[Immanuel-Fowler]

Stacked on #7 (feat/sandbox-arrays-structs); merge that first.

What

The two things a sandboxed serverlet could not do that the other boundaries could, both were compile errors until now.

grant call on a sandboxed serverlet. In a library build, a sandboxed serverlet takes the same grant lines a landline does. There they are the only way the guest reaches the host at all:

• Each grant is exactly one import defined in the guest's wasmtime linker (orch_host.<group>_<function>), behind which the Host trait method runs on the host. Nothing is defined for anything ungranted, so it does not exist inside the guest. This is step 7 of docs/design/sandboxed-serverlets.md: containment and consent as one mechanism.
• The guest carries the call through a generated stub over the landline wire codec, so host functions take and return numbers, booleans, strings, arrays, and structs.
• A handler that calls an ungranted host function is refused by orchestrate check, naming the serverlet, the call, and the grant that would allow it.
• A host error or panic fails that one call inside the guest, which logs it and continues with the return type's default. A host call counts against the serverlet's timeout, since the guest is still inside its call while the host runs.

on_crash on a sandboxed serverlet runs on the host after a call ran past its timeout, exhausted its memory, or stopped itself, with the trap's message bound, before the guest is replaced and the caller gets the default. It cannot reach the guest's state, which is inside the instance being thrown away; a handler that names a state binding is a compile error saying so.

Not an impossibility

The brief allowed a written argument that these cannot exist for a WASM guest. They can, so this implements them rather than arguing otherwise.

Tests

• library_sandbox_grants_are_mediated_host_functions: a granted call with an int, a struct, and an array, a host error answered with a default, across two ticks, with the host's log captured.
• runtime_sandbox_on_crash_runs_on_the_host: a timed-out call runs the handler with the trap message, and the fresh guest starts over.
• Error cases: sandbox_ungranted_host_call.orch (refused by check) and sandbox_crash_uses_state.orch.
• Parser test for grant call and on_crash inside a sandboxed serverlet, and the refusal on a plain one.
• Snapshot sandbox_guest regenerated: the guest gains the host-call helper.

Found on the way

A handler named move reached rustc as a keyword. Any Rust keyword used as an OrchestrateLang name does; recorded in LIMITATIONS-notes.md, not fixed here.

Changelog entries are under [Unreleased]. No version bump.

🤖 Generated with Claude Code