Passing lambdas into child models allow them to execute arbitrary parent model code

See https://stackoverflow.com/a/54369364/145080.

That's a pretty awesome use, but it will also break bad when running multiple children simultaneously. Child models, by default, run in parallel, which means there's no way to control what order they will run code in (even with random-seed). Normally, this is fine, since child models can't directly affect each other. But passing procedures in mean order matters, so the results of the above code will be unpredictable, even if you use random-seed. Worse, child models don't synchronize on the same object (otherwise parallelism would be pointless), and global variables are not effectively marked volatile, if two child models run

set foo foo + 1

in the parent, they may both read the un-updated foo before the other hasn't finished its update, resulting in foo being incremented once, not twice.

The other reason why this isn't supposed to work is more philosophical. All inter-level logic is supposed to live in the parent. Allowing any child to talk directly to any other child results in code that is very difficult to reason about and debug.

The safest option here is to just block anonymous procedures from being passed around (as I thought they were). Another option, which addresses the technical concern, but not the philosophical, is to disable parallelism if anonymous procedures are being passed around.

No source files, tests, or entry points are named. Start by reproducing the linked anonymous-procedure example with multiple child models and inspect how procedures are passed and parallel execution is coordinated; done means the chosen safety policy is enforced and covered by regression tests.