Reuse checked reflection inputs before acquiring controller ownership

src/execution-world/public-reflection.ts

@@ -1,26 +1,21 @@
-import { compileInspectionTemplates } from "./inspection.js";
-import { compileKernelProgram } from "./kernel.js";
+import { compileInspectionTemplates, type InspectionKernel } from "./inspection.js";
 import { hexDigest, type ExecutionPlan } from "./plan.js";
 import { clientContractCatalog, type ExecutionInstallation } from "./installation.js";
 import { publicOperationContract, publicQueryContract } from "./client-contracts.js";
 
-/** Explicit public projection. Never serialize conformance storage or package ports. */
-export function publicDefinitionSnapshot(plan: ExecutionPlan, installation: ExecutionInstallation) {
+/** Explicit public projection of checked inputs. Never serialize conformance
+ * storage or package ports, or recompile a historical Candidate at runtime. */
+export function publicDefinitionSnapshot(
+  plan: ExecutionPlan,
+  installation: ExecutionInstallation,
+  kernel: InspectionKernel,
+) {
   const workspace = plan.definition.workspace;
-  const kernel = compileKernelProgram(plan) as {
-    operations: {
-      atom: string;
-      interface: string;
-      operation: string;
-      unsupported: string | null;
-      effect: string;
-      targets: string[];
-    }[];
-  };
   const catalog = clientContractCatalog(
     plan,
     installation,
     installation.packages.map((pkg) => pkg.revision),
+    kernel,
   );
   const rows = {
     atoms: workspace.atoms.map((atom) => ({ id: atom.id, name: atom.displayName, documentation: atom.documentation })),
@@ -68,7 +63,7 @@ export function publicDefinitionSnapshot(plan: ExecutionPlan, installation: Exec
       ),
     })),
     queries: [
-      ...compileInspectionTemplates(plan).contracts.map((descriptor) => ({
+      ...compileInspectionTemplates(plan, kernel).contracts.map((descriptor) => ({
         id: JSON.stringify([descriptor.package, descriptor.query]),
         name: "Public inspection",
         package: descriptor.package,