The Gold Standard of Websites | Separating ArrayBuffer transfer Growth, Truncation and Source Detachment

transfer uses the current source byte length when newLength is omitted and otherwise converts the supplied value with ToIndex.

Worked example. Start with bytes 10 through 80 in an eight-byte resizable buffer whose maximum is twelve; compare transfer(), transfer(5) and transfer(10).

Treat the three calls as three separate state transitions, not as alternative views of one mutated object. For each branch, write the source current length, source maximum, requested target length and resulting target kind before calculating bytes. The no-argument branch chooses eight from the source state; the explicit branches choose five and ten after ToIndex. This ordering explains why target length is settled before copying and why a failed conversion cannot detach the source.

A useful test records the conversion log as well as lengths. With the string “6”, confirm that conversion produces six, that six bytes are copied, and that the source is detached only after a six-byte target exists. Keep a fresh source for the omitted, numeric and string cases so an earlier transfer cannot contaminate the evidence.

State-table practice for name the source and requested target length. Create columns for source current length, source maximum, requested target length, ToIndex result and copied prefix length. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Change the supplied length from 10 to the string “6” and identify the conversion before allocation. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: A readable argument does not prove the conversion or allocation will succeed. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for name the source and requested target length. Capture source current length, source maximum, requested target length, ToIndex result and copied prefix length in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Next chapter

the copied byte count is the smaller of the old and new byte lengths.

Worked example. Transfer the eight-byte fixture to five bytes and retain 10, 20, 30, 40 and 50.

The copy calculation is an interval intersection. The old buffer contributes indices zero through seven, while the five-byte target can hold indices zero through four; their shared interval therefore contains five bytes. Nothing about the source maximum changes that arithmetic. Writing the result as old length eight, new length five and copy length min(8,5)=5 makes the discarded suffix visible instead of treating truncation as a mysterious side effect.

Verify both content and provenance. Assert the five retained values in order, then show that no later resize of the returned buffer can reveal 60, 70 or 80. Repeat with a three-byte target and expect only 10, 20 and 30. This changed case checks the rule rather than memorising one printed array.

State-table practice for copy only the shared prefix. Create columns for source maximum, requested target length, ToIndex result, copied prefix length and initialized tail length. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Change the target to three bytes and recompute the surviving prefix rather than slicing the printed array by habit. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Truncation discards the uncopied suffix; it does not store it invisibly for later regrowth. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for copy only the shared prefix. Capture source maximum, requested target length, ToIndex result, copied prefix length and initialized tail length in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

allocating the longer target creates initialized bytes before the old prefix is copied.

Worked example. Transfer eight bytes to ten and obtain the eight original bytes followed by two zeros.

A longer transfer has two logically separate phases: allocate initialized target storage, then copy the old prefix. The target positions zero through seven receive the old values; positions eight and nine were created as part of the new allocation and remain zero. Calling those bytes “copied zeros” would lose their history and could lead an application to treat unused capacity as valid payload.

Test the boundary with target lengths eight, ten and twelve. The copied prefix should stay eight in every case, while the zero-filled count changes from zero to two to four. Also write a nonzero value into one new byte after transfer so the test distinguishes initial zeroing from later application data.

State-table practice for zero-fill a longer target tail. Create columns for requested target length, ToIndex result, copied prefix length, initialized tail length and target resizable state. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Change the target to twelve and identify four new zeros while preserving the first eight values. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Zero is initial content, not evidence that the application wrote four valid records. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for zero-fill a longer target tail. Capture requested target length, ToIndex result, copied prefix length, initialized tail length and target resizable state in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

the abstract operation allocates and copies before it detaches the source and returns the target.

Worked example. Record source.detached, source.byteLength and target bytes before and after a successful transfer.

Successful transfer is transactional from the program’s point of view. A target must be available and its required bytes must be established before the source becomes detached. The language does not expose whether an engine copied pages, moved backing storage or reallocated memory, so the observable proof is object state: a usable target paired with an unusable source. Physical implementation guesses add no evidence to that proof.

Use an environment where an intentionally excessive allocation is expected to fail, but frame the result carefully because exact memory limits vary. The important assertion is that a thrown allocation failure does not justify claiming completed detachment. For the successful control, assert target bytes first and then the source’s detached observations.

State-table practice for detach the source after successful construction. Create columns for ToIndex result, copied prefix length, initialized tail length, target resizable state and source detached state. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Force target allocation to fail and separate that failure from a completed source detachment claim. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: The specification permits implementation strategies such as a move or realloc without exposing that physical strategy. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for detach the source after successful construction. Capture ToIndex result, copied prefix length, initialized tail length, target resizable state and source detached state in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

all existing TypedArray and DataView objects still point at the detached source after transfer.

Worked example. Create a full Uint8Array, a subview and a DataView before transfer; then test their operation-specific observations.

Every pre-existing view retains its identity and its reference to the original buffer object. Transfer changes that buffer’s state; it does not retarget a Uint8Array or DataView to the new owner. Consequently, the full view, the subview and the DataView must be tested through their own APIs after detachment. A newly constructed view over the target is a different object with a new backing-buffer relationship.

Capture view.buffer identity before transfer, perform the transfer, and compare it with target identity afterwards. Then exercise representative operations rather than relying on one property: inspect a typed-array length, attempt a method call and read a DataView field. Finally create equivalent target views and show that only those reach the transferred bytes.

State-table practice for invalidate every view of the source. Create columns for copied prefix length, initialized tail length, target resizable state, source detached state and source current length. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Create fresh views over the returned target and compare them with the old view identities. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: A subview does not transfer just its visible window when the buffer method is called. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for invalidate every view of the source. Capture copied prefix length, initialized tail length, target resizable state, source detached state and source current length in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

transfer preserves resizability for a resizable source and carries its original maximum into the target allocation.

Worked example. Transfer an eight-of-twelve buffer to ten and check target.resizable and target.maxByteLength.

Preserving resizability carries capability, not current size. An eight-of-twelve source transferred to ten yields a target whose current extent is ten while its maximum remains twelve. The returned object may later resize within that ceiling. A fixed eight-byte source has no maximum capability to preserve, so transfer returns a fixed target even though the same method name was used.

Check all three exposed properties together: byteLength, maxByteLength and resizable. Then call resize at the valid maximum and one byte above it. The first call demonstrates retained capability; the second demonstrates the retained ceiling. Run the same sequence on a fixed-source transfer and expect the resize operation to be unavailable.

State-table practice for preserve resizability when transfer requires it. Create columns for initialized tail length, target resizable state, source detached state, source current length and source maximum. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Start from a fixed eight-byte source and show that the target remains fixed. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Preserving resizability does not mean the target starts at the maximum length. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for preserve resizability when transfer requires it. Capture initialized tail length, target resizable state, source detached state, source current length and source maximum in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

preserved maximum capacity constrains allocation when the requested target is larger than the source maximum.

Worked example. Request thirteen bytes from an eight-of-twelve source and record the RangeError path.

The preserved maximum is part of the target allocation contract. Asking an eight-of-twelve source for thirteen cannot produce a resizable target whose current length already exceeds its maximum, so the request follows a RangeError path. Asking for exactly twelve sits on the valid semantic boundary, although an implementation may still fail for ordinary resource reasons that the abstract length check cannot predict.

Build a boundary table for eleven, twelve and thirteen. Record requested length, comparison with maxByteLength, semantic result and whether detachment occurred. The twelve-byte row should be distinguished from a real-world out-of-memory failure: both can throw in practice, but only the thirteen-byte row violates the buffer’s declared maximum.

State-table practice for reject an over-maximum target for a resizable source. Create columns for target resizable state, source detached state, source current length, source maximum and requested target length. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Use twelve instead and identify the valid boundary. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Maximum capacity is an allocation contract, not a promise that every valid request can avoid environmental memory failure. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for reject an over-maximum target for a resizable source. Capture target resizable state, source detached state, source current length, source maximum and requested target length in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

the operation performs ToIndex on an explicit newLength before it checks whether the source is detached.

Worked example. Detach a source, pass an object whose conversion logs and throws, and identify the first observable failure.

An explicit argument is observable work. ToIndex may call user code through valueOf or toString, and that work happens before the operation asks whether the source has already been detached. This is why an argument object that throws can mask the later detached-buffer TypeError. Omitting the argument removes that conversion step and lets the state check become the first failing boundary.

Use a conversion object that appends to a log and then throws a distinctive error. With a detached source, assert the log entry and the conversion error. Replace it with a primitive valid length and assert the detached-buffer TypeError instead. The two cases establish order without relying on engine messages.

State-table practice for convert length before checking detached state. Create columns for source detached state, source current length, source maximum, requested target length and ToIndex result. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Pass a simple valid length to the same detached source and observe the later TypeError branch. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Changing argument conversion can change which error appears first. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for convert length before checking detached state. Capture source detached state, source current length, source maximum, requested target length and ToIndex result in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

the transfer operation accepts an ArrayBuffer with the required slots, excludes SharedArrayBuffer and rejects a non-undefined detach key.

Worked example. Call the method generically with a SharedArrayBuffer and separate type rejection from ordinary target sizing.

The method’s receiver check is about the required ArrayBuffer slots, not merely an object that reports a byteLength. SharedArrayBuffer has different shared-memory slots and cannot be detached, so generic invocation fails before target-size reasoning can make it transferable. Host detach keys add another protected state in the abstract operation, but ordinary web code should not pretend it can manufacture every host-only key scenario.

Use three receivers: an ordinary ArrayBuffer, a SharedArrayBuffer where supported, and a plain object with a byteLength property. Record the accepted ordinary path and the TypeError paths for the others. This evidence separates genuine internal slots from surface resemblance and avoids inventing a public detach-key test.

State-table practice for reject shared memory and protected detachment. Create columns for source current length, source maximum, requested target length, ToIndex result and copied prefix length. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Use an ordinary transferable ArrayBuffer and compare the accepted path. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Public JavaScript does not expose every host detach-key scenario, so avoid fabricating a browser fixture for it. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for reject shared memory and protected detachment. Capture source current length, source maximum, requested target length, ToIndex result and copied prefix length in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

transfer creates a new owner and detaches the source, resize changes the same resizable object, and slice creates a separate copy without detaching.

Worked example. Run all three operations from equivalent eight-byte fixtures and record object identity, source usability and target length.

Transfer, resize and slice can produce similar-looking bytes while expressing different ownership decisions. Transfer returns a different owner and detaches the source. Resize changes the current extent of the same resizable object. Slice creates a different buffer containing copied bytes while leaving the source usable. Identity and source state therefore belong in the comparison beside target bytes and lengths.

Start each operation from an independent eight-byte fixture. Assert source === result where that comparison is meaningful, source usability after the call, result byteLength and the exact result bytes. Repeat with a five-byte result. If only the byte arrays are compared, the test has missed the behaviour that most affects later code.

State-table practice for separate transfer from resize and slice. Create columns for source maximum, requested target length, ToIndex result, copied prefix length and initialized tail length. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Change only the requested length and keep the ownership columns in the comparison table. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Matching target bytes do not make the ownership effects interchangeable. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for separate transfer from resize and slice. Capture source maximum, requested target length, ToIndex result, copied prefix length and initialized tail length in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

a decisive check records source identity, target identity, lengths, maximum, detached state and every byte provenance.

Worked example. Assert five-byte truncation and ten-byte growth from fresh independent fixtures.

A byte ledger turns transfer into auditable arithmetic. One row describes the old index, old value, whether that index lies inside the new length, and the target value or discarded status. Separate columns record object identity, maximum capacity and source detachment. This layout handles truncation and growth with the same method and makes newly initialized zeros visibly different from preserved zero-valued source bytes.

For five-byte and ten-byte targets, assert every ledger row rather than one aggregate print. Then change the old length to twelve and the new length to seven. The expected copy count becomes seven, the discarded range becomes seven through eleven, and no zero-filled tail remains. That changed fixture demonstrates transfer of the reasoning.

State-table practice for verify the operation with a byte ledger. Create columns for requested target length, ToIndex result, copied prefix length, initialized tail length and target resizable state. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Repeat with a twelve-byte fixture and a seven-byte target to transfer the arithmetic. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: One console print after transfer cannot prove which bytes were copied or newly initialized. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for verify the operation with a byte ledger. Capture requested target length, ToIndex result, copied prefix length, initialized tail length and target resizable state in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Next chapter

a complete account states requested length, copy length, zero-filled remainder, target resizability and source detachment before discussing implementation.

Worked example. Report old 8, new 10, copy 8, append two zeros, preserve max 12 and detach source.

A concise explanation should follow the operation’s logical order: choose target length, determine the shared prefix, account for any initialized tail, state target resizability and maximum, then state source detachment. Performance belongs after those semantics because the specification permits several storage strategies. Secure erasure is also a separate system property; losing JavaScript access to a detached source does not prove physical memory sanitisation.

Practise two reports from the same eight-of-twelve source. For ten, say copy eight, add two initialized zeros, preserve maximum twelve and detach the source. For five, say copy five, discard three, preserve the declared maximum for future resizing and detach. Neither report should promise zero-copy speed or erased physical pages.

State-table practice for explain length policy before performance. Create columns for ToIndex result, copied prefix length, initialized tail length, target resizable state and source detached state. Populate the before row from the worked fixture, predict the operation’s first observable effect, and then compare that prediction with the returned value, thrown error or changed object state. If a check fails, mark all later effects as not reached rather than filling them from expectation. This makes the chapter’s rule falsifiable and shows exactly where conversion, receiver state, allocation, view geometry or application interpretation first diverges.

Changed-case evidence. Change to new 5 and explain the discarded suffix. Recalculate only the cells whose premises changed and name one observation that would disprove the answer. Keep the boundary in view: Do not claim guaranteed zero-copy speed or secure erasure from the language semantics. The aim is not to reproduce the original output with different numbers; it is to identify the earliest changed decision and carry that state forward without restoring discarded bytes, inventing capacity, retargeting an old view or assuming data readiness.

Practical review for explain length policy before performance. Capture ToIndex result, copied prefix length, initialized tail length, target resizable state and source detached state in a minimal fixture and keep object identity, byte provenance, capacity, view access and application meaning in separate assertions. Report the first decisive specification step, the resulting bytes or error class, and one limit on what the fixture proves. This produces evidence another reader can reproduce across engines without turning language behaviour into an unsupported claim about physical copying, performance, secure erasure or concurrent protocol correctness.

Contents · Previous chapter · Return to the Websites subject guide