kernel: loaders never escape as an exception, date-spec validates on load

Layer.load narrowed its catch to Sexplib0.Sexp_conv_error.Of_sexp_error,
but rank_of_sexp is caller-supplied and may raise anything -- e.g. a
hand-written rank parser that calls invalid_arg. Overlay.load already
catches every exception from the equivalent call; mirror that here so
layer.mli's "never as an exception" promise actually holds.

Date_spec.t derived its sexp converters with plain ppx_sexp_conv, unlike
Slug and Lang, which hand-write validating parsers specifically so
malformed data is rejected at load. (Fixed (month 13) (day 40)) used to
deserialise cleanly into a spec that simply never resolves -- a saint
quietly vanishing with no diagnostic. t_of_sexp now re-runs the value
through the existing fixed validator, the same shape Slug and Lang
already use.

Covering tests: a Layer.load case where rank_of_sexp raises
Invalid_argument instead of Of_sexp_error (would have escaped
uncaught before this fix); two Date_spec.t_of_sexp cases (month 13,
31 April) that must raise Of_sexp_error rather than silently
constructing an unresolvable spec.

1 files changed, 4 insertions, 2 deletions

diff --git a/lib/kernel/layer.ml b/lib/kernel/layer.ml
index bf71206..515b052 100644
--- a/lib/kernel/layer.ml
+++ b/lib/kernel/layer.ml
@@ -52,5 +52,7 @@ let load rank_of_sexp path =
   | sexp -> (
       match t_of_sexp rank_of_sexp sexp with
       | t -> Ok { t with entries = canonical t.entries }
-      | exception Sexplib0.Sexp_conv_error.Of_sexp_error (exn, _) ->
-          Error (Printf.sprintf "%s: %s" path (Printexc.to_string exn)))
+      (* [rank_of_sexp] is caller-supplied and may raise anything, not only
+         [Of_sexp_error] -- mirrors [Overlay.load]'s catch-all, so "never as
+         an exception" (layer.mli) actually holds. *)
+      | exception exn -> Error (Printf.sprintf "%s: %s" path (Printexc.to_string exn)))