> Well, untrusted by whom and for what?  Gcc is certainly not verified correct (and verified-correct programs often have bugs due to errors in the specification), yet as a human matter I trust it not to mung my computer and in fact to compile my C programs correctly, if somewha nastily.

But the difference between GCC and this SRFI is that there is
a pretty clear definition of what behavior is _expected_ to be
safe. ANSI C doesn't provide guarantees about all behavior, but
it does provide guarantees about specific pieces of behavior,
and additionally points out which pieces of behavior are notably
unspecified. Consequently, we can determine whether or not an
implementation is actually buggy or just takes liberties with
what the standard says is undefined behavior.

Conversely, this SRFI, by your own admission, has "no guarantees."
Consequently, an implementation that is no safer than 'eval' is
today is perfectly conformant. This would likely be the case in
at least Chicken and Chibi, which AFAICT are the only two R7RS
implementations that are widely used a the moment.

Safety features are supposed to provide guarantees. That doesn't
mean they always hold up their end of the bargain (bugs abound!),
but it does mean that we can reason about what the behavior
_should_ be.

- Phil