polydat_core/kernel/subcontext/

kernel.rs

// Copyright 2024-2026 Jonathan Shook
// SPDX-License-Identifier: Apache-2.0

//! [`ScopeKernel<M>`] — typed wrapper around [`crate::kernel::PolydatKernel`].
//!
//! Per SRD-67 §"Walled-off invariant", `ScopeKernel<M>` is the
//! typed surface; the underlying `PolydatKernel` stays public, and its
//! construction primitives are sealed (`from_program` is crate-private,
//! `materialize_wiring_from_outer` private), so a child is built only
//! through the typed surface.
//!
//! The kernel exposes:
//! - [`Self::subcontext_builder`] — yields a typed
//!   [`super::SubcontextBuilder`] over this kernel's
//!   [`super::ParentView`]. The single public entry point for child
//!   construction on the typed path.
//! - [`Self::spawn`] — the single chokepoint where every
//!   cross-binding is resolved; takes a closed
//!   [`super::ScopeModule`] artifact, applies SRD-67's
//!   cross-binding rules, returns a typed child kernel and
//!   records the spawn under `name` in this kernel's registry.
//! - [`Self::release_child`] — drop a registry entry to allow
//!   re-spawn under the same name (for per-iteration
//!   re-traversal).

use std::collections::HashMap;
use std::marker::PhantomData;
use std::sync::{Arc, Mutex};

use crate::ast::{PortType, Value};
use crate::kernel::{PolydatKernel, SharedCell};

use super::builder::{ParentView, SubcontextBuilder};
use super::error::{ContractViolation, SourceContext};
use super::module::{ScopeModule, WriteThroughBinding};
use super::name::ChildName;
use super::pull::RegisteredPullConsumer;

/// Phantom-marker brand for the workload-root scope kernel —
/// the top of any spawn type chain. Tests / examples that need
/// a "starting" identity use this.
#[derive(Debug)]
pub struct RootMarker;

/// Phantom-marker brand for "child of `P`". `spawn` returns
/// `ScopeKernel<Child<P>>`, distinct at the type level from a
/// sibling's `Child<P>` *value* but type-compatible at the
/// module-identity level (per SRD-67 §"Decision 6").
#[derive(Debug)]
pub struct Child<P>(PhantomData<fn() -> P>);

/// Internal record of a spawned child — used for the
/// duplicate-spawn diagnostic.
#[derive(Debug)]
struct ChildEntry {
    site: SourceContext,
}

/// Typed wrapper around an `Arc<PolydatKernel>`.
///
/// Construction via this type goes through the SRD-67 protocol
/// (`subcontext_builder` → `finalize` → `spawn`); direct
/// construction from a `PolydatKernel` is `pub(crate)` for the
/// Phase 1 internal bridge.
pub struct ScopeKernel<M> {
    name: ChildName,
    inner: Arc<Mutex<PolydatKernel>>,
    site: SourceContext,
    children: Mutex<HashMap<ChildName, ChildEntry>>,
    consumers: Mutex<Vec<RegisteredPullConsumer>>,
    /// Rule 2 write-through bindings. Per-cycle eval of this
    /// kernel must call [`Self::commit_write_throughs`] after
    /// producing values to fan them through the parent's
    /// `SharedCell`s.
    write_throughs: Vec<WriteThroughBinding>,
    _module: PhantomData<fn() -> M>,
}

impl<M> std::fmt::Debug for ScopeKernel<M> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("ScopeKernel")
            .field("name", &self.name)
            .field("site", &self.site)
            .finish()
    }
}

/// One shared cell visible at a parent scope, reified for
/// transitive cross-binding. Returned by
/// [`ScopeKernel::shared_cells_in_scope`].
///
/// Carries the name a child must use to bind to the cell,
/// the port type (so Rule 2 / `extern` synthesis at finalize
/// can declare a typed input slot), and the cell handle (so
/// spawn can attach it to the child's matching input).
///
/// "In scope" semantics: a cell visible at the parent is one
/// the parent itself can read or write at this scope —
/// covering both:
///
/// 1. Cells the parent declared via its own program
///    (`shared X := <init>` produces a cell-bound input slot).
/// 2. Cells inherited from the parent's own ancestors
///    (attached during the parent's spawn). Without this
///    case, a `shared` cell at the workload root would not
///    propagate to grand-children whose immediate parent's
///    body never references the name.
///
/// Both cases are answered by walking the parent's input
/// slots and reading `PolydatState::shared_cell` for each (see
/// `PolydatKernel::shared_cells_in_scope`).
#[derive(Clone)]
pub struct SharedCellInScope {
    /// The binding's name.
    pub name: String,
    /// The cell's declared type.
    pub port_type: PortType,
    /// The cell.
    pub cell: SharedCell,
}

impl std::fmt::Debug for SharedCellInScope {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("SharedCellInScope")
            .field("name", &self.name)
            .field("port_type", &self.port_type)
            .finish()
    }
}

impl<M> ScopeKernel<M> {
    /// Enumerate every shared cell visible at this scope.
    /// Delegates to [`PolydatKernel::shared_cells_in_scope`] —
    /// the carrier lives at the kernel layer so it survives
    /// any wrap/unwrap dance the activity layer does. The
    /// `SharedCellInScope` re-export is kept for callers in
    /// the SRD-67 builder; it's a thin alias over the kernel
    /// layer's `SharedCellEntry`.
    pub fn shared_cells_in_scope(&self) -> Vec<SharedCellInScope> {
        let inner = self.lock_inner();
        inner
            .shared_cells_in_scope()
            .into_iter()
            .map(|e| SharedCellInScope {
                name: e.name,
                port_type: e.port_type,
                cell: e.cell,
            })
            .collect()
    }

    /// Internal constructor — only the spawn path and
    /// [`wrap_root_kernel`] produce a `ScopeKernel` directly. Public
    /// callers go through the protocol.
    pub(crate) fn new_internal(
        name: ChildName,
        kernel: PolydatKernel,
        site: SourceContext,
        consumers: Vec<RegisteredPullConsumer>,
    ) -> Self {
        Self::new_with_write_throughs(name, kernel, site, consumers, Vec::new())
    }

    pub(crate) fn new_with_write_throughs(
        name: ChildName,
        kernel: PolydatKernel,
        site: SourceContext,
        consumers: Vec<RegisteredPullConsumer>,
        write_throughs: Vec<WriteThroughBinding>,
    ) -> Self {
        Self {
            name,
            inner: Arc::new(Mutex::new(kernel)),
            site,
            children: Mutex::new(HashMap::new()),
            consumers: Mutex::new(consumers),
            write_throughs,
            _module: PhantomData,
        }
    }

    /// The structured name this kernel was spawned under (for
    /// child kernels) or its self-label (for root kernels).
    pub fn name(&self) -> &ChildName {
        &self.name
    }

    /// Diagnostic site for this kernel's construction.
    pub fn site(&self) -> &SourceContext {
        &self.site
    }

    /// Borrow the underlying `PolydatKernel` for read-only
    /// operations. The lock is released when the returned guard
    /// is dropped. Exposed for callers that drive the kernel directly
    /// (the builder's `finalize` does, as do tests).
    pub fn lock_inner(&self) -> std::sync::MutexGuard<'_, PolydatKernel> {
        self.inner
            .lock()
            .expect("ScopeKernel inner kernel poisoned")
    }

    /// The pull consumers registered with this kernel. Used by
    /// the activity-side fixture adapter at seal time.
    pub fn consumers(&self) -> Vec<RegisteredPullConsumer> {
        self.consumers
            .lock()
            .expect("ScopeKernel consumers poisoned")
            .clone()
    }

    /// Whether `name` is recorded in this kernel's named-child
    /// registry. Diagnostic; Phase 1 tests assert against this.
    pub fn has_child(&self, name: &ChildName) -> bool {
        self.children
            .lock()
            .expect("ScopeKernel children registry poisoned")
            .contains_key(name)
    }

    /// Drop the named child from this kernel's registry. The
    /// child kernel itself is unaffected — only the registry
    /// entry. After release, the same name may be spawned again
    /// (typical for comprehension scopes that re-traverse per
    /// iteration). See SRD-67 §"Release semantics".
    pub fn release_child(&self, name: &ChildName) {
        self.children
            .lock()
            .expect("ScopeKernel children registry poisoned")
            .remove(name);
    }

    /// Begin construction of a child sub-context. Per SRD-67
    /// §"Step 1 — Parent yields a builder": the builder takes the
    /// parent's [`ParentView`] — its program and its in-scope cells,
    /// which is everything finalize reads of a parent — accumulates
    /// module matter, and produces a closed [`ScopeModule`] artifact
    /// at finalize. It holds no reference to the parent kernel, so a
    /// caller that only has a [`PolydatKernel`] needs no `ScopeKernel`
    /// to stand up a child.
    pub fn subcontext_builder(&self) -> SubcontextBuilder<M> {
        SubcontextBuilder::new(ParentView::of(&self.lock_inner()))
    }

    /// Spawn a child kernel from a closed [`ScopeModule`]
    /// artifact. Per SRD-67 §"Step 4 — Parent spawns the child
    /// kernel": this is the single chokepoint where every cross-
    /// binding is resolved.
    ///
    /// The artifact arrives with Rule 1 (name closure) and Rule 2
    /// (the shared write-through rewrite) already applied by
    /// [`SubcontextBuilder::finalize`]. Spawn materializes the
    /// closed program under this parent via
    /// `PolydatKernel::materialize_subscope`, whose
    /// `materialize_wiring_from_outer` (kernel/state.rs) does the
    /// live binding: attaches every parent-visible `SharedCell` to
    /// a matching child slot and forwards the rest as transit
    /// (Rule 2's cell attach, SC8), value-copies or cell-attaches
    /// parent outputs into child externs (Rules 4 and 5), pulls
    /// every `const` output once after wiring so scope-init values
    /// see post-bind inputs (Rule 3), and freezes the scope
    /// coordinates. Per-cycle publication to the cells is
    /// [`Self::commit_write_throughs`].
    pub fn spawn(
        self: &Arc<Self>,
        name: ChildName,
        artifact: ScopeModule<Child<M>>,
    ) -> Result<ScopeKernel<Child<M>>, ContractViolation> {
        // ----- Named-child registry guard (SRD-67 §"Spawn
        // semantics") -----
        {
            let mut children = self
                .children
                .lock()
                .expect("ScopeKernel children registry poisoned");
            if let Some(prior) = children.get(&name) {
                return Err(ContractViolation::DuplicateChild {
                    name: name.clone(),
                    prior_site: Box::new(prior.site.clone()),
                    this_site: artifact.context.clone(),
                });
            }
            children.insert(
                name.clone(),
                ChildEntry {
                    site: artifact.context.clone(),
                },
            );
        }

        // ----- Cross-binding resolution -----
        // Single chokepoint: `materialize_wiring_from_outer` walks every
        // cell visible at the parent (own slots + transit
        // cells inherited from ancestors), attaches each to
        // any matching child slot, and forwards the rest as
        // transit on the child kernel. This is the transitive
        // cascade — an ancestral `shared X` cell remains
        // visible to deep descendants regardless of how many
        // intermediate scopes' bodies skip the name.
        //
        // Honours Rule 1 (import resolution validated at
        // finalize), Rule 2 (write-through rewrite produces
        // the matching child input slot finalize-side),
        // Rule 4 (coordinate routing via IterationExtern
        // input-kind), Rule 5 (closure-binding economy —
        // unreferenced names skip cell attachment but still
        // ride the transit channel for grand-children).
        let parent_inner = self.lock_inner();
        let child_kernel = parent_inner.materialize_subscope(artifact.program.clone(), &[]);
        drop(parent_inner);

        let child_site = artifact.context.clone();
        let child_consumers = artifact.consumers.clone();
        let child_write_throughs = artifact.write_throughs.clone();

        Ok(ScopeKernel::new_with_write_throughs(
            name,
            child_kernel,
            child_site,
            child_consumers,
            child_write_throughs,
        ))
    }

    /// The Rule 2 write-through bindings carried by this kernel.
    /// Empty for the vast majority of kernels; populated only
    /// when the artifact's `finalize` rewrote a child export to
    /// a parent `shared` cell write.
    pub fn write_throughs(&self) -> &[WriteThroughBinding] {
        &self.write_throughs
    }

    /// Per-cycle Rule 2 commit: pulls every write-through's
    /// synthetic source output (`__write_<X>`) and stores its
    /// value through the corresponding child input slot for
    /// `<X>`. Because `materialize_wiring_from_outer` attached the parent's
    /// `SharedCell` to that slot, the write propagates to the
    /// cell, where it becomes visible to the parent and to any
    /// sibling that shares the same cell.
    ///
    /// No-op for kernels with no write-throughs.
    ///
    /// TYPE-STABLE (scope_model.md §"Type stability"): each pending
    /// value passes the same boundary as
    /// [`crate::kernel::PolydatKernel::commit_write_throughs`] —
    /// matching types pass, catalog adapters heal (widening), and an
    /// unhealable mismatch is an `Err` at the write site.
    pub fn commit_write_throughs(&self) -> Result<(), String> {
        if self.write_throughs.is_empty() {
            return Ok(());
        }
        let mut inner = self.lock_inner();
        // Two-pass to avoid holding two mutable borrows of the
        // kernel at once: pull each value first (the pull mutates
        // state), collect (idx, value) pairs, then write through
        // in a second pass.
        let mut pending: Vec<(usize, Value)> = Vec::with_capacity(self.write_throughs.len());
        for wt in &self.write_throughs {
            let Some(idx) = inner.program().find_input(&wt.export_name) else {
                continue;
            };
            let value = inner.pull_ref(&wt.source_output).clone();
            let slot_type = inner
                .program()
                .input_port_type_by_idx(idx)
                .expect("write-through idx resolved from find_input");
            let value = crate::kernel::state::check_write_through_type(
                &wt.export_name,
                &wt.source_output,
                slot_type,
                value,
            )?;
            pending.push((idx, value));
        }
        for (idx, value) in pending {
            inner.state().set_input(idx, value);
        }
        Ok(())
    }
}

/// Construct a workload-root [`ScopeKernel<RootMarker>`] from a
/// pre-compiled [`PolydatKernel`]: the door into the typed scope
/// path, where a host spawns children it keeps and releases by name
/// rather than dropping a kernel on the floor.
///
/// `PolydatKernel::build_subscope` no longer calls this. It used to,
/// to stand up a transient typed parent for the builder to validate
/// against, which is what kept the only constructor of a root scope
/// crate-private; the builder takes a [`ParentView`] now, so this is
/// the host's constructor and nothing else's.
pub fn wrap_root_kernel(
    kernel: PolydatKernel,
    label: impl Into<String>,
) -> Arc<ScopeKernel<RootMarker>> {
    let label = label.into();
    let name = ChildName::from_segments([label.clone()]);
    let site = SourceContext::new(label);
    Arc::new(ScopeKernel::new_internal(name, kernel, site, Vec::new()))
}

/// Typed Polydat matter accepted by both kernel-construction
/// paths — root and subscope. Opaque externally: the only way
/// to obtain a `PolydatMatter` value is via [`PolydatMatter::builder`].
///
/// Internally carries one of three input forms — fresh source,
/// pre-parsed statements (the "module parser" output), or a
/// pre-compiled program. The builder validates that exactly
/// one form is provided.
pub struct PolydatMatter<'a> {
    pub(crate) inner: PolydatMatterInner<'a>,
}

pub(crate) enum PolydatMatterInner<'a> {
    Source(SourceMatter),
    Statements(StatementsMatter),
    Program(ProgramMatter<'a>),
}

pub(crate) struct SourceMatter {
    pub(crate) label: String,
    pub(crate) body: String,
    pub(crate) result_bindings: Option<String>,
    pub(crate) inherited_outputs: Vec<String>,
    pub(crate) options: super::builder::CompileOptions,
}

pub(crate) struct StatementsMatter {
    pub(crate) label: String,
    pub(crate) statements: Vec<crate::dsl::ast::Statement>,
    pub(crate) result_bindings: Option<String>,
    pub(crate) inherited_outputs: Vec<String>,
    pub(crate) options: super::builder::CompileOptions,
}

pub(crate) struct ProgramMatter<'a> {
    pub(crate) program: Arc<crate::kernel::PolydatProgram>,
    pub(crate) iter_bindings: &'a [(String, Value)],
}

impl<'a> PolydatMatter<'a> {
    /// Begin building Polydat matter. The builder is the only
    /// constructor of `PolydatMatter`; the variants and their
    /// fields are not exposed.
    #[inline]
    pub fn builder() -> PolydatMatterBuilder<'a> {
        PolydatMatterBuilder::new()
    }
}

/// Builder for [`PolydatMatter`]. Configure exactly one input form
/// (source, pre-parsed statements, or program), plus optional
/// metadata, then call [`Self::build`].
#[derive(Default)]
pub struct PolydatMatterBuilder<'a> {
    label: Option<String>,
    body: Option<String>,
    statements: Option<Vec<crate::dsl::ast::Statement>>,
    program: Option<Arc<crate::kernel::PolydatProgram>>,
    iter_bindings: &'a [(String, Value)],
    result_bindings: Option<String>,
    inherited_outputs: Vec<String>,
    options: super::builder::CompileOptions,
}

impl<'a> PolydatMatterBuilder<'a> {
    fn new() -> Self {
        Self::default()
    }

    /// Diagnostic label for this matter. Surfaces in compile
    /// errors and the `__transient` parent name during the
    /// SubcontextBuilder dance.
    pub fn label(mut self, label: impl Into<String>) -> Self {
        self.label = Some(label.into());
        self
    }

    /// Provide Polydat source as a string. Mutually exclusive with
    /// [`Self::statements`] and [`Self::program`].
    pub fn source(mut self, body: impl Into<String>) -> Self {
        self.body = Some(body.into());
        self
    }

    /// Provide Polydat source as pre-parsed AST statements. Mutually
    /// exclusive with [`Self::source`] and [`Self::program`].
    /// Use when the caller has already run the module parser
    /// (e.g. when synthesising scope source from a structured
    /// model and wanting to skip a string round-trip).
    pub fn statements(mut self, stmts: Vec<crate::dsl::ast::Statement>) -> Self {
        self.statements = Some(stmts);
        self
    }

    /// Provide a pre-compiled program. Mutually exclusive with
    /// [`Self::source`] and [`Self::statements`]. Used for per-
    /// fiber state forks, comprehension iteration, and other
    /// call sites that hold a compiled program directly.
    pub fn program(mut self, program: Arc<crate::kernel::PolydatProgram>) -> Self {
        self.program = Some(program);
        self
    }

    /// Iter-var bindings applied before the parent binds the
    /// child. Only meaningful for the program form.
    pub fn iter_bindings(mut self, bindings: &'a [(String, Value)]) -> Self {
        self.iter_bindings = bindings;
        self
    }

    /// SRD-66 result-binding source. Folded through
    /// [`super::SubcontextBuilder::add_result_bindings`] at
    /// finalize. Only meaningful for source / statements forms.
    pub fn result_bindings(mut self, src: impl Into<String>) -> Self {
        self.result_bindings = Some(src.into());
        self
    }

    /// Names to pass through `mark_inherited_outputs` so the
    /// scope tree can distinguish own exports from cascade-
    /// inherited names. Source / statements forms only.
    pub fn inherited_outputs(mut self, names: Vec<String>) -> Self {
        self.inherited_outputs = names;
        self
    }

    /// Compile-time knobs (lib paths, strict mode, required
    /// outputs, cursor limit). Source / statements forms only.
    pub fn options(mut self, options: super::builder::CompileOptions) -> Self {
        self.options = options;
        self
    }

    /// Validate and produce typed matter. Errors when zero or
    /// more than one input form is configured.
    pub fn build(self) -> Result<PolydatMatter<'a>, String> {
        let forms = [
            self.body.is_some(),
            self.statements.is_some(),
            self.program.is_some(),
        ];
        let count = forms.iter().filter(|x| **x).count();
        if count == 0 {
            return Err(
                "PolydatMatter::builder: no input form set (use .source / .statements / .program)"
                    .into(),
            );
        }
        if count > 1 {
            return Err(
                "PolydatMatter::builder: multiple input forms set; choose exactly one".into(),
            );
        }
        let label = self.label.unwrap_or_else(|| "(matter)".to_string());
        let inner = if let Some(body) = self.body {
            PolydatMatterInner::Source(SourceMatter {
                label,
                body,
                result_bindings: self.result_bindings,
                inherited_outputs: self.inherited_outputs,
                options: self.options,
            })
        } else if let Some(stmts) = self.statements {
            PolydatMatterInner::Statements(StatementsMatter {
                label,
                statements: stmts,
                result_bindings: self.result_bindings,
                inherited_outputs: self.inherited_outputs,
                options: self.options,
            })
        } else {
            // program
            PolydatMatterInner::Program(ProgramMatter {
                program: self.program.expect("program form set per count above"),
                iter_bindings: self.iter_bindings,
            })
        };
        Ok(PolydatMatter { inner })
    }
}

impl PolydatKernel {
    /// THE subscope-construction path. Per the kernel-construction
    /// invariant, this is the ONE method through which a parent
    /// kernel produces a child. `compile_polydat` produces root
    /// kernels; everything else is a subscope and routes here.
    ///
    /// Cell propagation, scope-coordinate plumbing, and Rule 2
    /// write-throughs flow from `self` (the parent) into the
    /// returned child. Returns the child kernel plus any
    /// write-through bindings finalize produced (empty for the
    /// program-matter form, populated for the source-matter
    /// form when a result-LHS collides with a parent `shared`
    /// cell).
    pub fn build_subscope(
        &self,
        matter: PolydatMatter<'_>,
    ) -> Result<PolydatKernel, ContractViolation> {
        use super::module::BodyFragment;
        match matter.inner {
            PolydatMatterInner::Program(p) => {
                Ok(self.materialize_subscope(p.program, p.iter_bindings))
            }
            PolydatMatterInner::Source(s) => {
                let strict = s.options.strict;
                let label = s.label.clone();
                let mut builder: SubcontextBuilder<RootMarker> =
                    SubcontextBuilder::new(ParentView::of(self));
                builder
                    .context(SourceContext::new(s.label.clone()))
                    .mark_inherited_outputs(s.inherited_outputs)
                    .with_compile_options(s.options)
                    .body(BodyFragment::PolydatSource(s.body));
                if let Some(src) = s.result_bindings {
                    builder.add_result_bindings(&src)?;
                }
                let module = builder.finalize()?;
                let child = self.materialize_subscope(module.program.clone(), &[]);
                enforce_l2f_strict(&child, strict, &label)?;
                Ok(child)
            }
            PolydatMatterInner::Statements(s) => {
                let strict = s.options.strict;
                let label = s.label.clone();
                let mut builder: SubcontextBuilder<RootMarker> =
                    SubcontextBuilder::new(ParentView::of(self));
                builder
                    .context(SourceContext::new(s.label.clone()))
                    .mark_inherited_outputs(s.inherited_outputs)
                    .with_compile_options(s.options)
                    .body(BodyFragment::Statements(s.statements));
                if let Some(src) = s.result_bindings {
                    builder.add_result_bindings(&src)?;
                }
                let module = builder.finalize()?;
                let child = self.materialize_subscope(module.program.clone(), &[]);
                enforce_l2f_strict(&child, strict, &label)?;
                Ok(child)
            }
        }
    }
}

/// L2.f strict-mode hardening — when strict is on, escalate
/// silent Plan B fall-through to a hard error. Per
/// composition_substrate.md L2.f's strict-mode hardening
/// clause: an intermediate-layer `const X := <expr>` whose
/// RHS evaluates to `Value::None` at scope-init normally
/// falls through to the outer scope's `X` via the
/// conditional-shadow semantics (none_semantics.md). Strict
/// mode rejects this silent fall-through, forcing the author
/// to either ensure the const yields a defined value or
/// remove the binding and declare `extern X` explicitly if
/// fall-through to outer was intended.
fn enforce_l2f_strict(
    child: &PolydatKernel,
    strict: bool,
    label: &str,
) -> Result<(), ContractViolation> {
    if !strict {
        return Ok(());
    }
    let bindings = child.find_l2f_violations();
    if bindings.is_empty() {
        return Ok(());
    }
    Err(ContractViolation::StrictNonePropagation {
        bindings,
        site: SourceContext::new(label.to_string()),
    })
}

// `bind_program_under_parent` and the `build_kernel_under_parent_*`
// family of free-function bridges are removed. Per the kernel-
// construction invariant, only two paths exist:
//
//   1. Root kernel built from source via `compile_polydat` (and family).
//   2. Subscope kernel materialized by a parent kernel via
//      [`PolydatKernel::materialize_subscope`] or
//      [`PolydatKernel::build_subscope`] — all methods on
//      `PolydatKernel` itself, parent-supervised, typed.
//
// External callers go through these PolydatKernel-controlled paths
// directly; no free-function bridges remain.

// `instance_program` is removed. The two sanctioned construction
// paths are:
//
//   1. Root kernel built from source via `compile_polydat` family.
//   2. Subscope kernel materialized by an existing parent
//      kernel via `PolydatKernel::materialize_subscope` or
//      `PolydatKernel::build_subscope`.
//
// Tests that need a kernel from pre-compiled program matter use
// `PolydatAssembler::compile()` (which returns a root kernel) directly.