Safe nondeterminism in a deterministic-by-default parallel language