> Very interesting! I would have avoided doing something like
> this for fear of a race condition when attempting to unseal
> two different envelopes made by the same sealer -- but
> with E's event model i guess this isn't a problem, is it?
Yes, this solution is very explicitly dependent on the E event model. I confess, it scares me every time I depend on the E event model...but I do it anyway because it really is safe and it really is convenient, and it really is easy to understand. I think it's just scary because it's different, different enough so it feels like you're depending on an implementation dependency (but you're not, of course, it is an explicit guarantee of the language). Anyway, as you can tell, I'm sold on it :-)