Open Genera 8.5 browser and WebAssembly investigation and implementation roadmap

Path A — Generated public C handlers

The public VLM tree generates stub/i*.c instruction handlers from alpha-emulator/*.as and Lisp translator inputs. Its active build links those handlers with the emulator interface and Life Support.

Advantages:

• broad instruction coverage already expressed in C;
• generated source can be regenerated and audited;
• closer lineage to the public VLM execution path;
• easier differential symbol/opcode mapping.

Risks:

• generated C emulates Alpha register conventions and uses GNU-C-style control patterns;
• host-size, alignment, floating-point, signal, and setjmp assumptions need audit;
• public-fork behavior is not automatically the preserved historical profile;
• large dispatch functions may compile poorly to WebAssembly.

Path B — Older portable c-emulator

The public tree also contains a roughly 10,000-line standalone C interpreter.

Advantages:

• explicit interpreter control flow and processor state;
• potentially easier to instrument and single-step;
• fewer generated-code dependencies.

Risks:

• it is not selected by the active public build;
• comments show incomplete or provisional host fault behavior;
• its release and instruction coverage may predate required VLM fixes;
• equivalence to the selected world is unproved.

Path C — New specification-derived interpreter

Advantages:

• clean state model and WASM-first host ABI;
• simplest rights and portability story;
• conformance can be designed from the start.

Risks:

• highest implementation cost;
• easiest path to subtle trap, memory-cycle, stack-cache, and GC-barrier errors;
• duplicates working public implementation knowledge;
• delays Life Support investigation.

DG-ENGINE decision procedure

Build the same rights-safe synthetic corpus for all viable candidates. Compare:

1. packed and full-word decode;
2. every legal and illegal opcode position;
3. operand addressing and pop order;
4. call/return, bind/catch, and multiple-value state;
5. every memory-cycle × tag class;
6. instruction and memory trap frames;
7. PHT and stack-cache transitions;
8. floating-point result, exception, and rounding state;
9. VLM-only instruction candidates; and
10. generated-code reproducibility.

Select Path A if it compiles without semantic rewrites and passes the corpus. Select Path B only if it closes equivalent or broader behavior and its provenance gap is bounded. Start Path C only if neither public path can be made deterministic and conformant.

G0 — Freeze profiles, evidence, and publication boundary

Deliverables:

• OG85-WEB-LOCAL profile manifest;
• hashes and byte sizes for the research-only world, debugger, historical VLM, configuration, and public VLM source;
• a public/private/generated disposition table;
• local-file handling threat model;
• native harness checkpoint set from launch through usable Listener.

Exit gate G-G0:

• the public application can be built without any licensed bytes;
• local artifact validation occurs before mapping or mutation;
• research fixtures stay ignored; and
• native checkpoints are repeatable from fresh private copies.

G1 — Generate the rights-safe Ivory conformance corpus

Deliverables:

• assembler/fixture generator independent of licensed compiled functions;
• legal opcode vectors and explicit illegal holes;
• object/tag/memory-cycle matrices;
• initial and expected final processor-state records;
• native public-VLM and, where safe, preserved-VLM trace adapters;
• deterministic comparison format.

The corpus implements IVY-W01 through IVY-G01 from the processor specification. It must include both halt=057 and the guaranteed undefined %halt=377 case.

Exit gate GW0-ISA-A: at least one native engine passes all architectural vectors, and disagreements are classified as fixture defect, profile delta, implementation defect, or unresolved oracle.

G2 — Complete DG-ENGINE

Deliverables:

• generated-handler WASM compile experiment;
• older C-emulator compile experiment;
• portability audit for integer widths, pointer casts, struct layout, unaligned loads, host floating point, signals, threads, and nonlocal jumps;
• instruction-boundary performance and trace comparison;
• written engine selection record.

Stop rules:

• do not patch away a semantic difference merely to make a test green;
• do not use the preserved world as the first opcode fixture;
• do not select an engine that cannot expose exact restart state;
• do not interpret “boots farther” as instruction correctness.

Exit gate DG-ENGINE: one reference WASM interpreter passes the complete synthetic corpus and can snapshot/restore every guest-visible processor field.

G3 — Specify and implement the world-memory substrate

Deliverables:

• VLOD v2 parser with overflow, bounds, parent, timestamp, and architecture checks;
• generation-zero load-map implementation;
• incremental-world parent resolver kept optional until required;
• 40-bit word storage preserving all tags/cdr codes;
• sparse virtual-memory mapping;
• wired, mapped, unmapped, and ephemeral region classification;
• PHT/page-request interface;
• VLM Debugger loader.

The selected base VLOD contains 6,690 blocks, 114 wired load-map entries, and 10,952,704 tagged Qs. Those observations are fixture constraints, not universal format limits.

Exit gate GW1-WORLD:

• browser and native tools produce the same mapped-region and word hashes;
• malformed maps and parent mismatches fail before execution;
• no licensed content leaves local browser storage; and
• a snapshot round-trip preserves every 40-bit word.

G4 — Inventory and specify communication areas

Deliverables:

• exact Boot, FEP, System, and Embedding area field maps;
• owner, direction, units, initialization, and lifetime for every field used by the selected boot;
• ring/queue schemas with producer/consumer and wrap rules;
• signal allocation, pending/live/reawaken masks, acknowledgement, and wakeup order;
• corruption and stale-completion behavior;
• native trace hooks at every queue and signal transition.

Required probes:

Exit gate G-G4: a single-thread event model and the native threaded model produce the same guest-visible transition trace for all probes, or the browser adopts the minimum necessary worker/shared-memory structure.

G5 — Close the minimum coprocessor surface

Deliverables:

• complete trace of coprocessor reads/writes from reset through Listener;
• register/operation inventory;
• per-operation inputs, outputs, commit point, retry behavior, signals, and host errors;
• browser service handler or explicit unsupported result;
• exactly-once test at every side-effecting commit boundary.

Start with boot-used operations, then classify the remaining public/source-visible operations:

required-for-boot
required-for-normal-operation
required-for-save-or-administration
optional-hardware/product
unknown/unobserved

Exit gate DG-LIFE-A: every boot-used operation has a tested browser implementation or a documented native result proving it is not reached in the selected profile.

G6 — Implement paging and virtual disks

Deliverables:

• page request/completion state machine;
• host paging store;
• virtual disk geometry and request queue;
• deterministic completion schedule;
• immutable base plus private overlay;
• backpressure, cancellation, and host-storage failure behavior.

The engine must distinguish:

• guest memory already mapped from the VLOD;
• host paging for evicted guest pages;
• guest-visible virtual disk blocks;
• VLOD/world persistence;
• temporary session swap.

Exit gate G-G6: native and browser issue the same page/disk transactions through the first Cold Load checkpoint, and a host failure produces a bounded guest or operator-visible failure without corrupting the active overlay generation.

G7 — Implement clock, reset, signals, and Cold Load display

Deliverables:

• guest monotonic and time-of-day services;
• supervised local RFC 868-equivalent startup response if the selected world requires it;
• reset, high/low priority sequence-break, pause, resume, and stop state;
• Cold Load window renderer and input protocol;
• VLM Debugger command/input path;
• deterministic test-clock mode.

Time received by the guest is a recorded input. Browser wall time cannot enter instruction tests implicitly.

Exit gate GW2-COLD: the selected world reaches a usable Cold Load/VLM Debugger state, accepts a harmless read-only command, pauses/resumes, and reproduces the native checkpoint trace.

G8 — Inventory the Genera X11 protocol subset

Deliverables:

• byte-exact native capture from connection setup through representative core applications;
• parser inventory of every request/reply/event/error;
• visuals, depths, pixmap formats, colormaps, fonts, cursors, atoms, properties, selections, grabs, and extension probes;
• modifier and keyboard map transactions;
• ordering and sequence-number model;
• request corpus for a standalone test client.

The existing harness proves only a sensitive startup subset: selected server grabs, modifier-map requests, SetModifierMapping, and ordinary guest traffic. It does not establish the complete application-era X11 surface.

Exit gate DG-X11: every request in the selected trace is classified as required, optional/fallback, or unsupported-with-observed-recovery, and the request corpus can replay without the Genera guest.

G9 — Implement a bounded browser X server

Deliverables:

• connection setup and resource-ID allocation;
• request decoder with strict bounds and byte order;
• windows, pixmaps, GCs, fonts, cursors, properties, atoms, selections, colormaps, and event masks required by DG-X11;
• expose, configure, focus, keyboard, pointer, and grab ordering;
• Canvas/WebGL renderer preserving logical pixels;
• deterministic server trace and framebuffer checkpoints.

The implementation is an X server endpoint, not a translation of Dynamic Windows or CLIM into DOM widgets. Genera remains responsible for its UI.

Exit gate G-G9: the captured request corpus and a live native-VLM relay session produce matching replies/events and logical framebuffer checkpoints.

G10 — Complete keyboard and pointer integration

Deliverables:

• browser physical-event normalization;
• Symbolics keymap including Control, Meta, Super, Hyper, Shift, Symbol, Function, Help, Select/System, Network, Complete, Abort, Resume, and other selected keys;
• byte-exact modifier-map behavior expected by the guest;
• on-screen keyboard and remapping for browser-reserved gestures;
• pointer motion/button/grab/focus handling;
• event provenance viewer.

Exit gate G-G10: enumerate and inject the selected X keyboard and pointer maps, verify modifier chords and focus/grab transitions, and execute a harmless Listener and Zmacs input workflow with the same guest-visible events as native.

G11 — Complete boot to the main Genera UI

Deliverables:

• automated semantic boot markers;
• native-versus-browser processor, communication, coprocessor, page/disk, X, and input traces around each marker;
• bounded diagnostic bundle on divergence;
• stable Listener-ready snapshot for testing, not public distribution.

Exit gate GW3-BOOT:

• three fresh boots reach the same selected system identity and Listener state;
• no unknown coprocessor or X request was treated as success;
• all host queues are internally consistent at idle;
• the base VLOD and debugger remain unchanged; and
• licensed snapshots remain local and disposable.

G12 — Interactive core workflow

Deliverables:

• run/pause/resume/reset controls;
• integral display scaling and full-screen presentation;
• input-capture escape and accessibility shell;
• synthetic Listener, editor, Inspector, Help, file, and window workflows;
• reviewed logical framebuffer and semantic result checkpoints.

Exit gate GW4-INTERACTIVE: the browser completes the defined workflow with equivalent values, guest event traces, activity/window transitions, and logical pixels for the selected states.

G13 — Persistence and Save World investigation

This milestone begins with an oracle, not an implementation claim.

Deliverables:

• disposable private-world Save World probe;
• complete coprocessor, file, page, disk, and hash trace;
• identification of every modified artifact;
• success, failure, and interrupted-commit state;
• browser persistence design chosen from the result.

The browser storage model still uses immutable base plus versioned private state, but it must distinguish:

• VLOD changes requested by Save World;
• virtual disk changes;
• paging/session state;
• browser-level suspend snapshot;
• exported recovery bundle.

Exit gate GW5-PERSISTENT:

• native successful Save World is independently established;
• the browser reproduces its durable artifacts and guest acknowledgement;
• crash injection yields a previous or new valid generation;
• resume from a browser snapshot is never mislabeled as a historical Save World; and
• export/import validates all parent and base identities.

G14 — Networking as an optional profile

Deliverables:

• offline default that satisfies guest boot without an external route;
• local RFC 868 response if still required;
• browser packet queue matching Life Support;
• explicit broker framing for optional Ethernet/Chaos/IP traffic;
• origin, peer, protocol, size, and rate policy;
• loopback-only conformance environment.

Exit gate G-G14: ordinary offline use emits no network traffic beyond loading the application itself; optional loopback traffic matches native packet and signal order.

G15 — Hardening, performance, and release

Deliverables:

• fuzzing of VLOD maps, X requests, disk imports, queue messages, and save manifests;
• memory ceilings and controlled out-of-memory behavior;
• no licensed content in logs, crash reports, caches exposed to the site, or build artifacts;
• instruction and subsystem profiling;
• reproducible build;
• browser compatibility matrix;
• GW0–GW6 conformance report showing every open gate.

Exit gate GW6-MUSEUM: a user can load their own validated licensed artifacts, operate the selected world locally, persist only private state, and reproduce the declared conformance report without any licensed input entering the public build.

G16 — Optional dynamic translation

Interpretation remains normative. Candidate translated blocks terminate at:

• instruction or memory exceptions;
• page/PHT activity;
• stack-cache scroll;
• allocation or GC transport;
• preemption checks;
• calls, returns, binding/catch cleanup where restart state changes;
• coprocessor operations;
• code or mapping generation changes.

Each block records source guest PCs, word/tag hashes, memory-map generation, assumptions, and exact deoptimization state.

Exit gate GW7-OPTIMIZED: interpreter and translated modes pass randomized instruction, trap, boot, and application differential traces, including mutation and forced deoptimization.