Function refuse_kernel_calls_with 

pub fn refuse_kernel_calls_with(
    program: &CompiledProgram,
    interner: &Interner,
    backend: &str,
    entries: &HostEntries,
) -> Result<(), String>

refuse_kernel_calls, judging what the host’s own entries reach as well as Main — the same roots a module built with those entries lowers.