Honest guarantees

Know where the boundary ends.

Visibility and isolation

UndoLang is not a filesystem database or snapshot. Other processes can observe intermediate changes, and it does not isolate concurrent applications. A whole program is not one super-transaction.

Platform behavior

Rename replacement and directory sync do not have one portable guarantee. macOS arm64 is behavior-tested here; Linux, Windows, and other release targets are cross-built only. Windows open handles and reparse behavior need real-host validation.

Metadata

Contents, directory structure, symlink targets for move/delete, and basic modes are covered. Ownership, ACLs, xattrs, SELinux labels, timestamps, sparse allocation, hard-link identity, resource forks, and alternate streams are not preserved.

Objects and paths

Symlink copying, FIFOs, sockets, devices, and unsafe reparse points are unsupported. Separate primary roots with overlapping allowed paths can race.

Recovery scope

Recovery rolls back the one unresolved transaction; it never automatically resumes later program entries. Corrupt or ambiguous state retains backups and requires inspection. History is audit metadata, not a promise of post-commit undo after unrelated changes.

Language scope

No loops, functions, variables, imports, shell commands, plugins, networking, service control, or environment interpolation. This constraint is what lets every shipped mutation have defined planning and inverse behavior.

See the repository support matrix for exact test status.