@borrowed Is Removed, And The Word That Allows A Tether Is @tethersStatus: Superseded by ADR-283 — its D1 is D4 there; D2-D3 are not carried (withdrawn by ADR-209 D5)
Date: September 23, 2026
Target Version: Nikaia 0.0.167
Narrows: ADR-008 D6’s assertion half. D6’s inspection half
— the solved state in the ledger and --tethers that prints it — is untouched
and is what this leaves standing
Related: ADR-010 D1 (the polarity: absence is the safe
reading), ADR-084 (a keyword is the most expensive thing a
language adds), ADR-050 D7 (un-reserving is the free direction),
ADR-124 (unsafe: a word that buys a boundary visible at the
site), ADR-156 D4 (the refusal that stands where the state is
missing)
ADR-008 D6 gave a struct an opt-in assertion:
@borrowed
struct Reading { name: ref String, temp: i32 }It means no value of this type ever tethers — an escape that would promote the struct to a tethered representation is a compile error rather than a silent change of layout. The reasoning was predictability in a hot path, and it is sound reasoning about the thing it names.
The word is in the wrong place, and a reader pays for it on every line it
stands on. Meeting @borrowed above a struct, a reader has three questions
and the source answers none of them: why is this here? is it needed? is it
missing somewhere else? The word’s whole job is to make a silent state
change loud, which means what it guards cannot be seen by reading — so its
presence and its absence look identical on the page, and a struct that should
have it looks exactly like one that should not.
And the polarity is the wrong way round. ADR-010 D1 is this project’s rule about which reading gets the word: the dangerous one is loud and the absent word is the safe one. Here the expensive state is the default. A tether keeps the whole buffer alive, not the part pointed at — Part I 6.6’s own example is one short name out of a 13 GB memory-mapped file pinning all 13 GB — and it is the state a program falls into by writing nothing. The cheap, predictable state is the one that costs a word.
Meanwhile it forbids nothing. The transition it refuses does not exist:
Tethered is not built (ADR-008 §5,
#196), so a program that would tether is
refused by NK2302 or NK2303 whether or not the word is written. Eight
structs in this tree carry it and the emitter writes a comment into the
generated Rust on each one saying that the check does not exist. That is a
decoration that reads as a decision.
@borrowed is removed.From the grammar, the AST, the ledger’s borrowed column, the emitter’s
comment, the corpus and the two specification pages that name it as a thing to
write. It is not deprecated and not kept parsing: a word that does nothing is
what this record is about, and leaving it parsing would leave the three questions
in place for whoever reads a program written before today.
Nothing a program can observe changes. Every refusal is where it was,
because the word was never what produced one. The @ is free again — attributes
live in their own namespace, so nothing is reserved and nothing is released
(ADR-050 D7’s free direction, taken).
@tethers, written above the struct.@tethers
struct Token { text: ref String }This struct may keep its buffer alive. Without it, a value of the type that would outlive the buffer it points into is an error — which is what happens today, so the default is not a new refusal but the one already standing, given a reason a reader can act on.
It is a permission and it reads as one, which is the whole of the change. A
grant is a thing a reader can check by looking at the declaration: the author
allowed this. An assertion is not, because what it asserts is invisible. This
is the shape ADR-124 gave unsafe — a word bought so the boundary
is visible at the site — and the shape
ADR-009 D1 gave unchecked, which editors/’s own grammar
already separates out as an assertion you make rather than a question you ask.
And a reader who meets it has one question, with an answer in the source: what does this struct hold a view of, and is keeping that alive what I meant? Both halves are the fields.
@tethers arrives with the state it permits, and not before.ADR-084: a keyword is the most expensive thing a language adds.
This record removes a construct for doing nothing; writing a second one in its
place on the same day would be the same mistake with the opposite polarity. The
grammar does not take @tethers today, so a program that writes it gets the
parse error that lists what is possible there — which is true, rather than a
word that parses and permits a state nothing can reach.
What is decided now is the word and its polarity, so that
#196’s remaining items have a target to
build towards instead of a question to reopen. Item 7 of that list was
@borrowed, vacuous until the rest exists; it is @tethers now, and it is
not vacuous — it is the thing the rest is for.
borrowed = true was derived, recorded,
shipped across a package boundary, and read by nothing. A .contracts file
written before this is now refused — unknown key borrowed on a type —
and the answer is to rebuild, because the file is derived and every build
rewrites it (ADR-100). The version key is not raised for it:
nothing reads that key to decide anything, there is no registry and no
distribution format (ADR-069 D5), and raising it would claim a
compatibility story this project has not written.tokenize example changes, and this is the part of the
change a reader will actually meet. It said the returned tokens tether with
no annotations, no copies of the text, no dangling references. The
annotation is the point: they tether because Token says @tethers, and a
Token that does not say it is refused with the buffer and the escape named.--tethers prints the solved state of
every view and changes nothing; a change of state shows up as a ledger diff in
review. That is the tool for which state is this in, and it never needed an
assertion beside it.--tethers and the ledger diff,
which is D6’s own answer to the same question — and it will have a refusal,
because a struct with no @tethers that starts tethering is an error.@tethers takes arguments. A per-field grant, or naming which
buffer, is a question for whoever builds the representation; the record fixes
the bare form.@borrowed twice as the spelling for text’s view state; which word it uses
when it is built is its own question, and the answer this one gives is that
the grant is @tethers.