Emergency Break and the cold-load stream

Evidence and release boundaries

Entry points and visible contract

The menu item and keyboard prefix are not different breakpoint implementations. In each inspected release they start a process that calls the same keyboard recovery function. The menu exists partly because a mouse may still work when the relevant keyboard path does not; a System 46 change note says this explicitly. After the cold stream is selected, however, it has no pointer or presentation bindings.

Why it survives window-system failure

The cold-load stream is part of the small I/O environment available during and below ordinary system startup. It can draw characters and read keyboard input without acquiring an application window, redisplaying a pane, consulting a command table, or selecting an editor buffer. “Cold-load” names that implementation layer; entering Emergency Break does not reload the cold load or replace memory with an older image.

This separation matters in failure cases such as:

• a sheet or superior locked by another process;
• the selected process waiting in Output Hold or on a window-system lock;
• the error handler being unable to obtain a usable error window;
• the scheduler discovering an invalid inhibit-scheduling state; or
• a screen that cannot be exposed on the available hardware.

The ordinary debugger can be the thing that cannot display. The cold-load path changes the I/O dependency first, then runs Lisp and debugger machinery over that minimal stream.

System 46: a compact independent breakpoint

KBD-USE-COLD-LOAD-STREAM first moves the cold-load cursor home and clears the rest of the line. It establishes a top-level catch, enables scheduling for the break, binds TERMINAL-IO to the cold-load stream, prints the current package, and calls BREAK on that stream. The operator receives a Lisp break loop drawn directly over the display rather than a new window.

The contemporary window-debugging documentation gives the intended operating sequence: enter through Terminal Call or the menu, inspect process or window state, optionally redirect error-handler output to the cold-load stream, continue, and then force the affected process into the normal error handler. It also suggests the cold-load stream for trace output when tracing the ordinary window interface itself. That is a narrow diagnostic purpose, not a recommendation to use this console as the normal listener.

System 303: screen preservation and error-window recovery

The maintained implementation adds several layers around the same idea:

1. a global ownership flag prevents the normal keyboard process from consuming characters while the cold-load stream owns the keyboard;
2. the current screen is saved before the breakpoint and restored in an unwind cleanup;
3. any error windows recorded as locked are offered one at a time for handling over the cold-load stream;
4. standard terminal I/O is rebound to the cold-load stream and the current package is displayed;
5. BREAK runs under an explicit abort/error restart; and
6. screen restoration runs even when the breakpoint exits abnormally.

This is a useful code-only finding beyond the short menu label: Emergency Break can be the dispatch point for an already-waiting error whose graphical debugger window could not be used. It does not merely create an unrelated REPL.

The source also contains degraded recovery neighbors: clearing temporary windows, clearing window-system locks, attempting a lock-aware redisplay, and forcing or redirecting output. These are separate operations. Emergency Break gives the operator a place to reason about them; it does not automatically clear every lock or repair every process.

Genera 8.5: front-end console and explicit cleanup

Genera's WITH-COLD-LOAD-STREAM wrapper saves the selected window and original terminal stream, redirects query, debug, error, standard input, and standard output through synthetic terminal streams, marks the cold-load stream selected, and asks the debugger substrate to take over the console. An unwind cleanup calls the debugger's cold-load recovery function. The actual Emergency Break path clears the selected-window binding, prints the current package, and invokes BREAK over the cold-load stream.

That user-facing path is distinct from the function named SI:EMERGENCY-BREAK. When recursive debugger depth reaches 25, Genera bypasses the ordinary debugger command surface and enters that smaller read/evaluate/print loop; at depth 30 it halts into the auxiliary FEP/VLM layer. The menu label therefore must not be used as evidence that the menu directly invokes the minimal evaluator.

The underlying Genera stream is not just a character-output primitive. The inspected source maintains cursor geometry, a rubout-handler buffer, prompt and “noise string” state, activator and unread-character cells, single-character Rubout, whole-buffer Clear Input, screen refresh, Help, activation, and **MORE** behavior. It does not provide the ordinary Input Editor's cursor-motion, word-motion, kill/yank, or completion maps. Its lowest-level display and keyboard operations go through the front-end processor interface. This explains how the console can offer a usable reader while avoiding Dynamic Windows.

The exact source tree is context-sensitive. Before rubout editing, Control-Suspend recursively enters BREAK, Control-Meta-Suspend enters the ordinary Debugger, and Control-Abort signals Abort. Within the editor, Refresh redraws the prompt and buffer, Control-Refresh redraws after a fresh line, Help chooses the first available configured help mode, and any otherwise unhandled modified character beeps. The Lisp reader uses End as its activation character. There is no cold-stream pointer command or multi-stage editor prefix.

The ordinary Break loop then gives the first nonwhitespace character another context: Resume returns; Abort and Control-Z take the abort path; Suspend enters a nested Break; Meta-Suspend enters the ordinary Debugger; and (RETURN expression) returns all values of the expression. Once text has begun, intercepted characters again follow their ordinary asynchronous behavior. This command-loop layer is distinct from both the lower cold-stream intercept and the depth-25 minimal evaluator.

Availability is platform-sensitive:

• on 3600-family builds the source enters the console directly;
• on Ivory-machine builds it checks the applicable system case, including a Domino debug switch;
• if the stream is unavailable and the caller did not require it, the user receives a notification; and
• a caller that requires a debugger instead signals the stated reason, allowing a stack trace and warm-boot path rather than silently pretending the console exists.

This conditional is a high-confidence source fact. Whether the purchased Open Genera VLM world takes each branch remains a runtime question; the museum has not forced a failure merely to discover it.

Capabilities and limits

Runtime observation on LM-3 System 303

Disposable harness session emergency-break-20260718, generation 1, booted load band System 303-0 as Experimental System 303.0, ZWEI 129.0, microcode 323. After dismissing the date question, the researcher opened the System Menu and confirmed the visible Emergency Break item. The exact menu click did not expose the breakpoint in that attempt, so the listener evaluated the menu target directly as (tv:kbd-use-cold-load-stream).

The observed display then:

1. identified package USER;
2. announced a breakpoint using the cold-load stream;
3. said Resume would continue and Abort would quit;
4. accepted the researcher-entered form (+ 40 2); and
5. printed 42 on the cold-load display while the original Lisp Listener remained visible underneath.

Runtime observation: LM-3 System 303 Emergency Break after evaluating a synthetic arithmetic form, captured 2026-07-18. Underlying software and display material remain the property of their respective rightsholders; reproduced for criticism, scholarship, and historical documentation under 17 U.S.C. section 107. No affiliation or endorsement is implied.

The harness's F11 event did not act as Resume in this context; Page Down inserted a visible Resume character into the cold-load reader, and submitting it produced an unbound-variable error. That is evidence about the present host-to-CADR key mapping, not evidence that a physical CADR Resume key failed. The session was therefore stopped through the harness instead of claiming a verified in-guest return path.

The selected screenshot contains only a functional recovery display, short system labels, and researcher-entered arithmetic. Its use is reviewed in the runtime screenshot publication policy and recorded in the curated CADR screenshot catalog. It is not a source, manual, font, or decorative screenshot gallery.

Runtime observation on Genera 8.5

Disposable isolated session d04-emergency-break-publication-20260719, generation 1, used the exact identified Open Genera archive, VLM, debugger, and base world. The harness explicitly targeted either the main or Cold Load X client and failed closed if that kind was absent or ambiguous.

The positive action sequence was:

1. hold Shift and the rightmost mouse button to display the System Menu;
2. move to and visibly highlight Emergency Break;
3. release the momentary-menu button and select the still-displayed item with Left;
4. observe the separate Cold Load client announce “Emergency Break, using the cold load stream,” proving the actual menu dispatch rather than a direct substitute;
5. type the synthetic form (+ 40 2);
6. send the source-defined End character through host KP_End;
7. observe the value 42 and a new Command: prompt; and
8. send Resume through host F5, then observe the saved main Listener display restored.

Runtime observation: Open Genera Emergency Break after actual System Menu entry, captured 2026-07-19. Underlying software and display material remain the property of their respective rightsholders; reproduced for criticism, scholarship, and historical documentation under 17 U.S.C. section 107. No affiliation or endorsement is implied. The image is excluded from the repository's project license.

Two earlier menu gestures in this same session changed global input status without displaying or selecting the item. They remain negative timing/focus evidence, not successful entries. The third observed menu, highlight, exact reason banner, value, and restored display form the positive claim chain.

Preservation and safety guidance

• Always use a disposable private disk or world. A valid Lisp form can mutate the live machine as completely as code evaluated in an ordinary listener.
• Record the exact source/world boundary before testing. The recovery path changed substantially between System 46, System 303, and Genera.
• Test with synthetic, side-effect-free forms first. Do not manufacture a disk, scheduler, or network failure simply to obtain a dramatic screen.
• Distinguish an in-guest Resume/Abort result from an emulator stop. The latter proves containment, not guest recovery.
• Keep raw captures and all Genera inputs ignored. Curate only the minimum screenshot required to establish a specific historical claim.

Open questions

• Which exact physical-key sequence is appropriate for returning from this System 303 breakpoint through the present usim Space Cadet mapping? The source and display name Resume, but the current harness delivery was not verified.
• Which actual platform/availability branches besides the now-verified base-world menu entry are reachable on 3600, Ivory, and Domino configurations?
• Does Function Suspend in the purchased world follow the same complete lifecycle, including ignored numeric argument and typeahead release, as the source?
• Which Genera debugger commands remain usable when invoked through the primitive stream, and which assume Dynamic Windows despite the stream redirection?
• Can a controlled locked-error-window fixture demonstrate the System 303 diversion path without risking unrelated state?
• Can equivalent Genera locked-window and Output Hold fixtures cover the cold yes/no/debugger choices without manufacturing destructive failure?

Related articles

• Software application dossier coverage
• Emergency Break and degraded interaction paths reimplementation specification
• Lisp Listeners on the MIT CADR and LM-3
• Operating CADR through the Xvfb harness
• Operating Genera through the Xvfb harness
• Publishing runtime screenshots