System 452.1 Genera Terminal bindings, protocols, and simulators

Release profiles

The System 452.1 source and System 452.22 world have not been proven load-identical. Every conformance result MUST name one profile. A source fact MUST NOT be presented as an observation from NT-G85-S45222-RUN, and a screenshot MUST NOT be used to prove an unexercised source branch. A combined label means “implements the selected source contract and compares the named bounded runtime states,” not “the world contains byte-identical functions.”

Compatibility levels

The filter-stream data model, registration interfaces, state blocks, and deterministic adapters below are prerequisites for every level, not a separately claimable shell. This document supplies the NT-G4521-U445-SRC contract through L3 and bounded NT-G85-S45222-RUN evidence for part of L1. It does not establish L4.

It makes no claim of source API compatibility, ABI or compiled-file compatibility, loader or load-contract compatibility, world-image compatibility, exact pixel or timing compatibility, Internet interoperability, support for every historical Symbolics patch level, or correctness of an arbitrary site-modified command/simulator registry. A reimplementation that makes one of those stronger claims MUST state and test it separately.

Normative companion incorporation

The complete effective binding tree is the union of this document's local overlays and the following exact in-repository sections. These are incorporated normatively, not cited as optional background:

Local cells win only in their declared contexts. An absent local cell falls through to the incorporated owner only where this document explicitly names a parent. A hard local error or consume result stops lookup. A conforming implementation MUST emit an effective-tree dump with context, raw event, normalized event, prefix path, numeric state, owner, selected leaf, shadowed candidates, and fallback; a flat list without ownership is insufficient.

Evidence vocabulary

Licensed source identity ledger

The source files remain untracked local licensed inputs. Paths are archive-relative, sizes are bytes, and hashes are SHA-256 so a licensee can repeat the audit without this repository redistributing the files.

Within the principal Terminal source, the audited regions are: command table and window classes (lines 69–483), parser/presentations and processes (485–709), connection lifecycle (711–832), filters and commands (863–1259), login protocols (1266–1370), More and auxiliary filters (1378–1506), Telnet (1545–1799), ITP (1803–1908), SUPDUP (1912–2167), 3600 (2170–2232), simulator registry and Glass (2246–2403), graphics (2411–3237), ANSI simulators (3239–3667), and the Select T registration (3682). Line numbers identify the inspected source only; they are not public links and no licensed source text is reproduced.

Manual evidence

These decoded proprietary manuals stay under the ignored Genera help tree. This specification paraphrases them and treats source/runtime disagreement explicitly.

Source, manual, and runtime disagreements

Component graph

entry and reuse
├─ Create Terminal / Select T / Peek Remote Login
└─ NVT window allocation or idle-window reuse

NVT window
├─ TV minimum-window and graphics/stream behavior
├─ Dynamic Window with typeout and recorded output
├─ Command Processor readers and command table
├─ typein process: keyboard -> input filters -> network stream
├─ typeout process: network stream -> output filters -> screen
├─ connection state blocks and mutable options
└─ label, wallpaper stream, simulator, histories, and locks

connection construction
├─ Generic Network service/path resolver
├─ login protocol registry
├─ ordered input filter chain
├─ ordered output filter chain
└─ one terminal simulator registered into the output chain

Terminal is TV/Dynamic Windows, not CLIM

The selected top-level class combines TV stream, graphics, selection, process, and minimum-window behavior with a Dynamic Windows window-with-typeout facility. It uses Command Processor command tables and accelerated-command reading, Dynamic Windows presentations and Accepting Values, and output recording. No inspected dependency declares a CLIM application frame, CLIM pane, CLIM port, or direct CLIM protocol use.

A conforming reconstruction MUST identify the substrate as TV + Dynamic Windows + Command Processor. It MUST NOT infer CLIM from shared terms such as frame, pane, presentation, command table, graphics, or redisplay.

Outgoing versus incoming terminal facilities

This document specifies the outgoing NVT-WINDOW Terminal application. The separately named Network Terminal and Remote Terminal sources implement incoming remote-console/server infrastructure. They share dependencies and some vocabulary, but they are not alternate names for this outgoing client. A reimplementation MUST keep incoming listeners, remote console authentication, exported streams, and server session ownership outside this contract until a separately profiled specification incorporates them.

Required records

A conforming implementation MUST expose inspectable equivalents of the following records. Internal representation and names MAY differ.

All nondeterministic effects MUST pass through explicit adapters: host/path resolver, network open/close/read/write/listen, clock/tick, scheduler/process, keyboard/pointer, screen/graphics, filesystem, kill ring, printer, and condition/debugger. Tests MUST be able to replace each adapter independently.

Source-profile initial state

On a newly allocated Terminal screen, the source profile requires:

The selected source initializes the label tag to its disconnected value, while the constructor itself does not visibly call the label-recomputation method. Separately, the System 452.22 runtime witness displayed Terminal 1. The screenshot establishes only those rendered pixels; it cannot reveal the hidden label tag or prove when a recomputation did or did not occur. L2-STRICT MUST preserve the source-visible initial field value, NT-G85-S45222-RUN MUST preserve the observed rendered label, and the relationship between them remains TODO-ORACLE-G-INITIAL-LABEL rather than being inferred from either evidence layer.

Core invariants

1. At most one committed network stream belongs to a Terminal window.
2. A window is reusable only when both its network stream and pending target are absent.
3. The typein and typeout processes are distinct. Network output must never wait on a local command reader in the typein process except through an explicit shared state or lock.
4. Network writes are serialized by the connection's write lock. Simulator replacement and filter setup are not retroactively covered by that lock.
5. A committed input chain is ordered from screen/keyboard toward the stream; a committed output chain is ordered from stream toward the screen.
6. Every filter receives setup/reset in the specified direction and order. Rebuilding a fast function because the output tick changed is not a filter reset.
7. The visible label is derived from name, current label tag, connected simulator suffix when non-Glass, and wallpaper marker. Stored and rendered values remain separately observable.
8. Output recording false disables the recorded-text presentation context; it does not merely hide a menu item.
9. The configured local escape character applies only to the current connection's More filter and returns to the default on the next connection.
10. Failed or partial transitions preserve their actual intermediate state; no transaction rollback may be invented where the selected source has none.

Entry paths

The selected profile has three semantic entry routes, with different allocation contracts:

1. Create Terminal invokes the System menu's generic Create operation, constructs a fresh Terminal window with the mouse-selected geometry, and selects it. It does not search the idle-window list.
2. Select T uses the global Select prefix and generic activity-selection policy, which may select an existing current, recently selected, or exposed Terminal or create one. The exact Select normalization, Control force-create flag, disabled-key handling, Help, Rubout, and failure tree are the incorporated D02 G85 Select contract. The suffix is uppercased and modifier bits are stripped; only Control retains separate meaning as force-create. There is no Select numeric-argument stage.
3. Peek Remote Login chooses a host from Peek's host menu, calls the direct target-reserving lookup described below, and then selects the returned Terminal.

An implementation MAY expose a direct programmatic get-window-to-host operation, but that API name is not required for compatibility. Its observable allocation and selection behavior is.

Idle-window reuse

The direct target-reserving lookup used by Peek and programmatic remote-login callers MUST scan previously-selected-windows in array order under one interrupt-suppression boundary. It MUST claim the first Terminal for which both network-stream = none and pending-target = none; this is not an implementation choice. Claiming calls the window's target setter before leaving the protected scan, and that setter MUST flush the typein process before storing the pending target. If the scan finds no eligible window, the lookup leaves the protected region and creates a fresh Terminal with the target supplied at initialization. It returns the window; the caller, rather than the lookup itself, selects it.

The Create route always constructs fresh. The Select-T route follows the incorporated D02 generic activity selector, including Control force-create; it MUST NOT be silently replaced with the direct first-idle scan. These three routes therefore share a window flavor but not one allocation algorithm.

This is a reservation protocol: pending-target prevents two concurrent callers from claiming the same disconnected window before its typein process begins the connection. Clearing that reservation and the exact result of a failure before the typein process consumes it are TODO-RUNTIME; a replacement MUST document its choice and MUST NOT silently claim strict fidelity.

Selection and burial

Selecting or exposing a Terminal MAY reset/wake the typein process according to the TV process substrate. Generic Function-Bury is discovered dynamically by the source Help command and preserves the connection, protocol state, and screen contents. Its completion waits for deexposure and then re-exposure; a strict scheduler can therefore wait indefinitely if the window is never selected again.

Kill boundary

The Terminal-specific kill method stops or enables its two processes as required by the inherited lifecycle. Whether inherited destruction always runs the full connection-disconnect cleanup is not established by the selected local method and is TODO-RUNTIME. L2-CORRECTED MAY require disconnect-before-destroy, but MUST report the divergence; L2-STRICT MUST preserve the observed/source-confirmed path once the oracle is closed.

Context dispatcher

The effective input graph begins with window state and semantic context, not with a single flat key table:

Terminal input event
├─ global Select/Function/System or unhandled sheet event
│  └─ incorporated D02 prefix and pointer trees
├─ disconnected host prompt or command argument prompt
│  └─ incorporated Dynamic Windows Input Editor tree
├─ connected ordinary keyboard character/list event
│  └─ input protocol mapping, then ordered input filters
├─ connected configured local escape
│  └─ MoreEscape local accelerated-command reader
│     ├─ direct local accelerator
│     ├─ numeric argument stage
│     ├─ full-command stage (`:`, M-X, or C-M-Y)
│     ├─ Help -> display curated Help and reprompt in the same reader
│     ├─ Rubout -> cancel, except when Rubout is the configured escape
│     └─ unknown -> beep, clear input, report, and reprompt
├─ `Network X` Accepting Values sheet
│  └─ local option fields + incorporated Accepting Values/Input Editor trees
├─ recorded terminal text presentation
│  └─ local presentation handlers + incorporated gesture resolver
└─ blank/window/presentation pointer event
   └─ local overlay below + incorporated 96-cell and sheet routing trees

Lookup of a fixed accelerator precedes the configurable-escape tester. Therefore an escape configured to the same character as a fixed accelerator invokes that accelerator rather than sending a literal escape. The exception is bare Rubout: when Rubout is configured as the escape, the escape tester runs before the ordinary Rubout-cancel fallback and sends the literal escape path.

Fixed accelerated-command cells

The selected Terminal table contributes exactly 63 normalized accelerator cells. Case-equivalent letters are aliases under the table's character comparison, not additional Shift-specific cells.

No other local character is silently self-inserting in this reader. An unknown cell beeps, clears the current command input, displays an error, and reprompts. Bare Rubout cancels silently unless it is the current local escape. Help uniquely prints documentation and stays in the reader; every other successfully completed command returns from that reader after execution.

Numeric-argument automaton

The local reader MUST retain exactly the source-visible pair (argument-kind, argument-value). It begins as (nil, 1); a non-NIL kind is also the argument-present flag.

minus / :sign:
  kind := :sign
  value := -1

C-U / :control-u:
  kind := :control-u
  value := value * 4

Infinity / :infinity:
  kind := :infinity
  value := (2^40) * signum(value)

digit d / :digit:
  if prior kind != :digits:
    kind := :digits
    value := signum(value) * d
  else:
    value := (value < 0 ? -1 : +1) * (abs(value) * 10 + d)

Minus is a reset, not a sign toggle or sign bit: C-U then minus and digits then minus both produce (:sign, -1). Repeated C-U from the initial state produces 4, 16, 64; minus then repeated C-U produces -4, -16. Infinity from an argument value of zero remains zero. The first digit after C-U or Infinity replaces that magnitude using its sign; the first digit after minus preserves the negative sign unless the digit is zero. Thus minus, 0, 5 produces positive 5 because the zero loses the negative sign before the next digit. The 2^40 value is the selected source's finite sentinel, not mathematical infinity.

Only Network M accepts the resulting numeric value among direct local commands: no argument toggles More processing, explicit zero disables it, and every nonzero value, including a negative value, enables it. Other direct local commands and the colon/M-X entry reject a supplied argument through the accelerator error path. C-M-Y accepts it: zero opens input-history display/selection, while a nonzero value selects an initial prior command. After an argument key, the source briefly waits for typeahead and shows an Arg indication only when input pauses.

Direct local command leaves

The M-W operation walks the top frame, exposed inferiors, and typeout windows that support marking. It does not install the entire shared Marked Text command table into Terminal merely because it calls that substrate. C-Y and presentation-yanked text take different routes: C-Y deliberately bypasses the outer MoreEscape filter, while presentation-yanked recorded text is passed through the complete typein filter chain and can invoke the local escape if its bytes contain that character.

Full command inventory

The selected command table has 16 live long command names:

An older, feature-disabled send-file form is not a seventeenth live command. A runtime/site command-table dump MAY contain additional registered commands, but it must report them as profile mutations, not silently fold them into this source closure.

Canned Help tree

The Help output is curated rather than generated exhaustively:

Canned Help
├─ single-key rows: A, B, D, L, Q, M, X, C-Y, M-W, :
│  ├─ command presentations: A, B, D, L, Q, X, C-Y
│  └─ plain text only: M, M-W, :
├─ extended-command-name presentations
│  ├─ Set Terminal Simulator Type
│  ├─ Set Escape Character
│  ├─ Set Wallpaper File
│  ├─ Set Overstriking
│  ├─ Send File
│  └─ Send String
└─ omitted despite reachability
   ├─ direct F accelerator
   ├─ Connect parser command
   ├─ Set Output Recording
   ├─ Receive File
   └─ Set Local Echoing

The visible Help command is Canned Help; it is not a promise to enumerate the effective table. The C-Y Help presentation constructs a Send String command form without the string argument that ordinary execution needs. Whether selecting that presentation enters an argument prompt, signals an arity error, or is patched in the preserved world is TODO-RUNTIME.

Connected keyboard-to-protocol tree

After local-escape interception, every remaining connected input event passes to the selected input protocol. The exact built-in branches are:

connected remote input
├─ Telnet/NVT ASCII -> Telnet character/list translation
├─ ITP/SUPDUP -> ITP character/list translation
├─ 3600 -> three-byte 3600 encoding or logout byte
├─ TTY serial -> seven-bit/escape serial encoding, break, or finish
├─ CHAT -> character path plus noninterrupting list-event guard
└─ LISPM-null -> character-stream echo path

Super and Hyper do not acquire an invented wire representation. Each protocol below states whether it drops, rejects, consumes, or encodes modifier bits. Ordinary connected input does not inherit ZWEI editing commands.

Pointer and presentation overlay

The exact 96-cell raw pointer map, logical aliases, modifier ordering, physical chord selection, double-click encoding, selected-window routing, and no-window routing are the incorporated Dynamic Windows and D02 sections above. Terminal adds these applicable leaves:

The Yank From Kill Ring menu item is absent when the ring is empty. Clear is conditional on output compression/record state. Generic blank-area Operation, System Menu, select-this-window, window-operation, presentation-debugging, and command-menu handlers remain owned by the incorporated substrate.

Two optional loaded-system overlays are not part of the core Terminal source:

• NT-G4520-HC446-SRC can add a menu-only Hardcopy handler on blank or broadly typed input-editor content and a marked-text tester. It obtains and unmarks the selected string, then sends it to the default printer with a title. Runtime residency is TODO-RUNTIME.
• NT-G-IMG-SRC can add a menu-only “pick up image from screen” operation in the same broad context; a chosen screen rectangle becomes the default image. Its exact release and runtime residency are TODO-RUNTIME.

ZWEI buffer-pointer handlers decline on an ordinary Terminal screen. A source-visible mouse-position translator in the Terminal file is reader-commented and therefore inactive in NT-G4521-U445-SRC; it MUST NOT be exposed as a hidden live gesture.

Complete unbound, shadowing, and Help rule

For every raw key or pointer state, a conformance trace MUST produce exactly one of: local Terminal leaf, incorporated parent leaf, protocol encoding, semantic consume, silent cancel, dead blip, beep/retry, asynchronous keyboard intercept, or declared site extension. Unlisted modifier combinations are not “don't care”: they retain their unique primary pointer gesture, or reach the appropriate keyboard unbound path. Help exposure is context-specific: Select Help, Input Editor Help, local Canned Help, Accepting Values Help, presentation-specific Help, and generic pointer documentation are distinct branches and MUST NOT be merged into one modern help overlay.

Host and option parser

The disconnected typein process exposes its typeout window and reads a semantic host argument. Return after the host accepts defaults; Space enters keyword acquisition. The parser admits these source-profile keywords:

The dummy Connect command exists to make Command Processor parse this template; executing that dummy command as an ordinary command is an error. The parser renames the user-facing echo, overstrike, and record-output keywords to the connection method's internal option names before invocation. A reconstruction MAY use a direct schema rather than a dummy command but MUST preserve input behavior and distinguish an omitted option from an explicitly supplied false value.

Resolution decision tree

resolve(host, login-protocol?, connection-protocol?, simulator?)
├─ neither protocol supplied
│  └─ invoke the most desirable Generic Network LOGIN service on host
│     └─ if host lacks service, use the Generic Network path-specification recovery
├─ login supplied, connection omitted
│  └─ find path to that login protocol on host; invoke with simulator service args
└─ connection supplied
   ├─ login omitted -> use LISPM-null login interpretation
   ├─ find path for the explicit connection protocol
   ├─ find named login-protocol object
   ├─ destructively replace the path's service arguments with simulator args
   └─ invoke the login interpretation over that path

The service-argument list contains only a terminal-simulator entry when explicitly requested. In the explicit-connection branch it replaces, rather than extends, the path's former argument list. That mutation is observable to code retaining the path and is normative for STRICT; a CORRECTED implementation MAY copy the path but must report the change.

Login protocols that declare character streams receive character-to-code and code-to-character adapters because the underlying Generic Network service path is known to return the wrong stream kind in this source profile. A remaining kind mismatch signals a continuable “wrong connection stream sort” condition. Continuing does not repair the stream and can fail later; tests MUST exercise both abort and continue branches.

Simulator selection

An explicit simulator symbol is accepted only when it is identity-equal to a member of the current mutable simulator registry. A string is compared case-sensitively with registered display names and, on a match, converted to that registered type. An invalid string or symbol does not signal here: it leaves the placeholder unchanged, which yields Glass behavior when the protocol contains that placeholder.

Without an explicit simulator, host system types VMS, VMS4, and VMS4.4 select VT100; all other matched hosts select Ambassador. Failure to find any mapping falls back to Glass. The selected source registers by push-to-front; after its four built-ins load, the predicted clean order is VT100, Ambassador, Imlac, Glass. The registry is mutable, so L4 MUST dump names, type identities, and order from the running world.

Built-in login protocol matrix

Filters below are listed in data-flow order: keyboard to network for input and network to screen for output. Desirability is the source's numeric service ordering.

This registry is extensible. CTERM may appear as an externally registered login protocol, but it is not a hidden branch in the selected source and MUST NOT be claimed without registry evidence.

Connect transition

Connection construction is nontransactional and MUST preserve this observable order:

1. Suppress completion of the typeout window while acquiring the network stream, input-filter type list, output-filter type list, and printable label addition.
2. Store the label tag.
3. Set overstriking to the explicit value when supplied. Otherwise set it false for foreign system types Unix, Unix42, VMS, VMS4, or VMS4.4, and to the global default (true in the selected profile) for other hosts.
4. Set output recording.
5. Clear the current character attribute.
6. Remove the typeout window.
7. Reset the echo-area position to zero.
8. Clear recorded output history.
9. Instantiate and wire input filters from the Terminal screen toward the stream.
10. Instantiate and wire output filters from the stream toward the Terminal screen.
11. Commit the network-stream field.
12. Recompute the visible label.
13. Run input-filter setup from the keyboard-side root outward until the network stream.
14. Run output-filter setup from the screen-side root inward until the network stream.
15. Run setup on every retained state block.
16. If initial local echo was requested and an echo input filter exists, enable its echo state.
17. If a wallpaper pathname was supplied, apply it.
18. Reset and enable the typeout process.

State-block lookup creates a missing block, pushes it into the retained block list, and immediately calls setup. The final state-block loop can therefore call setup a second time on a block created during filter setup. A strict implementation MUST permit and expose that double setup. Setup methods MUST be idempotent only where the selected block actually is; a corrected implementation cannot erase the ordering from its conformance trace.

There is no encompassing unwind/rollback. A failure before step 11 can leave an open stream not reachable through the committed network-stream field. A failure after step 11 can leave a partially wired, partially set-up connection. The outer typein loop's connected-condition handler begins only after the connect call, so a connect failure is not equivalent to a connected-session error. L3-STRICT MUST expose these partial states under injected failures. L3-CORRECTED MAY close/unwind them but MUST label each divergence.

Connected typein loop

After connect, the typein process establishes a catch/restart boundary and repeatedly reads an event from the Terminal screen. If no screen input is pending, it forces network output first. Characters and keyword-headed list events are passed to the input-filter root; other objects are ignored unless output recording has installed the presentation context.

With recording enabled, the active context accepts either an Input Editor target or Terminal Input. A normal event takes the same character/list path. A selected presentation contributes its stored object, and every element of that object is sent through the entire input-filter chain. This is why a recorded string that contains the local escape can enter local-command handling, unlike Send String and raw-text Send File.

The connected body has an unwind clause: if the committed stream remains non-null, it invokes disconnect. Connection-closed and end-of-file conditions become a human-readable “closed by host” reason; other errors preserve the condition object. A deselect reason deselects the window, disables the typein process, and yields once. Other non-null reasons expose the typeout window and print the reason.

Disconnect transition

Disconnect MUST execute in this order:

1. disable the typeout process;
2. close wallpaper output if active;
3. if a network stream is committed, request abortive close;
4. reset each input filter from keyboard root toward the network stream;
5. reset each output filter from screen-side root toward the network stream;
6. clear the network-stream field;
7. reset every retained state block;
8. set the stored label tag to the disconnected marker and recompute the label;
9. reset and enable the typeout process.

There is no unwind protection. Close or reset failure leaves the later steps undone. If the committed stream remains non-null, the connected body's unwind can retry disconnect. A conforming failure trace MUST show exactly which close/reset calls ran, whether the stream remained committed, and which label was last rendered.

Logout first emits the protocol-neutral logout event and then immediately performs abortive disconnect; it does not wait for a peer acknowledgement. Disconnect and deselect throws the special deselect reason, so later ordinary “Disconnected” completion text is skipped.

Option persistence across connections

Typeout process and fast path

If no stream is committed, typeout disables itself and yields. Otherwise it snapshots the output-process tick, finds the echo filter/state, and builds a sequence of each output filter's fast-test function. The fast path is usable only when every filter supports it and the network stream supports buffered input.

The fast loop waits for network or synthetic echo data, reads a network buffer, and copies ordinary bytes into a 100-character screen buffer until any fast test says the slow path is required. It advances only consumed network bytes. The slow path then pulls through the full filter chain until network input or filtered input is no longer immediately available. A tick change exits the current loop and rebuilds the fast composition; it does not call filter reset.

Output recording is dynamically enabled around both paths. Mouse wakeups are delayed while output is drawn. Network error or end-of-file injects a local (:ERROR error) event into the screen keyboard queue and disables typeout. The MoreEscape filter in typein later throws that error to the connected catch boundary.

Concurrency and notices

All direct network-output operations acquire the window's output lock, serialize strings/characters, and optionally force output. Telnet negotiation and protocol controls use this path. Ordinary filter wiring, simulator replacement, and state setup are not automatically protected by this lock; tests MUST probe replacement while output is active rather than assuming atomicity.

Remote bell handling first services pending sheet exceptions, beeps only when both the Terminal screen and effective Terminal stream are exposed, then consumes consecutive identical bell bytes so a run becomes one audible event. Input/output activity notices are suppressed while disconnected.

Generic filter stream

Every filter has one input, one output, and one pending untyi element. listen returns true when either the pending element exists or the upstream listens true. Nonblocking input repeatedly pulls and filters until a non-null result or upstream exhaustion, returns the result, and clears the pending cell. Blocking input repeats that operation and scheduler-waits on listen. untyi replaces the single pending cell.

On output, a pending untyi value is emitted downstream before the new value is filtered. A non-null filter result is then emitted; null consumes it. Force-output delegates downstream. Generic setup and reset are no-ops. Because the pending cell is singular rather than a stack, a second untyi before consumption replaces the first; that edge is part of STRICT behavior.

Viewport stream

The viewport maps its origin and size to the Terminal screen's current visible cursor limits and recomputes after initialization, size/margin changes, and scroll-position changes. Cursor addressing is therefore relative to the visible terminal area, not the enclosing sheet.

Its output operation deliberately writes to the underlying screen rather than applying coordinate translation to ordinary characters. Clear-window homes then clears the rest. “Terpri and wrap” moves to column zero and (row+1) mod height, then clears the destination line. This wrap is different from normal scrolling newline and MUST have its own conformance case.

Character translation

The default translation array has 256 cells. Codes 0 through 127 map to themselves; unassigned cells 128 through 255 are null. The following named Genera characters override their indexed cells:

Before that table, an active simulator may provide an exact character translation. Otherwise Control reduces the character code to its low five bits. A resulting code strictly greater than octal 400 is discarded. Equality with octal 400 proceeds to index 256 of the 256-cell array and is therefore an apparent selected-source out-of-bounds defect. STRICT MUST reproduce the condition; CORRECTED SHOULD use >= and discard it, with the profile divergence reported.

For a fixed numeric result with Meta, ASCII letters first flip case, then set octal 200. Super and Hyper receive no special encoding and MUST NOT be silently mapped to modern Alt/GUI conventions. An array-valued translation emits each element in order; a null mapping consumes the input.

Scroll moves locally forward one screen. Meta-Scroll and Back-Scroll move locally backward one screen. These are consumed and have no numeric repeat in this protocol path.

NVT ASCII output toward the peer

Negotiation state

Each setup clears new-telnet, echo, transmit-binary, receive-binary, and SUPDUP output flags. The first incoming IAC, regardless of following command, first emits DO ECHO and DO SUPPRESS-GO-AHEAD, then marks the connection as new-Telnet.

Unsupported subnegotiation drains input until an IAC followed by SE. After the SUPDUP-OUTPUT option and its required selector byte have been recognized, its special counted grammar reads one count byte. Every :TYI through the counting stream then decrements the count, including the outer opcode byte and every operand consumed by an embedded SUPDUP effector. Interpretation continues until the count is less than or equal to zero. A negative count signals the hard out-of-phase error immediately; the success-trailer branch consumes nothing after that error. At exactly zero, the parser reads and discards two arbitrary bytes, then reads one candidate byte. A non-IAC candidate signals immediately without consuming a would-be SE byte. Only when that candidate is IAC does it read one more byte and require SE; a non-SE candidate then signals after both candidates have been consumed. Screen output and state mutations performed before truncation, over-consumption, or a trailer error remain in effect; the parser has no rollback. Negotiation writes are force-flushed through the network output lock.

The echo state stores a FIFO of locally echoed values. Setup clears it. Input appends non-list values only while local echo is active. Changing to remote echo stops new enqueueing but does not clear values already queued; changing back permits new enqueueing. Listen and fast-test paths can wake on queued echo. The direct output filter returns (queued-echo OR peer-value): if the slow scalar path has already read a peer value while an echo is queued, the queued value replaces that peer value and the selected code does not requeue it. L3-STRICT MUST preserve and test this loss; a corrected mode may retain the peer value only under a separately named profile.

Non-CADR ITP named-key table

For Genera, character codes octal 200 through 241 map as follows; 242 through 377 and every explicitly blank cell map to null. Values greater than seven bits carry protocol modifier information and are split by the encoding rule below.

Scroll and Meta-Scroll are intercepted locally for one-screen forward/backward movement. Control-Scroll is first remapped to the protocol Scroll key, restoring a wire-visible Scroll operation. The encoder retains all character modifier bits. For a modified ASCII letter, it flips letter case to reverse the keyboard driver's shift folding. Control codes other than Escape and Rubout acquire the ITP TOP bit; Rubout also acquires TOP.

After named-key lookup, a nonzero modifier field emits octal 034, then 100 OR bits, then the seven-bit code. An unmodified code 034 emits doubled 034; other unmodified codes emit directly. A null or list-valued mapping is returned to later handling rather than converted to bytes. Interrupt is translated as the Genera Abort entry. Logout force-emits octal 300,301.

TELSUP first consults the Telnet named-key table; if that result is not a semantic list event it falls back to the ITP table, then uses the same quoting rule. This priority is part of the TELSUP profile.

3600, TTY, CHAT, and LISPM-null input

CHAT output consumes data marks, responds to timing mark 5 with forced mark 6, and consumes other marks; ordinary values pass. TTY output strips the high parity bit from non-list values. Character-stream compatibility adapters convert character/code at the stream boundary only where the Generic Network bug requires them.

Shared Glass behavior

The null simulator's user-visible name is Glass TTY. It masks every incoming numeric value to seven bits, then applies this state machine:

One source comment equates 60 ticks with one second; a timing-fidelity profile MUST measure the actual runtime tick scale rather than assume modern wall-clock seconds. The default line-feed moves down without forcing column zero; default next-line uses the Terminal's newline; reverse line-feed subtracts rows. Multi-line movement uses cursor addressing rather than repeated effectors.

The Imlac simulator is Glass plus octal 177 escape dispatch into the 128-cell SUPDUP display-opcode table. In negotiated binary receive mode, every non-CR byte passes through unchanged as a character; CR still uses Glass handling. Escape reads the next byte b and computes ch = b + 0o176. If b = 1, ch = 0o177 and that literal character is returned without forcing output. Otherwise output is forced first and the implementation indexes the dispatch table at ch - 0o200 with no bounds check. For an eight-bit byte source, only b = 2 through 0o201 yield valid indices 0 through 127. b = 0 attempts index -2; b > 0o201 attempts beyond index 127. Both cases signal after the force-output effect, and EOF can fail earlier while forming ch. No input clamping or silent ignore may be invented in strict mode.

SUPDUP connection preamble

SUPDUP setup obtains/reset-compatible SUPDUP state, sets character-insert capability for host system types WAITS and Multics, emits terminal variables, emits the finger location string, and then renders an ASCII greeting. Greeting input begins with a CR, continues until EOF or octal 210, suppresses LF, and converts every other byte from ASCII to a screen character.

Each 18-bit terminal value is serialized most-significant six bits first in three six-bit bytes. The terminal-variable sequence is exactly:

1. -6, then 0;
2. terminal type high half 0, low half octal 000007;
3. option high half 054632 OR (CID ? 1 : 0) OR (overstrike ? 001000 : 0), low half 000054;
4. maximum vertical high half 0, low half character-height - 1;
5. maximum horizontal high half 0, low half character-width - 1;
6. roll high half 0, low half 0;
7. terminal metric high half (line-height << 10) OR (character-width << 6) OR 000055, low half 040000;
8. force output.

Here << 10 is a ten-bit shift, while numeric literals shown with leading zeroes are octal. The finger record force-emits octal 300,302, the local finger-location ASCII string, and a terminating zero. A clean-room implementation MUST provide a configurable nonprivate location string for tests.

SUPDUP text opcode table

Bytes below octal 200 become ordinary characters. Bytes octal 200 through 240 dispatch as follows; an ignored operation consumes no documented arguments unless the row says otherwise.

Region movement starts at the current pixel row, converts both arguments by line height, clips the region bottom to the stored viewport height, caps movement to the clipped region height, and moves the remaining pixels in the requested direction. Malformed or truncated operations can consume some arguments and mutate state before the stream error; there is no protocol-level rollback.

Generic SUPDUP graphics grammar

Graphics state retains viewport-centered offsets, virtual scale, current protocol position, inclusive clipping limits, XOR/IOR mode, and virtual/physical coordinate mode. Reset centers protocol origin in the character-cell-aligned interior, chooses the smaller aligned dimension for a virtual range of octal 4000 on either side, clears position, selects IOR and physical modes, and derives inclusive clipping limits. Unlike TV rectangles, all four protocol edge coordinates are inclusive.

Entering graphics repeatedly reads seven-bit commands. If a read value has octal 200 set, it is pushed back and graphics mode returns so the outer SUPDUP parser can process it. Otherwise:

When octal 100 is set, low four bits select a drawing operation:

Point decoding is absolute when octal 20 is set: four seven-bit payloads form signed 14-bit X and Y. Otherwise two payloads are signed seven-bit deltas added to the current position. In virtual mode coordinates are multiplied by the reset scale; all coordinates are clipped to the inclusive limits, with Y inverted around the stored origin. The drawing ALU is flip in XOR mode, erase when the command has octal 40, and draw otherwise.

Packed bitmap data uses six bits per input byte except every third byte, which uses four. A byte with octal 100 terminates. Bits advance X even outside the clipping limit; set bits within range draw one-pixel points. Run data uses low six bits as the advance and octal 100 as visible/run-on; zero terminates. This grammar, including sign extension, bit order, inclusive rectangle +1, nested dynamic restoration, and malformed-stream partial effects, is mandatory for L3.

GT40, ARDS, and SUDS compatibility graphics

These three emulators are protocol clients inside SUPDUP, not separately selectable Terminal simulator names.

GT40. The byte after opcode 206 is reduced by octal 100; a negative result does nothing, otherwise the low four bits address a 16-cell table. Only entries 0, 1, and 2 are live: combined insert/delete, insert, and delete. Every GT40 word is assembled from three input bytes in 6-low, 4-middle, 6-high bit fields. A count is (word - 5) >> 1.

The retained display-list array has exactly ten cells, indexed 0 through 9, despite the 16-cell command dispatch above. Peer-supplied item words are used directly as array indices without a range check. Delete stores the item word in current-item-number before attempting the array read; an out-of-range item therefore leaves that field changed, signals before erasing or clearing that item and before its checksum, and does not roll back earlier items in a multi-delete. Insert first reads its word count and calls one-item delete without checksum; that delete reads and stores the item number. A valid item may therefore be erased/cleared before the new display object is allocated, while an out-of-range item signals during that initial array read before allocation. Insert relies on the current item established by this delete rather than reading a second item number.

The combined command uses the low two bits of a word: 1 inserts; 2 deletes one plus a following encoded count. Insert first deletes the named object without consuming a checksum, reads a word count, then parses command/data words into a growable display object. Modes are character string, short vector, long vector, absolute point, unused X/Y graphplot, relative point, and unused. Visibility and blink bits control flip drawing and a display-list blinker. Short vectors contain signed six-bit X/Y; long vectors contain signed ten-bit magnitudes; all coordinates scale by 7/10 and Y is inverted. Insert consumes one final checksum word. Delete reads each item number, flip-erases it unless its blink phase is already off, clears it, and normally consumes one checksum. Unsupported command/mode entries are ignored rather than generalized.

ARDS. State begins at protocol (0,0) with scale 1.0. Each entry computes a square scale from the smaller viewport dimension over 1023, centers the square in the larger dimension, and reads until a byte outside octal 100–177; that byte is pushed back, graphics exits, and the screen cursor is placed at the last graphics position with an eleven-pixel vertical adjustment. Long values use two payload bytes for signed magnitudes and derive visibility from one flag bit; short values use one payload and are always visible. Set replaces absolute X/Y then plots; long and short add vectors. Visible lines draw with IOR. The selected source itself warns that its scaling/offset is imperfect; strict fidelity preserves the calculation.

SUDS. The first byte uses low six bits as an item number, octal 100 as delete, and octal 200 as retain/blink. An immediate octal 302 exits. Delete+retain flip-erases and clears the retained object, then drains through octal 302. Otherwise the grammar starts at (0,0), size 0, intensity 0. Bytes without octal 200 form strings, excluding NUL and SI, until a command byte; strings are drawn in the configured small fixed Roman style with flip and advance X by 6 * (size+1) * length. Coordinate commands carry signed little-endian 16-bit X/Y and bits for visible, absolute/relative, and vector/point. Visible coordinates draw flip lines and retained operations are appended to the item.

SUDS commands octal 300 and 301 set the low three size bits and low six intensity bits respectively; the renderer records but otherwise ignores both. 302 ends, 303 clears through SUPDUP, and 304 maps a signed Y argument into the bounded echo area. Setup derives half-scale offsets from a nominal 576-by-512 region and resets echo position. Retained blinking toggles each display object by redrawing it with flip. There is no automatic adjustment of existing display lists after window-size changes.

3600 output protocol

On setup, the 3600 filter force-emits record 1,width,height-1, then record 2,string-length,local-finger-location-ASCII. Ordinary bytes below octal 200 become characters. Opcodes 200 through 207 are, in order: bell, wrapped newline, clear window, clear rest of window, clear rest of line, insert character, delete character, and set cursor.

Insert/delete consume one count. Set-cursor consumes X then Y. If that target is on the current row and exactly one column right, it emits one viewport Space effector; otherwise it addresses the cursor. Higher opcodes within no registered slot are consumed. A peer fixture MUST supply a nonprivate location string.

ANSI base simulator

The ANSI parser is intentionally a subset. It ignores NUL and DEL, dispatches ESC, and otherwise uses Glass behavior. SI selects set 0; SO selects set 1. Four character set slots exist. Set 1 initially names the VT100 device font; absent sets pass plain characters, and present sets merge the byte's character with the selected style.

After ESC, [ enables CSI parsing. Parameters are decimal values separated by semicolons; empty positions remain null. Parsing stops on the first non-digit, non-semicolon byte. Private introducers are delegated to a concrete simulator rather than parsed generically. Unsupported commands are ignored unless a concrete branch explicitly drains additional bytes.

Implemented non-CSI official escapes are:

Implemented official CSI final bytes are exhaustive in this table. For count-like arguments, null, zero, and one mean one.

SGR recognizes only null/0 (ordinary), 1 (bold), 4 (underline), 5 (blink), and 7 (reverse video). Multiple later SGR parameters are ignored. Blink is stored as an attribute, but the selected screen drawing wrapper has no blink branch, so its established rendering effect is ordinary drawing. Unsupported SGR values yield no selected attribute.

Cursor arithmetic has no parser-level bounds checks; it delegates out-of-range behavior to the viewport/screen substrate. Cursor reports, device attributes, general mode set/reset, repeat, scroll-up/down, tab controls, status reports, and the many operations mentioned only by comments are not implemented. A replacement MUST NOT advertise a general ANSI terminal at this profile level.

Ambassador and VT100 deltas

Ambassador delegates ordinary escapes to the ANSI base. CSI > drains another parameter sequence and ignores it. CSI p stores the fourth parameter as the configured screen-line count when present. At that configured bottom line, line-feed moves a clipped region upward; elsewhere it addresses the next row. Other Ambassador-specific sequences are absent.

VT100 setup installs exactly four input translations: the four Genera arrow characters become ESC [ A, ESC [ B, ESC [ C, and ESC [ D. No other function or keypad key translation is established. Non-CSI = and > write alternate and numeric keypad-mode state, but no selected input path reads that state; an observable keypad effect is therefore unestablished. Non-CSI Y reads Y then X, subtracts octal 40, and addresses the cursor. CSI ? drains and ignores another parameter sequence. CSI r stores zero-based top and exclusive-looking bottom region values from its first two parameters and homes the cursor.

At the stored bottom boundary, VT100 line-feed scrolls only the configured region; at the top boundary, reverse index moves that region downward. Next-line at the bottom invokes regional line-feed and restores column zero; otherwise it uses scroll-at-end newline. The source does not implement general VT52 cursor keys, save/restore, device identification, printer control, reports, or private modes.

Simulator replacement transaction

Set Terminal Simulator Type locates the current registered simulator in the output chain. Absence signals an error. An identity-equal request is a no-op. Otherwise it:

1. clears the input-translation alist;
2. constructs the replacement with the old simulator's upstream and downstream;
3. patches the upstream output pointer to the replacement;
4. runs replacement setup;
5. makes the replacement the output-root value returned to the window;
6. recomputes the label.

The old simulator is not reset, the operation does not take the network output lock, and it does not increment the output-process tick. Failure after upstream patching can leave a partial chain; concurrent typeout may still hold a fast composition for the former chain. These are mandatory injected-failure and scheduling tests for L3-STRICT.

Accepting Values option transaction

Network X snapshots current simulator, More, overstrike, recording, escape, wallpaper-enabled/path, and echo state, then presents fields in this display order:

1. Escape character;
2. More processing;
3. Overstrike;
4. Record output;
5. Wallpapering, with Wallpaper file only when enabled;
6. Local Echo only when an echo state block exists;
7. Terminal simulator only when a simulator exists in the chain.

The complete field-editing, pointer, Help, correction, Exit, and Abort behavior is the incorporated Dynamic Windows Accepting Values and Input Editor contract. On a successful exit, changes apply nontransactionally in this exact order:

1. wallpaper replacement if enable/path changed;
2. escape character;
3. More processing;
4. overstriking;
5. output recording;
6. local echo if supported;
7. terminal simulator if supported;
8. increment output-process tick.

An error at any step leaves earlier changes in effect and skips later ones. Abort before the successful exit applies none of this post-sheet sequence, subject to the incorporated Accepting Values contract for field-local temporary state.

Raw and serial file transfer

Raw-text Send File opens the requested file through the filesystem error-case API. Open failure prints a local “not sent” condition and writes no peer bytes. On success it records length and truename, bypasses the outer MoreEscape filter if present, temporarily changes the Terminal label, removes typeout, streams characters through the remaining input filters while reporting progress, and restores the derived label in an unwind clause. Early EOF stops before the reported length. Protocol filters after MoreEscape still transform the data.

The active Send File parser defaults to the raw-text serial format. Other output formats and Receive File operate directly on the network stream through the serial file subsystem; Receive defaults to XMODEM. They run in typein and interrupt typeout with a closure that waits on a completion flag and acknowledges that it saw the interrupt. Cleanup sets completion, waits for acknowledgement, sleeps one second as a workaround, then wakes typeout. A missed interrupt or acknowledgement can hang indefinitely. Cancellation is a nonlocal serial-file cancellation, and a caught error is printed locally. There is no transaction that retracts peer bytes or a partially written receive file.

Send String paths

The explicit Send String command removes typeout, skips a leading MoreEscape filter, and emits each supplied character through the remainder of the input chain. The C-Y accelerator obtains the top kill history element and materializes a non-string interval. By contrast, selecting recorded terminal text sends each stored element through the complete chain, including MoreEscape. Tests MUST cover an embedded local escape in both paths and show the difference.

Wallpaper semantics

Setting a new wallpaper first closes the old one. It then tries to open the new path for output; failure prints a local error, removes typeout, and leaves wallpapering disabled. The old stream is not restored. Finally it recomputes the label. Wallpaper writes are guarded by a local error restart: a failed character/string/effect write closes and disables the wallpaper rather than failing the screen operation.

Wallpaper receives ordinary character and string output before it reaches the screen. More prompts temporarily disable copying. Cursor-address approximation is lossy: movement on the same row writes backspaces or spaces; movement to another row writes at most one newline when moving downward, none when moving upward, then X spaces. Clear, arbitrary graphics, attributes, and exact cursor state are not a faithful screen serialization. A reimplementation MUST call this a text journal, not a screenshot, transcript of all protocol state, or reversible terminal image.

Screen attributes and overwrite policy

Graphic output clears the destination character first when overstriking is false. Bold uses the selected bold face. Underline draws a one-pixel line at the baseline; reverse video flips the full line-height rectangle spanning the graphic advance. Other attributes, including blink, do not add a drawing operation. Nongraphic effectors follow the underlying screen path. String output with overstriking false computes the affected motion and clears the covered area before drawing.

Verified disconnected appearance

Runtime observation: Genera 8.5/System 452.22 after a local test login and Select T, captured 2026-07-19. The pixels establish only the prompt, initial label, left scrollbar, blank surface, border/who-line relationship, and relative geometry. They do not establish connection, protocol, simulator, command, presentation, source-residency, font, or timing behavior. Symbolics software and screen expression remain the property of their respective rightsholders; the intended use is limited criticism, scholarship, and historical verification under the repository's case-specific 17 U.S.C. section 107 review. No affiliation or endorsement is implied.

Publication gate: closed for this exact use. The D10 capture-specific rights review and the curated Genera asset approval both name this exact image and normative companion, with the bounded claims stated in the caption. The later raw Help capture contains substantial licensed Help prose, is not covered by that decision, and remains ignored.

The screenshot corrects one manual inference and bounds one source question. The visible prompt is exactly Connect: (the name of a host), not the manual's nearby longer phrasing, and the rendered label is exactly Terminal 1. Pixels cannot reveal the hidden source-profile label tag or establish whether or when it was recomputed; that cross-profile relationship remains TODO-ORACLE-G-INITIAL-LABEL.

Capture provenance

The screenshot sidecar records only the four-action prefix and capture-time provenance. It MUST NOT be described as containing later actions or final shutdown state; those come from the final action log and run record below.

Frozen final run record

The run began at 2026-07-19 20:18:06 EDT and stopped at 20:38:02 EDT. Its final run.json is 26,230 bytes, SHA-256 dff005f4dfd273ccdb95bff977bdea5750765af25ff79aa4ac6e697129087b3c. The final action log contains six records for three intents and three linked successful XTEST-dispatch outcomes, is 3,158 bytes, and has SHA-256 96928167fa6e35b4810ad2bfe6c9c9fdd639be084c09e44df8ac902266b84d83. After the capture, a Network/Help physical sequence at the disconnected host prompt displayed the Input Editor host-argument Help, not connected Terminal Canned Help. This runtime observation confirms the context precedence specified above; the corresponding raw screen is intentionally not published because the sparse initial screen is sufficient and the Help screen contains far more licensed prose.

Shutdown prompt observation, yes transmission, confirmation acceptance, and cleanup progress were recorded. Cleanup then reached the known confirmed stall and required bounded forced termination. Final flags are forced_stop=true, forced_after_confirmed_shutdown_stall=true, state_may_be_incomplete=true, and orderly_vlm_host_shutdown=false. The private world remained byte-identical to its start hash. The harness invoked neither Save World nor a host-process checkpoint. save_world_performed and guest_checkpoint_created remain unknown; no world-hash inference may turn them into false. This witness MUST be described as forced-stopped, never orderly.

What the runtime does not prove

No network peer or site service was configured. The run does not establish service resolution, a successful connection, local Network-prefix behavior while connected, Telnet/SUPDUP bytes, filters, simulators, More, wallpaper, output recording, presentations over remote data, file transfer, disconnect ordering, connection reuse, or source-to-world identity. Every such claim remains source-profile behavior or a test obligation below.

Explicit extension points

Compatibility requires registries, not hard-coded switches. The login-protocol registry carries service identity, desirability, stream kind, input/output filter type lists, and invoke operation. The simulator registry carries type identity and case-sensitive display name. The state-block registry maps a symbolic protocol-state kind to its constructor. Host-default simulator mappings and the host-system lists that suppress overstrike or enable SUPDUP character insertion are mutable policy. Command tables, Select mappings, pointer gestures/handlers, presentation types, and serial-file formats are likewise externally extensible through their owning subsystems.

A conforming implementation MUST support deterministic add, replace, enumerate, and lookup operations for each applicable registry; retain ordering and identity where the selected source makes them observable; invalidate inherited command/gesture caches through the incorporated substrate rules; and include every effective entry in its test manifest. Site extensions MUST carry a separate profile identifier.

Protocol parsing MUST be incremental. A deterministic test stream must be able to stop after every byte, return EOF, raise a network error, or switch between buffered and scalar delivery. The implementation MUST trace bytes consumed and emitted, filter/state mutations, screen primitives, locks, process transitions, and conditions without depending on proprietary output.

Result and fixture rules

Every test result MUST record profile, strict/corrected mode, implementation revision, effective registries, mutable global values, screen dimensions/font metrics, fake host attributes, input bytes/events, scheduler decisions, output bytes, screen primitive trace, state before/after, conditions, and oracle status. PASS-SOURCE means agreement with deterministic selected-source behavior; PASS-RUNTIME requires the named preserved-world oracle as well. A source-only pass MUST NOT be relabeled runtime-compatible.

Peers MUST run inside the throwaway network namespace, with no external route, credentials, uncontrolled login daemon, or guest-visible file service. They are recording protocol fixtures, not simulated historical ITS, TOPS-20, Unix, VMS, or Symbolics sites.

The cross-system D10 specification owns the canonical NT-* test identifiers. The more granular GT-* labels below are subordinate cases, not an alternate conformance namespace. Reports MUST cite both the canonical owner and the exercised local cases:

Binding and context tests

Lifecycle, failure, and scheduler tests

Protocol tests

Display and simulator tests

Options, file, wallpaper, and visual tests

Required connected preserved-world oracles

The following named tests gate L4 and currently have no PASS-RUNTIME result:

• GT-RUN-PEER-TELNET: successful isolated Generic Network path, first-IAC matrix, echo/binary transitions, input/output, error, and orderly application disconnect;
• GT-RUN-PEER-SUPDUP: terminal variables, greeting, keyboard ITP, every text effector, selected graphics vectors, bell, and reset;
• GT-RUN-PEER-SIM: Glass, Imlac, Ambassador, and VT100 selection, label, parsing, registry order, and live replacement;
• GT-RUN-PEER-MORE: More waiter, literal escape, Canned Help, commands, presentation-yanked text, and output recording;
• GT-RUN-PEER-FILE: disposable raw and XMODEM transfers with both byte traces;
• GT-RUN-PEER-WALL: disposable journal path, cursor approximation, write failure, and disconnect closure; and
• GT-RUN-IDENTITY: establish which selected source definitions, if any, correspond to resident System 452.22 compiled functions.