What would it take for you to reconsider macros / compile time evaluation?

The unsafe pragma seems like an ugly exception to the otherwise seamless capability-safe design.

One thought— not a full one— is that a functional module system would allow for a comptime unsafe capability root.

I’m guessing the rejected alternative was to pass an unsafe capability; but that would get awkward quick…