Earlier posts looked at boundaries within Seamless itself: regions contain mutation, expanded code goes through ordinary checking, and failures remain explicit. The next boundary is literal: the one between Seamless code compiled to WebAssembly and the host that gives it access to the outside world.
WebAssembly can calculate, allocate, and manipulate its own memory, but it cannot open a file, write to a terminal, make an HTTP request, start a timer, or update the DOM by itself. Those operations belong to the host: Node, a browser, Wasmtime, or some other embedding environment.