Emergency Break and degraded interaction paths reimplementation specification

Release profiles

EB-C303 source and runtime are triangulated evidence, not a proven build chain. The same distinction applies to G85-SRC and G85-BASE-WORLD/G85-RUN.

The cold-load stream is TV/FEP life-support I/O. It is not a CLIM application. The Genera System Menu entry is a Dynamic Windows menu only until it launches the recovery process; the selected cold stream itself has no presentations or pointer commands. The ordinary Genera Debugger uses Command Processor and presentations, and its Display Debugger uses Dynamic Windows. Those higher interfaces are separate consumers reached after an error or explicit debugger transition.

D04 conformance ends at the debugger transition boundary. The ordinary and graphical Lisp Debuggers are D12 applications; the Open Genera VLM Debugger is a D52 application. Their source-bounded maps below are dependency evidence and closure checklists, not part of EB-*/L1 or EB-*/L2 conformance.

Conformance levels

This document normatively defines EB-C46/L2, EB-C303/L2, and EB-G85/L2 at the semantic grain stated here. L3 is reserved. A conforming L1 implementation MUST provide a machine-readable dump of its effective binding graph. Site patches or remaps MUST appear as overlays on the selected base tree rather than being silently substituted for missing base bindings.

An EB-*/L2 claim does not imply D12 Lisp Debugger or D52 VLM Debugger application conformance.

Exact public source artifacts

The System 46 identities refer to public Git revision 8e978d7d...; the LM-3 identities refer to Fossil check-in 4df393c.... Exact source anchors appear in the sources.

Exact licensed Genera artifacts

The purchased archive is 206,213,430 bytes with SHA-256 89fb3e76b91d612834f565834dea950b603acf8f9dbacacdd0b1c3c284a2d36e. The files remain local ignored inputs. Their identities support audit and original technical description, not redistribution.

Normative evidence map

Cold stream

The clean-room model MUST expose at least:

ColdStream {
  selected: Boolean
  available: Boolean
  cursor_x, cursor_y: Integer
  width, height, character_width, line_height: Integer
  unread_character: Character | None
  activator: Character | List | None
  input_buffer: growable character vector
  fill_index, scan_index: Integer
  rubbed: Boolean
  noise_strings: ordered map<input-boundary, display-string>
  prompt, reprompt: Optional callback/string
  more_enabled: Boolean
}

EB-C46 MAY use its smaller historical representation, but its behavior MUST match the selected profile. EB-G85 starts with a 512-character input vector, default width 1000, height 300, cursor coordinates zero, character width 10 and line height 16. Growth MAY use another allocation strategy provided no specified input is lost.

Acquisition context

ColdAcquisition {
  acquiring_process
  original_terminal_io
  original_selected_window
  inherited_scheduler_inhibit
  owns_cleanup: Boolean
  saved_screen: Optional raster
  saved_who_line: Optional raster
  owner_debugger_level: Optional Integer
  prior_keyboard_owner
}

EB-C46 does not save a screen or establish the later global keyboard owner. EB-C303 saves the main display and who-line and dynamically owns the keyboard. EB-G85 best-effort saves an eligible local unlocked main screen and records the acquiring process and exact debugger recursion level. These differences MUST remain profile-visible.

Breakpoint session

BreakpointSession {
  profile
  reason
  package
  stream
  evaluation_history
  recursive_debugger_depth
  exit_reason: resume | abort | return-form | top-level-throw | error | nonlocal
}

EB-G85 additionally distinguishes ordinary-cold-break from minimal-emergency-evaluator. The former is the user-facing path. The latter is entered only by the recursive degradation tier or an explicit internal call.

Locked-error and Output Hold state

EB-C303 MUST model an ordered set of locked error windows, each with its waiting debugger/process and lock state. It MUST separately model the current Output Hold candidate, target sheet, superior-lock diagnosis, helper-process deadline, and decision history. These are independent state machines; using one generic “emergency recovery” flag is nonconforming.

Core invariants

1. Entry MUST operate on the current live Lisp state; no band/world/snapshot reload occurs as part of Emergency Break.
2. Cold input MUST NOT require an ordinary application window, pane redisplay, presentation database, or CLIM/Dynamic Windows event loop.
3. No cold-stream profile defines a pointer command after stream selection.
4. Only the acquisition that owns cleanup MAY restore or release the shared cold display state.
5. EB-G85 restoration MUST additionally match both acquiring process and exact debugger level; a nested or foreign unwind MUST NOT restore the outer raster.
6. Every profile MUST preserve ordinary Lisp multiple values and update the profile's specified history variables.
7. Numeric arguments accepted by a global prefix MUST NOT acquire semantics at a list-form Emergency Break leaf that ignores them.
8. Abort, process reset, warm boot, cold boot, VLM shutdown, Save World, and host forced stop MUST remain distinct operations and evidence claims.
9. A runtime succeeded XTEST action proves host dispatch only; the corresponding guest leaf is verified only by a recorded guest-visible result.

EB-C46 global entry trees

Terminal prefix (old keyboard: Esc)
├─ unmodified 0..9 -> argument := 8 * (argument or 0) + digit
├─ unmodified minus -> set sticky negative flag
├─ Terminal/Esc again -> reset prefix state
├─ O -> ignore argument; select last eligible exposed MRU entry
├─ S -> consume signed argument through recent-window selection
├─ Call -> evaluate list-form leaf in new process "KBD ESC"
│          -> KBD-USE-COLD-LOAD-STREAM
├─ Help, ?, or another exact registered suffix -> dispatch effective shared entry
└─ unregistered suffix, including Rubout -> no operation

The parsed argument is discarded at Call because the table action is a literal form. The radix-eight accumulator deliberately accepts 8 and 9; for example, those values participate literally in 8 * old + digit. Minus negates the eventual value or supplies -1 without digits. Suffix modifier bits are retained for exact registry matching. The mutable effective registry and all non-D04 owners MUST be dumped as the normative overlay incorporated from D02. Pointer ingress begins with D02's complete sheet/application router, not an unconditional right-button leaf. In a C46 keyboard-sensitive window encoded double-Right is the escape hatch, an unselected window consumes another click to select itself, and a selected window can receive the encoded event. At the default unhandled bitmask, Left selection wins over Right. Only an accepted Right reaches:

right button -> System Menu
└─ any button on Other -> Auxiliary Menu
   └─ any button on Emergency Break -> same cold-load function

The full D02 pointer/context tree is incorporated normatively. The operator text recommends Left, while the System 46 BASIC-MENU implementation selects an ordinary item with any button. A conforming source-exact profile MUST retain the implementation behavior and record the manual discrepancy.

EB-C303 global entry trees

Terminal
├─ 0..9 -> argument := 10 * (argument or 0) + digit
├─ minus -> set sticky negative flag
├─ B -> bury selected window alias; ignore argument
├─ character #x1D -> Set Mouse Screen; NIL cycles, non-NIL chooses
├─ O -> ignore argument; select last eligible exposed MRU entry
├─ S -> consume signed argument through recent-window selection
├─ Call -> new process "Handle Terminal-CALL" -> KBD-USE-COLD-LOAD-STREAM
├─ other exact registered suffix -> dispatch shared entry
├─ unregistered selected-buffer/global asynchronous suffix -> quote if room
├─ unregistered Rubout -> no operation
└─ other unregistered suffix -> beep

The list-form Call leaf again ignores the parsed argument. Minus negates the eventual value or supplies -1 without digits. Terminal preserves suffix modifier bits and has no second-Terminal reset branch. The complete mutable registry and leaf owners are the incorporated D02 overlay.

D02 context router accepts menu request -> three-column System Menu
└─ any button on Programs / Emergency Break
   -> new process "Emergency Break"
      -> KBD-USE-COLD-LOAD-STREAM

The incorporated C303 router gives encoded double-Right escape precedence. A keyboard-mouse window otherwise receives the event; an essential application can select an unselected target, deliver through :FORCE-KBD-INPUT, accept single Right for System Menu, or beep. At the no-window handler, Left then Middle then Right bit priority applies without fallthrough from a false higher-priority gate. The simple tree above begins only after that complete context route selects System Menu.

EB-G85 Function and pointer trees

Function
├─ function keys disabled -> beep, terminate prefix
├─ 0..9 -> argument := 10 * (argument or 0) + digit
├─ minus -> set sticky negative flag
├─ Function again -> reset argument
├─ O -> ignore argument; select last eligible exposed MRU entry
├─ S -> consume signed argument through recent-window selection
├─ uppercase terminal leaf, preserving modifier bits
│  ├─ Suspend -> list-form (KBD-USE-COLD-LOAD-STREAM)
│  │             process "Function Suspend", priority 100, typeahead held
│  └─ other firewall-enabled exact registration -> dispatch effective owner
├─ unresolved Help/? with installed registration -> Function Help
├─ unresolved Rubout -> no operation
├─ unresolved Abort/Suspend base character -> corresponding Control async intercept
└─ every other unresolved/disabled suffix -> beep

The Function Suspend numeric prefix is syntactically valid but semantically ignored because the literal handler form replaces the generic argument before evaluation. Typeahead hold ends after the handler returns. The firewall and registry gate all registered leaves, and suffix modifier bits remain significant. The complete effective registration set and its owners are a mutable D02 overlay, not behavior to infer from this one Emergency Break leaf.

Pointer ingress is the following leaf after the complete G85 D02 context router:

Shift + rightmost-button momentary System Menu
└─ press/drag to Programs / Emergency Break
   └─ select plain :EVAL item
      -> process "Emergency Break"
         -> KBD-USE-COLD-LOAD-STREAM with reason "Emergency Break"

The G85 router gives encoded double-Right escape precedence. A single Left can select an unselected window and then be conditionally forwarded; another event can be consumed by application :FORCE-KBD-INPUT. At the unhandled Right boundary, unmodified or Shift-Right requests System Menu, Meta-Shift-Right enters the separate window editor, and other modifier combinations beep. The no-window handler uses Left, then Middle, then Right priority without falling through after an ineligible higher bit. The item itself has no application-specific left/middle/right variants. Both the complete D02 pointer/context tree and its momentary-menu transaction are incorporated normatively.

Genera portable host-key bridge used by G85-RUN

The preserved X Remote Screen map distinguishes guest keyboard characters from host keysyms. Relevant complete function-key translations are:

The keypad mapping includes keypad decimal -> Rubout and keypad 1 (KP_End) -> End. G85-RUN used explicit cold-window targeting, KP_End for End, and F5 for Resume. These host names are evidence for this harness/runtime pair, not physical Symbolics keyboard legends.

EB-C46 cold reader

The hardware wait inhibits scheduling; Lisp evaluation restores scheduling. At the **MORE** pause, the next accepted character dismisses the marker. Break read outside the rubout handler can recursively invoke BREAK.

EB-C303 cold reader

If global MORE processing is enabled, the next accepted character dismisses **MORE**; if disabled, output wraps without waiting. Recursive BREAK MUST save and restore the interrupted rubout buffer and scan position.

EB-G85 low-level intercept before rubout editing

The FEP character layer runs before the stream editor:

This precedence matters. A special character intercepted here cannot be redefined as a self-inserting cold-reader character.

EB-G85 cold reader decision tree

next passed character
├─ matches caller blip predicate
│  -> return (:BLIP-CHARACTER character NIL)
├─ matches caller activation predicate
│  ├─ no editing/rescan -> return (:ACTIVATION character NIL)
│  └─ after edit -> store activator and throw to rescan
├─ Refresh
│  -> clear whole cold window; redraw prompt, buffer, noise strings
├─ Control-Refresh
│  -> fresh line; redraw prompt, buffer, noise strings
├─ Clear Input
│  -> erase buffer; zero fill; clear noise; mark edited/rescan
├─ Rubout
│  ├─ empty -> beep
│  └─ content -> erase one displayed character and boundary noise;
│                decrement fill; mark edited;
│                if now empty and FULL-RUBOUT -> throw out
├─ Help
│  -> fresh line; choose first available help mode:
│     BRIEF -> COMPLETE -> MERGED function -> PARTIAL -> generic cold-stream note;
│     fresh line; redraw prompt/buffer
├─ any remaining character with nonzero modifier bits
│  -> beep and ignore
└─ plain character
   -> echo and append
      ├─ prior edit -> throw to rescan
      └─ no edit -> advance scan and return character

The Lisp reader configures exactly End as its activation character. There are no hidden cursor, word-motion, kill/yank, completion-prefix, pointer, numeric-argument, or repeat commands in this cold editor. Return MAY appear as an ordinary character accepted by Lisp syntax, but it MUST NOT replace the source-defined End activation leaf.

On parse error the implementation clears any pending activator, reports the condition, explains Rubout correction when supported, redraws the buffer, and forces another edit when correction is enabled.

UNTYI stores a list as the activator; otherwise it stores one unread character when outside editing or at the start, and otherwise backs up the scan index. LISTEN checks unread input, then the activator, then hardware. CLEAR-INPUT clears unread, buffer positions, noise and pending hardware input.

EB-G85 cold MORE subcontext

The page boundary is two line-heights above the bottom.

output reaches page boundary
├─ MORE globally and locally enabled
│  -> display **MORE**; read one character; erase marker/home
│     ├─ Suspend -> (BREAK T)
│     ├─ Abort -> signal SYS:ABORT
│     ├─ Space -> continue
│     └─ any other returned character -> consume and continue
│        (no UNTYI pushback)
└─ MORE disabled
   -> clear/restart at home without pausing

Tab advances to the next eight-column stop. Unsupported character-set or diacritic output uses a lozenged character name when one is available.

Breakpoint command-boundary trees

EB-C46:

EB-C303:

Raw special-key dispatch occurs only at the new-form boundary. During editing, the cold reader's own map wins except for lower-level intercepts.

EB-G85 user-facing entry invokes the ordinary command-loop BREAK over the cold stream. Its first-nonwhitespace tree is:

These special-character leaves are read only at the first nonwhitespace boundary; after text begins, standard intercepted characters take their ordinary asynchronous path. Control-Suspend, Control-Meta-Suspend and Control-Abort also retain the lower-level cold-stream meanings above. A read/evaluation error enters ordinary debugger machinery; it does not silently switch to the minimal evaluator.

Minimal Genera emergency evaluator

The debugger depth-25 tier binds standard input/output to synthetic terminal I/O, marks the debugger potentially broken, prints its reason and loops:

Errors are not caught as a second mini-language; they re-enter debugger machinery with the system-problems flag set.

System 46 debugger dependency: complete initial dispatch table

Every non-null initial dispatch-table entry is listed. Condition-specific questions, site patches, and dynamically rebound characters are overlays.

Numeric prefixes apply only where the selected debugger command consumes them. An unlisted modified character follows the debugger's unbound-command response; the source does not close its exact beep/message at every terminal, so that visible response remains TODO-RUNTIME. Unmodified ordinary characters enter the Lisp form reader. Rubout at command boundary retries, Control-G is intercepted through the I/O buffer and throws to the debugger's top-level catcher, and Break can enter a nested break loop.

The numeric tree is decimal despite the historical reader's possible octal base:

Control-, Meta-, or Control-Meta digit
├─ first digit -> argument = digit
├─ more digits -> argument = old * 10 + digit
└─ next debugger command -> consume argument, then clear it

There is no minus argument leaf. Backtrace and motion variants use the value as a depth/count; Control-Meta-A and Control-Meta-L use it as an index, default zero. Control-Z accepts but ignores a value. Most other bodies accept and ignore one, while Meta-Z has no numeric parameter in its function signature; a conforming implementation MUST NOT promise that every prefixed command succeeds uniformly.

The source-bounded System 46 graphical menu is ordered:

What Error -> Arglist -> Retry -> Set arg -> T -> Quit one level -> Inspect
-> Return a value -> Search -> NIL -> Exit -> Edit -> Continue -> Throw

Its effective pointer/input overlay is:

No source guard corresponding to the System 303 cold-stream Control-Meta-W guard was found. That absence is source-scoped, not a claim that every System 46 display can successfully construct the graphical handler.

System 303 debugger dependency: complete initial dispatch table

System 303's Help reader is itself a complete nested binding tree:

Help or ?
├─ G/g -> General
├─ I/i or E/e -> Information
├─ F/f -> Stack Frames
├─ S/s -> Stepping
├─ P/p or X/x -> Proceeding plus current dynamic choices
├─ T/t -> Transferring
├─ D/d or C/c -> Describe, then read one debugger command character
├─ Help/? -> print topics and remain in Help
└─ Abort, Control-Z, or Control-G -> abort Help

Super letters are not 26 static commands: only choices assembled for the current condition are bound semantically. The numeric parser has a release-specific edge that MUST NOT be normalized away:

Control-, Meta-, or Control-Meta-minus/digit
├─ first minus -> -1
├─ second minus -> beep; retain prior argument
├─ digit -> digit + 10 * prior argument
└─ next command -> consume and clear argument

Thus minus then 3 produces -7 in the pinned source, not conventional -3. Runtime confirmation remains an oracle obligation. Numeric Abort clears the prefix and returns to the debugger command-loop top; bare Abort exits. Backtraces and motion consume depth/count. Control-Meta-A/L/T/V use an index, default zero. Control-Meta-S lists bindings without a prefix and selects the indexed binding into */+ with one. Control-Meta-H treats any prefix as “all handlers.” Meta-T uses no prefix for temporaries, zero to include pending open frames, and -1 for every regular-PDL word. Control-M uses the prefix as bug-report frame count. Control-Shift-S treats a prefix as a PC; Control-Shift-C treats -1 as clear-all in the current function and another prefix as a PC. Meta-Shift-C, Control-Shift-L and Meta-Shift-S accept but ignore the value. Meta-I's documentation advertises a prefixed show-all variant, but the source body ignores its argument.

System 303's graphical menu is ordered:

What Error -> Arglist -> Retry -> Set Arg -> T -> Exit Window EH -> Inspect
-> Return a Value -> Search -> NIL -> Abort Program -> Edit -> Proceed -> Throw

Left on Proceed invokes the default, right opens the current dynamic proceed menu, and middle is unbound. Left selects stack frames and generic values. Inspector history left re-inspects while right transfers the object to *; Inspector-pane right also transfers its object. Argument/local presentations can be selected for replacement, and inherited margin gestures reach stack top/bottom. On the cold-load stream, Control-Meta-W explicitly reports that the graphical debugger cannot be invoked and leaves the user in the textual debugger.

Genera ordinary Debugger dependency: source-bounded command surface

At the ordinary prompt, colon or Meta-X starts a named Command Processor command, an accelerator invokes its command directly, and an ordinary readable form evaluates in the selected frame's environment. A numeric prefix on colon or Meta-X is an accelerator error because full-command entry accepts no argument. The complete printed command inventory is:

Source-visible additions complete the base tree:

The ordinary frame PDL has its own argument-sensitive tree; it is not the VLM point stack:

Control-Space
├─ no prefix -> push current frame
├─ modified numeric 0 -> show frame PDL
├─ exactly Control-U (argument class :control-u, value 4)
│  -> pop and select saved frame
├─ exactly Control-U Control-U (argument class :control-u, value 16)
│  -> pop and discard saved frame
└─ every other prefix, including a typed modified 4 -> beep; no command

Control-Meta-Space exchanges the current frame with the top saved frame and rejects every numeric argument. It does not rotate the PDL.

The inherited standard argument grammar is also a multi-stage tree:

Debugger command boundary
├─ Control-U -> argument class :control-u, value 4
│  └─ repeated Control-U -> multiply by four
├─ Control-, Meta-, or Control-Meta-minus -> signed argument state -1
├─ Control-, Meta-, or Control-Meta-digit -> signed decimal accumulation
├─ modified Infinity -> sign times 2^40
├─ another argument character -> continue argument state
└─ accelerator
   ├─ argument-aware leaf -> consume class and value
   └─ argument-disallowing or unknown leaf -> accelerator error

Unmodified digits, minus and Infinity begin ordinary form input rather than numeric arguments. Prefix state survives entry into Control-X. Accelerator error beeps, clears accelerator input, reports the undefined/disallowed sequence and reprompts.

The complete Control-X tree is:

Control-X
├─ C -> set trap on call
├─ Control-C -> clear trap on call
├─ Meta-C -> proceed and trap on call
├─ Control-Meta-C -> restart and trap on call
├─ E -> set current exit trap; any numeric presence means current plus outer
├─ Control-E -> clear current exit trap; numeric presence means current plus outer
├─ T -> condition tracing: no prefix toggles, 0 disables, nonzero enables
├─ B -> bindings: no prefix current frame, prefix entire stack
├─ I -> environment: no prefix toggles, 0 dynamic, nonzero lexical
├─ Control-I -> symeval in last instance
├─ Control-A -> all arguments
├─ Control-L -> all locals
├─ Control-R -> rest argument
├─ D -> compiled code
├─ Control-D -> source code
├─ Help -> enumerate applicable inherited leaves; execute none
└─ unknown -> accelerator error

Control-X makes a short typeahead probe; if no terminal is ready it displays the prefix prompt and continues waiting. It has no timeout termination. The implementation MUST NOT flatten Control-X C, Control-X Control-C and Control-X Meta-C into one command.

The dynamic direct-choice tree is assembled for each condition. Super-A through Super-Z select current proceed/restart/special entries by position. The base source also provides Super-Shift-C for :store-new-value and Control-Shift-P for :package-dwim when applicable. Earlier dynamic entries shadow later ones, and dynamic entries shadow global commands except Abort and Resume; Resume is assigned to the first suitable proceed/restart. Selecting a presented proceed option executes that same option.

Plain Help is introductory; Control-Help lists the command inventory. In the Display Debugger, Help routes to its Dynamic Windows Help display. Entry/exit leaves are:

An otherwise ordinary graphic character begins Lisp-form input in the selected frame. Presentation blips may satisfy typed command arguments. Meta-Abort is the reader's abort character; Suspend and Meta-Suspend are intercepted entry/suspension controls rather than Debugger table leaves.

Genera Display Debugger dependency: source-bounded pointer composition

The interactor retains every ordinary Debugger keyboard command above. Its sixteen button rows and all secondary gestures are:

Right-button submenus are complete:

The Display Debugger composes its application overlay with the complete Dynamic Windows raw map. The selected base initializes one unique primary gesture for each of 32 modifier states on each of Left, Middle and Right: 96 cells. Each row below expands to <prefix>Left, <prefix>Middle and <prefix>Right; empty means the unmodified buttons:

The non-null initialization aliases relevant to this composition are:

Every other raw cell retains only its unique primary gesture and has no Debugger-specific base handler. Generic Dynamic Windows handlers may still apply by presentation type. The exact physical multi-button, double-click and Shift-Right System Menu precedence is incorporated normatively from the Dynamic Windows gesture contract.

Debugger-specific pane translators are:

Source-language presentations retain applicable language/type translators. The effective Right menu is therefore not a closed static list: inherited Dynamic Windows translators plus loaded-world and site extensions are overlays. A conforming implementation MUST dump the presentation ancestry, active command table, raw gesture, applicable translator order and resulting menu for the pinned world; until that probe is run, the exact loaded-world menu is TODO-RUNTIME rather than guessed.

Open Genera VLM Debugger dependency: source-bounded compact prefixes

The Open Genera VLM Debugger runs in the separate Cold Load X client and is an address-oriented halted-machine debugger, not a Lisp evaluator. An EB-G85/L2 implementation MUST preserve this transition boundary even if VLM commands are implemented by another host component. In the pinned runtime the harness must target that client as --window-kind cold-load; its reserved title-only debugger classifier is not an observed route for this profile.

Its numeric/location grammar is:

number in current base [dot -> establish point]
├─ Control/Meta/Super/Hyper numeric context -> decimal argument
├─ #'symbol -> function cell
├─ 'symbol -> symbol address
├─ backquote + Q/O/S -> object/input form
└─ @V / @P / @R / @U -> virtual / physical / region / unmapped segment

Typeout formats are character ('), bit numbers (#), array header (A), control register (C), error trap (E), instruction (I), current-base integer (O), Lisp pointer (Q) and Lisp object (S). Escape/lozenge modifies a command's secondary or default argument only where that command defines it.

The point-stack prefix tree is:

Control-Space -> push current point
Control-U Control-Space -> pop and select
Control-U Control-U Control-Space -> pop and discard
0 Control-Space -> display point stack
Control-Meta-Space -> exchange top points
numeric-argument Control-Meta-Space -> rotate points

Complete compact stack commands are:

Complete location controls are: = Describe Location; ^, Return, Line, Space or Backspace set an open location when an argument is active; /, ^, Tab, Line, Space or Backspace show an open location when the set preconditions are absent; ; shows a supplied value in a format. The same ^ is context-sensitive. A conforming implementation MUST decide from open-location and argument state before mutation and SHOULD confirm historical memory writes.

Named debugger commands additionally include Describe Area, Describe Physical Address, Describe Region, Describe Virtual Address, Symbol Function, Symbol Value, Debug Process, Set Typeout Format, Set Base, Set Debugger Options, Set Default Segment, Set Package, Mail Bug Report, Accelerator Help (Control-Help), and Abort (Control-Z or Abort).

Named full commands enter through colon or Meta-X. Unlike the Lisp Debugger there is no Lisp-form fallback, and the selected source/manual profile establishes no pointer binding. Exact undefined-key diagnostics, completion behavior and nested Help topics remain TODO-RUNTIME for the pinned 346,880-byte debugger image with SHA-256 2db918cfe8f35f52c7ff4b7695b0ecd3bb85e41a3327ea5a94874edf05edb54a.

VLM-only top-level leaves are:

The full VLM inventory is also maintained in the normative Ivory/FEP/VLM layer analysis. That incorporation MUST be version-pinned in any implementation test fixture.

Standard System 303 yes/no query

This complete FQUERY tree is inherited by each System 303 recovery question unless the question explicitly adds choices.

Explicit EB-C303 locked-error diversion

enter explicit Emergency Break
-> own keyboard; save main and who-line rasters
-> for each LOCKED-ERROR-WINDOW in order
   -> ask "handle this error in cold stream?"
      ├─ Yes -> restore saved screen; remove window; wake its debugger; exit
      └─ No -> next queued window
-> no selected queued error
   -> bind streams; display package/reason; run breakpoint
-> any unwind
   -> restore screen; restore keyboard-owner binding; terminate process

Automatic System 303 locked-error arbitration

unsafe error window
-> push on LOCKED-ERROR-WINDOWS without interrupts
-> free temporary locks
-> if immediate query enabled:
   save screen; own keyboard; clear cold input; ask C/U/N
   ├─ C -> remove this window; waiting debugger adopts cold stream
   ├─ U -> clear all window-system locks; retry normal notification
   ├─ N -> leave locks and wait
   ├─ Help/Clear Screen -> generic FQUERY behavior
   └─ invalid -> generic beep/typeahead-clear/list/retry
-> wait until safety predicate succeeds or window removed
-> unwind always removes stale list entry

No pointer aliases exist. In the selected source, the immediate query's local screen restore is not itself enclosed by an unwind-protect. An injected nonlocal exit can bypass that local restore even though the outer cleanup removes the queue entry and unwinds keyboard ownership. EB-C303 MUST preserve this in a legacy-exact mode. A safer mode MAY guarantee restore but MUST label the deviation.

When immediate querying is disabled, external leaves are:

Terminal Hold Output trees

EB-C46:

Terminal Hold-Output
├─ process exactly in Output Hold, with sheet and hold flag
│  -> free temporary locks; expose sheet
└─ otherwise -> beep

EB-C303:

Terminal Hold-Output
├─ no suitable process/window -> beep
├─ temporary locks only -> free them; expose
├─ window or superior locked
│  ├─ ask attempt exposure while impersonating locking process?
│  │  ├─ Yes -> helper process, bounded at 10 seconds
│  │  │  ├─ success -> return
│  │  │  ├─ condition -> report; continue
│  │  │  └─ timeout -> reset helper; report; continue
│  │  └─ No -> continue
│  └─ ask forcibly unlock all window-system locks?
│     ├─ Y / Space / T -> clear locks
│     ├─ N / Rubout -> retain locks
│     ├─ D / E -> set Debug I/O to cold stream; interrupt process into debugger
│     └─ Help / Clear Screen / invalid -> FQUERY retry behavior
└─ exposed, unlocked, inexplicably held sheet
   ├─ Yes -> clear output-hold flag
   └─ No -> retain flag

Unless an earlier success/debugger branch returns, the ordinary tail attempts to expose the target. The impersonated helper's success, condition and timeout are three observably distinct results.

Genera retains the same diagnostic shape with a cold query when normal screen use is unavailable. Its yes aliases are Y, Space and T; no aliases are N and Rubout; Debugger is D. In the forcibly-unlock query, the debugger choice asynchronously breaks the held process after routing Debug I/O to cold stream. A conforming Genera profile MUST preserve the bounded helper and distinguish expose failure from force-unlock authorization.

Related global degraded leaves

These leaves MAY be invoked from the cold evaluator by calling their Lisp functions, but they are not automatically executed by Emergency Break.

EB-C46 explicit breakpoint

The source-exact transaction is:

entry
-> home cold cursor; clear rest of line
-> establish top-level catch
-> bind terminal I/O to cold stream
-> permit scheduling during Lisp evaluation
-> print current package and enter BREAK
-> Resume/Altmode-P, Altmode-G, RETURN form, error or nonlocal transfer
-> leave without a saved-screen restore transaction

Cold output can overwrite the visible ordinary display. Recovery of that display is a separate operator redisplay action. A conforming EB-C46 implementation MUST NOT invent later screen-save or ownership semantics.

EB-C303 explicit breakpoint

entry process
-> dynamically set COLD-LOAD-STREAM-OWNS-KEYBOARD = true
-> save main screen and who-line bitmaps
-> home cold cursor; clear current line
-> offer each locked error window
-> if none selected, bind query/terminal streams to cold stream
-> print package and reason
-> run BREAK inside named abort/error restart
-> unwind for every normal or abnormal exit
-> restore saved screen unconditionally
-> restore prior keyboard-owner binding
-> process terminates

Screen restoration is part of the explicit transaction, not a success-only action. The implementation MUST cover Resume, Abort, (RETURN ...), evaluator error and nonlocal exit. A fault in the restoration mechanism itself follows the release's ordinary error policy; it MUST NOT be relabeled successful recovery.

EB-G85 acquisition wrapper

WITH-COLD-LOAD-STREAM performs:

1. capture original terminal I/O and selected window;
2. construct/bind synthetic terminal I/O for query, debug, error, standard input and standard output;
3. preserve the inherited scheduler-inhibit value;
4. if terminal I/O is not already cold, mark this invocation as cleanup owner, mark the stream selected and request debugger takeover;
5. execute the body inside an Error/Abort restart whose purpose is leaving the cold breakpoint; and
6. on every unwind, invoke debugger recovery only when this invocation acquired the stream.

The keyboard/menu entry executes without interrupts, dynamically clears the selected-window binding, reports the package and enters ordinary BREAK.

EB-G85 debugger takeover and recovery

Takeover MUST:

• switch terminal I/O to the cold stream;
• inhibit scheduling so one process owns primitive interaction;
• best-effort save a nonremote, unlocked main screen into a correctly sized raster;
• record the owner process and current debugger recursion level;
• select the stream, home the cursor, and print a reason banner.

Recovery MUST:

1. clear the stream-selected flag;
2. confirm that current process and debugger level equal the saved owner;
3. deselect/finish the cold stream;
4. clear ownership without interrupts;
5. temporarily force the required main-sheet locks;
6. copy the saved raster back;
7. deallocate the raster;
8. restore lock values/count; and
9. mark the who-line clobbered so it will be repaired.

A nested debugger level or foreign process MUST NOT restore the outer raster. It may clear its local selected flag only. This exact owner-and-level condition prevents a nested failure from prematurely repainting the screen of the suspended outer debugger.

The cold stream's SELECT operation finishes pending output, sets its selected flag and asks the FEP to select. DESELECT asks the FEP, finishes output and clears the flag. These calls are observable lifecycle events even if a port has no physical FEP.

Availability branches

EB-G85 source defines:

The Null/Idle process uses required entry if it detects scheduling left inhibited or preemption disabled. The lower takeover routine separately warns that some platforms have a null cold stream; an implementation MUST distinguish guarded user entry from an internal unguarded selection whose output would be invisible.

Genera Life Support operation set

The selected source's cold display uses these operation codes:

An EB-G85/L2 port MUST provide behaviorally equivalent operations and ordering. It MAY encode them differently only below a conformance-visible adapter. Input must not be lost across cursor/clear operations. Output completion must precede selection state changes as described above.

Required stream operations

The semantic stream protocol MUST cover:

• character and string output, cursor position and fresh-line handling;
• clear rest of line/window, home and finish output;
• character input, any-character input, unread input and listen/readiness;
• clear input, rubout-handler invocation and editable input buffer access;
• selection/deselection, size negotiation and beep;
• prompt/reprompt and display noise associated with input positions; and
• MORE pagination with the selected profile's interception semantics.

The ANY-TYI equivalent MUST avoid ordinary scheduler blocking outside rubout editing. A reimplementation that waits on a normal window toolkit condition variable while the scheduler is the failed subsystem MUST provide an independently serviced life-support path or it is not L2 conforming.

Display geometry and rendering

Text advances by character width; newline advances by line height and returns to the left edge. Tab targets the next multiple-of-eight column. Output that cannot be represented directly SHOULD use a visibly delimited character name. Clearing and redrawing input MUST preserve prompt, buffer and noise-string order exactly at the semantic level, although the raster font and host pixel layout may differ outside a selected visual profile.

Automatic cold debugger fallback

EB-C46 selects cold debugger I/O when:

• the error occurs in scheduler, keyboard or mouse processing;
• terminal I/O is clobbered;
• printing the error fails and the retry also fails; or
• error-handler I/O is explicitly configured as the cold stream.

It homes and clears the primitive display. It does not save/restore the screen or establish the later owner flag. Operator redisplay is separate.

EB-C303 adds:

• first-entry-only screen save;
• the responsible second-level debugger stack group;
• cold-stream keyboard ownership;
• scheduling inhibition while the cold debugger is active;
• restoration of owner binding on unwind; and
• when that debugger stack group is freed, a standard yes/no/Help/Clear Screen question asking whether to restore the saved screen.

Choosing No deliberately leaves the cold display visible. A conforming implementation MUST NOT restore automatically after No.

Genera recursive degradation ladder

Each debugger entry increments depth. The exact policy is:

Cold or remote debugger sessions suppress proceed menus that require the ordinary presentation surface. Threshold tests MUST distinguish 14/15, 19/20, 24/25 and 29/30; an implementation MUST NOT use >= 15 for every degraded state.

Genera process-abort dependency (D22; non-gating)

Process abort is a separate D22 process/scheduler application dependency. D04 owns the semantic edge by which its timeout query can acquire and unwind the cold stream; the query's generated physical shortcuts do not gate EB-G85/L2. Process abort is initially cooperative. After its timeout, a query may appear on an ordinary popup or the cold stream. The cold query takes the scheduler lock, acquires the cold stream, and guarantees corresponding recovery on unwind. Its complete semantic choice set is:

The exact displayed shortcut characters are query-generated and MUST be dumped from the selected installed option set before claiming a physical key map. The semantic choices above are source-required. This state machine MUST remain separate from the user-facing Emergency Break process.

Abort, reset, warm boot and world boundaries

• Cold-stream Abort signals the ordinary abort condition; it is not a process reset or boot.
• Meta-Abort in the System 303 breakpoint explicitly resets that Emergency Break process; it does not restore a band.
• A Genera warm reinitialization rebinds basic I/O to cold load, resets warm-boot and error-recursion state, and rebuilds process/screen-manager state. Source warns that current process state is lost without ordinary unwind; old processes run their warm-boot action or are flushed.
• Cold boot or world loading replaces a wider machine state and is outside this application transaction.
• Halt Genera :Shutdown No pauses the running VLM process; :Start/:Continue can resume it. :Shutdown makes unsaved state non-resumable. Save World is a separate guest operation requiring its own authorization and direct observation; it was not verified in G85-RUN.
• A host harness stop is containment evidence. It is not a guest Abort, Resume, Reset, Warm Boot or Save World.

Failure matrix

System 303 cold breakpoint

C303-RUN, 2026-07-18. The primitive break display announces the package and cold-load-stream breakpoint, accepts a synthetic form and displays 42. The entry was invoked through the menu target's Lisp function rather than a successfully observed item-selection dispatch; guest Resume/restoration was not verified in this run. The exact image is approved only for this analytical use under the repository's capture-specific rights review.

An EB-C303 visual profile MUST retain:

• the ordinary screen visible beneath/around primitive cold text when the raster is not cleared completely;
• a package line, breakpoint/recovery instructions and a command prompt;
• monospaced unornamented primitive output; and
• typed form and printed values in chronological order.

Exact font pixels and this screenshot's screen contents are not otherwise normative.

Genera 8.5 actual System Menu entry and cold client

G85-RUN, 2026-07-19. The actual System Menu leaf launched a process whose banner read “Emergency Break, using the cold load stream.” The researcher entered only synthetic arithmetic, submitted it with the source-defined End character, and received 42. A subsequent Resume restored the saved main Listener display. The exact image is approved only for D04 analysis and is excluded from the project license.

The tested VLM exposes the cold stream as a separate 1024 by 768 X client titled INTERNET|10.0.0.2 Cold Load Stream. An EB-G85 visual profile MUST preserve the semantic separation between the primitive cold display and the 1200 by 900 main Genera client, but a non-X port MAY represent them as independently targetable surfaces. The cold view requires:

• an entry banner containing the supplied reason;
• current package identification;
• breakpoint name and Resume/Abort guidance;
• Command: prompt; and
• left-to-right form/result/new-prompt chronology.

G85-RUN exact observation record

The action sequence included explicit exact-window selection. After two nonselecting menu attempts retained as negative evidence, the successful sequence held Shift and right button, exposed the menu, moved to the highlighted Emergency Break row, released, then selected it with left. The cold client showed the exact reason banner. The harness typed (+ 40 2), sent end -> KP_End, observed 42, sent resume -> F5, and captured the restored main client. Host success records alone do not carry these claims; the before/after pixels do.

Artifact and profile isolation

Global entry and prefixes

Cold reader and pagination

Evaluators and debugger transition edges

D12 debugger application dependency closure (non-gating for D04)

EB-T26 through EB-T31 close the separately scoped D12 debugger applications. They preserve the audit obligations discovered here but do not gate EB-*/L2.

Ownership, locks and degraded recovery

Automatic fallback and persistence

D22 process/scheduler dependency closure (non-gating for D04)

D52 VLM Debugger dependency closure (non-gating for D04)

Visual and runtime oracle tests

Runtime closure probes

The following remain TODO-RUNTIME:

• run a compatible System 46 band and capture its exact direct/no-save display;
• resolve the current System 303 host mapping for guest Resume and prove saved-screen restoration;
• exercise Genera Function Suspend, including ignored numeric argument and typeahead lifecycle;
• exercise every Genera cold editor key, Help mode, MORE branch and pointer nonbinding;
• create safe System 303 and Genera locked-error and Output Hold fixtures;
• trigger automatic cold debugger fallback and nested owner-level cleanup without manufacturing unsafe damage;
• branch-test actual VLM platform availability;
• use the now-capable exact cold-window selector for a separate read-only VLM :Show Version/:Show Status and pause/resume observation, routed to D52 and non-gating for EB-G85/L2; and
• dump the live Display Debugger's inherited presentation-translator overlays and compare every effective Right menu against the source-bounded base candidates, routed to D12 and non-gating for D04.