On Wednesday, 28 August 2024 at 11:20:43 UTC, Manu wrote:
> At the end when everything's had a go
> (...)
> So just close out all outstanding tokens
> in the optimistic case... does that sound right?

That's what I tried to implement, with each function keeping an
array of callers of that function, so it could propagate an
attribute violation to functions that had 'outstanding tokens'
from calling that function.

But we don't have the luxury to wait, because D code may inspect
function types and demand an answer. Here's a (contrived) example:

```D
import std.traits;

@system void systemFunc();

void fun1()()
{
     alias T = typeof(fun2()); // is fun2 @safe? need an answer
for T now!

     // let's make a contradiction!
     static if (hasFunctionAttributes!(fun2!(), "@safe"))
         systemFunc();
}

void fun2()()
{
     fun1();
}

void main0() @system
{
     fun1();
}

void main() @safe
{
     fun2(); // not system!
}
```

We don't need to support such contrived examples of course, but
even for normal code, there are many places where the compiler
inspects the type of a function. Making it account everywhere for
the possibility that the function's attributes can still change,
even after semantic analysis has finished, is a complex task.