Okay, cool, but the collector is used at runtime with TinyScheme. _cons calls get_cell calls get_cell_x calls _get_cell calls gc for example; what makes you think otherwise?
Right. I found <https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox....> which agrees with you (on page 9). Guess it's down to defining "at runtime" now; the TinyScheme code (and GC) and Scheme code for the sandbox definitions are shipped to a user of macOS, and the user can invoke sandbox-exec with new sandboxing definitions (e.g. <https://jmmv.dev/2019/11/macos-sandbox-exec.html>), running TinyScheme and Scheme code. So I'd think Scheme is part of the entire sandbox system, even if not in the kernel?