This page tracks public caveats that matter when using the shipped compiler. Private bootstrap notes and historical recovery plans live outside the public docs.
ulimit or userspace RSS poller alone is not containment. Use the guarded path in Bootstrap System.scripts/safe_rebuild.sh; artifact-root isolation alone does not cap memory.--jobs/--opt-jobs, --no-fork, or an explicit serializer. A CLI silently accepting an unknown flag does not prove serial execution.scripts/fix_ir.py is confined to an explicitly marked frozen Stage-1 IR compatibility path. Its output is never production-eligible; it is a bootstrap seed only. Current compiler, recovery, cross-build, and release paths pass emitted IR to LLVM unchanged and fail closed on rejection.seen compile; seen build is not a shipped alias.seen --version / seen -v and seen --help / seen -h are supported by the shipped compiler.seen init, seen fmt, seen format, seen clean, and seen test. They fail with an explicit unsupported-command diagnostic instead of silently advertising source-wrapper behavior.--backend=c is intentionally unsupported until a production C backend is wired into the release entrypoint.seen-pkg binary, or supplies a client from another Seen release, is rejected.{ artifact = "..." } dependencies and are linked from objects.tsv.HashMap and HashSet iteration order is nondeterministic. In deterministic mode, use ordered collections such as BTreeMap/BTreeSet or explicitly mark the nondeterministic usage where allowed.
SecretBytes.clear overwrites its mutable byte storage. SecretString.clear invalidates the logical owner, but immutable Seen string allocator storage cannot yet be guaranteed to be overwritten. Use SecretBytes when best-effort in-process zeroisation is required.SecretRevealPolicy.Allow and is never the logging or serialization default.@move and @c_resource bindings. Ownership transfer through closure environments and task captures remains unsupported rather than implicitly copied.parallel_for is capture-free in 0.21.1. Its pthread worker callback has no outer-local environment, so examples must not read or mutate enclosing locals. Explicit value/reference/move captures and compiler-proven disjoint mutation are future work.@async and await lower coroutine syntax, but they do not implicitly start operating-system threads. Production coordination uses the bounded async.mod scope/executor surface; no poll-all or best-effort cancellation fallback is shipped.comptime supports the tested integer/string expressions, target predicates, parameters, assertions, and simple block control flow. Arbitrary recursive compile-time functions, heap-backed values, I/O, and general macro execution are not established release features.f32x4, f32x8, f64x2, f64x4, i32x4, and i32x8. Low-level vector load/store builtins take raw addresses, not (Array, offset) arguments.--emit-glsl emits inspectable shader/reflection artifacts and invokes glslc when available, but arbitrary Seen shader bodies are not guaranteed to translate faithfully. The generated host wrapper does not construct a usable Vulkan pipeline. Real GPU execution still needs explicit shader, buffer, pipeline, synchronization, and fallback handling through the runtime.String uses the %SeenString length/data representation and is not a C char *. Use a reviewed shim or explicit raw-pointer conversion for native C text APIs; the compatibility CString wrapper does not by itself promise a newly allocated NUL-terminated buffer.pub fun controls Seen visibility; use @export for an unmangled native symbol. Even then, verify emitted signatures and use @repr(C) for supported aggregate layouts before publishing a C header.[native.dependencies].SeenArray headers; use runtime allocation paths.!invariant.load.trunc i64 to i1 in codegen.isNaN/isInfinite checks must avoid LLVM fast flags that imply nnan/ninf.When reporting a compiler issue, include:
.seen reproduction.seen compile or seen check command..ll artifact.seen binary or compiler_seen/target/seen was used.