Working towards being able to run in a child process.

Essential ideas:

  1. You need to be able to simulate a test machine execution without
     actually running it. This requires operations to have a "simulate"
     method.
  2. This at first seemed to require much stronger guarantees about the
     effects of operations. In the end it doesn't because you can just
     write the simulate method, but this is a nicer way to spec them
     anyway. You can still write the full generality if you want.