marshalsea parses Ruby Marshal streams without deserializing them, discovers gadget sinks by runtime reflection, and ships the defenses that stop them. Built as a teaching artifact for the deserialization vulnerability class.