A promise with a build flag

Twelve yes votes out of twenty. Nine no votes out of twenty-two. Twelve more countries abstaining. That is the national-body ballot on the C++26 draft, and it makes C++26 the first C++ standard the national bodies have ever refused to sign off. The vote has always been a formality. This one missed both of its bars: two-thirds yes among voting members, and no more than a quarter voting no.

The fight is over Contracts, and it usually gets told as a story about process. A committee ignored national-body comments, opponents lobbied national bodies by citing the language's creator, and the three-year release train punishes anyone who misses it. All true. But the process story buries the substance. This wasn't a fight over whether C++ should let you write down a promise. It was a fight over whether the promise has to be kept.

The feature reads simply. A precondition like pre (size > 0) on a function says the caller must guarantee it, and a postcondition says what the function guarantees back. Then the build decides what those lines mean. A violation can terminate the program, call a handler and then terminate, log and keep going, or, in ignore mode, never be checked at all. Mixing modes is allowed. Build your code to enforce and link a prebuilt library that pulls in the same dependency built to ignore, and the linker keeps one copy of the shared function. Which copy it keeps is not something you can know from your source.

The national bodies saw this coming. Their comments, from Sweden, Spain, the United States, France and others, asked for contracts that could be made reliably non-ignorable, and the committee turned them down. One proposal, P3911, would have added exactly that. Herb Sutter, the committee's former chair, described it in his own paper on the failed ballot:

In the Evolution Working Group's January telecon, a poll merely to encourage more work in that direction failed, 8 to 25. Standard library hardening, the part of C++26 meant to catch misuse of the library at runtime, is written in terms of contract assertions, so it inherits the same maybe.

This wasn't a fight over whether C++ should let you write down a promise. It was a fight over whether the promise has to be kept.

Compare what a binding specification buys you. This week, DeepMind reported that its agents had formally verified key guarantees of the Signal protocol in four weeks. Pointed at older Signal versions with long-fixed bugs, it found them and showed those versions could not be verified. A spec that holds fails loudly. A contract in ignore mode fails silently, and in a language with undefined behavior that's how the worst bugs already fail.

The case for the draft is real. The vote to add Contracts to the working draft passed 100 to 14. The ignore mode exists because C++ users won't pay for checks in hot paths, and zero-cost abstraction is the reason the language exists. The design was billed as a minimum viable product precisely so every faction could live with it, and a team that wants enforcement can turn it on. Concede all of it. The trouble is that "turn it on" is a property of your build, and the linking case means your build doesn't settle it. If the caller can't verify a guarantee from source, it's a convention, and conventions are what the assert macro already gave C++.

WG21 meets in Búzios next week. The pro-Contracts camp has said it would rather re-ballot the draft unchanged and wait for the national bodies to blink. The other option is the one extension the committee's former chair called low-cost and low-risk. One of those ships a feature. Only the other ships a promise.