harden method results, or attach an extra then() in user-level code?

[agoric]

harden method results, or attach an extra then() in user-level code?

[erights]

).then(harden, harden);

Aside from hardening, this is not semantics preserving. You probably meant:

).then(harden, (er) => { throw harden(er); })

or

).then(harden, (er) => Promise.reject(harden(er)))

[erights]

We need to do more of this hardening ourselves, even in the return context. If we release objects we've made without hardening them, then they are not defensive. In this particular case the array is fresh and transferred rather than shared, so there's not actually any damage our clients can do to us by mutating the array. But the testing code doesn't have any way to tell. And we don't have enough static checks to tell at the releasing side either. As @dckc says, about 40% of our overall engineering effort is fighting the pervasive mutability of JS.

Assigning this to myself , not that I'm going to put in all the hardens we're missing. But I can take the lead for now at figuring out how to get us to put in the hardens we need, or how to survive not doing so.

@dckc the static analysis you're thinking of doing is likely crucial to this effort. In recognition of that I'm adding you to the assignees as well.