Chapter 13 — Field Updates on Untrusted Media

Mon, 01 Jan 0001 00:00:00 +0000

Anything that can update itself can be replaced by something else. The question is who gets the last word.

— workshop wall

# 13.1 The Practice

The Practice. A module is safe to load when everything it claims has been checked or authenticated, and the loader refuses everything else — so the daring operation, installing new code on a running device from untrusted media, becomes a checklist the machine executes.

Chapter 14 — Epilogue: Tyu's Effect on Thinking

Mon, 01 Jan 0001 00:00:00 +0000

The Vigilance Trap is closed. Not because everyone stopped being careful — because being careful stopped being the mechanism.

— workshop wall

Chapter 1 opened with two ways to be careful, and promised the second. Look back at what “moving the promise into the program” turned out to mean, claim by claim:

The claim	The check	Where it was earned
“my stack ends where I say”	the stack-effect checker	ch. 2
“my values stay in their ranges”	subtypes, trap 21	ch. 3
“this is true whenever the word runs”	contracts, trap 20	ch. 4
“I only do what I declared”	the effect matrix	ch. 5
“my stack never rises past its shape”	the `(net, high)` monoid	ch. 6
“one writer, or many readers; custody moves”	the borrow ledger	ch. 7
“the hardware is what the descriptor says”	MMIO checking	ch. 8
“this word is one sentence”	factoring, made mechanical	ch. 9
“the interface is the whole truth”	the `.def` mirror	ch. 10
“the handler and mainline cannot race”	the cross-context rule	ch. 11
“the scheduler holds what I handed it”	effects + annotations	ch. 12
“this module may run here”	the loader’s gates	ch. 13

Twelve claims. None of them is a comment. The daring they licensed — an interrupt sharing a device, signed code arriving from untrusted media — was not made safe by a framework or a review process. It was made safe because each claim got small enough to check, and then the checks got composed.

Part IV — The Daring Parts on

Chapter 13 — Field Updates on Untrusted Media

# 13.1 The Practice

Chapter 14 — Epilogue: Tyu's Effect on Thinking