feat(any): make `Grouped` trait unsafe and encapsulate `AnyOutput`

fields

Declare `Grouped` as `unsafe trait` to make its soundness invariant
visible.
Make `AnyOutput.type_id` and `member_id` private; add public accessors
and
the `unsafe fn new_bare` constructor.

2 files changed, 16 insertions, 3 deletions

diff --git a/mingling_core/src/program/collection/mock.rs b/mingling_core/src/program/collection/mock.rs
index 5847f10..dbe4789 100644
--- a/mingling_core/src/program/collection/mock.rs
+++ b/mingling_core/src/program/collection/mock.rs
@@ -23,9 +23,12 @@ pub enum MockProgramCollect {
     Bar,
 }
 
-impl Grouped<MockProgramCollect> for MockProgramCollect {
+/// SAFETY: This is a mock type used only for temporary testing.
+/// It will never actually enter the macro system.
+/// The internal `panic!` ensures that `member_id` will never be executed.
+unsafe impl Grouped<MockProgramCollect> for MockProgramCollect {
     fn member_id() -> MockProgramCollect {
-        MockProgramCollect::Foo
+        panic!("Attempting to read an unsafe enum type");
     }
 }
 
diff --git a/mingling_core/src/program/hook.rs b/mingling_core/src/program/hook.rs
index 48f632f..7d94a21 100644
--- a/mingling_core/src/program/hook.rs
+++ b/mingling_core/src/program/hook.rs
@@ -695,7 +695,17 @@ mod tests {
         }
     }
 
-    impl Grouped<MockHookEnum> for MockHookEnum {
+    /// SAFETY:
+    ///
+    /// This implementation is only for testing purposes to satisfy trait bounds.
+    /// Since this code only constructs `AnyOutput` and calls methods like
+    /// `downcast`, `is`, `restore`, `route_chain`, and `route_renderer` —
+    /// none of which involve `ProgramCollect::do_chain` or
+    /// `ProgramCollect::render` — the type/member_id correspondence is
+    /// never exploited in an unsafe way here.
+    /// The caller must ensure that the associated `member_id` correctly
+    /// corresponds to the type's role in the group.
+    unsafe impl Grouped<MockHookEnum> for MockHookEnum {
         fn member_id() -> MockHookEnum {
             MockHookEnum::A
         }