From 1803dd427416ef19918c0ec7d50093b6d45f29af Mon Sep 17 00:00:00 2001
From: 魏曹先生 <1992414357@qq.com>
Date: Tue, 21 Jul 2026 19:16:10 +0800
Subject: feat(any): make `Grouped` trait unsafe and encapsulate `AnyOutput`
 fields

Declare `Grouped` as `unsafe trait` to make its soundness invariant
visible.
Make `AnyOutput.type_id` and `member_id` private; add public accessors
and
the `unsafe fn new_bare` constructor.
---
 mingling_core/src/program/collection/mock.rs |  7 +++++--
 mingling_core/src/program/hook.rs            | 12 +++++++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)

(limited to 'mingling_core/src/program')

diff --git a/mingling_core/src/program/collection/mock.rs b/mingling_core/src/program/collection/mock.rs
index 5847f10..dbe4789 100644
--- a/mingling_core/src/program/collection/mock.rs
+++ b/mingling_core/src/program/collection/mock.rs
@@ -23,9 +23,12 @@ pub enum MockProgramCollect {
     Bar,
 }
 
-impl Grouped<MockProgramCollect> for MockProgramCollect {
+/// SAFETY: This is a mock type used only for temporary testing.
+/// It will never actually enter the macro system.
+/// The internal `panic!` ensures that `member_id` will never be executed.
+unsafe impl Grouped<MockProgramCollect> for MockProgramCollect {
     fn member_id() -> MockProgramCollect {
-        MockProgramCollect::Foo
+        panic!("Attempting to read an unsafe enum type");
     }
 }
 
diff --git a/mingling_core/src/program/hook.rs b/mingling_core/src/program/hook.rs
index 48f632f..7d94a21 100644
--- a/mingling_core/src/program/hook.rs
+++ b/mingling_core/src/program/hook.rs
@@ -695,7 +695,17 @@ mod tests {
         }
     }
 
-    impl Grouped<MockHookEnum> for MockHookEnum {
+    /// SAFETY:
+    ///
+    /// This implementation is only for testing purposes to satisfy trait bounds.
+    /// Since this code only constructs `AnyOutput` and calls methods like
+    /// `downcast`, `is`, `restore`, `route_chain`, and `route_renderer` —
+    /// none of which involve `ProgramCollect::do_chain` or
+    /// `ProgramCollect::render` — the type/member_id correspondence is
+    /// never exploited in an unsafe way here.
+    /// The caller must ensure that the associated `member_id` correctly
+    /// corresponds to the type's role in the group.
+    unsafe impl Grouped<MockHookEnum> for MockHookEnum {
         fn member_id() -> MockHookEnum {
             MockHookEnum::A
         }
-- 
cgit