Module fragment 

Expanding one heredoc body against a scope the caller supplies.

A plan publishes what a command was asked to read on stdin. When the delimiter was unquoted the shell expands the body first, so the published text is not the text the command receives — and an analyzer handed the published text would judge a program that never runs.

expand_fragment closes that gap, under two rules that are the whole design:

• The caller supplies the scope. Nothing is read from session state. An embedder deciding against values it holds gets the body those values produce, never one the kernel peeked and never a stale one — read TOKEN binds at runtime, and a plan cannot see it.
• A $(…) is returned, not run. Running it is a decision with a clock and a blast radius, and it is the same decision the caller is asking about. Each substitution comes back as a Hole carrying its plan; a caller that judges it safe runs it in a kernel of its own construction and expands again with the answer in scope.

Expansion runs the interpreter’s own Evaluator, never a second implementation of expansion — a separate one would drift, and the drift is the analyzed-text-is-not-executed-text failure this exists to prevent.

Enums

FragmentError

Why a fragment could not be expanded. Every variant names what was asked for and what was there instead — an expansion that quietly returned nothing would be read as a body that runs and produces nothing.

Functions

expand_fragment

Expand one heredoc body against scope, without executing anything.