[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83506-en":3,"doc-seo-83506-105":29,"detail-sidebar-cat-0-en-105":95},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83506,549758146520,"Patrick","https://ap-avatar.wpscdn.com/avatar/80002397d8c0411e94?_k=1775819394049821470",8,"Research & Report","Certificate-Carrying Transformation of Event-Driven Block Programs","Block-based end-user languages like Scratch execute massive numbers of programs whose authors cannot review correctness proofs. Behavior-preserving rewrite tools typically rely on analysis and testing, lacking a checked guarantee. This work introduces certificate-carrying source-to-source rewriting with an untrusted optimizer and a trusted fail-closed checker. The checker recomputes all rewrite-dependent side conditions under an explicit observation lens, supported by a cooperative-frame refinement theorem. Implemented in Lean and evaluated on 300 real Scratch projects, it rejects unsound rewrites with no false accepts after adversarial perturbations, adding regression tests when prior audits found misses.","Certificate-Carrying Transformation of Event-Driven  \nBlock Programs  \nYuan Si and Jialu Zhang∗  \nUniversity of Waterloo, Waterloo, Canada  \n[yuan.si@uwaterloo.ca](yuan.si@uwaterloo.ca), [jialu.zhang@uwaterloo.ca](jialu.zhang@uwaterloo.ca)  \narXiv :2607 .00563v 1 [ cs .PL] 1 Jul 2026  \nAbstract—Block-based end-user languages such as Scratch run tens of millions of programs whose authors are not expected to read a correctness argument. The tools that rewrite these programs establish behavior preservation through program analysis and testing, without a checked guarantee. We turn optimization of such programs into certificate-carrying sourceto-source rewriting. An untrusted optimizer proposes a rewrite; a trusted, fail-closed checker accepts it only after recomputing every side condition that the rewrite’s behavior preservation depends on, under an explicit observation lens. The checker is the sole authority: given a correct checker and a small, explicitly stated set of model-to-VM assumptions, an optimizer bug cannot mint an unsound acceptance. The observation lens is a parameter of the framework, and the central soundness argument is a cooperative-frame refinement theorem: a write whose value is overwritten before any thread observes it, within a window in which no thread yields, can be removed. We mechanize this theorem in Lean and show that one parametric statement covers two concrete rewrite families, instantiated to variable state and to renderer state. We build a checker for six rewrite families and evaluate it on 300 real Scratch projects sampled from the public repository. The checker accepts a behavior-preserving rewrite on 94.3% of projects (283 of 300), a breadth carried by editor and asset cleanup with the certified-runtime families applying on fewer; certification costs under one tenth of a second per project on average; and a cross-family adversarial campaign of 4,278 perturbed rewrites produces zero false accepts on the hardened checker. An independent pre-submission audit had earlier found eight false accepts the per-family test suites missed; each is now rejected and carries a regression test. An ablation that strips the semantic side conditions, leaving the analysis-and-testing stance alone, ships rewrites that the virtual machine confirms change behavior; the full checker rejects every one. The result is a working account of how to give behavior-preservation guarantees for a concurrent, event-driven, end-user language.  \nI. INTRODUCTION A Scratch project is a concurrent, event-driven program.  \nScripts run under a cooperative scheduler, communicate through broadcasts and clones, and render to a stage that the player watches frame by frame. The public Scratch repository holds tens of millions of such projects, written largely by children and hobbyists, an audience not expected to inspect a static analysis or a correctness argument. Programs in this setting carry the same kinds of redundancy that compilers remove from conventional code: a sprite is repositioned twice with no visible frame in between, a broadcast reaches no receiver, a costume is removed yet still listed. A tool that  \nCorresponding author: Jialu Zhang.  \ncleaned up these programs would benefit authors who lack the means to do so themselves; recurring quality problems in shared Scratch code are documented to impede its reuse and sharing [1],[2] . The obstacle is trust: an optimizer that silently changes a child’s game is worse than none, and this population cannot notice or recover from the change.  \nEnd-user languages make this trust problem sharp. A professional developer reads diffs, runs tests, and reverts a bad commit; the author of a Scratch game has none of these defenses, and the program is itself the deployed program, so a source rewrite is the shipped change. A guarantee that a rewrite preserves what the player sees is the only acceptable basis for touching these programs automatically, and producing one fora concurrent, rendered, event","cbCaiuFx5DVbQ4Hx","https://ap.wps.com/l/cbCaiuFx5DVbQ4Hx","pdf",316478,1,12,"English","en",105,"# Abstract\n# Introduction\n## Scratch as a concurrent, event-driven language\n## Trust and certified optimization for end-user programs\n## Certified rewriting and observation lenses","[{\"question\":\"What problem does the paper address for Scratch-like block languages?\",\"answer\":\"It addresses the trust gap when tools automatically rewrite end-user programs, where authors cannot inspect correctness proofs or recover if an optimizer introduces behavior changes.\"},{\"question\":\"How does the system provide a checked behavior-preservation guarantee?\",\"answer\":\"An untrusted optimizer proposes a rewrite, while a trusted checker recomputes every side condition required for behavior preservation under an explicit observation lens, minting acceptance only when all conditions hold.\"},{\"question\":\"What is the key soundness idea behind the permitted rewrites?\",\"answer\":\"The soundness relies on a cooperative-frame refinement theorem stating that a write overwritten before any thread observes it, within a window where no thread yields, can be removed without changing observable behavior.\"},{\"question\":\"What were the evaluation results on real Scratch projects?\",\"answer\":\"On 300 sampled Scratch projects, the checker accepted behavior-preserving rewrites on 94.3% (283/300). Certification costs averaged under one tenth of a second per project, and an adversarial campaign of 4,278 perturbed rewrites produced zero false accepts on the hardened checker, with earlier missed cases rejected and added as regression tests.\"}]",1784188504,30,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":90,"head_meta":92,"extra_data":94,"updated_unix":27},"certificate-carrying-transformation-of-event-driven-block-programs","",{"@graph":35,"@context":89},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/certificate-carrying-transformation-of-event-driven-block-programs/83506/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81,85],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the paper address for Scratch-like block languages?","Question",{"text":75,"@type":76},"It addresses the trust gap when tools automatically rewrite end-user programs, where authors cannot inspect correctness proofs or recover if an optimizer introduces behavior changes.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the system provide a checked behavior-preservation guarantee?",{"text":80,"@type":76},"An untrusted optimizer proposes a rewrite, while a trusted checker recomputes every side condition required for behavior preservation under an explicit observation lens, minting acceptance only when all conditions hold.",{"name":82,"@type":73,"acceptedAnswer":83},"What is the key soundness idea behind the permitted rewrites?",{"text":84,"@type":76},"The soundness relies on a cooperative-frame refinement theorem stating that a write overwritten before any thread observes it, within a window where no thread yields, can be removed without changing observable behavior.",{"name":86,"@type":73,"acceptedAnswer":87},"What were the evaluation results on real Scratch projects?",{"text":88,"@type":76},"On 300 sampled Scratch projects, the checker accepted behavior-preserving rewrites on 94.3% (283/300). Certification costs averaged under one tenth of a second per project, and an adversarial campaign of 4,278 perturbed rewrites produced zero false accepts on the hardened checker, with earlier missed cases rejected and added as regression tests.","https://schema.org",{"og:url":51,"og:type":91,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":93,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":96},[97,101,105,109,114,119,124,126,131,134,138],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},"Exam",70,"exam",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},5,"Comic",60,"comic",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},6,"Technology",50,"technology",{"id":120,"doc_module":4,"doc_module_name":45,"category_name":121,"show_sort_weight":122,"slug":123},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":28,"slug":125},"research-report",{"id":127,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":129,"slug":130},9,"Religion & Spirituality",20,"religion-spirituality",{"id":129,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":129,"slug":133},"World Cup","world-cup",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":135,"slug":137},10,"Lifestyle","lifestyle",{"id":139,"doc_module":4,"doc_module_name":45,"category_name":140,"show_sort_weight":110,"slug":141},19,"General","general"]