Command–query separation principle [re: @mustuse as a function attribute]

[Paul Backus]

On Wednesday, 19 October 2022 at 18:45:40 UTC, Adam D Ruppe wrote:
> On Wednesday, 19 October 2022 at 18:25:54 UTC, Paul Backus 
> wrote:
>> because it would introduce implicit coupling between modules 
>> where no coupling (explicit or implicit) previously existed.
>
> How is this any different than inheritance of attributes like 
> @safe, which exists now?

The difference between @mustuse and @safe is that adding @safe 
imposes additional restrictions on the *function*, but adding 
@mustuse imposes additional restrictions on the *calling code*.

Another way to think of it is: @safe is like an "out" contract, 
and @mustuse is like an "in" contract.

Derived classes are allowed to weaken in contracts and strengthen 
out contracts, but not the reverse. By the same logic, derived 
classes are allowed to remove @mustuse and add @safe, but not the 
reverse.