Module program 

Literal program lookup, shared by preflight and process launches.

Functions

candidates

Candidate paths in lookup order, for the environment variable reads. Scoped callers validate each candidate inside their own access boundary before allowing it to reach a process launcher.

resolve

Resolve against the inherited PATH and, on Windows, PATHEXT. A bare name never implicitly searches the working directory; relative PATH entries are based on cwd.

resolve_with

Resolve using the environment that the child will receive, not the caller’s PATH: variable reads one variable of that environment.