Compiled objects, QFASL, relocation, and UNFASL

Stream and group encoding

A QFASL stream is read as 16-bit units historically called nibbles. The stream begins with two octal magic values, 143150 and 071660. A normal operation begins with a group header containing:

• a check bit that must be set;
• an operation-specific flag bit;
• an eight-bit count of following units, with an extended-length escape; and
• a six-bit operation number.

Operations can consume raw 16-bit units and can recursively request values from nested groups. A value-producing group enters its result in a FASL table and returns that table index. Later INDEX, MOVE, fetch, store, aggregate, and compiled-frame operations can refer to it. A file contains one or more independently loadable whacks; the working FASL table is discarded and reinitialized at a whack boundary.

This is a small virtual machine for object construction. The format is not a flat sequence of printed s-expressions, and a symbol name inside it need not correspond to a recoverable source definition.

Complete System 303 operation inventory

The maintained System 303 table has 56 positions. The following grouping is explanatory; the actual numeric opcode is the operation's zero-based position in the source vector.

FUNCTION-HEADER and FUNCTION-END delimit compiled regions for file-editing and inspection operations; they do not themselves recreate a DEFUN. FRAME carries boxed and unboxed components used to construct compiled frames. Array construction is similarly split: one operation makes an array object, other operations populate its elements or leader.

System 46 to System 303 evolution

System 46 has 52 table positions. Most positions retained their meanings, but these changes prove that the common magic number alone is not a compatibility guarantee:

The retired entries reflect an earlier path for linking PDP-10-style microcode artifacts. The later table instead adds language data types and larger table references. A preservation parser therefore needs a release-specific opcode table, not a single guessed “CADR QFASL” dialect.

Loading can execute and mutate

The full loader is intentionally active. EVAL and EVAL1 evaluate reconstructed forms. APPLY invokes a reconstructed function with reconstructed arguments. Store operations change value, function, property, symbol, or array-leader cells; fetch operations depend on the current world. A relocation escape transfers control to another loader. Compiled-frame and older microcode operations construct code or link it into the running environment.

Consequences for preservation are direct:

• file extension and magic bytes do not make an arbitrary QFASL passive;
• loading in a historically valuable world can redefine functions or corrupt state;
• a parser that implements only data constructors is safer than a loader with “evaluation disabled” after parsing, because other mutation operations remain;
• an unknown opcode, malformed size, incompatible slot table, or unexpected load-time form should be a hard rejection, not a best-effort skip.

QC-FILE, QFASD, and output choice

The file compiler reads source forms, compiles definitions, and sends the resulting objects and top-level effects to a dumper. In System 303, QC-FILE can select ordinary QFASL or REL output (:FASL and :REL in the inspected implementation). It records macros expanded while compiling and can include file property data, but that metadata is not a reversible record of every macro invocation or source form.

This distinction explains why “decompile the QFASL” is not an inverse compiler operation. The dumper serializes the compiler's chosen runtime objects and required effects. Multiple source programs can produce equivalent loader streams, and the stream does not record which of those programs was the original.

Container and five-operation sublanguage

A REL file starts like a QFASL, then uses FASL-OP-REL-FILE to escape into a different halfword stream. The inspected System 303 loader defines this complete five-entry operation vector:

The storage-format version is independently checked and is 1 in the inspected loader. This is a second compatibility boundary beyond the outer QFASL opcode table.

Sections and relocatable pointers

The dumper divides objects by area and representation into contiguous sections. A relocatable pointer uses its high ten bits for a section number and its low 14 bits for the index within that section. The loader chooses a destination area for each section, loads its words, identifies pointer-bearing data types, and adds the appropriate relocation base.

Two sections have special semantics:

• Section 0 stands for interned symbols and references to their value and function cells. Its actual data is reconstructed from the symbol table rather than loaded as an ordinary section.
• Section 1 contains forms to evaluate and optimized store commands. References to its results become fixup lists; after an entry is processed, its value is written to every referring location.

Other sections contain list or structure storage placed into an area chosen through the format's area-code map. The representation therefore preserves a larger portion of the compiler's connected object graph than a sequence of independent QFASL constructors. It is reasonable to describe REL as a relocating Lisp heap fragment inside a loader container. It is still not a world snapshot: it excludes unrelated memory, process state, devices, and the rest of the running system.

Maintained user interface

System 303 exposes two user-callable entry points:

(si:unfasl-file input-file &key output-file verbose terse)
(si:unfasl-print input-file &key verbose terse)

UNFASL-FILE writes a textual description and defaults the output pathname to the input name with type UNFASL. UNFASL-PRINT writes the description to the current output stream. Both default the input type to QFASL, verify the two magic units, reinitialize the table at each whack, and accept verbose and terse controls.

The maintained implementation deliberately represents decoded names as unfasl-symbol objects printed with angle brackets. Its source says this extra syntax prevents the output from misleading a reader into treating them as ordinary interned symbols. That design is a useful warning about the entire output: it is a description of loader structures, not a source file ready to compile.

What it retains and what it cannot restore

A separate decompiler could build control-flow graphs and higher-level pseudo-Lisp from compiled frames. That would be a new analysis tool, not a mode already supplied by UNFASL, and its output would remain a semantic approximation.

Fresh System 303 observation

An isolated System 303-0 session on 2026-07-18 evaluated (fboundp 'si:unfasl-print) and returned T. A subsequent attempt to inspect SYS:FONTS;5X5.QFASL reached the UNFASL pathname-opening path, then requested a login for the unconfigured ED-FILE host and entered the error handler. No file was opened or loaded. This establishes that the inspected load band contains the maintained entry point, while also showing that its logical pathname defaults depend on a configured file-service environment.

The local session was d23-qfasl-unfasl-20260718, generation 1. It used load band System 303-0, base disk SHA-256 bb16e46ad81decfe1efe691d36b6aa4ce3fd4ffb82474365de3520989d397cb5, and usim SHA-256 707a77d23e28ea1c45ae0eb0145dc181fa7ba649b9defc30044d4f847ac2c5be. The base disk was unchanged and the emulator exited normally without a forced stop. The ignored run record is 6,888 bytes with SHA-256 4d54aed2992fcdc917bb9106f5c604167cdabbcb183925a4bf6e5f627a5203ec.

No screenshot is published. The successful result was a single listener return and the failed pathname attempt was an error backtrace; neither visible state adds enough explanatory value to justify another curated image. The raw run remains local with its provenance.

Version-5 command encoding

The inspected L-BIN definitions say each command is a 16-bit word. The high four bits select a main dispatch and the low 12 bits carry an immediate operand. One high-field value escapes into a larger command table. Format version 5 is current in these sources; the loader accepts version 4 directly, offers a condition/restart path for obsolete version 3, and rejects other unsupported versions.

There are 55 named definitions: 12 immediate operations, including the command escape, and 43 escaped command operations.

Complete immediate inventory

Complete escaped-command inventory

The table records both 3600-family “L” and Ivory “I” compiled functions. Their load and disassembly paths are architecture-conditional; the wrong machine family does not silently reinterpret the code. Styles and character sets in the command language also show that L-BIN can serialize more than executable functions.

Loading effects

The L-BIN loader evaluates a FORM, installs definitions through FDEFINE, sets variables through SETQ, changes property lists through PUTPROP, interns or looks up packages and symbols, creates arrays and instances, and constructs compiled functions. The file-attribute list can change source-path metadata used for definition records. As with QFASL, loading is an operation with effects in the current Lisp world, not archive extraction.

Recoverable at high confidence

• a documented, closed data-only opcode subset;
• exact scalar, list, string, array, and named-structure contents when the runtime schema is known;
• package and symbol spelling carried by the file;
• function-region boundaries and architecture-specific instruction streams;
• explicit source pathname or file-attribute metadata still present in the artifact;
• explicit load-time forms, with the warning that their subforms may already be compiler-generated or macro-expanded.

Recoverable only as a semantic reconstruction

• control-flow graphs and pseudo-code inferred from machine instructions;
• approximate Lisp expressions reconstructed from calls, branches, constants, and stack/dataflow analysis;
• definition relationships inferred from cell stores and linkage records;
• data types inferred from operations or runtime conventions rather than preserved source declarations.

Not recoverable in general

• comments, whitespace, and editorial layout;
• the exact macro calls and reader syntax used by the author;
• names or abstractions erased by optimization;
• dead source that produced no serialized effect;
• a unique original program when multiple programs compile to the same result.

Public System 46 files

Public System 303 files

Licensed Genera files

The following are portable records of local licensed inputs; the source files and their contents remain untracked.