Seal file's four variants, discriminated by kind() #645

Feature: #625 · Part 2, phase 5 of sealed-provider-resources.md. This phase is where the feature's goal is met.

Any, Regular, Directory, SymbolicLink each become a sealed interface over an unexported struct (any, regular, directory, symbolicLink). Announcements keep naming provider.Regular and friends, so all four fragments stay byte-identical.

The discriminator (ruling 6)

Each variant interface declares kind() <Interface>:

type Regular interface { Resource; kind() Regular }
type Directory interface { Resource; kind() Directory }

Go compares full method signatures, result types included, so *regular cannot satisfy Directory. And because a type may declare only one method named kind, mutual exclusivity is structural — a concrete type cannot be two kinds at once. Four differently-named markers would keep the kinds distinct but say nothing about exclusivity; one name with four result types says both, and says it to the compiler.

Why this is not optional

Regular and Directory have identical exported method sets — verified 2026-08-24:

Regular    Digest Equal Etag Exists MismatchesKind String Unmarshal{JSON,Text,YAML}
Directory  Digest Equal Etag Exists MismatchesKind String Unmarshal{JSON,Text,YAML}

As bare interfaces they are structurally interchangeable: r.(Directory) would succeed for a regular file and every kind-honesty guarantee from #616 would evaporate without a single test failing.

And file is not merely an aesthetic exception. Its variants carry zero exported fields, so tryHydrateStruct fills nothing yet still forges and returns an identity-less *Regular. Part 1 alone leaves the most-used provider open on the very path that motivates the feature.

Watch here

op.RegisterResourceMint gains four interface→struct registrations. *Any's resolution at activation (op.KindResolver) and #616's supersession rules must be re-pinned against interface types rather than concrete ones — that is where a silent regression would hide.