Conversation

I want an interpreted Forth with per-RAM-address object capabilities somehow baked right in at the VM level so it absolutely cannot be bypassed.

I probably don't want this, but I think I do.

Any old Lisp actually comes *super close* to actually being this, because Lisp pointers inside conses *are* capabilities (sort of). They can't be faked, can't be read, can't be converted to or from numbers.

But object capabilities are a bit hard to reconcile with radical simplicity/transparency.