kobako 0.21.1-aarch64-linux → 0.22.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43f465417ab6549eb551ce4d45acc511245e5c69c8ed0da630352a7db1a97457
-  data.tar.gz: e27fbee4cee43ddac783ba6240832c3f0131fc2a62c5ef4f5ef7399c0dfdaa1a
+  metadata.gz: 31ada84079df29e6403f69a5d3a5dcf6dd8780430a4063cbc3576399272904f8
+  data.tar.gz: 3f66558a59dde0642cc6fa8b4871c009e2aaf6efb9efb973e74a45e5158fa9c2
 SHA512:
-  metadata.gz: fb388ad5d74a6c3f7a9fc4816e004200e427ec819ae24495612ac2376f8cdf6e6fa2bc28f5a5c53c3312daef3abd7895c33f4e87f9f04da8668ef0ccf1ca5fad
-  data.tar.gz: 3d598ff006a0db04c6b78a572a46a7afa2cbe051e9853f9cf71ec8c71d339aaf78b24590dccbadd8af298bd137e118817293d87cd43e605fb86ce7063727c6cd
+  metadata.gz: e839baee0544f72426b9887a745a564bf8350370beca72f4dd3e230fb71b568682bb6e7794acad502e5e27c984cafe9fe7ffb14f0d5ab8ea6cbbc2e863a73439
+  data.tar.gz: c54343f8b35e7e340ff90155c23e185f1be3888226675aa0f5a1fb6ac6912a77f9bff5b69f8db8583c622eee5b3a39666dca6c3d780fd5f8cc977571c6a2cc35

data/.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.21.1","wasm/kobako-core":"0.13.1","wasm/kobako-mruby":"0.13.1","wasm/kobako-io":"0.13.1","wasm/kobako-json":"0.13.1","wasm/kobako-regexp":"0.13.1","wasm/kobako-baker":"0.13.1","crates/kobako-transport":"0.13.1","crates/kobako-codec":"0.13.1","crates/kobako-runtime":"0.13.1","crates/kobako-wasmtime":"0.13.1","crates/kobako":"0.13.1"}
+{".":"0.22.0","wasm/kobako-core":"0.14.0","wasm/kobako-mruby":"0.14.0","wasm/kobako-io":"0.14.0","wasm/kobako-json":"0.14.0","wasm/kobako-regexp":"0.14.0","wasm/kobako-baker":"0.14.0","crates/kobako-transport":"0.14.0","crates/kobako-codec":"0.14.0","crates/kobako-runtime":"0.14.0","crates/kobako-wasmtime":"0.14.0","crates/kobako":"0.14.0"}

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.22.0](https://github.com/elct9620/kobako/compare/v0.21.1...v0.22.0) (2026-08-06)
+
+
+### Features
+
+* **spec:** give the ubiquitous language a place N-6 can be checked from ([ab44dba](https://github.com/elct9620/kobako/commit/ab44dba0b08e558a5b96b95b3c4d1c70bf6bc7ad))
+* **transport:** give a failed Service call a class that says why ([b39f176](https://github.com/elct9620/kobako/commit/b39f1761e9922b7ac761571393f9a6f4478ae522))
+* **transport:** let a guest block's exception continue as itself ([c8b1de7](https://github.com/elct9620/kobako/commit/c8b1de7154336fab8fa20c0d7a5b3baaad11d551))
+* **transport:** separate a failed exchange from a failed Service ([fb92515](https://github.com/elct9620/kobako/commit/fb92515fc76ffebbb8491b525d53b1725cf97dd0))
+
+
+### Bug Fixes
+
+* **codec:** keep a value the packer cannot walk inside the codec taxonomy ([ac99d58](https://github.com/elct9620/kobako/commit/ac99d58f0c9a274b230d645d7c37aba88516eab2))
+* **regexp:** stop raising where MRI answers no match ([d229974](https://github.com/elct9620/kobako/commit/d2299740a2a0206c88e7c397cdb72dc730c4c1cf))
+* **transport:** answer a held block failure only to the block that raised ([24dfd6e](https://github.com/elct9620/kobako/commit/24dfd6ec999e0ba1587b9c69da6d2b29563fc875))
+* **transport:** report a yield the host cannot write as the Service's ([19459f8](https://github.com/elct9620/kobako/commit/19459f87555190043127290441bf6b95bcad93d6))
+* **transport:** report an answer the host cannot write as the Service's ([bff4cdc](https://github.com/elct9620/kobako/commit/bff4cdccc076859d7da43f5dedb9a283ffed94ee))
+* **transport:** spend a block's failure when its Service yields again ([3042a72](https://github.com/elct9620/kobako/commit/3042a72b9e3bb0d6a1d5cb5734d7eaee6a669e85))
+* **wire:** let a Fault reader survive what it predates ([eeabfb7](https://github.com/elct9620/kobako/commit/eeabfb7aa4de3d08852ca1b41517b924d72a7312))
+
 ## [0.21.1](https://github.com/elct9620/kobako/compare/v0.21.0...v0.21.1) (2026-07-30)
 
 

data/README.md

@@ -321,7 +321,7 @@ For workloads that must be isolated from each other (one Sandbox per tenant, per
 
 For hosts that serve many short invocations, `Kobako::Pool` keeps a bounded set of warm, identically set-up Sandboxes and hands each one to a single exclusive holder at a time ([`docs/behavior/runtime.md`](docs/behavior/runtime.md) B-46..B-48). Construction forwards every `Sandbox.new` keyword verbatim; the optional block is the per-Sandbox setup window and runs exactly once per constructed Sandbox.
 
-`Kobako::Pool` is experimental today and is best treated as a convenience for warm, pre-configured reuse rather than a throughput optimisation. B-49 bakes the shared boot state into the artifact and every dynamic script still compiles and runs per invocation, so all a pool actually saves is the ~28 µs host-side `Sandbox.new`. For the workload kobako is built for — many small, short-lived Sandboxes running dynamic scripts — that is not a significant gain (~4-5% in the [serverless example](examples/serverless/README.md), and proportionally less once the script itself does real work). What a Pool buys is warm setup and exclusive checkout, not isolation: a Sandbox holds no state from any run, so Threads sharing one are equally safe (see [Concurrency](#concurrency)).
+`Kobako::Pool` is experimental today and is best treated as a convenience for warm, pre-configured reuse rather than a throughput optimisation. B-49 bakes the shared boot state into the artifact and every dynamic script still compiles and runs per invocation, so all a pool actually saves is the host-side `Sandbox.new` — now under 3 µs, an order of magnitude below the invocation that follows it. For the workload kobako is built for — many small, short-lived Sandboxes running dynamic scripts — that is not a gain worth the coupling. What a Pool buys is warm setup and exclusive checkout, not isolation: a Sandbox holds no state from any run, so Threads sharing one are equally safe (see [Concurrency](#concurrency)).
 
 ```ruby
 pool = Kobako::Pool.new(slots: 4) do |sandbox|
@@ -498,17 +498,17 @@ Order-of-magnitude figures on macOS arm64, Ruby 3.4.7, YJIT off. Absolute values
 | Phase                                                        | Cost                  |
 |--------------------------------------------------------------|-----------------------|
 | First `Sandbox.new` ever for a Guest Binary (Module JIT, then disk-cached) | ~500 ms once per machine |
-| First `Sandbox.new` in a fresh process (`.cwasm` cache warm) | ~3 ms one-time        |
-| Subsequent `Sandbox.new` (caches warm)                       | ~28 µs                |
-| Warm `#eval("nil")` on a reused Sandbox                      | ~71 µs                |
-| Warm `#run(:Entrypoint, ...)` dispatch                       | ~97 µs                |
-| Service call amortized inside one invocation                 | ~6.8 µs               |
-| Snippet replay per invocation                                | ~7.6 µs each          |
+| First `Sandbox.new` in a fresh process (`.cwasm` cache warm) | ~1.3 ms one-time      |
+| Subsequent `Sandbox.new` (caches warm)                       | ~3 µs                 |
+| Warm `#eval` with one Service call on a reused Sandbox       | ~71 µs                |
+| Warm `#run(:Entrypoint, ...)` dispatch                       | ~81 µs                |
+| Service call amortized inside one invocation                 | ~5.7 µs               |
+| Snippet replay per invocation                                | ~7.5 µs each          |
 | Per additional idle Sandbox (RSS)                            | ~1 KB                 |
 
-The Cranelift JIT runs once per machine and gem version — the compiled artifact persists in a `.cwasm` disk cache, so later processes deserialize in milliseconds. An idle Sandbox holds no wasm instance (the canonical boot state is baked into the artifact and instantiated per invocation), which is why a thousand idle tenants cost ~33 MB total. Under the default `gvl: :hold`, wasm work is GVL-serialized: aggregate throughput stays around 17k `#eval`/s regardless of Thread count, though Ruby-side `#eval` setup still overlaps. Opting a Sandbox into `gvl: :release` lifts that ceiling for compute-bound scripts (see [Concurrency](#concurrency)). A +10% regression on any SPEC-mandated benchmark blocks release.
+The Cranelift JIT runs once per machine and gem version — the compiled artifact persists in a `.cwasm` disk cache, so later processes deserialize in milliseconds. An idle Sandbox holds no wasm instance (the canonical boot state is baked into the artifact and instantiated per invocation), which is why a thousand idle tenants cost ~33 MB total. Under the default `gvl: :hold`, wasm work is GVL-serialized: aggregate throughput stays around 16k `#eval`/s regardless of Thread count, though Ruby-side `#eval` setup still overlaps. Opting a Sandbox into `gvl: :release` lifts that ceiling for compute-bound scripts (see [Concurrency](#concurrency)). A +10% regression on any SPEC-mandated benchmark blocks release.
 
-Regexp is an opt-in capability gem, excluded from the default binary and the gated set; its throughput is tracked in a separate non-gated characterization (`#11` in [`benchmark/README.md`](benchmark/README.md)). There `=~` (~5 µs/match) costs about 4× `match?` (~1.2 µs), because `=~` eagerly builds the `MatchData` and match globals — prefer `match?` for boolean tests.
+Regexp is an opt-in capability gem, excluded from the default binary and the gated set; its throughput is tracked in a separate non-gated characterization (`#11` in [`benchmark/README.md`](benchmark/README.md)). There `=~` (~5 µs/match) costs about 4.5× `match?` (~1.1 µs), because `=~` eagerly builds the `MatchData` and match globals — prefer `match?` for boolean tests.
 
 ```bash
 bundle exec rake bench  # every gated regression benchmark (~5-8 min)

data/crates/kobako-runtime/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.14.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.13.1...kobako-runtime-v0.14.0) (2026-08-06)
+
+
+### Miscellaneous Chores
+
+* **kobako-runtime:** Synchronize kobako crates versions
+
 ## [0.13.1](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.13.0...kobako-runtime-v0.13.1) (2026-07-30)
 
 

data/crates/kobako-runtime/README.md

@@ -26,7 +26,7 @@ map the neutral types onto their own language surface.
 
 ```toml
 [dependencies]
-kobako-runtime = "0.13.1" # x-release-please-version
+kobako-runtime = "0.14.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-transport/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.14.0](https://github.com/elct9620/kobako/compare/kobako-transport-v0.13.1...kobako-transport-v0.14.0) (2026-08-06)
+
+
+### Features
+
+* **transport:** let a guest block's exception continue as itself ([c8b1de7](https://github.com/elct9620/kobako/commit/c8b1de7154336fab8fa20c0d7a5b3baaad11d551))
+* **transport:** separate a failed exchange from a failed Service ([fb92515](https://github.com/elct9620/kobako/commit/fb92515fc76ffebbb8491b525d53b1725cf97dd0))
+
+
+### Bug Fixes
+
+* **wire:** let a Fault reader survive what it predates ([eeabfb7](https://github.com/elct9620/kobako/commit/eeabfb7aa4de3d08852ca1b41517b924d72a7312))
+
 ## [0.13.1](https://github.com/elct9620/kobako/compare/kobako-transport-v0.13.0...kobako-transport-v0.13.1) (2026-07-30)
 
 

data/crates/kobako-transport/README.md

@@ -35,7 +35,7 @@ the golden vectors in this crate are derived from that document.
 
 ```toml
 [dependencies]
-kobako-transport = "0.13.1" # x-release-please-version
+kobako-transport = "0.14.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-wasmtime/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.14.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.13.1...kobako-wasmtime-v0.14.0) (2026-08-06)
+
+
+### Miscellaneous Chores
+
+* **kobako-wasmtime:** Synchronize kobako crates versions
+
 ## [0.13.1](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.13.0...kobako-wasmtime-v0.13.1) (2026-07-30)
 
 

data/crates/kobako-wasmtime/README.md

@@ -24,7 +24,7 @@ SDK consumes the same surface.
 
 ```toml
 [dependencies]
-kobako-wasmtime = "0.13.1" # x-release-please-version
+kobako-wasmtime = "0.14.0" # x-release-please-version
 ```
 
 ## License

data/lib/kobako/codec/encoder.rb

@@ -30,10 +30,24 @@ module Kobako
       # rescue below maps the two violations the guard does not reach onto the
       # same error: an integer outside i64..u64 (+RangeError+) and any
       # packer-internal +NoMethodError+.
+      #
+      # A value that nests without bound — a reference cycle necessarily
+      # does — exhausts the packer's own recursion instead, which Ruby
+      # reports outside +StandardError+. Mapping it keeps an unwritable
+      # value a wire violation the dispatch boundary can answer, rather than
+      # one that escapes every caller's rescue and traps the invocation.
+      #
+      # The refusal is spent once per thread: a thread that has absorbed one
+      # such overflow aborts on the next instead of raising, and a Hash cycle
+      # never reaches Ruby at all — the packer walks a Hash through C frames
+      # that carry no stack guard. Bounding the walk before the packer is
+      # handed the value is what would make the refusal repeatable.
       def self.encode(value)
         FACTORY.dump(value)
       rescue ::RangeError, ::NoMethodError => e
         raise UnsupportedTypeError, e.message
+      rescue ::SystemStackError
+        raise InvalidTypeError, "value nests deeper than this host can write (a reference cycle necessarily does)"
       end
     end
   end

data/lib/kobako/codec/error.rb

@@ -18,7 +18,8 @@ module Kobako
     class TruncatedInputError < Error; end
 
     # The type byte at the current position is not in the 11-entry kobako
-    # type mapping (e.g. an unknown ext code, or a reserved msgpack tag).
+    # type mapping (e.g. an unknown ext code, or a reserved msgpack tag) —
+    # or, on encode, a value nesting past what the packer can walk.
     class InvalidTypeError < Error; end
 
     # A msgpack +str+ payload was not valid UTF-8, or an ext 0x00 Symbol

data/lib/kobako/errors.rb

@@ -116,12 +116,45 @@ module Kobako
 
   # Service layer. Raised when a Service capability call inside a mruby
   # script reported an application-level failure that the script did not
-  # rescue.
+  # rescue. The base class covers a Service that ran and raised; the two
+  # subclasses below cover the calls that never reached one, so a Host App
+  # routes them apart with +rescue+ instead of by reading the message.
   class ServiceError < Error
     include Diagnosable
     include CarriesExecution
   end
 
+  # The ServiceError subclass raised when the call reached no Service
+  # method: the bound path holds nothing, the Capability Handle is not
+  # live in this invocation, or the method is absent or outside the guest
+  # surface. The causes stay indistinguishable — an opaque target must
+  # disclose nothing about which methods it defines — so what a Host App
+  # learns is that this call will not succeed by being retried.
+  class NoServiceError < ServiceError; end
+
+  # The ServiceError subclass raised when the call reached the Service
+  # method but its arguments did not fit — an unknown keyword, or an
+  # arity mismatch.
+  class ServiceArgumentError < ServiceError; end
+
+  # Raised at a Service method's +yield+ site when the guest block it
+  # yielded to raised. A Service rescues it the way it would rescue a
+  # block's exception without a Sandbox between the two frames; leaving it
+  # unrescued returns it to the guest, which re-raises the exception it
+  # raised in the first place. It therefore never reaches the Host App as
+  # an invocation outcome and carries no Execution. +klass+ names the
+  # guest-side class, which has no host counterpart to rebuild.
+  class BlockError < Error
+    include Diagnosable
+  end
+
+  # Raised at a Service method's +yield+ site when a yield argument has no
+  # wire representation, so the round-trip never left the host and the
+  # block never ran. As BlockError, a Service rescues it at that site and
+  # may go on, so it never reaches the Host App as an invocation outcome;
+  # unrescued, the dispatch answers as that Service having failed.
+  class YieldValueError < Error; end
+
   # HandleExhaustedError is the canonical SandboxError subclass for the
   # id-cap-hit path. Raised when the per-invocation Handle ID counter in
   # Catalog::Handles reaches +0x7fff_ffff+ (2³¹ − 1) and further

data/lib/kobako/outcome.rb

@@ -17,12 +17,16 @@ module Kobako
     ORIGIN_SANDBOX = "sandbox"
     ORIGIN_SERVICE = "service"
 
-    # The guest-written class names that select a +SandboxError+ subclass.
-    # A name absent here settles as plain +SandboxError+, so the guest
-    # widens the taxonomy only by naming a class the host already defines.
+    # The guest-written class names that narrow the class a Panic settles
+    # as. A name absent here settles as the base class its origin already
+    # chose, so the guest widens the taxonomy only by naming a class the
+    # host already defines.
     SUBCLASSES = {
       "Kobako::BytecodeError" => BytecodeError,
-      "Kobako::UndefinedEntrypointError" => UndefinedEntrypointError
+      "Kobako::UndefinedEntrypointError" => UndefinedEntrypointError,
+      "Kobako::Transport::Error" => Kobako::Transport::Error,
+      "Kobako::NoServiceError" => NoServiceError,
+      "Kobako::ServiceArgumentError" => ServiceArgumentError
     }.freeze
 
     module_function
@@ -52,13 +56,17 @@ module Kobako
       UndefinedEntrypointError.new(message, name: entrypoint, available: available.map(&:to_sym), **attribution)
     end
 
-    # +origin == "service"+ selects ServiceError; a sandbox-origin failure
-    # naming one of the guest-written subclass names selects that subclass
-    # so callers can rescue that path specifically.
+    # +origin+ picks the branch, and the guest-written class name may
+    # narrow within it so callers can rescue one path specifically. A name
+    # naming a class outside the branch its origin chose is ignored rather
+    # than honoured: what a guest calls its exception must not move the
+    # failure to a layer the attribution did not put it in.
     def error_class(origin, klass)
-      return ServiceError if origin == ORIGIN_SERVICE
+      base = origin == ORIGIN_SERVICE ? ServiceError : SandboxError
+      selected = SUBCLASSES.fetch(klass, base)
+      return base unless selected <= base
 
-      SUBCLASSES.fetch(klass, SandboxError)
+      selected
     end
 
     # An arm the host cannot settle: the guest wrote nothing, or wrote

data/lib/kobako/transport/dispatcher.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../codec"
+require_relative "../errors"
 require_relative "../payload"
 require_relative "call"
 require_relative "reflection"
@@ -36,6 +37,29 @@ module Kobako
       # not part of the public Kobako error taxonomy.
       class UndefinedTargetError < StandardError; end
 
+      # The codec fault of a request that never became a call, restated in
+      # the vocabulary the guest can act on while staying inside the codec
+      # taxonomy the fault boundary sorts on.
+      class UnreadableRequestError < Kobako::Codec::Error; end
+
+      # The category kobako's own refusals answer under, keyed by the class
+      # each is raised as and ordered most specific first. A class absent
+      # here is the Service's own exception, which answers under +runtime+
+      # wearing the +<class>: <message>+ shape that says so.
+      #
+      # +Kobako::Codec::Error+ is the floor rather than a path of its own:
+      # a codec fault reaching the boundary unnamed is the exchange failing,
+      # and must not be dressed as something a Service raised.
+      OWN_FAULTS = {
+        HandleExhaustedError => "internal",
+        UndefinedTargetError => "undefined",
+        ArgumentError => "argument",
+        YieldValueError => "runtime",
+        Kobako::Codec::Error => "internal",
+        Kobako::SandboxError => "runtime"
+      }.freeze
+      private_constant :OWN_FAULTS
+
       # Answer a single routed Call with +[ok, bytes]+, which the native
       # side puts on the Reply's ok or fault arm. Invoked from the
       # per-invocation dispatch Proc that
@@ -61,7 +85,7 @@ module Kobako
       # stays uncaught and traps the invocation rather than being masked as a
       # rescuable fault.
       rescue StandardError => e
-        [false, *caught_fault(e)] # : [bool, String, String?]
+        [false, *caught_fault(e, yielder)] # : [bool, String, String?]
       ensure
         yielder&.invalidate!
       end
@@ -70,12 +94,23 @@ module Kobako
       # the +catch+ frame a guest +break+ unwinds to. Split from #dispatch
       # so the reply-shaping and the failure boundary stay one glance wide.
       def run(call, resolver, handler, yielder)
-        arguments, carried_handle = Kobako::Codec.track_handles { Payload::Arguments.decode(call.payload) }
+        arguments, carried_handle = decode_arguments(call.payload)
         receiver = resolve_target(call.target, resolver, handler)
         args, kwargs = resolve_call_args(arguments, handler, carried_handle)
         catch(BREAK_THROW) { invoke(receiver, call.method_name, args, kwargs, yielder) }
       end
 
+      # Decode the Call's payload into its arguments, reporting whether any
+      # Capability Handle crossed. A codec fault here is a request that
+      # never became a call, restated so it cannot read as an unwritable
+      # reply — the same restatement #encode_ok makes in the other
+      # direction.
+      def decode_arguments(payload)
+        Kobako::Codec.track_handles { Payload::Arguments.decode(payload) }
+      rescue Kobako::Codec::Error => e
+        raise UnreadableRequestError, "Sandbox could not read the request: #{e.message}"
+      end
+
       # Resolve positional and keyword arguments off the decoded payload in
       # one step. +carried_handle+ reports whether the decode carried any
       # Capability Handle; when it did not, every argument resolves to
@@ -95,14 +130,24 @@ module Kobako
       # is the +StandardError+ caught by #dispatch's rescue; the category
       # tells the guest which kind of failure it was so it can raise the
       # matching proxy-side error.
-      def caught_fault(error)
-        case error
-        when Kobako::Codec::Error then fault("runtime",
-                                             "Sandbox received a malformed request: #{error.message}")
-        when UndefinedTargetError then fault("undefined", error.message)
-        when ArgumentError        then fault("argument", error.message)
-        else                           fault("runtime", "#{error.class}: #{error.message}")
-        end
+      #
+      # The class prefix marks a Service's own exception and nothing else:
+      # it is the +<class>: <message>+ shape a Host App is told to keep
+      # secrets out of, so wearing it says the Service raised. kobako's own
+      # refusals answer under their own wording instead of borrowing that
+      # shape.
+      #
+      # The guest's own block failing is not the Service's to report at
+      # all, so the Yielder that raised it is asked first — it recognises
+      # its own by identity and words the failure the guest's way.
+      def caught_fault(error, yielder)
+        block_failure = yielder&.fault_text(error)
+        return fault("block", block_failure) if block_failure
+
+        own = OWN_FAULTS.find { |klass, _| error.is_a?(klass) }
+        return fault(own.last, error.message) if own
+
+        fault("runtime", "#{error.class}: #{error.message}")
       end
 
       # Dispatch +method+ on +target+. +kwargs+ is already Symbol-keyed
@@ -182,10 +227,18 @@ module Kobako
       # +UnsupportedTypeError+; the rescue routes it through the
       # Catalog::Handles via #wrap_as_handle and re-encodes with the
       # Capability Handle in place. The happy path encodes exactly once.
+      #
+      # Any other codec fault is the answer failing to encode rather than the
+      # request failing to decode, and a Service is the only side that can
+      # change what it returns — so it is named here, where the direction is
+      # known, instead of falling to the boundary's codec floor and reporting
+      # as an exchange that produced no Service outcome.
       def encode_ok(value, handler)
         Kobako::Codec::Encoder.encode(value)
       rescue Kobako::Codec::UnsupportedTypeError
         encode_ok(wrap_as_handle(value, handler), handler)
+      rescue Kobako::Codec::Error => e
+        raise Kobako::SandboxError, "Sandbox could not write the Service's answer: #{e.message}"
       end
 
       # Allocate +value+ in the Sandbox's Catalog::Handles and return a +Handle+

data/lib/kobako/transport/yielder.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../codec"
+require_relative "../errors"
 
 module Kobako
   # See lib/kobako/transport.rb for the umbrella module doc; this file
@@ -20,8 +21,8 @@ module Kobako
     #   * ok    — return the decoded value to +yield+'s caller
     #   * break — +throw break_tag, value+ so the Dispatcher's +catch+
     #     frame unwinds the Service method
-    #   * error — raise the guest's class and message at the Service's
-    #     yield site
+    #   * error — raise a BlockError at the Service's yield site,
+    #     carrying the guest's class on +#klass+
     #
     # The Dispatcher calls #invalidate! from its +ensure+ block once
     # dispatch completes; any later call to a stashed Yielder then raises
@@ -40,6 +41,23 @@ module Kobako
         @break_tag = break_tag
         @handler = handler
         @active = true
+        @raised = nil
+      end
+
+      # The text the guest's own block failure crosses back as, or +nil+
+      # when +error+ is not the BlockError this Yielder raised. Identity
+      # rather than class: a Service that rescued the block's failure and
+      # raised its own has reported something else, and the guest must
+      # hear about that instead.
+      #
+      # The class travels with the message because not every block failure
+      # is an exception the guest holds — a block value the guest refused
+      # has a class to raise under and no object to continue.
+      def fault_text(error)
+        raised = @raised
+        return if raised.nil? || !error.equal?(raised)
+
+        "#{raised.klass}: #{raised.message}"
       end
 
       # Re-enter the guest with +args+ and reify the Yield Reply into
@@ -52,8 +70,8 @@ module Kobako
       def yield(*args)
         raise LocalJumpError, "guest block invoked after host dispatch frame returned" unless @active
 
-        arm, body, klass = @yield_to_guest.call(Kobako::Codec::Encoder.encode(args))
-        raise "#{klass}: #{body}" if arm == :error
+        arm, body, klass = @yield_to_guest.call(encode_args(args))
+        raise remember(BlockError.new(body, klass: klass)) if arm == :error
 
         value, carried_handle = decode_body(body)
         throw @break_tag, value if arm == :break
@@ -76,6 +94,24 @@ module Kobako
 
       private
 
+      # Encode what the Service is yielding. A value outside the wire type
+      # set fails here, before the guest is re-entered, and is restated so
+      # the Service reads a refusal of its own argument rather than a codec
+      # class it never named.
+      def encode_args(args)
+        Kobako::Codec::Encoder.encode(args)
+      rescue Kobako::Codec::Error => e
+        raise YieldValueError, "Service yielded a value the block cannot receive: #{e.message}"
+      end
+
+      # Hold onto the BlockError being raised so #fault_text can recognise
+      # it if it comes back unrescued, and return it so the raise site reads
+      # as one statement. Only the newest is kept: a Service that rescued
+      # an earlier one and yielded again has already handled it.
+      def remember(error)
+        @raised = error
+      end
+
       # Decode a value-carrying arm's payload, answering the value and
       # whether the decode carried a Capability Handle. The tracking
       # bracket opens only around this decode: the guest re-entry may run

data/lib/kobako/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kobako
-  VERSION = "0.21.1"
+  VERSION = "0.22.0"
 end

data/sig/kobako/errors.rbs

@@ -47,6 +47,19 @@ module Kobako
     include CarriesExecution
   end
 
+  class NoServiceError < ServiceError
+  end
+
+  class ServiceArgumentError < ServiceError
+  end
+
+  class BlockError < Error
+    include Diagnosable
+  end
+
+  class YieldValueError < Error
+  end
+
   class HandleExhaustedError < SandboxError
   end
 

data/sig/kobako/outcome.rbs

@@ -2,7 +2,7 @@ module Kobako
   module Outcome
     ORIGIN_SANDBOX: String
     ORIGIN_SERVICE: String
-    SUBCLASSES: Hash[String, singleton(SandboxError)]
+    SUBCLASSES: Hash[String, (singleton(SandboxError) | singleton(ServiceError))]
 
     type panic_fields = [String, String, String, Array[String], Array[String]]
 

data/sig/kobako/transport/dispatcher.rbs

@@ -4,8 +4,13 @@ module Kobako
       class UndefinedTargetError < StandardError
       end
 
+      class UnreadableRequestError < Kobako::Codec::Error
+      end
+
       BREAK_THROW: Symbol
 
+      OWN_FAULTS: Hash[singleton(StandardError), String]
+
 
 
 
@@ -15,7 +20,9 @@ module Kobako
 
       def self?.resolve_call_args: (Kobako::Payload::Arguments arguments, Kobako::Codec::_HandleTable handler, bool carried_handle) -> [Array[untyped], Hash[Symbol, untyped]]
 
-      def self?.caught_fault: (StandardError error) -> [String, String]
+      def self?.decode_arguments: (String payload) -> [Kobako::Payload::Arguments, bool]
+
+      def self?.caught_fault: (StandardError error, Kobako::Transport::Yielder? yielder) -> [String, String]
 
       def self?.invoke: (untyped target, String method, Array[untyped] args, Hash[Symbol, untyped] kwargs, ?Kobako::Transport::Yielder? yielder) -> untyped
 

data/sig/kobako/transport/yielder.rbs

@@ -5,9 +5,12 @@ module Kobako
       @break_tag: Symbol
       @handler: Kobako::Codec::_HandleTable
       @active: bool
+      @raised: Kobako::BlockError?
 
       def initialize: (Kobako::Transport::_GuestYielder yield_to_guest, Symbol break_tag, Kobako::Codec::_HandleTable handler) -> void
 
+      def fault_text: (Exception error) -> String?
+
       def yield: (*untyped args) -> untyped
 
       def to_proc: () -> Proc
@@ -16,6 +19,10 @@ module Kobako
 
       private
 
+      def encode_args: (Array[untyped] args) -> String
+
+      def remember: (Kobako::BlockError error) -> Kobako::BlockError
+
       def decode_body: (String body) -> [untyped, bool]
 
       def restore: (untyped value, bool carried_handle) -> untyped

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kobako
 version: !ruby/object:Gem::Version
-  version: 0.21.1
+  version: 0.22.0
 platform: aarch64-linux
 authors:
 - Aotokitsuruya
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-07-30 00:00:00.000000000 Z
+date: 2026-08-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: msgpack