kobako 0.29.0 → 0.30.0

data/ext/kobako/src/runtime/filesystem.rs

@@ -1,11 +1,10 @@
-//! The Ruby face of the Filesystem: `Kobako::Filesystem::Memory`,
-//! `Temporary`, `Directory`, and `Overlay`, each standing for the
-//! `kobako_runtime` Filesystem of that kind.
+//! The Ruby face of the Filesystem: `Kobako::Filesystem::Tmpfs`,
+//! `Bind`, and `Overlay`, each standing for the `kobako_runtime`
+//! Filesystem of that kind.
 //!
 //! A kind kobako ships runs in Rust; Ruby only picks it and the access.
-//! Ruby is asked again while the guest runs through a mount's block, at
-//! most once per open or change, and through a Filesystem written in
-//! Ruby, once per call.
+//! Ruby is asked again while the guest runs, through a mount's block and
+//! through a Filesystem written in Ruby.
 
 mod grants;
 mod ruby;
@@ -14,38 +13,36 @@ use std::sync::Arc;
 
 use magnus::value::{Opaque, ReprValue};
 use magnus::{
-    function, gc, method, prelude::*, scan_args::get_kwargs, scan_args::scan_args,
-    DataTypeFunctions, Error as MagnusError, RHash, RModule, RString, Ruby, Symbol, TypedData,
-    Value,
+    function, gc, prelude::*, scan_args::get_kwargs, scan_args::scan_args, DataTypeFunctions,
+    Error as MagnusError, RArray, RHash, RModule, RString, Ruby, Symbol, TypedData, Value,
 };
 
 use ruby::RubyFilesystem;
 
-use kobako_runtime::filesystem::{
-    Access, Blocking, Directory, Filesystem, Memory, Overlay, Temporary,
-};
+use kobako_runtime::filesystem::{Bind, Filesystem, FilesystemError, Overlay, Tmpfs};
 
 pub(super) use grants::{to_grants, validate_mount};
 
+/// Each kind kobako ships is one Filesystem instance, made once with its
+/// Ruby object, so every Mount of that object shares it as a bind mount
+/// shares a super block.
 macro_rules! filesystem_class {
     ($name:ident, $class:literal) => {
         #[magnus::wrap(class = $class, free_immediately, size)]
-        pub(super) struct $name(Arc<dyn Filesystem>);
+        pub(super) struct $name(Arc<Filesystem>);
     };
 }
 
-filesystem_class!(MemoryFs, "Kobako::Filesystem::Memory");
-filesystem_class!(TemporaryFs, "Kobako::Filesystem::Temporary");
-filesystem_class!(DirectoryFs, "Kobako::Filesystem::Directory");
+filesystem_class!(TmpfsFs, "Kobako::Filesystem::Tmpfs");
+filesystem_class!(BindFs, "Kobako::Filesystem::Bind");
 
-/// The Overlay itself rather than a shared handle, so `layer` can answer a
-/// new one and leave this one as it was. It marks the Ruby object of
+/// The Overlay's one Filesystem instance. It marks the Ruby object of
 /// every Layer, since a Filesystem written in Ruby has nothing else
 /// keeping it alive.
 #[derive(magnus::TypedData)]
 #[magnus(class = "Kobako::Filesystem::Overlay", free_immediately, size, mark)]
 pub(super) struct OverlayFs {
-    overlay: Overlay,
+    filesystem: Arc<Filesystem>,
     layers: Vec<Opaque<Value>>,
 }
 
@@ -57,40 +54,36 @@ impl DataTypeFunctions for OverlayFs {
 
 pub(super) fn register(ruby: &Ruby, kobako: RModule) -> Result<(), MagnusError> {
     let module = kobako.define_module("Filesystem")?;
-    let memory = module.define_class("Memory", ruby.class_object())?;
-    memory.define_singleton_method("new", function!(memory_new, -1))?;
-    let temporary = module.define_class("Temporary", ruby.class_object())?;
-    temporary.define_singleton_method("new", function!(temporary_new, -1))?;
-    let directory = module.define_class("Directory", ruby.class_object())?;
-    directory.define_singleton_method("new", function!(directory_new, 1))?;
+    let tmpfs = module.define_class("Tmpfs", ruby.class_object())?;
+    tmpfs.define_singleton_method("new", function!(tmpfs_new, -1))?;
+    let bind = module.define_class("Bind", ruby.class_object())?;
+    bind.define_singleton_method("new", function!(bind_new, 1))?;
     let overlay = module.define_class("Overlay", ruby.class_object())?;
-    overlay.define_singleton_method("new", function!(overlay_new, 0))?;
-    overlay.define_method("layer", method!(overlay_layer, -1))?;
-    MemoryFs::class(ruby);
-    TemporaryFs::class(ruby);
-    DirectoryFs::class(ruby);
+    overlay.define_singleton_method("new", function!(overlay_new, -1))?;
+    TmpfsFs::class(ruby);
+    BindFs::class(ruby);
     OverlayFs::class(ruby);
     Ok(())
 }
 
-/// `Memory.new(files = {}, limit: 64 MiB, inodes:)`: each
+/// `Tmpfs.new(files = {}, size: 64 MiB, nr_inodes:)`: each
 /// `path => contents` pair becomes a file, its directories created along
 /// the way. Ruby hands a bare `"path" => contents` over as keywords, so
-/// every String keyword is a file too. Without `inodes:` the entries
-/// follow the limit.
-fn memory_new(args: &[Value]) -> Result<MemoryFs, MagnusError> {
+/// every String keyword is a file too. Without `nr_inodes:` the entries
+/// follow the size.
+fn tmpfs_new(args: &[Value]) -> Result<TmpfsFs, MagnusError> {
     let ruby = Ruby::get().expect("Ruby thread");
     let args = scan_args::<(), (Option<RHash>,), (), (), RHash, ()>(args)?;
     let mut files = Vec::new();
-    let mut limit = Some(Memory::DEFAULT_LIMIT);
-    let mut inodes = None;
-    let limit_key = ruby.to_symbol("limit");
-    let inodes_key = ruby.to_symbol("inodes");
+    let mut size = Some(Tmpfs::DEFAULT_SIZE);
+    let mut nr_inodes = None;
+    let size_key = ruby.to_symbol("size");
+    let nr_inodes_key = ruby.to_symbol("nr_inodes");
     for hash in args.optional.0.into_iter().chain([args.keywords]) {
         hash.foreach(|key: Value, value: Value| {
             match Symbol::from_value(key) {
-                Some(key) if key.equal(limit_key)? => limit = to_limit(value)?,
-                Some(key) if key.equal(inodes_key)? => inodes = Some(to_limit(value)?),
+                Some(key) if key.equal(size_key)? => size = to_count(value)?,
+                Some(key) if key.equal(nr_inodes_key)? => nr_inodes = Some(to_count(value)?),
                 Some(key) => {
                     return Err(MagnusError::new(
                         ruby.exception_arg_error(),
@@ -105,125 +98,104 @@ fn memory_new(args: &[Value]) -> Result<MemoryFs, MagnusError> {
             Ok(magnus::r_hash::ForEach::Continue)
         })?;
     }
-    // A list no Memory holds is an `ArgumentError` the Host App can rescue.
-    let memory = Memory::try_from_iter(files)
+    // A list no Tmpfs holds is an `ArgumentError` the Host App can rescue.
+    let tmpfs = Tmpfs::try_from_iter(files)
         .map_err(|error| MagnusError::new(ruby.exception_arg_error(), error.to_string()))?
-        .with_limit(limit);
-    Ok(MemoryFs(Arc::new(match inodes {
-        Some(inodes) => memory.with_inodes(inodes),
-        None => memory,
-    })))
-}
-
-/// `Temporary.new(limit: 64 MiB, inodes:)`.
-fn temporary_new(args: &[Value]) -> Result<TemporaryFs, MagnusError> {
-    let args = scan_args::<(), (), (), (), RHash, ()>(args)?;
-    let kwargs = get_kwargs::<_, (), (Option<Value>, Option<Value>), ()>(
-        args.keywords,
-        &[],
-        &["limit", "inodes"],
-    )?;
-    let (limit, inodes) = kwargs.optional;
-    let limit = match limit {
-        Some(limit) => to_limit(limit)?,
-        None => Some(Memory::DEFAULT_LIMIT),
-    };
-    let temporary = Temporary::new().with_limit(limit);
-    Ok(TemporaryFs(Arc::new(match inodes {
-        Some(inodes) => temporary.with_inodes(to_limit(inodes)?),
-        None => temporary,
-    })))
+        .with_size(size);
+    let filesystem = Filesystem::new(Arc::new(match nr_inodes {
+        Some(nr_inodes) => tmpfs.with_nr_inodes(nr_inodes),
+        None => tmpfs,
+    }));
+    filesystem.map(TmpfsFs).map_err(cannot_stand)
 }
 
-/// A `limit:` or `inodes:` count, or `nil` for none.
-fn to_limit(limit: Value) -> Result<Option<usize>, MagnusError> {
-    Option::<usize>::try_convert(limit)
-}
-
-fn directory_new(path: String) -> Result<DirectoryFs, MagnusError> {
+/// A Filesystem whose instance cannot stand, an `ArgumentError` the Host App
+/// can rescue.
+fn cannot_stand(error: FilesystemError) -> MagnusError {
     let ruby = Ruby::get().expect("Ruby thread");
-    Directory::new(&path)
-        .map(|directory| DirectoryFs(Arc::new(directory)))
-        .map_err(|err| {
-            MagnusError::new(
-                ruby.exception_arg_error(),
-                format!("cannot open host directory {path}: {err}"),
-            )
-        })
+    MagnusError::new(
+        ruby.exception_arg_error(),
+        format!("cannot make a Filesystem: {error:?}"),
+    )
 }
 
-/// `Overlay.new`, with no Layer yet.
-fn overlay_new() -> OverlayFs {
-    OverlayFs {
-        overlay: Overlay::new().with_blocking(Arc::new(GvlFreeWait)),
-        layers: Vec::new(),
-    }
+/// A `size:` or `nr_inodes:` count, or `nil` for none.
+fn to_count(count: Value) -> Result<Option<usize>, MagnusError> {
+    Option::<usize>::try_convert(count)
 }
 
-/// An Overlay's thread waits for its lock without the GVL, so a holder
-/// asking a Layer written in Ruby can take the GVL and finish.
-struct GvlFreeWait;
-
-impl Blocking for GvlFreeWait {
-    fn wait(&self, wait: &mut dyn FnMut()) {
-        super::gvl::region(super::gvl::holds(), wait);
-    }
+fn bind_new(path: String) -> Result<BindFs, MagnusError> {
+    let ruby = Ruby::get().expect("Ruby thread");
+    let directory = Bind::new(&path).map_err(|err| {
+        MagnusError::new(
+            ruby.exception_arg_error(),
+            format!("cannot open host directory {path}: {err}"),
+        )
+    })?;
+    Filesystem::new(Arc::new(directory))
+        .map(BindFs)
+        .map_err(cannot_stand)
 }
 
-/// `layer(filesystem, access: :read)`, a new Overlay with `filesystem`
-/// beneath this one's Layers.
-fn overlay_layer(overlay: &OverlayFs, args: &[Value]) -> Result<OverlayFs, MagnusError> {
-    let args = scan_args::<(Value,), (), (), (), RHash, ()>(args)?;
-    let kwargs = get_kwargs::<_, (), (Option<Value>,), ()>(args.keywords, &[], &["access"])?;
-    let (filesystem,) = args.required;
-    let access = match kwargs.optional.0 {
-        Some(access) => to_access(access)?,
-        None => Access::Read,
+/// `Overlay.new(lower:, upper: nil)`: the Filesystems in `lower`, topmost
+/// first, under `upper`, a Tmpfs. Without `upper` it takes two lower
+/// Layers at least.
+fn overlay_new(args: &[Value]) -> Result<OverlayFs, MagnusError> {
+    let ruby = Ruby::get().expect("Ruby thread");
+    let args = scan_args::<(), (), (), (), RHash, ()>(args)?;
+    let kwargs =
+        get_kwargs::<_, (RArray,), (Option<Value>,), ()>(args.keywords, &["lower"], &["upper"])?;
+    let lower = (0..kwargs.required.0.len())
+        .map(|index| kwargs.required.0.entry::<Value>(index as isize))
+        .collect::<Result<Vec<_>, _>>()?;
+    let upper = kwargs.optional.0.filter(|upper| !upper.is_nil());
+    let upper_fs = match upper {
+        Some(upper) => match <&TmpfsFs>::try_convert(upper) {
+            Ok(tmpfs) => Some(tmpfs.0.clone()),
+            Err(_) => {
+                return Err(MagnusError::new(
+                    ruby.exception_type_error(),
+                    format!(
+                        "upper must be a Kobako::Filesystem::Tmpfs, got {}",
+                        upper.class()
+                    ),
+                ))
+            }
+        },
+        None => None,
     };
-    let mut layers = overlay.layers.clone();
-    layers.push(Opaque::from(filesystem));
+    let lower_fs = lower
+        .iter()
+        .map(|layer| to_filesystem(*layer))
+        .collect::<Result<Vec<_>, _>>()?;
+    let overlay = Overlay::new(lower_fs, upper_fs).map_err(|_| {
+        MagnusError::new(
+            ruby.exception_arg_error(),
+            "an Overlay needs a lower Layer under its upper, or two lower Layers without one, \
+             each Filesystem at most once",
+        )
+    })?;
     Ok(OverlayFs {
-        overlay: overlay
-            .overlay
-            .clone()
-            .layer(to_filesystem(filesystem)?, access),
-        layers,
+        filesystem: Filesystem::new(Arc::new(overlay)).map_err(cannot_stand)?,
+        layers: lower.into_iter().chain(upper).map(Opaque::from).collect(),
     })
 }
 
-fn to_access(access: Value) -> Result<Access, MagnusError> {
-    let name = Symbol::from_value(access)
-        .map(|symbol| symbol.name())
-        .transpose()?;
-    match name.as_deref() {
-        Some("read") => Ok(Access::Read),
-        Some("read_write") => Ok(Access::ReadWrite),
-        _ => Err(MagnusError::new(
-            Ruby::get().expect("Ruby thread").exception_arg_error(),
-            format!(
-                "access must be :read or :read_write, got {}",
-                access.inspect()
-            ),
-        )),
-    }
-}
-
-/// The Filesystem a Ruby handle of any kobako kind stands for.
-fn to_filesystem(value: Value) -> Result<Arc<dyn Filesystem>, MagnusError> {
-    if let Ok(fs) = <&MemoryFs>::try_convert(value) {
-        return Ok(fs.0.clone());
-    }
-    if let Ok(fs) = <&TemporaryFs>::try_convert(value) {
+/// The Filesystem instance a Ruby handle of any kobako kind stands for. A
+/// Filesystem written in Ruby has no instance of its own to share, so each
+/// call makes one.
+fn to_filesystem(value: Value) -> Result<Arc<Filesystem>, MagnusError> {
+    if let Ok(fs) = <&TmpfsFs>::try_convert(value) {
         return Ok(fs.0.clone());
     }
-    if let Ok(fs) = <&DirectoryFs>::try_convert(value) {
+    if let Ok(fs) = <&BindFs>::try_convert(value) {
         return Ok(fs.0.clone());
     }
     if let Ok(fs) = <&OverlayFs>::try_convert(value) {
-        return Ok(Arc::new(fs.overlay.clone()));
+        return Ok(fs.filesystem.clone());
     }
     if let Some(fs) = RubyFilesystem::from_value(value) {
-        return Ok(Arc::new(fs));
+        return Filesystem::new(Arc::new(fs)).map_err(cannot_stand);
     }
     let ruby = Ruby::get().expect("Ruby thread");
     Err(MagnusError::new(

data/ext/kobako/src/runtime/gvl.rs

@@ -6,16 +6,24 @@
 //! callback, which is ordinary Ruby and must hold the lock. A thread-local flag
 //! stops a nested dispatch from re-acquiring a second time, and both directions
 //! run their closure through a `catch_unwind` trampoline because a panic must
-//! never cross the C frame of `rb_thread_call_without_gvl` /
+//! never cross the C frame of `rb_thread_call_without_gvl2` /
 //! `rb_thread_call_with_gvl` (undefined behaviour). The flag is per-thread,
 //! matching the one-thread-one-Sandbox contract, and is restored through a drop
 //! guard so an unwinding panic cannot leave it corrupt for the next invocation.
+//!
+//! A release never raises where it returns, as `rb_thread_call_without_gvl`
+//! would, since that jumps over every Rust frame of the run and what they hold:
+//! a lock's guard, this flag. An interrupt waits for the run to end instead.
 
 use std::cell::Cell;
 use std::os::raw::c_void;
 use std::panic::{catch_unwind, resume_unwind, AssertUnwindSafe};
 use std::ptr;
 
+use kobako_runtime::sched::{Blocking, Task};
+
+use super::escape;
+
 thread_local! {
     // True while this thread sits inside a region whose GVL we released and
     // have not yet re-acquired. Drives `reenter`'s one-shot re-acquire.
@@ -30,17 +38,39 @@ where
         return f();
     }
     let _guard = ReleasedGuard::set(true);
+    // An interrupt the thread receives meanwhile stops each wait for a lock the
+    // run meets; the interrupt itself still waits for the run to end.
+    let task = Task::current();
+    let task_ptr = ptr::addr_of!(task).cast_mut().cast::<c_void>();
     call_via(f, |func, data| unsafe {
-        rb_sys::rb_thread_call_without_gvl(Some(func), data, None, ptr::null_mut())
+        rb_sys::rb_thread_call_without_gvl2(Some(func), data, Some(interrupt_task), task_ptr)
     })
 }
 
+/// Have the thread's run stop waiting for locks, called by Ruby without the GVL
+/// as the region's unblocking function.
+unsafe extern "C" fn interrupt_task(task: *mut c_void) {
+    let task = unsafe { &*task.cast::<Task>() };
+    task.interrupt();
+}
+
 /// Whether this thread holds the GVL: outside any released region, or
 /// inside a dispatch that re-acquired it.
-pub(crate) fn holds() -> bool {
+fn holds() -> bool {
     !GVL_RELEASED.with(|g| g.get())
 }
 
+/// A thread waits for a lock without the GVL, so a holder asking a
+/// Filesystem written in Ruby, or a mount's block, can take the GVL and
+/// finish.
+pub(crate) struct GvlFreeWait;
+
+impl Blocking for GvlFreeWait {
+    fn wait(&self, wait: &mut dyn FnMut()) {
+        region(holds(), wait);
+    }
+}
+
 /// Runs inline when the GVL is already held — hold mode, or a nested
 /// dispatch whose outer frame re-acquired it.
 pub(crate) fn reenter<F, R>(f: F) -> R
@@ -95,7 +125,7 @@ where
 
 fn call_via<F, R>(
     f: F,
-    invoke: impl FnOnce(unsafe extern "C" fn(*mut c_void) -> *mut c_void, *mut c_void) -> *mut c_void,
+    mut invoke: impl FnMut(unsafe extern "C" fn(*mut c_void) -> *mut c_void, *mut c_void) -> *mut c_void,
 ) -> R
 where
     F: FnOnce() -> R,
@@ -104,9 +134,14 @@ where
         f: Some(f),
         result: None,
     };
-    invoke(trampoline::<F, R>, ptr::addr_of_mut!(ctx).cast::<c_void>());
-    match ctx.result.take().expect("gvl trampoline stores a result") {
-        Ok(value) => value,
-        Err(payload) => resume_unwind(payload),
+    loop {
+        invoke(trampoline::<F, R>, ptr::addr_of_mut!(ctx).cast::<c_void>());
+        match ctx.result.take() {
+            Some(Ok(value)) => return value,
+            Some(Err(payload)) => resume_unwind(payload),
+            // `rb_thread_call_without_gvl2` runs nothing while an interrupt
+            // is pending, so that one is taken off the thread first.
+            None => escape::hold_interrupts(),
+        }
     }
 }

data/ext/kobako/src/runtime/snapshot.rs

@@ -46,7 +46,7 @@ impl Snapshot {
         Self(snapshot, verb)
     }
 
-    /// Already split off the core envelope, so the Ruby side maps a failure
+    /// Already split off the Envelope, so the Ruby side maps a failure
     /// onto its error taxonomy without decoding a payload byte: the ok
     /// arm's payload, or a Panic's fields beside an empty payload. A trap
     /// has no Outcome; `#trap_error` is the discriminator there.

data/ext/kobako/src/runtime.rs

@@ -111,13 +111,17 @@ pub fn init(ruby: &Ruby, kobako: RModule) -> Result<(), MagnusError> {
     // directly into those classes through the constructors and mappers
     // in `runtime/errors.rs` — no intermediate hierarchy is registered.
 
+    // This extension is the only frontend in its process, so the first
+    // registration is the one that stands.
+    let _ = kobako_runtime::sched::register_blocking(Box::new(gvl::GvlFreeWait));
+
     let runtime = kobako.define_class("Runtime", ruby.class_object())?;
     runtime.define_singleton_method("from_path", function!(Runtime::from_path, 2))?;
     runtime.define_method("eval", method!(Runtime::eval, 3))?;
     runtime.define_method("run", method!(Runtime::run, 4))?;
     runtime.define_method("profile", method!(Runtime::profile, 0))?;
     runtime.define_method("compile", method!(Runtime::compile, 1))?;
-    runtime.define_singleton_method("validate_mount!", function!(filesystem::validate_mount, 3))?;
+    runtime.define_singleton_method("validate_mount", function!(filesystem::validate_mount, 3))?;
     // The guest re-enters for a block yield through a frame-scoped
     // `Kobako::GuestYielder` the dispatcher hands the Proc, not a method on
     // Runtime.
@@ -331,6 +335,7 @@ impl Runtime {
         let ruby = Ruby::get().expect("Ruby thread");
         let preamble = to_preamble(&ruby, preamble)?;
         let bytecodes = gvl::region(self.release_gvl, || self.driver.compile(&preamble));
+        escape::resume()?;
         Ok(bytecodes.map(|bytecodes| {
             ruby.ary_from_iter(
                 bytecodes

data/lib/kobako/catalog/extensions.rb

@@ -16,10 +16,10 @@ module Kobako
       # The Extension readers are duck-typed, so a malformed +name+ or
       # +backend.path+ surfaces through the registry it routes to.
       def install(extension, snippets:, services:)
-        validate!(extension)
+        validate(extension)
         snippets.register(code: extension.source, name: extension.name)
         backend = extension.backend
-        services.bind(backend.path, install_object(backend)) if backend
+        services.bind(backend.path, object_of(backend)) if backend
         @entries << extension
         self
       end
@@ -27,7 +27,7 @@ module Kobako
       # The asserted flag flips only on success, so a check that failed
       # re-runs on the next invocation rather than silently passing a broken
       # Sandbox.
-      def assert_dependencies!
+      def assert_dependencies
         return self if @asserted
 
         extension, dependency = unmet_dependency
@@ -52,7 +52,7 @@ module Kobako
 
       private
 
-      def install_object(backend) = backend.object.nil? ? Kobako::Unresolved : backend.object
+      def object_of(backend) = backend.object.nil? ? Kobako::Unresolved : backend.object
 
       def resolve_backend(extension, resolved, by_provider)
         backend = extension.backend
@@ -64,7 +64,7 @@ module Kobako
         resolved[backend.path.to_s] = by_provider.fetch(provider) { by_provider[provider] = provider.call }
       end
 
-      def validate!(extension)
+      def validate(extension)
         source = extension.source
         raise ArgumentError, "Extension #source must be a String, got #{source.class}" unless source.is_a?(String)
 

data/lib/kobako/catalog/flags.rb

@@ -18,10 +18,10 @@ module Kobako
         end
         raise ArgumentError, "flag value must be a String, got #{value.class}" unless value.is_a?(String)
 
-        key = Catalog.to_utf8!(name.to_s, "flag name")
+        key = Catalog.to_utf8(name.to_s, "flag name")
         raise ArgumentError, "flag #{key.inspect} already set" if @entries.key?(key)
 
-        @entries[key] = [Catalog.to_utf8!(value, "flag value"), !advisory]
+        @entries[key] = [Catalog.to_utf8(value, "flag value"), !advisory]
         nil
       end
     end

data/lib/kobako/catalog/handles.rb

@@ -23,8 +23,8 @@ module Kobako
       # call made through this Handle is authorized against the reference
       # the guest was given.
       def alloc(object)
-        reject_unwrappable!(object)
-        ensure_capacity!
+        reject_unwrappable(object)
+        ensure_capacity
         id = @next_id
         @entries[id] = Kobako::Transport::Exposure.of(object, @surfaces)
         @next_id = id + 1
@@ -36,7 +36,7 @@ module Kobako
       end
 
       def exposure(id)
-        require_bound!(id)
+        require_bound(id)
         @entries[id]
       end
 
@@ -61,7 +61,7 @@ module Kobako
       # a surface the floor reads as ordinary Service behaviour. Raising here
       # keeps the rule at the single mint point, so it holds on both the
       # Service-return and the +#run+ host→guest auto-wrap paths.
-      def reject_unwrappable!(object)
+      def reject_unwrappable(object)
         case object
         when Binding, Method, UnboundMethod, Module, Delegator
           # Delegator < BasicObject exposes no static +#class+, so name the
@@ -71,7 +71,7 @@ module Kobako
         end
       end
 
-      def ensure_capacity!
+      def ensure_capacity
         cap = Kobako::Handle::MAX_ID
         return unless @next_id > cap
 
@@ -80,7 +80,7 @@ module Kobako
               "in a single invocation (limit #{cap})"
       end
 
-      def require_bound!(id)
+      def require_bound(id)
         return if @entries.key?(id)
 
         raise SandboxError, "unknown Handle id: #{id.inspect}"

data/lib/kobako/catalog/mount.rb

@@ -7,21 +7,13 @@ module Kobako
       def key = at
 
       # Why +other+ cannot be mounted beside this Mount, or +nil+: a path
-      # means one Mount, and never sits inside another.
+      # means one Mount, as Docker refuses a duplicate mount point.
       def conflict(other)
-        return "path #{at.inspect} is already mounted" if other.at == at
-
-        "path #{at.inspect} nests with the mounted path #{other.at.inspect}" if nested?(other.at)
+        "path #{at.inspect} is already mounted" if other.at == at
       end
 
       # The Mount as the native side reads it.
       def to_native = [at, access, filesystem, policy]
-
-      private
-
-      def nested?(other)
-        [at, other].include?("/") || at.start_with?("#{other}/") || other.start_with?("#{at}/")
-      end
     end
   end
 end

data/lib/kobako/catalog/services.rb

@@ -16,7 +16,7 @@ module Kobako
 
       # The binding records +object+'s Exposure as it stands now.
       def bind(path, object)
-        path_str = validate_path!(path)
+        path_str = validate_path(path)
         if reserved?(path_str)
           raise ArgumentError,
                 "Service path #{path_str} is in the reserved #{RESERVED_NAMESPACE} namespace"
@@ -46,7 +46,7 @@ module Kobako
 
       private
 
-      def validate_path!(path)
+      def validate_path(path)
         path_str = path.to_s
         segments = path_str.split("::", -1)
         return path_str if !segments.empty? && segments.all? { |seg| CONSTANT_NAME.match?(seg) }

data/lib/kobako/catalog/snippets.rb

@@ -40,17 +40,17 @@ module Kobako
         if binary
           raise ArgumentError, "cannot combine binary: with code: / name:" if code || name
 
-          register_binary!(binary)
+          register_binary(binary)
         else
-          register_source!(code, name)
+          register_source(code, name)
         end
       end
 
       private
 
-      def register_source!(code, name)
-        code, name = ensure_source_args!(code, name)
-        body = Catalog.to_utf8!(code, "code")
+      def register_source(code, name)
+        code, name = ensure_source_args(code, name)
+        body = Catalog.to_utf8(code, "code")
 
         name_sym = normalize_name(name)
         if @entries.any? { |e| e.is_a?(Snippet::Source) && e.name == name_sym }
@@ -63,7 +63,7 @@ module Kobako
 
       # The +code:+ type check runs first so an explicit +code: nil+ reads
       # as a type error rather than a missing keyword.
-      def ensure_source_args!(code, name)
+      def ensure_source_args(code, name)
         raise ArgumentError, "missing keyword: code: + name:, or binary:" if code.nil? && name.nil?
         raise ArgumentError, "code must be a String, got #{code.class}" unless code.is_a?(String)
         raise ArgumentError, "missing keyword: name:" if name.nil?
@@ -73,7 +73,7 @@ module Kobako
 
       # Kept as bytes whatever encoding the caller tagged them with, since
       # the guest reads them as bytecode rather than text.
-      def register_binary!(bytes)
+      def register_binary(bytes)
         raise ArgumentError, "binary must be a String, got #{bytes.class}" unless bytes.is_a?(String)
 
         @entries << Snippet::Bytecode.new(body: bytes.dup.force_encoding(Encoding::ASCII_8BIT))

data/lib/kobako/catalog.rb

@@ -13,7 +13,7 @@ module Kobako
     # The native side carries a registered text only as UTF-8, so text read
     # as bytes is re-tagged, and bytes that are not UTF-8 are refused at
     # registration rather than failing every invocation.
-    def self.to_utf8!(text, what)
+    def self.to_utf8(text, what)
       utf8 = text.dup.force_encoding(Encoding::UTF_8)
       raise ArgumentError, "#{what} must be UTF-8 text" unless utf8.valid_encoding?