►
Description
We discuss the unsoundness that was uncovered with respect to `Pin` and possible ways to resolve it.
A
So
boats
I
think
you
said
you
had
an
outline
in
your
head.
How
to
present
I
feel
like
we
should
start,
maybe
at
I/o
know
about
the
rescue
but
I
found
when
I
was
reading
over
this.
That
I
was
kind
of
confused
on
a
lot
of
fairly
basic
things,
and
you
would
be
helpful
to
just
kind
of
lay
out
the
problem.
Yeah.
A
D
B
So
there
are
two
unsound
missus
with
there
were
three,
but
we
won
was
to
agree,
was
just
a
bug
and
we
fixed
it.
So,
looking
at
the
tool
that
still
remained
today
and
like
so
his
background,
pin
is
a
contract
between
three
different
parties.
Basically,
the
three
parties
are
the
person
who
defines
the
target
tights
that
the
pin
pointer
points
to
then
there's
a
person
who
calls
a
method
that
takes
a
pin
reference
to
better
know
type
and
then
there's
a
person
who
defines
the
actual
pointer
type
days
and.
A
B
Target
yeah
and
then
the
third
one
is
P,
which
for
the
most
part,
has
been
a
standard
library
that
they're
a
few
like
pin
you
tools,
also
create
sort
of
counts
and
pin
sells,
but
basically
no
one
is
really
yeah.
I
guess
the
standard
library
is
technically
will
stay
on
libraries,
defining
pin,
which
creates
the
contract
right.
B
A
B
B
A
B
D
F
B
I
mean
it's
a
sort
of
in
a
retrospectively.
It
explains
what
happened
right,
because
we
we
proved
correct,
like
pin
of
a
human
reference
instead
of
a
box,
and
then
we
realized
we
could
abstract
it.
As
long
as
we
made
a
constructor
and
safe
oops,
there
was
a
there
were
ways
to
do
it.
I'm,
like
they
get
around
that
right
so
like
when
we
abstracted
that
we
didn't
then
prove
that
we
had
like
really
short
up
the
problem.
A
A
To
Ralph
is
I
would
sort
of
find
it
helpful
to
show
maybe
I'm
unique
here,
but
I
know
it
involves
like
pin
as
mute
and
there's
a
kind
of
hole
through
the
coherence
rules.
But
if
maybe
it's
helpful,
if
we
simplify
it
even
more
in
say
like
just
pretend
the
coherence
was
wrong.
Weren't
there.
You
can
see
why
this
is
clearly
wrong,
but
we
thought
that
wouldn't
happen,
but
we
were
wrong.
A
B
Well,
because
that's
the
fundamental
route,
but
there's
also
the
core
since
I
wrote,
so
that's
what
they
all
share
is
that
you
construct
a
valid
pin
pointer
to
let's
say,
address
a
but
somehow,
in
your
code,
your
height,
your
pointer
type
swaps
out
and
creates
a
pointer,
the
dereferences
to
address
B,
which
is
not
actually
pinned.
What
you
haven't
proven
is
pinned,
and
so
you
you
know
you
meet
the
pin
requirements
somehow
and
then
you
actually
get
a
pin
pointer
to
a
different
address
which
is
not
necessarily
pinned.
C
D
B
B
D
Yes,
and
previously,
it
was
also
possible
to
have
an
evil,
partial
EQ
or
hash
and
I.
Don't
know
what
other
trade
things,
but
we
short
circuit
at
those.
Basically,
the
user.
No
long
has
any
control
over
which
partially
Hugh
gets
called.
It's
just
going
to
be
the
default
one
and
then
the
one
for
the
target
type.
But
the
prototype
has
no
saying
it.
Yeah.
E
D
G
C
F
A
B
So
yeah
and
I
think
the
only
way
actually
get
like
observed.
I
like
I
missed
this
you
just
using
manual
like
it
doesn't
work
with
like
features
in
a
way
or
anything,
but
it
does
actually
show
the
like
fundamental
in
correctness,
which
is
that
so
you've
pinned
a
box
playing
to
my
type,
which
contains
another
pointer
to
a
mic
Heights
inside
of
it,
and
then
your
dealer
commute
actually
points
to
the
unpinned.
So
there's
two
values
here:
the
pinned
one
and
the
intend
one.
B
C
B
D
B
B
C
B
We
won't
disagree
that
this
impulse
should
not
be
allowed
to
exist,
I
think,
but
the
input
is
the
bad
one,
or
rather
for
the.
We
was
agreed
that
it
actually
no
I
think
we're
also
just
think
that
that
imple
should
not
be
sufficient
to
call
as
mute
I.
Think
Chris
Rafat
had
a
market
rate,
so
you'd
have
to
add
unsafe,
indirect
mute
to
my
type,
and
that
would
solve
it,
whereas
I
want
to
just
make
it
so
that
that
would
be
an
incoherent
imple.
F
D
Y-You
can't
write
it.
If
you
can't
write
the
info,
then
yeah
like
either
either
either
the
if
they're
writing
the
input
is
okay,
but
not
sufficient
for
pinning,
because
pinning
requires
an
extra
checkbox
to
be
ticked.
Whether
user
says
unsafe,
infinity
review
blah
blah
blah
something
something
like
basically
certify
I
verify
that
my
dear
F
isn't
evil,
or
we
make
it
that
the
impact
can't
be
written
in
the
first
place
so
that
they
can't
be
in
either.
B
I
think
that
Niko
had
the
right
like
approach.
This
would
be
possibly
we'd
want
to
do
this
with
like
language
magic
today,
but
in
the
long
term,
what
we're
looking
at
is
these,
like
negative
impulse,
were
negative,
impose
an
assertion
that
this
simple
will
never
exist
and
then
later
on,
like
be
used
in
like
coherence,
proof
that
I
can
type
does
not
implement
a
trait.
So.
B
D
C
A
E
E
B
Right
and
I
think
that
when
Nico
I
heart
last
month,
we
sort
of
got
to
it
cuz
right
now.
The
way
it
works
is,
if
you
define
a
pointer
type
that
can
be
pinned
you
make
it
unsafe,
it's
unsafe
to
construct
it,
and
so
you
have
to
somehow
you
know
if
you
prove
that
you're
you
have
to
prove
that
your
pointer
type
meets
the.
C
Requirements
but
it
say
that
we
have
the
market
rate
Beyonce's
market
rate
the
chicky
forward,
compatible
with
like
removing
that
requirements
in
the
future.
If
we
find
out
well,
I
mean
the
unsafe
mercury
will
be
stable,
so
will
always
exist
yeah,
but
you
can
implement
it
for
all
types.
So
you
can
effectively
remove
the
requirements
by
even
say
infinitely
four
times.
C
G
B
F
D
B
I
mean
you
can
construct
a
pin
like
none
of
it.
None
of
the
pin
requirements
matter
if
the
target
is
on
pin.
The
problem
is
that
course
in
size
allows
you
to
take
a
pin
pointer
to
it
type
that
implements
on,
pin
and
then
coerce
it
into
attacked
it
a
pointer
to
a
type
that
implements
it
does
not
employ
templates.
Okay,.
B
B
D
I
that
that
makes
sense,
but
I
can't
formally
effort.
So
we
had
a
longest
cut.
Well,
I
was
a
single
lunch,
but
it
was
a
long
lunch
discussion
with
some
people
here
about
trying
to
to
put
that
into
a
formal
invariant,
because
the
the
the
the
key
question
when
coming
back
to
centrioles
is
how
much
of
this
can
be
formally
prove
more.
Whatever
is
we
need
to
figure
out
what
is
the
invariant
for
pin
p
for
any
arbitrary
type?
P
yeah?
D
Basically
make
it
so
that
the
that
the
invariant,
currently
the
problem
is
pin
P,
you
can
say
for
any
type
he
doesn't
even
have
a
quantifier
to
state
PP
trait
bond
is
the
only
on
the
constructor,
not
on
the
time
we
have
to
define
the
invariant
for
any
time,
and
so
we
can't
talk
about
the
target
type.
Even
it's
completely
unclear.
D
So
the
invariant
for
pin,
M
plus
mu
T
should
be
exactly
the
pinned
mutable
reference
invariant
that
we
have
for
the
old
style
of
the
idea
and
so
on,
but
that
require
that
can
only
work
if
this
invariant
is
defined
by
the
respective
pointer
type,
which
means
constructing
the
pin
of
the
prototype
must
have
a
way
to
learn
about
that
American
and
it
can't
with
pin
U,
which
has
no
bout.
Okay,.
D
So
maybe
it's
easier
to
say
what
the
environment
would
be
could
be
if
we
redesigned
this
from
scratch
and
I'm
not
saying
this
is
the
best
way
to
design
it.
But
if
we
could
make
breaking
changes
because
then
once
one
way
we
could
imagine
the
variant
to
be
is
if
pin
had
a
bound
on
the
type
yeah
and
then
okay,
this
in
here
would
be
just
a
P
I.
Guess
it's
a
it's
actually
and
the
but
the
actual
invariance.
D
D
F
A
D
B
I
think
like
do
you
meet
that
you
like
that
I,
don't
think,
there's
any
difference,
even
improving
it,
because
in
order
to
get
like
sitting
outside
course
in
sized,
you
have
new
unchecked,
which
is
found
a
DRF,
and
so
you
prove
the
invariant
in
the
input
on
ample.
Where
you
call
new
and
checked
the
same.
Is
that
that
location
that
unsafe
block,
where
you're
calling
deeper
anyone
checked
is
to
where
you
are
making
the
proof
and
just
like
in
this
case,
would
be
on
the
beer
up
in
the.
E
D
The
two
are
connected
is
allowed
to
talk
about
what
does
it
mean
to
have
a
pinned
instance
of
a
type
at
a
particular
memory
location?
And
so
then
several
generators
will
say:
oh
that's,
that
means
I
can
have
pointers
into
that
same
space
or
intrusive,
linked
lists
will
be
able
to
say
all
the
other
list.
Elements
can
point
to
those
locations
stuff
like
that,
and
so
the.
D
A
point
it
has
to
prove
that
when
you
County
reviewed
on
a
pinned
thing,
then
that's
okay,
first
of
all,
so
on
a
pinned,
mutable
reference
to
the
type,
because
that's
not
obvious
that
that's
okay
right,
the
definite
type
signature
says
you
can't
call
it
an
immutable
reference,
but
now
you're
calling
it
on
the
pinch.
Mutable
reference,
just
not
the
same
thing
to
the
contract.
Would
someone
have
to
say?
Oh
when
you
call
the
refuge
on
a
peak
mutable
reference?
D
First,
that's
an
okay
thing
to
do,
and
second,
then,
the
return
thing
is
also
a
pinch
mutable
reference
yeah.
So
the
argument
is
documents
of
the
compute
reference.
The
argument
is
just
the
pointer
type.
Yes,
so
when
you
call
when
you
call
it
on
the
pinned
version
of
this
pointer
like
a
pink
box
or
pinned
arch
arc
or
something
that's
an
okay
thing
to
do,
and
the
return
type,
the
reference
value
is
a
pink
mutable
reference.
D
That
would
be
the
kind
of
contract
that
would
have
to
be
proven
when
you
say
unsafe
in
PDF
in,
except
when
you
say
an
simply
ref
in
you
can't
talk
about
the
ref
mute
because
it
doesn't
inherit
from
that.
So
we
need
an
other
theory
of
pin,
mute
and
an
other
theory
of
chrome
and
it
kind
of
gets
annoying.
A
I
thought
would
be
I
feel
more
confused
than
when
I
went
in,
but
I
I.
What,
when
I
thought,
might
be
helpful
for
me
like
it
seemed
like
we
were
kind
of
having
a
bit
of
a
stylet
and
then
stylistic
but
a
debate
about
where
to
put
the
same
sort
of
proof
obligations
and
how
how
to
make
sure
they're
maintained
this.
A
B
Well,
I
feel,
like
I,
think
that
we
got
to
this
in
one
hour
101
about
this,
that
with
the
straights,
then
you
put
on
each
trait
like
the
invariant
like.
If
this
implements
pindy
refute,
then
you
know
etc.
It
must
therefore
uphold
this
invariant,
but
without
them,
what
you
have
is
either
this
implements
drf
mute
and
a
post
invariant
or
it
does
not
equal
India
revenue
and
I.
Think
the
issue
is
that
proving
the
something
decide
upon
tariff
mute
formally
relies
on
understanding,
formalizing
our
coherence
rules,
but.
D
Also,
that
is
kind
of
them,
so
in
the
in
the
thing
that
I've
been
very
foolish
caching
here
there
is
this
intermediate
step.
When
you
differ,
when
you
say
unsafe
in
PDF
in
you
pick
a
you
define
what
is
a
pin
variant
of
my
pointer
type,
you
can
have
prepare
your
prototype
for
being
allowed
to
pinning
was
an
in
our
formal
version
of
this.
D
We
have
a
mutable
reference
that
we
have
a
pink
meter
for
F
and
there
are
just
two
different
types
like
they
were
in
both
original
FBI
and
so,
but
the
print
mutable
reference
part
of
that
doesn't
actually
exist
as
a
type
in
rust.
But
in
this
sketch
proposal
here,
when
you
say
unsafe
in
PDF,
pin
four
amperes
enmity,
you
would
then
pick
Dax
types,
invariant,
basically
saying
it's
a
mutable
reference
to
something:
that's
in
a
pin
state
the
pin
type
state.
B
B
D
E
D
Have
to
set
things
up
in
a
way
that
this
can
work,
and
in
particular,
we
like
this
will
be
a
constraint
when
we
set
up
this
invariant,
because
we
don't
know
anything
about
the
target
type
if
we
require
the
target
type
to
be
dear
F
in
in
my
proposal,
that's
I
think
what
we
have
to
do
if
you
could
only
call
pin
new
on
at
least
when
we
do
it
completely
formally.
I
haven't
actually
found
an
example.
D
E
D
D
E
D
Is
very
difficult
right,
I.
Basically,
what
saying
is
the
proposal
that
I
originally
made
in
that
threat?
I
think
we
have
an
idea
for
how
to
pull
it
through
and
it
wouldn't
rely
on
coherence
and
there
would
be
I
said
the
explicit
places
where
the
user
would
have
to
pick
certain
invariants,
though
I'm
not
entirely
sure
how
to
actually
communicate
that,
because
it's
very
formal
also
it
would
have
a
problem
with
pin
you.
D
And
so
then,
after
that
we
thought
a
bit
about
what
would
the
invariant
look
like
for
your
proposal
bolts,
and
we
also
had
some
ideas
there.
So
maybe
it
makes
more
sense
to
move
to
that,
because
I'm
not
actually
I,
haven't
yet
had
time
to
write
this
up
but
I'm
not
actually,
as
opposed
to
you
proposed
anymore,
as
I
used
to
be
basic.
So.
B
I
would
always
want
to
make
the
argument
from
fro,
so
stepping
out
of
formalism,
which
is
I
think
in
practice
most
unsafe
ap
is
that
people
use
will
not
be
formally
proven
and
right
now,
like
we
have
a
coherence
model
where
you
can
reason
about.
You
know
you
can
informally
people
reason
that
I
type
this
on
communitary
and
as
a
rule.
This
holds
very
well
because
our
coherence
model
doesn't
allow
our
orphan
Impuls.
B
The
one
exception,
of
course,
is
that
we
have
this
fundamental
loophole,
and
so
that's
why
our
shared
and
middle
reference
is
heavies
ability
to
have
orbit
and
post
it.
We
didn't
think
about.
We
would
design
a
safety
eye,
but
basically
I
think
that
people
are
going
to
write
unsafe
API
is
that
soundness
depends
on
the
coherence,
rules,
working
and
I.
Think
that
that
we
should
like
just
endorse
and
accept
that
as
like
a
way
of
designing
api's,
even
if
it's
difficult
to
formalize
and
so
I
think
that,
like.
B
C
B
An
idea
of
the
kanika
is
like
the
way
that
I
think
that
people
should
design
unsafe
api's
in
rust.
Basically,
that,
like
you,
should
be
able
to
reason
about
I
know
that
Noah
this
symbol
doesn't
exist,
and
so
I
know
this
type
doesn't
have
this
behavior
and
so
I
know
that
this
is
sound
like
it's
how
people
are
so.
D
We
basically
I
mean
I,
don't
have
to
elaborate
on
that
much
here,
but
we
try
to
do
without
a
sketch.
What,
on
the
very
end,
could
look
like
for
a
pin
that
is
based
on
that
principle
and
I
I
mean
I,
think
boats.
You
will
not
be
very
surprised
because
it's
probably
what
your
head
in
your
head
all
along,
but
it
took
me
a
bit
to
get
any
idea
of
what
what
a
formal
version
of
this
could
be.
D
Pin
of
P
to
be
kind
of
three
things,
one
for
each
of
the
three
traits,
which
is
that
first
of
all,
if
P
implements
DRF,
then
calling
D
F
on
that
value.
On
that
specific
value
V,
we
must
okay
and
must
return
a
pin
and
person
T.
So
now
pin
this
pin
and
person
T
I,
don't
I!
So
yeah
syntactically,
that's
informed
because
we
defining
pin
of
P.
So
we
can
you
spin
off
P,
but
we
have
already
defined
yeah.
B
B
D
So
this
would
be
more
like
pincher
of
T
and
then
calling
and
then
furthermore,
if
P
implements
the
ref
mute,
then
calling
the
ref
mute
on
that
value
must
be
okay
and
must
return
a
pin,
mute
of
T
and
furthermore,
if
P
implements
clone
then
well
the
corresponding
thing.
It
must
be
okay
to
call
clone
and
that
value
and
the
shrine
thing
is
a
is
a
parent.
B
B
D
D
Correct
to
call
DF
on
the
ampersand
T
that
we
just
got
and
it
will
return
an
ampersand
solely
on
the
on
the
on
the
on
the
ampersand
on
the
the
P
that
we
just
got
and
it
will
be
okay
and
the
return
value
will
be
a
rather
shared
reference,
pin
shared
reference
because
there's
nothing
short
of
up
in
so
pin.
You
now
becomes
easy,
and
second,
the
the
in
correctness
at
least
I
mean
or
in
corazon
size.
B
D
And
crucially,
this
is
kind
of
works,
because
we
are
basically
saying
we
call
like
variant
talks
about
the
specific
value
of
V.
But
the
funny
thing
it
specifies
the
properties
of
the
value
of
V,
not
in
terms
of
the
length
has
to
be
less
than
the
capacity
or
something,
but
only
in
terms
of
when
you
call
some
functions
on
V
or
actually
on
ampersand
V,
because
you
have
a
passing
shadow
references.
D
A
I
rephrase
this
to
see.
If
I
understand
it.
Yes,
you
think
we
were
saying
is
so
pin
share
I
kind
of
wrote
it
there,
but
my
understanding
was
this
is
sort
of
a
fiction
we're
using
in
the
proof,
essentially
we've
defined.
Some
invariant
for
an
insanity
and
pin
share
is
kind
of
a
type
that
meets
that
invariant.
It
has
that
very.
D
Well,
did
the
invariant
for
for
a
percent
T
is
this
is
a
this
is
a
pointer
to
some
piece
of
memory
that
satisfies
whatever
the
sharing
invariant
forty
years
and
the
invariant
for
pin
share
of
T
is.
This
is
the
point
of
some
memory
that
says
tell
us
whatever
the
pinned
shared
a
memory
and
for
that
Tevas?
D
Every
type
has
kind
of
these
kappa
types
that
can
be
and
can
be,
mutable
can
be
shared,
it
can
be
a
pin,
it
can
be
unpinned
mm-hm,
and
this
is
basically
that
switching
out
the
type
state
of
the
point
e,
which
we
don't
have
a
good
way
to
talk
about
in
surfer,
syntax
and
I,
don't
know
how
to
explain
it
without
a
white
button.
All
of
that
and
some
some
pictures
but
I
hope
it's
makes
some
sense.
A
Yes,
I
think
it
did
and
we're
kind
of
I
think
I
think
what
you're
saying
is
that
we
can
sort
of
define
the
behavior
of
at
the
CMT
like
what
you
were
where
you
were
before
saying
had
to
be
localized
to
the
info.
We
can
kind
of
define
it
with
this
pin
share
and
then
say
when
you
call
new
unchecked
has
to
be
correct
with
respect
to
that
behavior
that
we
defined
well.
D
D
That
we
care
about
for
any
other
paint
prototype
is
that
you
can
call
the
FDA
food
and
clothes
you
don't
need
any
will
be
basically
only
these
three
hot
ripples,
so
to
speak.
Only
these
three
statement
that
it's
okay
to
call
three
certain
functions
on
them
and
then
everything
has
got
reduced
to
the
two
kind
of
well-known
paint.
Yeah.
B
I
think
that
makes
sense,
because
that
also
covers
so
like
manually
drop,
for
example,
everyone's
trf
New
York
nude.
But
it's
not
can't
be
pinned
because
it
is
just
like
a
new
type
because
that
then
moving
the
manually
drop
drop
moves
to
another
pin
and
you
need
to
express
the
invariant
that
that's
separately,
because
manually
drops
to
your
F&E
or,
if
you
just
don't
implement,
don't
return
a
pincher
and
opinion
right.
That's
like
they
don't
they're
in
the
the
pointers
that
return
in
that
type
state.
D
You
have
to
basically
at
that
point
true,
very
horrible
approval
to
do
program,
verification
for
the
different
degree
of
mute
with
this
when
called
on
the
specific
pointer
value
that
is
passed
on
you,
unchecked,
yes
and-
and
you
have
a
shortcut
if
you
can
prove
that
a
certain
input
doesn't
exist.
So
this
ties
into
being
a
between
negative
reasoning,
yeah
yeah.
D
E
B
A
Plus
I
think
this
I
was
gonna,
raise
this
point
about
orphan
and
Bulls,
and
orphan
rules
like
I
I'm.
Pretty
the
orphan
rules,
first
of
all,
over
from
roles
are
kind
of
weird
like
they're.
Okay,
if
you
only
have
one
type,
you
can
kind
of
understand
them,
but
yeah
it's
an
input
type.
It's
really
easy
to
get
confused
and
it's
not
hard
to
imagine
us
trying
to
change
them
and,
in
fact,
I
think
I
tagged
to
some
people
today
on
a
proposal,
essentials
not
defined
proposal.
A
D
C
A
C
B
C
A
D
A
It
seems
pretty
safe
to
assume
box
will
never
be
copy,
but
we
can't
state
that
in
a
way
that
the
word
from
rules
can
observe
and
there's
plenty
of
examples
like
this.
So
if
you
did
I
think
there's
no
I
may
have
forgotten
about
a
complication
but
I
think
if
you're
allowed,
if
we
were
able
to
have
negative
impulse,
we
would
conceivably
be
able
to
do
such
extensions
like
that.
But
I'd
have
to
work
it
out
a
little
bit.
Let's.
B
A
D
A
D
B
Well
thinking
everything
backed
it
in
4-pin,
what
we
might
even
want,
like,
though
I,
don't
think
that
we
should
add
is
the
language.
But
we
kind
of
want
is
like
a
statement
that
this
has
a
definitive
resolution
right
either
you
haven't
been
negatively
implemented,
direct
mute
or
even
put
a
dimmer
from
you
like
through.
C
B
D
Also
nice
about
this
proposal
is
that
we
could.
We
could
formally
prove
things
about
it
without
modeling
the
entire
trade
system.
It
was
the
the
plan
that
we
have
is
basically
to
have
one
single
file
in
our
proof
that
that
summarizes
the
assumptions
we
are
making
about
trade
in
fills
that
exist
and
don't
exist.
So
we
would,
we
would
somehow
somewhere
say
we
assume
that
am
percent.
D
He
implements
DRF
and
here's
the
code
and
we
assume
that
ampersand
he
doesn't
implement
a
were
a
fruit
and
that
these
assumptions
about
the
trade
universe
would
be
collected
in
one
file
and
then
we
could
clear
that,
under
those
assumptions
all
of
the
pin
contract
stuff
works
out,
but
we
wouldn't
have
to
actually
prove
that
trade
system
correctly
and
forces
these
assumptions.
That
would
be
a
separate
pool,
that's
kind
of
nice,
because
it
means
we
can
do
something
without
modeling.
B
This
also
like
I,
was
just
saying:
no
I
just
asserted
that
people
will
be
depending
on
the
orphan
rules
anyway,
but
it
is
like
plausible
to
like
tell
people
that.
Well,
if
you
want
to
be
really
correct
and
you
know
resistant
to
any
changes
that
we
make
in
the
future,
you
should
also
add
this
little
line
of
code
that
makes
it
guarantee
that
you'll
never
like.
If
we
have
the
ability
to
express
these
new
language,
then
I
think
we
would
say
what
I
think.
We
would
say
that
that
is
the
only
way.
A
E
There
was
a
detailer
that
I
don't
think.
I
was
working,
we're
on.
We
pointed
out
somewhere
early
on
that
fundamental
traits
were
the
cases
that
we
were
concerned
of
things
like
box
and
ampersand,
but
then
Ralph
mentioned
arc
and
RC
is
being
concerned
and
I'm
still
not
clear
on
whether
it
doesn't
sound
like
it's
actual
known
sound.
This
holds
there
is
that
so
the
thing
I
might
jump
to
is
this
whole
question
of?
Oh,
we
need
to
like
add
negative
angles
for
a
library.
B
The
two
reference
types
box,
RC
n
arc-
so
all
of
them,
except
for
box
and
middle
reference-
need
to
have
a
negative
Impala
tear
of
mute
and
then
a
middle
references
have
a
negative
Apollo.
So.
B
Yeah,
so
fundamental
is
the
only
way
you
can
actually
have
unsoundness
that
we
know
of,
because
fundamental
actually
allows
you
to
implement
DRF
mute
for
a
shared
reference.
It
does
not
allow
you
to
put
Dirac
mute
for
arc
because
arc
isn't
fundamental,
like
assuming
the
orphan
rules
are
correct,
there's
no
problem
with
arc,
but
this
allows
us
to
not
assume
the
orphan
rules
are
correct.
This
allows
us
to
just
assert
that
we'll
never
implemented
a
refuge
even
no
matter
what
we
do.
The
or
controls
I
see.
A
B
Both
have
a
constructor
called
pin
just
like
box
tones
that
creates
a
pinned
or
seen.
I
was
looking
at
the
from
impulse,
but
okay,
they
have
a
method
on
this
yeah
because
they
can't
have
a
from,
like
so
box,
also
has
from
box
to
box
pin
box.
But
you
can't
have
that
with
RC
arc,
because
you
could
have
another.
You
can't
anymore.
G
B
Back
negative
impulse
for
this
purpose,
or
we
could
I
mean
or
today
people
would
have
it
technically
sounds
possibly
unsound,
but
in
real,
like
fundamental,
isn't
unstable
and
we
don't
know
any
way
other
than
fundamental
to
get
around
this
so
for
custom
fighter
types
like
they
would
be
like
sort
of
in
this
state
but
see
the
long
stuff
is
in
today.
Remember
it's
technically
unsound,
but
there
isn't
really
a
solution
in
a
long
term.
We
have
a
solution.
B
E
D
B
C
B
D
A
D
A
Question
yeah,
I,
think,
I,
think
boats
and
I'm
inclined
to
agree
would
say
no,
because
we
should
be
guaranteed
that,
unfortunately,
we
didn't
because
of
the
fundamental
thing
we
don't
have
a
way
yeah
so
I
think
that
oh
and
because
we
don't
have
negatives
like
if
we
have
the
ability
to
say
negative
things,
and
we
could
say
it
and
then
you
can
say:
you're,
not
you're.
Relying
on
this
explicit
witness
of
negative
reasoning
right.
A
B
B
Though
the
impulse
fine,
as
long
as
it's
just
that
a
user
could
defined
their
own
course
and
size
for
their
pointer
type,
that
does
not
meet
the
pin
requirement
in
the
same
way
that
they
can
call.
It's
like
a
safe
way
to
call
new
unchecked.
Basically,
because
you
call
pit
new
and
then
use
course
in
size
to
give
it.
B
No,
no,
because
course,
and
size
is
the
way
of
friday,
creating
a
constructor,
because
you
do
pin
new.
Then
you
have
a
pin
of
a
pointer,
say,
2
y
32,
then
you
can
cast
use
of
course,
inside
to
your
pointer
to
dine
display,
they're,
no
longer
necessarily
implement
some
pin.
You
swap
it
out
somehow
with
something
else
it
implements
display,
but
it's
not
actually
on
pin.
D
B
F
D
A
C
C
D
A
D
B
D
For
this
team,
but
yeah
kind
of
I
mean
I
mean
the
intern
that
did
the
pin
work
has
expressed
interest
in
continuing
some
of
that.
So
we
do
have
the
plan
to
actually
formalize
this
second
idea
that
I
sketched,
including
the
collecting
the
assumptions
about
the
trade
system
somewhere
to
not
have
to
form
as
a
tracer,
so
cool.