The idea behind Arcan was to find the crunchy middle between a display server, a game engine and a multimedia processor. The control plane to this [BSD] “desktop engine” was designed for a scripting API targeting entry-level developers. Lua remain as the weapon of choice for that role as a better follow up to the ‘BASIC’ of the home computer era..
Static.. means that the compiled app is not capable of loading code outside of its own package, except for a set of preset helper scripts.. user controlled opt-in rather than an opt-out as in “install extension to disable javascript”.. security model comes from a combination of least-privilege and capabilities. “Decode” is security wise the most sensitive one as that is where parsing of untrusted inputs go. “Encode” is privacy wise the most sensitive one as that is where the real ‘you’ distil into digital form.
The intro video (20m) can motivate reading this deep dive technical series.