Thomas DuBuisson wrote:

...

(I notice that it relies on the user manually annotating anything that isn't safe to revert... This makes me nervous.)

So due to impurity everything that isn't explicitly annotated is implicitly 'unsafeIOToSTM'?

It seems that instead of marking the handful of things which are safe to run, you must mark the zoo of things that are not safe to run. Then again, by the looks of it, the compiler can't automatically decide if a given function is safe by which other functions it calls. It's manual. So if you had to manually mark things safe, you'd be marking all day...