►
Description
No description was provided for this meeting.
If this is YOUR meeting, an easy way to fix this is to add a description to your video, wherever mtngs.io found it (probably YouTube).
B
A
So
what
do
you
have
money?
I
thought.
A
C
A
C
A
D
D
So
it
looks
like
there
are
a
number
of
things
that
we
wanted
you
to
get
the
the
repo
into
the
format
that
we
want.
The
first
thing
would
be
to
move
the
shim
out
into
a
separate
repository
and
have
the
shim
be
built
for
different
targets
like
a
browser
target
module
target,
common
j/s
target
things
like
that,
and
so
that
the
the
the
actual
output
or
the
distribution
of
the
shim
wouldn't
actually
be
in
that
repo.
So
I
guess
what
I'm
looking
for
is.
D
A
A
B
D
D
B
B
D
A
I'll
just
mention
with
regard
to
the
testing
framework
right
now,
we're
not
running
tape
itself
inside
cess.
So
when
we
do
when
we
run
tests
within
that
testing
framework,
we
either
run
the
tests
themselves.
Not
incest
or
the
tests
are
written
in
this
very
awkward
style
where
the
test
begins
with
the
prelude
that
creates
a
new
system
and
then
proceeds
to
send
strings
into
the
cess
realm,
to
try
things
under
cess
and
clearly
what
we
should
be
doing
going
forward.
A
A
B
There
we
go.
This
is
a
pull
request
that
happened
literally
in
the
last
couple
of
hours
for
the
test
integration
repository,
which
is
a
new
initiative,
basically
at
the
lab
at
the
July
to
39b,
but
I
was
able
to
that.
I
was
invited
to
mark
and
I
concurrently,
pitched
starting
a
integration
tests
repository
to
catch
expect
accidents
in
the
making.
B
Integration,
repo
is
just
getting
started
frankly
in
its
integration
test
versus
the
test
uses
two
repository,
which
is
unit
tests,
okay,
and
that's
really
the
only
difference
tested
through
repositories
for
unit
tests.
This
protest
at
it
that,
where
multiple
features
come
together,
is
it's
a
baby?
Okay,
it's
a
baby.
We've.
B
A
So
I
think
because
you're
already
in
communication
with
them,
it
is
much
more
appropriate
for
that
news
to
come
from
them.
It's
also
more
powerful
for
the
news
to
come
from
them,
but
if,
for
some
reason
they
don't
want
to
be
taking
on
relaying
that
news
at
the
upcoming
meeting,
I'm
happy
to
relay
relay
the
news
as
a
as
a
short
formal
note
coming
in
that's.
B
A
B
In
addition,
if
anybody
here
has
local
tests
that
do
integration
by
all
means,
let's
here
in
terms
of
actually
being
able
to
run
the
tests,
as
I
said,
Leo
was
able
to
run
them.
I
have
not
been
able
to
yet
I've
not
had
more
than
about
three
minutes
to
really
look
at
it
to
see
how
they're
being
run
right
now.
So
I
can't
speak
to
just
the
fact
that
it
passed
on
three
on
three
platforms
and
failed
on
the
fourth,
but
due
to
a
bug,
probably
in
the
platform,
not
in
the
test.
B
B
The
in
the
pull
request
near
the
bottom
that
I
gave
you
guys
just
a
moment.
You,
okay,
request,
number
two
on
teeth
and
thirty:
nine
slash
test
integration,
I'm
feeding
this
for
the
bet
for
the
benefit
of
the
recording,
okay,
three
platforms:
past
set
of
tests
automatically
the
fourth
platform
did
not
model,
and
apparently
that's
due
to
a
bug
and
the
moddable
platform,
not
in
the
tests.
Okay,.
B
B
D
B
Right
so
I'm,
just
reading
straight
out
of
the
pool
request
here
on
v8
it
past
chakra
court,
past
javascriptcore,
past
spider
monkey
had
passed
model
have
failed,
saying
that
the
for
each
method
said
call
back,
there's
no
function.
Well,
I
double-checked
and
I'm
not
using
for
each
and
at
least
a
couple
of
these
tests.
B
B
A
D
Them
sure
well,
first,
I
just
want
to
clarify
Daria.
Were
you
talking
about
what
will
happen
with
the
document
or
what
will
happen
with
safe
modules
in
general,
I
thought
it
was
in
general,
okay,
okay,
in
that
case
after
this
I
want
to
present
about
the
document,
because
now
it's
a
github
repo,
but
anyway
sorry.
So
so
yes,
we
have.
B
D
B
Sorry
mark,
can
you
check
that
chat
window
I
sent
you
the
details
for
downloading
the
video
a
private
chat.
Yeah
like
you,
just
have
to
open
the
chat,
and
you
would
see
that
it's
yeah,
like
everybody,
can,
can
private
chat
or
chat
to
everyone
and
I
made
sure
this.
This
goes
directly
to
you
and
then
this
way,
it's
only
you
who's
handling
the
video
food.
You
know
like
shareable,
got.
B
D
So
we
did
some
planning
basically
so
for
our
first
version
obsess
that
we
think
people
might
be
able
to
use
for
real
security
purposes.
We
will
not
have
the
safe
modules
stuff
with
incest
at
that
point,
so
that
this
is.
This
is
after
basically
the
the
version,
one
or
I
guess
we're,
calling
it
version.
0.9
SS
that
we
will
actually
have
the
safe
modules,
so
assess
is
a
necessary
condition
of
the
safe
modules
plan.
A
D
So
it's
pretty
simple:
let
me
just
share
a
link
to
this
or
nice.
D
Okay,
so
we
haven't
broken
down
these
steps
apart
from
the
sus
person,
one
which
is
its
own
separate
internal
document
that
we
have,
but
we
have
translate
the
module
syntax
and
the
script
syntax,
there's
the
PRT
loader,
which
requires
a
purity,
checker,
I'm,
sorry,
pure
loader.
That
requires
a
purity
checker.
A
Yeah
Dejan
had
started
writing
a
purity
checker
based
on
the
contents
of
the
dress
of
the
draft
safe
modules
document
the
appendix
where
Kate
and
I
tried
to
write
down
some
some
static.
Checking
rules
that
we
would
hope
would
would
provide
a
guarantee
that
all
imported
values
were
pure
values
and
that
no
external
effects
happened
during
loading
from
the
pure
loader.
B
D
A
B
A
Atma
script
modules
without
a
parser,
but
we
don't
want
to
do
the
hints
of
if
we
do
the
handling
of
yeah
some
modules
at
the
same
level
as
the
SSP
one
itself,
then
we
destroy
the
smallness
of
cesky
one.
We
include
a
JavaScript
parser
in
our
trusted
computing
base
and
and
javascript
is
a
notoriously
hard
language
to
parse,
accurately
I
would
say
it's
a
nightmarishly,
hard
language
to
parse
accurately
and
there's
actually
one
issue
in
Appendix
B.
That
causes
it
to
be
fundamentally
ambiguous.
A
Preventing
you
from
parsing
it
accurately,
although
we
can
do
something
about
that,
so
the
layering
we
want
to
do
in
the
shim
again
not
of
the
proposal
is
to
translate
module
syntax
into
scripts
attacks.
This
overlaps
with
the
job
that
many
packages
do,
and
this
may
be
using
or
adapt
and
code
from
or
something
existing
packages,
but
we
somehow
need
to
translate
everything
into
script,
syntax
so
that
we
can
then
hand
it
to
assess
the
one
to
evaluate
commonjs
modules.
A
A
A
Then
it
would
come
time
to
act
on
the
hypothetical
manifest
that
we've
been
looking
at
as
a
description
of
how
to
create
separate
compartments
where
you
can
load
different
packages,
the
modules
in
different
packages
into
different
compartments
and
wire
them
up
in
a
least
Authority
manner,
as
described
by
the
manifest,
and
that
will
not
be
a
you
know.
Some
some
old
code
will
not
succeed
at
running
in
that
environment
because
it
does
not.
A
To
in
turn,
generate
the
manifests
and
the
simple
attenuators
that
the
manifests
would
be
applying
do
that
automatically
so
that
many
old
applications
can
be
moved
into
not
what's
called
a
narrower
Authority.
Let's
not
use
the
term
least
authority
for
the
firm
for
what
we're
doing
with
to
the
food,
but
narrower
Authority,
which
is
the
least
authority
that
things
seem
to
be
using
right
now.
We
want
to
provide
it
to
generate
a
manifest
instead
of
simple
attenuators
that
express
giving
them.
A
You
know
the
approximately
the
authority
that
they're
currently
using,
so
that
nothing
breaks
anything.
That's
using
a
ridiculous
amount
of
xxx
continues
to
use
a
ridiculous
amount
of
authority,
but
the
test
case
for
oh
and
then
I'm,
sorry,
I'm
doing
the
last
two
bullets
together
generate
the
manifest
and
simple
attenuators
and
then
sort
of
the
the
test
case
scenario.
Wise
for
all
of
this
are
things
like
the
events
train
incident.
A
Did
we
do
something
that,
coupled
with
the
plausible
sociology
of
distributed
development
that
we
imagined
could
arise
from
this
set
of
towing
that
things
like
the
event
stream
attack
would
not
have
been
able
to
succeed
as
easily
and
and
I'm
putting
it
in
a
very
modest
way
there?
Because
all
you
know
all
of
this
together
is
bringing
about
an
approximate
is
enabling
an
approximation
of
least
Authority
or
least
used
Authority
for
initialization.
A
D
A
Oh
right
and
one
thing
I
wanted
to
bring
up,
there's,
as
especially
with
Michael
online
mm-hm
is.
Since
we
wrote
this,
we
also
talked
about
a
step
towards
a
pure
loader
and
charity.
Checker
is
to
use
Michael's
meta,
interpretive
Jesse
and
with
use
it
to
create
a
self-contained,
Jesse
and
Jesse.
That's
not
executing
in
the
context
success,
but
just
a
a
self-contained
scandal
and
Jesse
and
to
first
write
and
Jesse
is
already
specifying
that
all
modules
must
be
purified
and
all
important
values
must
be
pure.
A
A
Passing
the
purity
checking
rules
and
being
loaded
by
the
pure
loader
that
those
two
things
together
guarantee
that
the
loaded
values
are
pure,
even
if
the
author
of
the
module
was
malicious
that
sound.
This
question
for
full
sex
is
going
to
be
a
difficult
thing
to
really
gain
good
confidence.
Long
most
of
the
issues
arise
in
doing
that
soundness
for
Jesse,
but
jesse
is
sufficiently
small
and
self-contained
and
easy
to
reason
about
and
I
think
it's
a
much
better
first
target
for
that
sounding.
D
C
High
mark
so
just
tell
you
know
where
I'm
not
as
far
as
modules
and
so
on
and
Jesse
and
Jessica
I'm,
currently
implementing
some
things
that
do
dynamic
checking's
of
the
static
rules,
so
I'm
going
to
first
fail.
The
in
that
the
evaluation
before
the
static
rules
are
implemented
to
tell
people
how
they
need
to
avoid
that
failure
and
then
that's
something
we
can
turn
off
if
we
need
to
that
that
later
time,
okay.
A
That's
it
that's
very
nice,
because
if
you
can
so
yes,
since,
since
your
met
interpreting,
you
can
dynamically
check
the
thing
that
we're
trying
to
statically
guarantee
and
then
a
way
to
demonstrate
unsoundness
is
to
write
a
module
that
passes
the
static
checks
and
then
fails
the
dynamic
tracks.
That
would
be
a
demonstration
of
unsoundness
of
the
static
tracks.
A
So,
in
order
to
dynamically
check
that
some
so
you're
not
dynamic,
met,
interpretive
Jessie
in
JavaScript
would
only
be
meta
interpreting
the
code,
all
the
objects,
the
data
I
it
wouldn't
be,
including
the
Jessie
objects
in
JavaScript
objects,
I
assumed
it
would
just
be
using
the
JavaScript
objects
that
Jessie
that
Jessie
code,
if
run
directly,
would
have
created.
That
was
my
guess.
Yeah.
C
So
I
struggled
with
this
for
a
little
while
and
I
started
off
in
some
kind
of
insane
way
that
Haskell
does
it
with
thunking,
but
essentially
I
went
back
to
using
just
the
plain
JavaScript
objects
and
what
I'm
settled
on
is
having
a
weak
weak
maps
to
illustrate
what
the
properties
of
those
objects
are.
I.
C
So,
for
example,
an
object
that
is
being
constructed
but
is
not
yet
escaped.
Okay
is
flagged
with
a
weak
map
so
that
I
can
see
if
that
object
actually
is
trying
to
escape
and
then
prevent
any
further
mutations
of
it.
So.
A
A
Okay
and
right.
A
So
there's
the
purity
checker
in
order
to
enable
us
to
write
code
where
we
don't
have
to
manually
harden
every
export.
The
assumption
is
that
we're
interacting
with
the
loader
that
hardens
all
exported
values
and
only
and
therefore
and
and
the
static
tracks
are
trying
to
guarantee
us
that
that,
if
that,
if
the
export
value
is
hardened,
then
the
exported
value
becomes
pure
I,
don't
see
how
one
would
turn
that
into
a
dynamic
check
without
including
the
objects.
C
Yeah,
so
this
is
handled
basically
by
another
flag,
or
we
say
once
we're
actually
exporting
something
like
when
we
are
trying
to
do
the
escape
that
both
turns
off
the
ability
to
mutate
the
object
with
with
computers,
lookups
and
so
on
or
sorry
it.
It
basically
requires
that
the
harden
call
is
being
made
as
that's
what
we're
meeting
for
Jesse,
so
we're
not
assuming
anything
about
the
loader
hardening
objects
for
us.
Oh.
B
A
A
The
purity
checking
rules
under
the
assumption
that
requiring
manual
hardening
everywhere
was
going
to
be
notationally,
to
painful,
to
ask
programmers
to
do
and
that
well
and
because
harden
itself
has
a
certain
Pleasant
transitivity
through
navigating
own
properties
that
if
we
can
assume
that
export
values
are
hardened,
then
we
can
substantially
unburden
the
notational
awkwardness
of
the
code
that
the
programmer
needs
directed
okay
and
if
that's
not
true,
if
it
turns
out
that
it's
not
that
unpleasant,
then
we're
doing
a
lot
of
work
that
we
don't
need
to
be
doing.
Yeah.
C
So
part
of
this
was
the
idea
that
we
might
be
running
Jessie,
not
under
an
SES
environment
necessarily
but
under
SES,
without
safe
modules.
Essentially,
is
what
I've
been
assuming
so
far.
Okay,.
C
So
this
is
what
stylistically
stuff
looks
like
that's
a
good
example.
C
Yeah
I
don't
have
it
everywhere,
but
essentially
this
is
all
I
needed
for,
say
an
importer
where
I
have
making
porter
here,
I
make
this
bigger
and
the
smaller
and
this
okay,
so
I
have
an
importer,
that's
making
porter
creates
and
right
now
the
only
semantics
are
basically
imported
escapes.
Make
importer,
so
I
need
to
harden
it
and
then
make
importer
itself
needs
to
be
hardened,
since
it
escapes
the
module
entirely.
Oh
I.
A
See
right,
I,
sighs
what
I've
been
forgetting
in
going
through
this
line
of
reasoning?
Is
that
another
way
in
which
jesse
is
much
simpler
than
cess
is
the
only
export
syntax
that
in
jesse
is
the
export
default
and
therefore
you
only
ever
exporting
one
thing
and
therefore
the
extra
notational
overhead
that
our
clearly
checking
rules
could
have
helped
leave,
is
just
one
additional
call
to
heart.
One
on
the
export
default
line,
correct.
C
A
Okay,
so
assuming
that
the
purity
checking
issue
is
still
there
still
even
for
Jessie,
assuming
the
manual
calls
to
harden
for
the
export
value,
the
soundness
issue
is
still
substantial
and
interesting,
because
you
have
to
successfully
analyze
anything
that
can
result
in
top-level
state
or
conservatively
rejected.
So,
for
example,
can
you
use
an
expression
containing
a
function?
Call
to
create
the
data
that
is
used
to
initialize
top-level
State?
No.
A
C
A
C
So
at
the
bottom
of
Jessie,
where
do
we
have
this?
As
he
just
need
expression
statement?
It's
a
module
expression!
Okay!
Here
we
go.
C
A
B
A
Good
waiting
for
somebody
to
ask
that
Oh
Justin
is
a
further
sub
setting
of
JavaScript
that
is
bigger
than
Jason
and
much
smaller
than
Jesse.
It's
essentially
a
subset
of
the
JavaScript
expression,
syntax,
where
we,
where
the
the
subset
of
main
restrictions
on.
What's
what
to
omit
even
from
the
expression.
Syntax
is
omitting
function,
definitions,
omitting
anything
which
would
define
a
variable
which
is
actually
in
the
expression.
Syntax
only
function,
definition
so
reduces
that
previously
self
problem
and
omitting
anything
that
itself
would
cause
a
side
effect.
You
know
expression,
syntax,
that
that
that
would
normally.
A
Cause
a
side
effect
on
execution,
the
key
things
that
Justin
does
have
beyond
just
normal
operators
and
data
literals
is,
it
has
variable
usage,
so
you
can
use
occurrences
of
variables,
all
of
which
are
free,
because
you
have
no
defined
occurrences
and
variables
and
nothing
that
can
introduce
a
name
into
scope
or
in
fact,
even
introduce
a
scope
boundary.
So
all
variable
uses
are
free
and
it
has
function
calls
now.
Another
way
in
which
it's
a
subset
is
Jetley.
Has
a
whitelisted
set
of
primordial
x',
so
h,
jesse
program
can
assume
correct.
A
A
A
A
place
where
Justin
program
is
expressed
its
expressed
assuming
a
certain
set
of
variables
in
scope,
and
that
must
be
so
that
usage
of
Justin
must
be
coordinated
with
an
execution
context
where
the
execution
context
provides
variables
and
scope
that
neatly
meet
the
expectation
under
which
Justin
is
written.
So
Justin
itself
only
defines
the
syntax
and
code
execution.
A
Semantics
does
not
define
the
free
variable
naming
environment,
that's
up
to
each
usage
of
Justin
to
define
separately,
and
the
result
is
that
if
you
provide
a
set
of
variables
and
scope,
all
of
which
are
side-effect
free,
then
then
the
resulting
justin
code
cannot
express
side
effects.
If
all
the
things
that
it
can
do
are
total,
then
the
justin
program
is
total.
All
of
them
are
deterministic.
Then
the
justin
program
is
deterministic.
A
I,
don't
remember,
we
should
take
a
look,
especially
since
you're
projecting
you
have
the
grammar
right.
There.
B
C
B
A
C
Mutters
Oh
that'll,
never
listen,
Jason!
That's
right!
That's
why
I'm
getting
confused
so
data.
Literal
is
just
one
of
these
things.
Alcohol's
true
numbers
string,
so
I
haven't
included
an
array
or
record
yet
which
I
should,
but
they
should
be
pure
versions
of
rayon
record
that
can
only
have
property
definitions
that
are
not
extensible,
because
in
an
array
a
plain
array
is
to
find
as
elements
which
are
then
extended.
Excitment
assign
expressions
which
justin
extends
to
be
function,
calls
and
so
on.
Yeah.
A
Just
to
avoid
confusion
here,
the
thing
that's
named
a
sign
expression
in
Jason
and
Justin.
It's
named
scientist
sign
expression
because
in
the
successive
definitions
of
supersets,
it's
the
thing
that
in
Jesse
and
full
JavaScript
is
the
productive
is
the
thing
that's
used
as
the
production
name,
decisive
sine
X
/.
A
C
A
A
C
So
I
can't
remember
where
we
mentioned
that
I
think
it
was
in
an
issue
somewhere
I'm
the
Justin
repository
where
we
were
talking
about
I,
believe
you.
This
is
right.
I've
made
the
assertion
that
export
defaults
should
be
the
only
thing
that
Jesse
allows,
as
well
as
no
top-level
mutable
state
in
module.
C
C
A
C
A
Think
what
Kate
and
I
were
trying
to
do
in
the
rules
we
wrote
down
was
to
allow
function,
calls
under
very
restrictive
condition
so
where
we
could,
where
the
function
itself
had
to
be
defined
in
the
same
module
and
we
could
carry
through
an
implied
purity
of
the
result
of
the
function,
call
analyzing
through
the
body
of
the
module.
Yes,.
A
B
C
A
Right
on
so
one
of
the
things
that
come
up
in
JavaScript,
which
should
come,
should
come
up
in
Jessie,
although
in
a
much
more
model
form
is
identity,
discontinuity.
So
one
of
the
things
that
you
know
make
one
of
the
differences
between
a
making
function.
That's
invoked
multiple
times
versus
a
string
of
code.
That's
evaluated
multiple
times.
Is
that
a
is
that
things
that
are
defined
outside
of
the
making
function,
which
are
therefore
necessarily
pure,
can
have
unforgeable
identity?
That
is
semantically
significant,
correct.
C
A
And
that
can
be
useful,
especially
for
trade
marking
or
branding
whatever
you
want
to
call
it.
Basically,
if
I
know
that
this
object
was
made
by
this
here,
piece
of
code
in
this
module,
even
if
it's
made
by
a
different
instance
of
this
module,
it's
as
long
as
it's
made
by
this
code
in
this
module,
then
I
can
believe
that
it
obeys
some
invariance
or
has
yeah.
C
So
here's
one
example:
I
have
I,
don't
think
I'm
still
a
little
bit
uncertain
is
how
so
other
thing
to
work,
because
I
think
we
need
the
case
where
we
can
harden
the
value
before
we
assign
it
to
an
expression
and
still
call
that
pure,
but
essentially
the
left
cur
object
is
is
used
elsewhere
as
a
constant
and
I
do
believe.
This
is
something
that
can
be
made
at
the
top
level.
Ok,.
A
C
A
C
A
That
you're
no
longer
able
to
accurately
track
it
mm-hmm
statically
in
terms
of
we're
at
mobile
care.
So
basically,
you
know
somewhat
like
the
ownership
checking
rules
of
rust,
whereas
as
any
at
any
point
where
it
might
become
alias,
it
may
or
may
not
be.
The
value
of
the
variable,
depending
on
other
things,
would
be
an
escape
yeah.
A
C
A
A
A
A
Better
suppose
that
I
should
be
able
to
reason
about
us,
essentially
as
if
they're
written
in
a
language
without
side
effects.
So
I
can
reason
about
them
as
if
side
effects
didn't
exist,
except
that
the
cracked
side
effects
the
side
effects.
The
side
effects
syntax.
That
I'm
allowing
could
really
be
thought
of
as
a
shorthand
for
let
a
new
thing
be
like
the
old
thing,
except
for
this
difference.
Right.
C
A
As
long
as
there's
no
possible
Ilya
Singh
that
I'm
uncertain
about
for
the
same
object,
then,
if
I
instead
rewrote
it
to
make
a
new
object
from
the
old
object,
except
for
one
property
difference,
then
the
program
would
again
become
side-effect
free.
As
far
as
data
values
are
concerned,
you
still
have
side
effects
on
on
mutable
and
captured
mutable
variables,
and
that's
intentional,
but
we
want
to
enable
the
reasoning
about
that
kind
of
side
effect,
though
like
Jesse
to
be
such
that
you
can
safely
reason
about
it
as
if
there
are
no
mutable
properties.
A
C
C
A
A
If,
if
left
recur
is
a
object,
that
I've
been
statically
tracking
and
I've
been
statically
tracking,
the
creation
of
named
properties
on
that
object,
then
oh,
this
may
be
hit,
may
be
hits
the
other
issue
that
that
we
resolved
in
the
issue
tracker
for
Jessie,
which
I'll
make
sure
in
a
moment.
But
my
thinking
was
that,
given
all
those
static
checking
rules
at
this
point,
I
really
know
where
food
came
from.
C
B
A
A
A
Say
I
say:
ok,
so
remove
left
recur.
So
what
recur
was
a
bad
example?
Is
there
room
yes,
exactly
little
f3
car
from
line
13
on
line
11.
C
A
A
B
A
X
dot
foo
equals
88,
okay,
okay,
that's
that's
a
more
clarifying
example
and
on
line
17,
let's
put
another
open.
Curly
closed,
coil,
okay,
okay!
Now
the
in
order
to
reason.
So
the
thing
the
thing
that's
scary
is
the
thing:
that's
on
line.
14
looks
like
an
assignment
write
in
JavaScript.
Semantics
is
an
assignment
and
on
the
expected
you
know
in
the
normal
expected.
Implementation
of
see
is
an
assignment
but
I.
C
C
A
C
A
C
C
A
A
A
Is
doing
something
different
on
this
example:
it's
with
with
the
value
being
either
a
empty
object
or
actually
with
the
value
being
be
empty
object.
It's
identical
with
the
original
left
recur.
Example.
That's
actually
a
very
nice
example
where
it's
different,
so
object
dot,
freeze
of
peg
constant
freezes.
A
The
outer
object,
the
object
containing
a
two
string
method,
but
it
does
not
freeze
the
two
string
method:
mm-hmm,
a
hardened
on
peg
constant
freezes,
both
if
two
string,
rather
than
returning
a
string
where
it
was
returning
a
mutable
object,
then
neither
object
got
freeze
nor
harden
would
have
any
effect
on
the
mutability
of
the
object.
The
two
string
returns.
A
Hardened
maintains
a
memo
of
values
all
to
be
hardened.
You
know,
for
purposes
of
this
conversation,
we
can
assume
that
that
memo
starts
out
empty.
Okay,
then,
on
initializing
a
cess
round.
We
actually
let
me
just
change
the
previous
statement.
We
assume
that
the
memo
is
initially
populated
with
all
of
the
primordial
zuv
assess
Ralph.
So
all
the
primordial
czar
already
known
to
be
hard.
Okay,.
A
So
then,
what
the
recursion
of
harden
is
it
enumerates
all
of
the
only
properties
of
the
object
that
is
hardening
it
from
sorry?
It
first
freezes
it
so
that
so
that
the
own
properties
that
it
obtains
cannot
change,
because
the
object
invariants
that
ECMO
script
enforce
that
once
the
object
agrees
that
it's
frozen,
it
cannot
change
what
it
reports
as
its
own
properties
over
time.
So
there's
a
utility
guarantee
there.
We
then
ask
for
its
own
properties
and
for
each
own
property
we
see.
Is
it
a
data,
property
or
an
excess
of
property
and.
A
A
A
A
When
we
finish
the
recursion
on
own
properties,
we
then
I'm,
sorry
and
the
recursion
for
each
out
for
each
of
the
objects
encounters
in
the
recursion.
It
both
freezes
and
Harden
acts.
Both
freezes,
acts
and
adds
X
to
a
set
of
objects
that
we're
going
to
harden
and
the
object
that
X
directly
inherits
from
is
objects
that
must
be,
must
have
been
hardened
or
must
must
be
hard
must
must
must.
A
So
then,
once
the
only
property
recursion
terminates,
this
is
the
most
precise
I've
ever
stated
it,
and
this
this
way
the
this
rule,
by
the
way
that
I'm
describing
comes
from
Bryan
and
Dean
I,
had
a
much
worse
wall
in
my
original
conception
apartment
then
for
each
object
in
the
must
be
hard
set.
It
checks
that
that
object
is
either
in
the
already
hardened
set
for
the.
This
is
an
object.
I
must
harden
set
if
it
finds
any.
If,
if
it
finds
anything
that
fails
that,
then
it
throws
an
error.
A
So
it's
done
partial
side
effects,
it's
frozen
some
stuff
and
then
harden
fails
with
the
throwing
error
and
that's
a
dangerous
state
and
even
in
Jesse
there's
a
catch.
So
you
can
end
up
with
a
by
catching
that
by
doing
a
hardened
and
catching
that
throw
we
need
to
reason
about.
We
probably
need
to
make
that
error,
uncap
and
Jessie,
which
is
oh,
my
god.
Oh
that's
an
extremely
messy
issue
that
I
honestly
have
not
thought
about
yet,
and
it
clearly
might
be
a
tremendously
dangerous
issue.
Well,.
A
A
Think
that's
a
good
hypothesis,
in
which
case
it
might
not
be
as
bad
for
Jessie
as
I
was
just
starting
to
panic
about
any
case.
If
all
of
those
checks
pass,
then
all
of
the
objects
in
the
eye
must
harden
these
are
already
known,
frozen
and
already
known
to
only
lead
to
other
objects
that
are
in
one
of
these
two
sets
I'm
sorry
they're
in
the
set
of
things
that
I
most
heartily
I
already
verified.
A
Things
that
I've
already
verified
that
the
other
set
things
that
must
be
hard
doesn't
contain.
Anything
that
is
not
in
one
of
the
other.
Two
sets
now
verified
that
everything
I've
gotten
to
by
transitive
property
walk
transitive,
stable
property,
because
each
object
is
frozen
first
before
I
ask
the
question,
so
the
transitive
enumeration
only
leads
to
objects
that
are
either
already
hardened
or
that
I'm
about
to
hardened
on.
A
So
at
this
point,
I
simply
copy
the
objects
I'm
about
to
hardened
into
the
already
hardened
set
into
the
memo,
and
then
at
that
point
harden
completes
successfully.
Returning
the
the
argument,
the
the
object
that
on
which
I
started
all
of
this-
and
that
is
the
full
operational
definition
of
hardened
to
the
Jessie
programmer,
because
they
for
dynamic
values
for
values
that
have
escaped
for
some
meaning
of
escape,
which
we're
now
trying
to
pin
down
the
Jessie
programmer
can
reason
as
if
all
values
that
it
creates
that
are
creating.
A
B
C
Mark
I
just
tried
to
take
a
step
back
and
suggest,
rather
than
the
static
analysis.
Proceeding
from
top
to
bottom.
I
would
see
him
more
as
proceeding
bottom-up,
where
we're
we're
harden
is
looking
at
the
transitive
closure
of
the
objects,
but
it's
not
looking
at
the
transitive
closure
of
the
objects,
return,
values.
C
A
C
A
C
A
C
A
A
A
C
B
C
Likewise,
X
dot,
foo
X
is
hardened
here,
so
we
can
assume
that
anything
that
it
refers
to
is
also
needs
to
be
hardened.
So
here
we
see,
X
has
a
function
in
it.
Now,
if
something
like
this
happened,
where
we
passed
in
Y
and
said,
x,
dot
y
equals
y
we're
hardening
X,
and
we
just
kind
of
have
to
assume
that
Y
already
passes
this
test.
C
A
A
B
A
So,
if
I
understand
how
such
top-down
reasoning
would
proceed,
I
would
say
that
any
of
those
would
be
adequate
totally
if
the
top
down
reasoning
will
precise
enough
and
any
of
those
would
be
adequate
because
the
result
is
passes.
The
result
has
the
in
Garrett
the
run
time,
invariant
invariant
to
a
chronic
guarantee.
In
addition,
if
y
26
were
written
as
bar
open
Hardin
of
left
recur,
that
would
also
be
adequate.
A
C
A
C
A
A
A
Oh
no
I'm,
sorry
I
can't
write
it
because
it
was
already
caught
by
the
earlier
rules
that
we
were
already
talking
about
so
I'm
wrong.
I'll,
just
say
it
for
clarity
for
the
record.
What
I
was
worried
about,
which
is
top
level
I
can
mutate
top
level
module
state
without
violating
you're,
not
just
create
mutable
top
level
modules.
There's
worried
that
I
can
mutate
it
as
long
as
I.
A
A
C
A
Share
Option
in
all
kinds
of
places,
if
you
go
to
your
on
my
Mac
I,
have
a
little
taskbar
item
that
says:
share
in
it.
Sorry
SUNY!
Oh
ok,.
A
A
C
B
A
C
A
There's
something
weird:
were
it's
not
my
tab.
Emacs
is
not
recurring.
It's
an
left
margin
which
is
mysterious
to
me.
Oh
he's
not
in
JavaScript,
oh
okay,
I
said
text;
okay,
it's
not
in
JavaScript
that.
B
A
A
A
C
B
C
Is
rejected
by
other
static
analysis,
which
is
saying:
why
is
not
a
funk
is
not
an
object.
You
are
preparing
in
that
function,
so
you
can't
assign
to
it.
I'm
sorry
say
that
again,
so
why
dot
count
equals
mm-hmm?
Why
is
passed
in
so
we
can't
statically
prove
that
is.
It
is
a
object
that
you
are
just
in
the
process
of
construction.
A
A
A
C
A
A
A
Then
clearly,
the
returned
value
cannot
be
a
means
to
sense
the
mere
the
the
possibly
changed
state
that
remains
that
semantically,
the
top-level
state
of
the
moderate
top-level
state
of
module.
You
know,
you're
ignoring
garbage
collection,
some
sense
still
exists,
but
but
clearly
these
these
static
checking
rules
must
soundly
guarantee
that
the
returned,
pure
value,
cannot
sense.
It.
A
C
C
C
A
A
Oh,
oh
right,
right
now,
I'm
sorry
I'm
still
confusing
the
module
initialization
code;
no!
No!
No!
No!
This
would
still
right.
This
is
a
counterexample
if
they're
sharing
the
top
lobe.
If
they
both
import
the
same
module,
then
they
both
get
foo
and
when
one
of
them
invokes
foo,
they
get
the
first
time
it
invokes
through
you
get
a
one
next
time
you
invoke
through
you
get
a
two.
A
B
B
Yeah
yeah,
no,
like
that.
That's
that
that
really
really
you
know
I
was
starting
to
think
okay.
Well,
then,
we
only
really
are
dealing
with
factories,
and
every
factory
has
to
be
invoked
as
an
as
a
separate
graph
for
every
single
node
in
the
graph.
That
is
using
it.
You
know,
so
we
were
creating
all
these
duplications
there's
no
harm
in
creating
a
duplicated
result
from
food,
because
you're
exporting
default
and
you're
calling
a
factory
you're,
obviously
a
factory
for
a
primitive
or
a
factory
for
something
you
know
whatever
it
so.
B
A
Let's
stay
on
the
particular
safety
question,
but
then
transition
that,
because
it
is
all
germane
but
but
but
if,
if
this,
if
the
static
checking
rules,
we
currently
have
in
mind
allow
this
and
we're
agreed
that
food
is
not
sure
which
seemed
an
inevitable
conclusion
here,
then
the
static
checking
rules
we
have
in
mind
are
not
Sam.
Okay,
mark.
C
B
Maybe
not
exported
at
all.
That's
that's
all
because
if
you're
higher
than
top
level
State,
then
you
cannot
like
well
harden
not
not
like
not
read
on
not
immutable.
Just
just
you
cannot
define
you
properties
on
to
it
so
or
are
you
not
able
to
refer
to
to
make
this
references
again
say
I
forget
the
sorry
I
I
know
like
I
forgot.
What
harden
does
and.
A
C
You
know
to
me
it
does
seem
to
be
a
top-level
issue,
because
if
we
did
the
same
kind
of
thing
with
the
make
foo
but
have
counter
be
a
Const
within
make
food
or
let
counter
then
we're
not.
We
don't
technically
have
the
same
problem
as
long
as
we're
not
calling
make
food
implicitly
in
our
default
export.
B
A
B
A
C
A
Like
export
make
food
cloud,
then
there
is
no
top-level
state,
the
Jesse
rules
by
design
dual
now
let
variables
inside
functions
in
particular.
That's
the
way
you
express
look
normal
local
mutable
objects
in
an
object.
Capability
style
is
to
express
objects
that
are
hardened,
but
not
pure.
That's
an
that's
intended
to
be
easy
to
express
for
runtime
behavior,
but
we're
trying
to
forbid
its
expression
as
behavior.
C
Okay,
so
I
have
I
have
a
different
way
of
saying
this.
What
if
we
say
that
harden
of
a
pure
expression
is
a
pure
expression,
as
we
did
earlier
and
now
typically
say
that
the
only
things
that
are
allowed
to
be
exported
are
pure
expressions,
so
you
can
export
make
food
call.
You
can
only
export
make
food
hard
to
make
food.
A
A
A
A
B
B
I
ask
one
question
before
we
do
sure,
so
what
you
did
right
here
is
eliminated
the
potential
for
shared
state
of
count
between
two
and
importing
modules
or
yeah.
So
it
is
a
shared
state
like
a
module
having
a
single
state
that
it
shares
with
its
importing
modules
like.
Is
there
a
way
to
have
a
count
that
is
not.
B
A
A
A
This
module
as
written
here
is
that,
for
this
one
is
easy
to
to
look
at
it
and
say
this
should
pass
past
the
purity
character,
even
when
run
directly
without
a
pure
loader
that
that
directly,
that
does
its
own
freezing
of
things
on
hardening
of
things.
This
one
has
written
clearly
only
exports
of
pure
value
make
foo
as
pure
and
therefore
can
be
safely
shared
among
things
that
cannot
that
should
not
be
able
to
communicate
with
each
other.
The
sharing
that
make
through
provides
no
communications
channel.