrap_hash: (Hash[untyped, untyped] hash, Kobako::Codec::_HandleTable handles, Integer depth) -> Hash[untyped, untyped]
 
-      def self?.container_representable?: (untyped value, Integer depth) -> bool
+      def self.primitive_type?: (untyped value) -> bool
+
+      def self.container_representable?: (untyped value, Integer depth) -> bool
     end
   end
 end

data/sig/kobako/codec/utils.rbs

@@ -1,9 +1,9 @@
 module Kobako
   module Codec
     module Utils
-      def self?.assert_utf8!: (String string, String label) -> void
+      def self.assert_utf8!: (String string, String label) -> void
 
-      def self?.with_boundary: [T] () { () -> T } -> T
+      def self.with_boundary: [T] () { () -> T } -> T
     end
   end
 end

data/sig/kobako/codec.rbs

@@ -17,8 +17,8 @@ module Kobako
     # The Handle allocator/resolver a wire walk works against: alloc
     # registers a non-wire-representable object and returns its Handle,
     # fetch resolves a wire Handle id back to the live object. The
-    # Sandbox's Kobako::Catalog::Handles is the production conformer;
-    # modelled structurally so the Codec and Transport tiers need no
+    # Kobako::Catalog::Handles each invocation mints is the production
+    # conformer; modelled structurally so the Codec and Transport tiers need no
     # upward dependency on Catalog.
     interface _HandleTable
       def alloc: (untyped object) -> Kobako::Handle

data/sig/kobako/constant_name.rbs

@@ -0,0 +1,3 @@
+module Kobako
+  CONSTANT_NAME: Regexp
+end

data/sig/kobako/context.rbs

@@ -4,6 +4,7 @@ module Kobako
       runtime: Kobako::Runtime,
       services: Kobako::Catalog::Services,
       snippets: Kobako::Catalog::Snippets,
+      flags: Kobako::Catalog::Flags,
       extensions: Kobako::Catalog::Extensions
     ) -> void
 
@@ -23,9 +24,7 @@ module Kobako
 
     def populate_observability!: (Kobako::Runtime::Snapshot snapshot) -> void
 
-    def trap_class_for: (Kobako::TrapError err) -> singleton(Kobako::TrapError)
-
-    def trap_error_for: (Kobako::Runtime::Snapshot snapshot, Symbol verb) -> Kobako::TrapError
+    def with_verb: (Kobako::TrapError err, Symbol verb) -> Kobako::TrapError
 
     def build_execution: (untyped value, failed: bool) -> Kobako::Execution
 

data/sig/kobako/errors.rbs

@@ -60,12 +60,18 @@ module Kobako
   class YieldValueError < Error
   end
 
+  class UnsupportedError < Error
+  end
+
   class HandleExhaustedError < SandboxError
   end
 
   class BytecodeError < SandboxError
   end
 
+  class UnsupportedFlagError < SandboxError
+  end
+
   class UndefinedEntrypointError < SandboxError
     attr_reader name: Symbol?
     attr_reader available: Array[Symbol]

data/sig/kobako/outcome.rbs

@@ -6,18 +6,16 @@ module Kobako
 
     type panic_fields = [String, String, String, Array[String], Array[String]]
 
-    def self?.reify: (Symbol kind, String payload, panic_fields? panic, ?entrypoint: Symbol?) -> Kobako::Codec::wire_value
+    def self.reify: (String payload, panic_fields? panic, ?entrypoint: Symbol?) -> Kobako::Codec::wire_value
 
-    # Everything below is private_class_method at runtime; RBS cannot mark a
-    # `self?` method private, so the declarations stay visible to the checker.
-    def self?.panic_error: (panic_fields panic, Symbol? entrypoint) -> (SandboxError | ServiceError)
+    private
 
-    def self?.error_class: (String origin, String klass) -> (singleton(SandboxError) | singleton(ServiceError))
+    def self.panic_error: (panic_fields panic, Symbol? entrypoint) -> (SandboxError | ServiceError)
 
-    def self?.trap_error: (Symbol kind) -> TrapError
+    def self.error_class: (String origin, String klass) -> (singleton(SandboxError) | singleton(ServiceError))
 
-    def self?.decode_value: (String payload) -> Kobako::Codec::wire_value
+    def self.decode_value: (String payload) -> Kobako::Codec::wire_value
 
-    def self?.wire_error: (String message, ?diagnostic: String?) -> Transport::Error
+    def self.wire_error: (String message, ?diagnostic: String?) -> Transport::Error
   end
 end