System 452.1 and Zmail 442.0 Converse and Notifications bindings and semantics

Selected profiles

The System 452.1/Zmail 442.0 source tree and System 452.22 world image have not been proven load-identical. A conforming report MUST identify one profile per result and MUST NOT use a source fact as proof that the same code was loaded in DM-G85-RUN. Conversely, a screenshot is not proof of an unexercised source branch. Combining DM-G452-SRC + DM-G85-RUN means implementing the selected source contract and comparing only the bounded world states, not asserting version or body identity.

This companion closes the main specification's CONVERSE-G452, CENTRAL-NOTIFY-G452, NOTIFICATIONS-ACTIVITY-G452, CP-REPORTS-G452, and NET-NOTIFY-G452 feature inventories. Its Write/Append and Hardcopy rows close only the Converse-facing portions of EXPORT and HARDCOPY-G452; filesystem and printer implementation remain owned by their subsystem specifications. A conformance label MUST name the selected closures and strict/corrected status of every applicable main-specification defect.

Normative companion incorporation

The following exact in-repository sections are part of this contract rather than background reading:

The local overlays in this document win only in the contexts and order stated. If a local cell is absent, the incorporated parent remains effective. If a local cell is hard undefined, lookup stops. A reimplementation MUST preserve the owner and lookup path for every effective result; flattening the tables without that provenance is not conforming.

Evidence vocabulary

Licensed source identity ledger

The source files remain untracked local licensed inputs. Paths below are portable archive-relative identities; hashes permit a licensee to reproduce the audit without publishing the files. Sizes are bytes and hashes are SHA-256.

The release-context row is the direct version evidence for DM-G452-SRC. It names System 452.1 and Zmail 442.0 in the licensed source distribution. The separate VLOD runtime reports System 452.22; this specification does not infer equivalence between those versions.

The purchased Open Genera archive used by the harness is 206,213,430 bytes, SHA-256 89fb3e76b91d612834f565834dea950b603acf8f9dbacacdd0b1c3c284a2d36e. The base and private Genera-8-5.vlod were each 54,804,480 bytes, SHA-256 a8ee5e86cc7e322f7385af3e0cd579d7650d4dcfc3ce328acbf8b25515dd0672, at both run boundaries.

Runtime witness boundary

DM-G85-RUN began 2026-07-18 06:39:03 EDT and ended 06:42:39 EDT. Its run record is 26,055 bytes, SHA-256 1ffacb2809fa4aee90e12fb7ff65413d1e443e0471adc82e1af2265743ad15f7; its 14-record action log is 6,881 bytes, SHA-256 742d8554f5273038b99e555d1262afbbbdb4dc2f0096f2a55f1357d7827eec03. The local login, Select C, local Converse Help, Select N, and a researcher-owned TV:NOTIFY call with fallback popups disabled were observed.

The shutdown prompt was observed, yes was accepted, and cleanup began. The known Cold Load channel mutex stall then required bounded termination. The final flags were forced_stop=true, forced_after_confirmed_shutdown_stall=true, state_may_be_incomplete=true, and orderly_vlm_host_shutdown=false. The harness performed neither Save World nor a host checkpoint; both world hashes remained unchanged. This witness MUST NOT be described as an orderly shutdown or as evidence of persistence.

Component graph

Listener / Command Processor
├─ QSend / QReply / Send Message
│  └─ Converse send preflight -> background sender -> Converse request queue
├─ Show Messages -> Converse object histories
└─ Show Notifications -> TV notification history

Converse frame (ZWEI + TV)
├─ one ZWEI window pane in Text mode
├─ ZWEI interval plus structural diagram lines
├─ Dynamic Windows margin components, including scroll bar
├─ optional temporary Dynamic Window incoming-message popup
└─ network :send adapters (:converse, Chaos :send, SMTP)

TV notification service
├─ newest-first retained history
├─ oldest-pending cursor
├─ central delivery process
├─ selected-stream handshake
├─ fallback popup and remote-terminal delivery
└─ Notifications Dynamic Windows program framework

Converse is ZWEI/TV, not CLIM

DM-G452-SRC composes the main frame from a Converse top-level editor, Converse state, new-panes-zwei-frame, and TV process/select mixins. It creates one zwei-window-pane, installs the Converse comtab, and enables Text mode. Its pane uses Dynamic Windows ragged-border, white-border, and scroll-bar margin components, but the editor and command loop remain ZWEI/TV.

The incoming-message popup is explicitly a temporary dw:dynamic-window, and its queries are FQUERY interactions. Listener message entry uses SCL:ACCEPT with a custom presentation type. Those are Dynamic Windows integrations, not evidence of CLIM.

Notifications is Dynamic Windows, not CLIM

Notifications is defined by dw:define-program-framework. Its frame contains a title pane, a two-cell command menu, and a scrolling typeout/display pane with a left margin scroll bar. TV:NOTIFY formats its text into a Dynamic Windows presentation-recording string, allowing sensitive content to survive in a record. Neither fact creates a CLIM application frame.

No selected file declares a CLIM application frame, CLIM port, CLIM command table, or direct CLIM protocol dependency. A conforming reconstruction MUST identify the main Converse frame as ZWEI/TV, the popup and typed readers as Dynamic Windows facilities, and Notifications as a Dynamic Windows framework. It MUST NOT market either as a CLIM application merely because the systems share terms such as presentations, commands, frames, panes, or redisplay.

Source-defined frame and pane properties

The following are source-profile contracts; they do not claim pixel identity with the separate Genera 8.5 witness.

Conversation object

An implementation MUST retain at least this logical state per conversation:

Conversation {
  first_line
  last_line
  recipients[]
  ident | NIL
  private
  node
  to_line_delimiter
  with_header_p
  append_mode_at_creation
  oldmsgs[]
}

OldMessage {
  before_header | NIL
  text
  id_or_extra_args
}

before_header=NIL denotes incoming content; an outgoing record has a generated status/header marker. oldmsgs is pushed newest first. The append-mode captured by the conversation controls how records are materialized and later normalized; it is not merely a viewer preference.

A conversation matches another message by non-NIL identity first. Without a usable identity, it matches only when recipient-set lengths are equal and every recipient's rendered address has a case-insensitive textual match. Incoming grouping uses the sender plus any ALSO recipients. Address comparison may cache rendered strings, but the cache MUST NOT change equality.

The strict comparison does not consume a counterpart after a match. Equal-length lists containing duplicate address A can therefore compare equal when each A finds the same single A in the other list even though another element differs. This is the main specification's G452-RECIPIENT-MULTIPLICITY defect. Strict mode MUST retain it; a consuming multiset comparison MUST be labelled with that defect's permitted correction rather than presented as source identity.

The headerless anonymous composer is always the initial conversation. Each new named conversation is inserted immediately after it, so the newest conversation appears at the top of the named list. Every structural first/last/delimiter line MUST remain reachable with reciprocal ZWEI links. Commands that require a current named conversation MUST reject the anonymous composer and damaged structures.

Histories and reply registers

Genera maintains three distinct histories:

*last-recipients* and *last-ident* are updated before an incoming direct message is queued into the Converse frame. QREPLY MUST snapshot both registers before any prompt or asynchronous work so a later receive cannot retarget an in-progress reply. The before-cold Converse reset is ordered: clear saved sends; clear last recipients; look up an already existing frame without starting one; and, if found, send delete-all-conversations. Delete-all sets the conversation list NIL before regeneration, so the old-list snapshot is empty. It deletes the interval, inserts a return, constructs exactly one fresh headerless To: composer, installs that singleton list, moves point to the end of the new first line, and requests text redisplay. No old anonymous/named conversation, old-message record, or unsent interval text remains reachable from the rebuilt frame. With no frame, only the first two clears occur.

The operation does not assign last identity, request stack, receive mode, gag, append/end policies, or beep count. Strict mode MUST retain exact sentinel values; queued work may later run against the rebuilt frame. A corrected mode MAY clear additional state only as a named deviation. The sequence has no rollback: failure at frame lookup/send, list-NIL, interval deletion/insertion, composer construction, list install, point move, or redisplay preserves every preceding effect and may leave NIL/partial/singleton frame structure according to that boundary.

There is no automatic transcript file. Write and Append commands are explicit user exports. A world save is outside this contract and MUST NOT be inferred from any history mutation.

Notification record and cursor

NotificationRecord {
  universal_time
  presentation_recording_string
  window_of_interest | NIL
}

NotificationState {
  history                 // newest record first
  next_note_tail           // list-tail identity, not numeric index
  tv_last_notification_tick
  central_process
  popup_times_by_console   // process-local alist: console identity -> successful popup tick
}

NetworkNotifyFilter {
  text_buffer[1500]
  packet_length = 0
  packet_tick = 0
  resolved_host = NIL
}

TV:NOTIFY follows a non-NIL synonym stream, validates the resulting window as NIL or a sheet and the format control as a string or list, then formats the complete record before mutating shared state. Validation or formatting error MUST create no record. Its no-interrupt body then pushes history, sets the TV last-notification tick, uniquely registers a non-NIL window in background-interest state, conditionally activates that window, and wakes the central process, in that order.

The sequence is not rollback-protected. Tick failure may leave history alone; interest registration or activation failure leaves history/tick and possibly the interest entry; wake failure leaves every prior mutation. Normal return preserves the optional window-interest branch's multiple values—usually NIL without a window—rather than returning the record or process-wakeup value.

The delivery cursor is a retained list tail. Selecting the oldest undelivered tail while history is pushed at the head produces FIFO delivery from a newest-first archive. Identity, not equality, determines whether a viewer cache or cursor has reached a prior history head.

popup_times_by_console is lexical state of the central delivery loop, not the TV global last-notification/delivery tick or network packet tick. It has at most one current entry per console, updates only after that console's fallback popup is successfully selected, and drops entries once their delay has elapsed. Two consoles therefore have independent popup throttles.

Initialization and selection

Zmail initialization MUST:

1. build the Converse direct and C-X comtabs;
2. install Select C for the Converse frame;
3. create and activate one frame;
4. force delayed save bits to true before editing or background typeout;
5. create one ZWEI pane and one headerless anonymous composer;
6. place point after its To: line; and
7. enable Text mode.

Quitting buries the frame and leaves its process waiting forever. Later selection or activity reset reuses that frame/process and retained object state. Quitting does not create a new transcript and does not clear history.

Frame request queue

Network and Listener callers MUST NOT mutate the ZWEI interval concurrently. They submit an :enter-request, which pushes one request under interrupt exclusion and forces keyboard input. The post-command hook traverses the pushed list, removes each request before execution, and executes it within the ZWEI command-loop catch.

Consequences which a strict implementation MUST preserve:

• the queue is LIFO, not FIFO;
• “queue empty” means every observed request has been claimed, not completed;
• a command-loop error is caught around the request body;
• a receive waits at most 1,000 ticks for the pending queue to become empty; and
• timeout produces a TV notification that a message is pending, even though an already dequeued request may still be executing.

The traversal follows the list chain captured at hook entry. A request PUSHed by a running handler becomes a new live head outside that chain and is deferred. If A is pushed then B and B pushes C, the current pass executes B then A and leaves C; the next pass executes C. This differs from System 303's tail-extending FIFO traversal.

An implementation MAY replace this mechanism with a serialized actor or event loop only if its observable claim/dequeue ordering and all races below remain selectable under the strict profile.

Parse and conversation validation

Sending from the editor first verifies structural reachability, locates the conversation containing point, extracts the active To: region and body, parses at least one address, and canonicalizes each host. A missing host triggers logged-in user discovery; no match is an error, one match is selected directly, and several matches open the transient host chooser specified below. An unknown explicit host, empty recipient set, point outside a conversation, or damaged buffer MUST fail before a network call.

Ordered send transaction

For an editor send or one-shot send, strict behavior is:

1. Force a user login and canonicalize recipients.
2. If receiving is gagged, run the gag preflight query. If services are disabled, run the service preflight query.
3. Determine whether the text requires fat/styled transport.
4. Find a :send service path for every recipient and reject a missing path or a protocol unable to represent required text.
5. Find or create the conversation.
6. Insert a temporary outgoing record with a unique identity and a “being sent” or “being mailed” state.
7. For an editor send, restore the composer template, remove the submitted edit, move point to the selected append/prepend active position, and request redisplay.
8. Spawn the Sending Message process.
9. For mail, call the Zmail string sender and treat its ordinary return as success; for interactive send, invoke every recipient and collect per-recipient network errors. A user abort becomes the distinct :sending-aborted result.
10. If errors exist while Converse is hidden, issue a TV notification for list-form delivery failures.
11. Queue completion back into the Converse process.
12. Replace the matching temporary record when the original conversation still exists. If it was deleted meanwhile, find or recreate the matching conversation and add the final record there. When exposed, list-form errors also reach the typein error surface.

Preflight refusal is passed to the background path after the temporary record is inserted, so a short-lived sending status remains source behavior. :add-msg pushes its oldmsgs record before completing every structural check; a damaged buffer can therefore retain a history mutation even though visible insertion fails. These are historical partial effects, not recommended transaction design.

The mail branch deliberately cannot report ordinary Zmail failures through its return value. A signaled condition during the body is protected by completion cleanup; the selected ordering can queue a success-looking final status before the background process condition is otherwise handled. That exact visible result is TODO-RUNTIME-CN-01; DM-G452-SRC MUST retain the cleanup ordering, while an explicit corrected mode MAY record an unknown/failure status instead.

Incoming direct messages

The receiver rejects, in order, when no user is logged in, a private recipient does not match the logged-in user, or Converse is gagged. A network-server property notification bypasses all Converse histories and invokes TV:NOTIFY directly. That early branch formats the sender, date, and body after trimming trailing Return and Space characters. It does not inspect the ENCRYPTED property: a message carrying both NOTIFICATION YES and ENCRYPTED still includes the body in the TV notification. This source-visible disclosure is distinct from hidden-frame receive mode dispatch below, where the catch-all branch suppresses an encrypted body.

For a normal accepted message, processing MUST first push saved-send state and set the last-recipient/identity registers, then find the Converse frame and enqueue visible insertion. The queued operation finds or creates the conversation, adds an incoming record, and requests redisplay. If the selected, visible editor point is inside a partial unsent composer, point stays there; otherwise it moves to the conversation's reply position selected by append mode.

The exact hidden-frame receive-mode value classes are:

The selected-source defaults are :POP-UP receive mode, NIL prepend mode, two beeps, NIL End-exits policy, and no gag. Thus a fresh source-profile frame prepends new records and End sends/remains while Control-End sends/buries.

Obsolete option variables are translated once on the next receive and then cleared or normalized. The direct Converse beep count runs immediately only when the frame is visible or the mode is :AUTO/:POP-UP; notification modes rely on the TV notification route. Receive-mode dispatch is intentionally not an enum validator: an unknown value reaches the same catch-all behavior as :NOTIFY-WITH-MESSAGE and does not signal a protocol error.

One-shot sends, replies, and saved receives

“Saved sends” MUST NOT be implemented as an outgoing queue: it contains received non-notification bodies. One-shot sends still produce Converse temporary and final records through the frame request queue.

Lookup and denominator

Select C is the TV activity-selection entry for the frame, not a cell in the Converse editor comtab. (QSEND) reaches the same frame by function entry. These entry routes are tested separately from the following in-frame denominator.

The application contributes exactly 12 direct fixed cells: eleven in its initial table plus the later C-X prefix cell. It contributes five local C-X leaves and 11 named-command strings resolving to ten unique command functions. Its local overlay is:

Converse input
├─ transient reader or popup active -> that context's tree below
├─ local Converse direct cell
│  ├─ command -> execute locally
│  ├─ C-X -> Converse C-X, then inherited Standard C-X
│  └─ :UNDEFINED -> terminal not-defined error
├─ inherited Standard ZWEI direct tree
├─ active Text-mode and editor presentation overlays incorporated above
└─ exhausted -> editor not-defined error

A NIL local lookup falls through. A local :UNDEFINED does not. The incorporated Genera editor lookup, alias, prefix, numeric, pointer, and failure trees are normative for every inherited leaf; referring to them as “normal editor keys” without preserving their exact path is nonconforming.

Direct fixed cells

There is no application-local automatic repeat wrapper. ZWEI numeric state remains dynamically visible to a command: Meta-Q inspects it, C-X carries it into the child lookup, and every other terminal local direct command ignores it and executes once. Repeated physical input repeats dispatch only through the TV/editor mechanism; it is not a counted Converse operation unless an inherited command says so.

Complete local C-X subtree

C-X
├─ 1 -> One Window
├─ 2 -> Two Windows
├─ 3 -> View Two Windows
├─ ^ -> Grow Window
├─ O -> Other Window
├─ Help -> inherited Standard C-X prefix documentation
├─ Abort -> inherited Standard C-X abort
├─ C-G -> inherited Standard C-X failure/keyboard-macro termination
└─ every other child -> exact Standard C-X lookup incorporated from D05/G85
   ├─ inherited command or alias
   ├─ inherited hard undefined
   └─ exhausted -> prefix not-defined error

The five listed local leaves shadow same-key Standard leaves. The prefix table has Standard C-X as its parent, so an absent child MUST NOT be reported unbound until that complete parent is exhausted. The frame also points its mode C-X indirection at this Converse prefix, preventing Text mode from bypassing it.

Complete local named-command table

The two encryption rows visible only as source comments are not installed commands and MUST NOT be counted. The local denominator is 11 names/10 functions. Named completion also sees inherited editor candidates according to the incorporated Zmacs tree; a conforming dump MUST retain table provenance and duplicate-name shadowing.

Of the 11 local names, only Compile File explicitly tests numeric-argument presence; the value itself is not used, and any present value selects the extra output-path prompt. The other local named command bodies do not implement counted repeat. Inherited candidates retain their own numeric policies.

Help, unbound, and shadowing behavior

The local Help command is not the standard multi-stage Help dispatcher. It shadows that entire tree in the main Converse context and prints a fixed explanation. It omits Meta-Q, the five local C-X leaves, all three hard-undefined keys, Compile File, Load File, Hardcopy Buffer, and the Bug/Report Bug alias pair. Help is therefore useful but not an exhaustive binding inventory.

In an inherited child context where local Help is absent, the complete standard Help dispatcher incorporated above remains normative. An unknown direct key follows Standard ZWEI and mode lookup; only exhaustion reports not defined. Hard-undefined keys report the same terminal class without consulting a parent. A command symbol without an implementation remains a distinct not-implemented error.

Main editor pointer and presentation tree

Converse defines no application-local mouse comtab, output presentation translator, or pointer menu. Over editor content, the complete Genera Zmacs pointer and Dynamic Windows presentation tree is normatively incorporated. Structural diagrams support editor copying through their ZWEI representation; this does not create a new application gesture. Blank text, buffer text, diagram, mode-line, and margin hits MUST remain distinct contexts.

The margin component receives a margin hit before editor-content dispatch. For the default vertical left scroll bar, the source-visible logical cells are:

That is 13 handled component cells. Start-box shifted Left/Right, shifted Middle, modified combinations not listed, and non-mouse characters have no scroll-bar handler. The horizontal top/bottom variant substitutes X/left/right for Y/top/bottom; Converse and Notifications use the default vertical form in the selected world.

When global scroll-bar auto-repeat is enabled, holding an accepted Left/Right cell waits the configured initial delay and repeats until all buttons are released. Pressing the opposite button reverses direction. Screenful regions use a fixed screen interval; line regions derive rate from pointer position, with configured minimum/maximum rates, and synchronize ZWEI repeats with input/redisplay waits. Middle-button absolute motion returns before auto-repeat. A conforming implementation MUST preserve these distinctions and MUST export the logical Shift-Mouse-R cells even on hardware that cannot generate one.

Gag and service preflight FQUERY trees

The gag query runs before the service query. Each has exactly five local key cells and three semantic choices:

FQUERY adds its normative common context: Help describes the choices; exact unmodified Select/Mouse-L on a presented choice returns that semantic object; invalid keyboard input beeps, lists or re-prompts according to query options, and does not select a default; Dynamic Windows scrolling may intercept scroll keys; Abort follows the enclosing query/command abort path. The local denominator is ten registered key cells and six displayed semantic-choice instances across the two queries. FQUERY compares registered choice keys with SI:MEM-CHAR/CHAR-EQUAL, so each registered letter also accepts its opposite case. Each five-cell preflight map therefore has eight effective character values: Y/y, Space, N/n, Rubout, and E/e. The two preflights together have 16 effective values.

Incoming-message popup trees

The temporary window is 400 pixels high, labelled Incoming Message, and operated through TV:WINDOW-MOUSE-CALL; it is always deactivated and the prior activity is restored after the call. It defines no local pointer comtab beyond FQUERY choices.

Encrypted text first enters this four-cell tree:

Encrypted action
├─ D/d -> decrypt in the popup, then continue to ordinary action
├─ C/c -> select Converse after popup cleanup
├─ N/n -> do nothing and close
└─ Rubout -> do nothing and close

Visible or successfully decrypted text then enters this seven-cell tree:

Ordinary action
├─ R/r | Space | T/t | Y/y -> verify recipients and open one-shot reply input
├─ C/c -> select Converse after popup cleanup
├─ N/n | Rubout -> do nothing and close
└─ failed reply -> display the error and read one arbitrary acknowledgement input

Each tree has three semantic choices presented through FQUERY, so exact unmodified Select/Mouse-L can also choose one. With both preflight queries, the application provides exactly 5 + 5 + 4 + 7 = 21 registered transient key cells and 8 + 8 + 7 + 12 = 35 effective character values after case folding. It displays 3 + 3 + 3 + 3 = 12 semantic-choice instances. Generic FQUERY Help, pointer, abort, scroll, and invalid-input branches are additional inherited context paths, not local choice cells. A conformance dump MUST preserve both the registered-cell and effective-value denominators rather than counting lowercase aliases as new source registrations.

Ambiguous-user host chooser

When several Lisp Machines report the unqualified recipient as logged in, Converse builds one TV momentary-menu row per result. Each row contains the host plus available identity, idle, and location details. There is no local keyboard-sensitive menu mixin. On a current highlighted row, the base menu handler ignores the complete button descriptor; Left, Middle, and Right therefore select the same host under all 32 modifier states. Moving out/deexposure returns NIL.

For a fixture with N rows, there are 3N accepted normalized primary-button operations. The single-primary raw subset contains 96N selecting tuples (N rows by three buttons by 32 modifier states). Because the complete button descriptor is ignored, every nonzero button mask also selects: Left, Middle, Right, Left+Middle, Left+Right, Middle+Right, and Left+Middle+Right. The full raw denominator is therefore 224N selecting tuples (N rows by seven nonzero masks by 32 modifier states), all mapping to the same row value. Conformance MUST choose and report N, all three denominators, and the rejected outside/deexposure complement rather than call this an unbounded inventory.

One-shot message and address readers

The custom message-string presentation type expands to string and owns a separate history so long message bodies do not pollute ordinary string history. Its two local activation leaves are exactly End and Control-End; both accept the current body. The encompassing Input Editor provides its complete correction, movement, deletion, history, Help, Abort, pointer, and unbound behavior through the normative companions.

Recipient correction uses generic SCL:ACCEPT of string with no local accelerator additions. A parse/canonicalization error beeps, prints the error, and re-enters that reader. TODO-RUNTIME-CN-02 remains for a live dump proving every world-installed Input Editor override; source-profile conformance uses the selected-source parent tree.

Area and invocation tree

The Conversation command subset is a child of Communication; the selected Communication subset contributes no direct command. Conversation contributes exactly two commands and no fixed keyboard accelerator, prefix, or menu accelerator:

Command Processor input
├─ typed/completed command name or eligible command presentation
│  ├─ Send Message
│  └─ Show Messages
├─ common CP command/menu/presentation paths incorporated from D28
└─ unknown/ambiguous name -> CP correction and completion, never arbitrary choice

Send Message takes one required (sequence address) positional argument, prompts as recipient, defaults from the last-recipient register, forces login, canonicalizes, then enters QSend message input and asynchronous send. It explicitly suppresses the common Output Destination keyword. Parse/editor errors are rendered on the error stream rather than partially sending.

Complete Show Messages keyword surface

The command has exactly ten specialized keywords, plus common Command Processor output/pagination processing inherited from D28:

Before those filters, source traversal is global and ordered:

1. visit TV:ALL-THE-SCREENS in list order;
2. visit each screen's direct :INFERIORS in returned order, without recursion;
3. select every direct inferior of type ZWEI:CONVERSE-FRAME, with no selected-frame restriction or deduplication; and
4. visit each selected frame's *CONVERSE-LIST* in list order.

The source wraps every mention, query, and output operation in a non-NIL-recipient guard. The headerless composer, and any other conversation whose :RECIPIENTS is NIL, is therefore silent even when Mention Empty Sequences resolves true.

Precedence is normative:

1. concatenate From and To as the person filter;
2. resolve Query and Mention Empty defaults;
3. if Query is true, force Summarize false;
4. derive incoming/outgoing flags from explicit Direction, or choose incoming when there are no people, otherwise From drives incoming and To drives outgoing;
5. keep conversations where any filter address matches any recipient by name and, when supplied, host;
6. normalize oldmsgs relative to the conversation's captured append mode;
7. apply Recent as the newest contiguous exchange sequence;
8. apply Order and then Start/Stop subsequence selection; and
9. optionally query per nonempty conversation, then print descriptors and bodies or summaries.

The per-conversation yes/no query registers Y, T, or Space for yes and N or Rubout for no, with generic FQUERY Help and exact unmodified presented-choice selection. Character-equal matching also accepts lowercase y, t, and n, so the five registered cells yield eight effective character values. This tree is conditionally reachable only when Query resolves true.

The selected source's Forward result is oldest-first when append mode is NIL (the default) and newest-first when append mode is true. That contradicts installed Help and MUST remain selectable in strict mode. A Stop below Start can reach an invalid subsequence edge for some combinations; strict mode MUST report the source failure, while an explicit corrected mode MAY reject the range during argument validation.

Path selection and per-recipient failure

SEND-MSG visits recipients in request order. For each host it asks for a :send path with automatic retry enabled and collects (network-error, recipient) for failures. :CONVERSE, Chaos :SEND, and SMTP can satisfy the service. Styled/fat text is allowed only on selected Converse or SMTP paths at preflight.

If a remote Converse endpoint rejects CHARACTER-TYPE-MAPPINGS, the sender strips style and performs one new generic NET:INVOKE-SERVICE-ON-HOST :SEND invocation. The selected STRING-SEARCH predicate is case-insensitive, so case variants of that property name trigger the same branch. The generic invocation permits automatic path reselection; it neither pins legacy SEND nor promises reuse of the path that produced the error.

The source wraps that invocation in PROG1: thinning and the complete second send run first, and only a normal return from that send emits the warning that style was removed. If thinning would lose nonrepresentable characters, it raises a new remote Converse error before invoking a second path and emits no warning. If the retry itself signals, its failure propagates and likewise skips the warning. Ordinary nonmatching errors MUST NOT trigger thinning, retry, or warning.

CONVERSE byte-stream grammar

The outbound grammar and phase ordering are:

DATE <formatted-time> CR
FROM <address> CR
TO <address> CR
ALSO <address> CR                 ; zero or more
IDENT <text> CR                   ; optional
PRIVATE YES CR                    ; optional
ENCRYPTED <keyword> CR            ; optional
NOTIFICATION YES CR              ; optional
CHARACTER-TYPE-MAPPINGS <forms> CR ; optional styled text
FONTS <comma-separated-fonts> CR   ; paired with mappings when emitted
CR
force-output
read first response
body bytes
EOF
read second response
abort-close stream

DATE, FROM, and TO are emitted first in that order. ALSO preserves recipient iteration order after excluding the selected TO. Style headers follow other optional properties. The first response grants or refuses body transmission; the second confirms delivery processing.

Response interpretation is exact: first character + succeeds; - raises a remote error from the remainder; % issues a warning notification and continues; any other first character raises a remote error containing the whole line. An empty response line reaches an indexing failure in strict source behavior and MUST NOT be silently treated as success.

The server accepts exactly ten property names: DATE, FROM, TO, ALSO, IDENT, PRIVATE, ENCRYPTED, NOTIFICATION, CHARACTER-TYPE-MAPPINGS, and FONTS. An unknown property or parse failure returns a - syntax response. A network failure while reading headers returns silently. Repeated ALSO lines are reversed back into input order. Every normally singleton property may also repeat; the last parsed value wins rather than producing a cardinality error. An empty parsed CHARACTER-TYPE-MAPPINGS sequence is accepted as empty/NIL.

Property-name lexing splits at the first Space, uppercases only the name substring, and interns it in the keyword package. Upper-, lower-, and mixed-case property names therefore select the same ten keys. A nonblank property line with no Space fails the key/value split and follows the syntax-error response path. This name normalization does not imply one uniform rule for property values: each property's parser above governs its own value case and syntax.

Zero occurrences of DATE, FROM, or TO are not rejected by a required-field validator; they flow into different downstream operations and MUST NOT be described as uniformly optional:

• Missing DATE is the only explicit clean default. After the first response and immediately before body construction, it becomes the current universal time.
• Missing TO remains NIL. In the ordinary logged-in, nonprivate, ungagged case, Zetalisp STRING-EQUAL coerces that NIL symbol to its print name, so a normal user ID compares unequal and the server sends the % “deliver to logged-in user” response. Body construction then emits a To: NIL line and continues. A private message instead compares the logged-in name with an explicit empty-string fallback and is normally rejected before the body. The degenerate user ID NIL follows the literal case-insensitive comparison and therefore does not take the ordinary % branch.
• Missing FROM acquires only the connection host property during claimed-host normalization; it still has no user/name field, so address rendering returns NIL. A property notification formats that NIL as the visible sender and completes synchronously. A normal direct message first mutates saved-send/reply state and is queued. An existing identity or exceptional matching recipient set can let the queued message use an existing conversation. Otherwise new-conversation header construction passes the NIL address rendering to CL:WRITE-STRING, raises a string-type error after partial editor-structure mutation, and does not append the new conversation object to the conversation list. Because the request is claimed before execution, the network server can still reach its final delivery response; the exact loaded-world condition presentation is TODO-RUNTIME-CN-10.

For a logged-in, nonprivate, ungagged fixture whose user ID is not NIL, whose present TO equals that ID, whose present FROM is valid, and which has no matching identity or recipient set, the complete presence matrix is:

No row licenses a reimplementation to add an unstated parser-level cardinality check. Private, no-login, gagged, property-notification, and existing-identity fixtures override the downstream portions only in the explicitly ordered ways above.

After parsing, the server rejects no-login/private/gag with -; a nonprivate TO mismatch warns with % that delivery will use the logged-in user; otherwise it responds + to request the body. It records a claimed-host mismatch in the body, adds non-notification sender/date and optional recipient headers, decodes style when possible, invokes incoming processing, and responds + for delivered processing. Errors while flushing the final response are ignored.

Chaos SEND and SMTP

The legacy Chaos SEND path transmits a thin sender/time line, optional Also-to, and thin body. Its server may reject before accepting; after accept it derives the sender from the first line, captures the body, submits a normal incoming message, and adds a compatibility service path when needed. It carries less identity and style information than CONVERSE.

SMTP is a service adapter, not the Converse interactive protocol. It may carry styled mappings or fall back according to its own mail encoding. The editor's Control-M mail command uses Zmail string sending and the limited error reporting already specified.

Selected-stream handshake

For each oldest pending record, a selected stream follows this exact state machine:

mode :ALWAYS-IGNORE -> handled immediately
mode :ALWAYS-POP-UP -> skip stream and request fallback
otherwise
├─ missing notification cell -> fallback
├─ compare-and-store loses because cell occupied -> fallback
└─ store record; wake selected process; wait 180 ticks
   ├─ cell consumed/NIL -> handled
   └─ timeout
      ├─ CAS reclaims record
      │  ├─ mode :IGNORE -> handled
      │  ├─ mode :BLAST -> asynchronous stream display, handled
      │  ├─ mode NIL or :POP-UP -> fallback
      │  └─ other mode -> notification-protocol error
      ├─ late consumer changed cell to NIL -> handled
      └─ alien remaining value -> notification-protocol error

The compare-and-store and late-consumer branches prevent a timeout race from delivering the same record twice through ordinary fallback. A reimplementation MUST distinguish a missing cell, occupied cell, consumed record, reclaimed record, and protocol-corrupt cell.

Console loop, fallback, and remote terminals

The central process waits up to 1,200 ticks (twenty seconds) for a selected window/screen and for a fallback popup to become selected. It throttles successive successful fallback popups by 600 ticks per console, using the process-local console-to-time alist. A popup on console A does not throttle console B. An adjacent source comment says five seconds, but executable timing is ten seconds at 60 ticks per second; strict behavior uses ten. The global last-notification tick is updated for other notification bookkeeping and MUST NOT be substituted for this per-console throttle state.

On successful console delivery, the process advances the cursor before delivering to remote terminals. Each remote terminal gets the same selected-stream offer and, if not accepted, asynchronous stream output; individual blast errors are ignored. Thus a remote failure does not put the console record back into the pending queue.

If fallback cannot deliver, the source recursively creates a system-failure notification and advances the cursor to the newest history head, potentially skipping older queued records. DM-G452-SRC MUST preserve this edge for comparison. The main specification's G452-POPUP-FAILURE-TAIL correction MAY isolate the failure record and continue older FIFO delivery, but MUST label the divergence. If no console is available, the 3600 build target and selected native IMACH cases print to Cold Load and record delivery; other targets sleep for the popup-delay interval and retry. Here “3600” names a platform feature, not a tick count.

Notification initialization has two independently testable registrations:

1. :BEFORE-COLD sets history and the delivery-tail pointer to NIL. It leaves the exact TV last-notification tick and current process identity untouched.
2. A distinct :ONCE action calls the process initializer. It kills a non-NIL prior process, sets the slot to NIL, allocates a priority-five system process into the slot, enables :NO-KBD-ARREST, presets the notification delivery top level, and enables the process. It leaves history, delivery-tail identity, and TV last tick untouched. This specification does not equate :ONCE with every cold operation.

Process recreation is nontransactional. Failure after any step preserves preceding effects: allocation failure can leave a NIL slot and no process; later setup failure can leave a referenced but only partly configured process. No selected rollback is present. Strict phase tests MUST seed all state sentinels and inject every process setup boundary.

Notification popup input tree

The reusable popup is 400 pixels high. Its input behavior is temporal:

selected at t0
├─ at any time: mouse-button blip + window of interest
│  -> deactivate popup and mouse-select that window
├─ at any time: mouse/list blip without that match -> ignore; popup remains
├─ first 180 ticks
│  ├─ Abort -> force popup down through the window's abort path
│  ├─ ordinary character + prior input buffer -> forward there; popup remains
│  └─ ordinary character + no prior input buffer -> ignore; popup remains
└─ after 180 ticks
   ├─ Help -> clear popup and show local Help; remain until next non-Help input
   ├─ any other ordinary character -> dismiss
   └─ manual deselect -> close

A new record displayed in the active popup appends to its output, refreshes the dismissal prompt, and resets the fifteen-minute inactivity deadline. It does not reset the original three-second selected-at time. The three-second and ten-second timings remain TODO-RUNTIME-CN-03; they are source-profile requirements, not claims from the current screenshot.

PRINT-NOTIFICATIONS

The newest record is index zero. The printer clamps From at zero, converts a negative To to its absolute value, swaps endpoints when From exceeds To, clips the high end, and prints the resulting range newest first. When the printed range contains the pending cursor, the exact mechanism is list-tail based: range is (nthcdr From history), while To controls only the print count. If the current delivery cursor is a tail of range, the function updates the TV last-notification tick and assigns the cursor to range itself. It does not assign the tail after the printed subset. Consequently From=0, To=0 can move the cursor to the history head and mark other unprinted pending records delivered. This identity/predicate/assignment side effect MUST be testable separately from formatting.

Effective keyboard denominator and precedence

Select N is the framework's global activity-selection key. The DISPLAY-NOTIFICATIONS function executes the system Select Activity command for Notifications. Neither route is an idle command-table cell, so neither is included in the 70-cell in-frame denominator below.

The program inherits Standard Arguments and Input Editor Compatibility; the latter inherits Standard Scrolling and Marked Text. There are no collisions between the selected fixed inherited cells and the four local cells. The complete source-profile denominator is:

Lookup checks the local Notifications table, then its two named parents in their configured inheritance, then terminates in the Command Processor unknown-accelerator path. There is no Colon Full Command or Unshifted Arguments parent in this program.

Four local fixed cells

Thirty-seven Standard Arguments cells and staged tree

The exact generated cells are:

• C-0 through C-9, M-0 through M-9, and C-M-0 through C-M-9 (30 cells);
• C--, M--, and C-M-- (three cells);
• the Control, Meta, and Control-Meta variants of the implementation's special infinity-argument base character, represented by source octet 016 (three cells); and
• C-U (one cell).

idle
├─ C-U -> argument 4
│  └─ repeated C-U -> multiply by four each time
├─ modified minus -> negative-sign state
├─ modified digit -> signed decimal accumulation
├─ modified infinity character -> signed infinity state
└─ next accelerator
   ├─ argument-aware scrolling leaf -> consume argument
   ├─ Input Editor Compatibility no-op -> accept and ignore argument
   ├─ another argument cell -> continue
   └─ local, marked-text, Refresh, Help, Exit, or unknown disallowing leaf
      -> accelerator error; do not execute leaf

Unmodified digits, minus, and infinity are not effective argument cells because the program does not inherit Unshifted Arguments.

Eighteen Standard Scrolling cells

The table has 18 physical/logical key cells even though several rows share commands. Save and Restore each form a two-stage prefix-like tree with every semantic character as a possible register; the child is data, not another command-table lookup.

Five Marked Text and six compatibility cells

The five no-op cells are deliberately bound and are not unbound fallthrough. Their accelerator generator has a nonempty two-argument lambda list, so the command-reader macro derives :ARGUMENT-ALLOWED T: a numeric prefix is accepted and ignored, and the cell remains a no-op. Marked-text cells and Refresh use empty accelerator lambda lists; a numeric prefix before one of those cells is an accelerator error and the leaf does not execute.

Menu, named command, pointer, and presentation contexts

The fixed command menu contains exactly two semantic cells, Help and Exit. Exact unmodified Mouse-L or Mouse-R on either cell executes the same zero-argument command, for four handled menu pointer leaves. Mouse-M and every modified raw gesture have no command-menu handler.

The program installs exactly one additional named command, Show GC Status. It has no local key or menu accelerator; typed/completed or presentation-produced command invocation calls the system GC status reporter, emits a fresh line, and returns no command values. It is distinct from the two fixed menu commands.

The notifications output loop establishes an SI:INPUT-EDITOR presentation input context. Over compatible displayed raw text, these inherited candidates are effective:

Applicability, nested presentation type, current marking state, and the full 96-cell raw gesture map are governed by the incorporated D28/G85 tree. The activity defines no local translator. Its Help mentions only the two Control Left/Right marking gestures and therefore is not exhaustive.

The left margin scrollbar has the same 13-cell component tree specified for Converse. Margin hit testing wins before output-text presentations. Its history noun is not customized by this activity. The main specification's first reviewed witness proves the analogous Converse left scroll bar and its second proves the Notifications left-scrollbar geometry; exact live Shift-Mouse and auto-repeat remains TODO-RUNTIME-CN-04 despite the complete source contract.

Activity Help and unbound behavior

Activity Help documents Scroll/Meta-Scroll, Super-S/Super-R, Control-Mouse-L and Control-Mouse-R, Super-W/Meta-W, End, Help/?, Refresh, and the left scrollbar. It omits the remaining inherited scroll aliases, horizontal and typeout scrolling, save/restore registers, Control-S/Control-R aliases, numeric argument families, Cut/Copy/Clear mark, five no-op cells, Control-Mouse-M, Control-Shift-Mouse-M, and Show GC Status.

An unlisted key is not automatically unbound: lookup must exhaust all four effective table families. An unknown accelerator then beeps, clears accelerated input, displays the diagnostic, and reprompts. Colon has no hidden full-command prefix. A presentation-produced command blip remains a separate valid route.