ADR-162: Diagnosis and Safety Are the Language’s — eprint, access_all, update_all

Status: Superseded by ADR-313 — its D1-D2 are D4-D5 there, its D3 is D10 Date: September 20, 2026 Target Version: Nikaia 0.0.79 Related: ADR-154 D1 (the list), D3 (a type lives in its module), D4 (a name joins by a record), §5 (the list enforced), ADR-281 D28 (the deadlock the doors close), ADR-281 (update_all), ADR-293 D6 (panic, the same argument one name over), Part I 1.3, Part II 12.3, Part III 17.1

1. Context

ADR-154 D1 names what needs no use, and §5 enforced it: a std name that lives in a module is refused without its prefix. That made the rule true for what a program writes, and left the other direction unwatched — a name the compiler keys bare that the page does not list is one nobody ever meets, because nothing refuses it.

Three had drifted through:

name what it is
eprint eprintln without the line break
access_all Part II 12.3’s door over several locks
update_all the same door, for a change rather than a read

And the specification already disagreed with itself about the first. Part III 17.1 writes eprintln / eprint are the same two on standard error. They are in the prelude rather than in a module — while Part I 1.3’s list wrote three of the four. The compiler followed Part III.

docs/open-decisions.md carried eprint as a question, and recommended adding it on the thin ground that a list that has eprintln and refuses eprint is a rule a reader cannot state. The owner answered it with a better reason, which is D1.

2. Decisions

D1 — eprint is on the list, because diagnosis is the language’s.

It is what a program says when something has gone wrong, which is what panic and assert beside it on that list are for. And what it does is not one thing: on a hosted target it is a file descriptor, on WebAssembly a call into the host, on a machine with no operating system a serial line or nothing at all.

A module cannot decide that, because a module does not know the target — the compiler does. Writing use std::io in front of it would say it is a library function like any other, which is the one thing it is not.

This is ADR-293 D6’s argument one name over: panic is on the list for the same reason, and its behaviour is target-dependent in the same way.

D2 — access_all and update_all are on it, because safety is the language’s.

Part II 12.3’s doors over several locks. What they buy is that a deadlock cycle cannot form: every acquisition takes the locks in one order however the program wrote them, so access_all(a, b) in one task and access_all(b, a) in another still take them alike (ADR-281 D28).

That is a property of the language rather than a convenience, and they are free functions rather than methods only because a method has one receiver and these have several. Behind a use std::lock they would read as an alternative to nesting access calls, which is exactly the reading that makes the deadlock possible.

D3 — The list and what std keys bare are held to each other by a test.

§5 of ADR-154 enforced one direction. The other one now has the test it never had: every function std’s ledger keys bare is named on the page, read off the page rather than copied into the test.

The reverse direction is not asserted yet, because assert is on the list and does not exist. That asymmetry is the right way round: a listed name that is missing is one a program meets, and an unlisted name that is reachable is one nobody meets — so the second is the one that needs a test.

3. Consequences

Part I 1.3’s list is what the compiler does, which it was not. Two pages of the specification also stop disagreeing about the printing functions.

docs/open-decisions.md loses its eprint entry, which is what an answer does to a question.

Two of the three were found by the measurement rather than asked about. The owner decided eprint; access_all and update_all came out of counting what std keys bare, and are on the list under D2’s own reason rather than by riding along with D1’s.

4. What this does not decide

5. What is built

This site is open source. Improve this page.