Callable Address Decontamination

Callable Address Decontamination

Public Janus APIs no longer ask users to pass callable addresses as integers.

Actor, grain, and tombstone-sink helpers in std.cluster.local now accept typed callables directly. Actor handlers use func(u64, i64) -> i64; tombstone sink callbacks use func(u64, u64) -> i32:

let actor_id = cluster.local_start_actor(
    system,
    0 as u64,
    cluster.POLICY_PERMANENT,
    user_handler,
)

The compiler lowers the callable to an internal runtime entry identifier when calling the bridge. That representation is not a user-facing u64 API.

Generated actor and grain starters remain the preferred surface for normal application code. Bridge wrappers may still carry RuntimeEntryId = u64 plumbing internally, but docs, examples, and teaching material should not ask users to manufacture function addresses with std.mem.address_of.