feat(any): make `Grouped` trait unsafe and encapsulate `AnyOutput`

fields

Declare `Grouped` as `unsafe trait` to make its soundness invariant
visible.
Make `AnyOutput.type_id` and `member_id` private; add public accessors
and
the `unsafe fn new_bare` constructor.

1 files changed, 11 insertions, 1 deletions

diff --git a/mingling_core/src/program/hook.rs b/mingling_core/src/program/hook.rs
index 48f632f..7d94a21 100644
--- a/mingling_core/src/program/hook.rs
+++ b/mingling_core/src/program/hook.rs
@@ -695,7 +695,17 @@ mod tests {
         }
     }
 
-    impl Grouped<MockHookEnum> for MockHookEnum {
+    /// SAFETY:
+    ///
+    /// This implementation is only for testing purposes to satisfy trait bounds.
+    /// Since this code only constructs `AnyOutput` and calls methods like
+    /// `downcast`, `is`, `restore`, `route_chain`, and `route_renderer` —
+    /// none of which involve `ProgramCollect::do_chain` or
+    /// `ProgramCollect::render` — the type/member_id correspondence is
+    /// never exploited in an unsafe way here.
+    /// The caller must ensure that the associated `member_id` correctly
+    /// corresponds to the type's role in the group.
+    unsafe impl Grouped<MockHookEnum> for MockHookEnum {
         fn member_id() -> MockHookEnum {
             MockHookEnum::A
         }