Ivory, FEP, and Open Genera VLM implementation layers

What a VLOD contributes

A VLOD supplies the serialized tagged world state that Life Support maps into the VLM's virtual memory. It is not a source archive and it is not, by itself, a host process checkpoint. The world contains compiled functions, Lisp objects, system registries, symbols, resources, and application state; the host still constructs the process, communication areas, X connection, virtual disks, and network attachment around it. See World loads and VLOD for format and extraction details.

Fact — public manual: host swap space extends the VLM's virtual memory during one run. It does not turn the world into a resumable snapshot after the host process exits.

Observation — runtime: the current harness copies a base VLOD to a private session path before launch and never invokes Save World. It records whether the copy changed but does not infer that any change represents a successful in-guest save.

Tagged words and object-aware memory

Fact — public architecture: an Ivory architectural word has 40 significant bits: a two-bit CDR code, a six-bit data type, and a 32-bit pointer or immediate field. The tag is not merely debugger metadata. Memory cycles, instruction dispatch, forwarding, traps, and garbage-collector cooperation can depend on it.

The architecture presents one word-addressed virtual address space. The lower 31/32 of that space is mapped—3,968 megawords—while the upper 128 megawords is an unmapped zone used for architectural purposes. Architectural pages contain 256 words. These are I-machine quantities; a host file offset or Unix virtual-memory page must not be substituted for them in preservation notes.

Instructions, calls, and dynamic state

Common instructions can be packed as two 18-bit halfword instructions in one tagged word. Full-word instructions and constants coexist with that representation, and CDR-code sequencing affects instruction flow. The architecture directly supports operations that a conventional untagged processor would normally leave entirely to a language runtime:

Fact — public architecture: coprocessor reads and writes are side-effecting operations whose architectural handling is designed to avoid accidental replay. This is central to the VLM boundary: a “write” can request a world save or another host service, not merely update ordinary Lisp memory.

Ivory is not CADR microcode

Ivory is a later instruction architecture, not the CADR's writable microcode control store translated into software. Genera's I-LISP-COMPILER emits Ivory instructions; it does not assemble CADR microinstructions. The exact CADR chain is documented in CADR microcode, microassembler, and console debugger.

Compiler and linker pipeline

Fact — source: I-LISP-COMPILER is not one file named “compiler.” Its declared order moves from architecture and internal definitions through optimization and front-end transforms to an Ivory-specific back end, disassembly, and public compiler entry points. I-LINKER is separately declared, allowing architecture linking machinery to be rebuilt and patched without treating the entire language front end as the same component.

The practical user commands—compile a definition, region, buffer, or file; inspect warnings; disassemble; and load compiled output—belong to the runtime/compiler dossier. At this layer the important fact is target selection: the release declaration selects the I-machine compiler for :IMACH and :VLM, so an Open Genera world is executing Ivory-targeted compiled objects rather than recompiling every function to the host's native instruction set.

Observation — runtime: the observed world reported machine model Virtual Lisp Machine and microcode description Ivory, version 5. Those values are guest-visible identity claims. They do not prove a physical Ivory chip is present.

The physical FEP filesystem

The FEP filesystem is the boot processor's storage namespace, distinct from the Lisp Machine File System that Genera presents to ordinary applications. FEP pathnames conventionally name a unit such as FEP0: and a root-relative file. The exact representation and available artifact types vary across the 3600 and Ivory families, but the operator-visible roles are stable enough to distinguish:

Fact — public manual: FEP pathnames merge missing fields against a contextual default and are case-insensitive. Supplying a name or type selects the newest version by default. On Ivory, completion and .newest selection skip deleted but unexpunged versions; an operator can explicitly name a version and use Add World File when recovering a deleted-but-not-overwritten world hierarchy. That recovery capability is another reason not to expunge or rewrite unique media during an exploratory session.

Mount, Show Directory, and Show File expose the filesystem to the front-end operator. Find World Files, Add World File, and Show World Files manage the bootable-world inventory. Set Default Disk Unit and Set LMFS FSPT Unit connect later operations to physical units and the Lisp filesystem partition table. At the destructive end, Create Initial FEP Filesystem, Disk Format, Set Disk Label, and restore commands can replace the metadata on which bootability depends.

Inference: the FEP filesystem is better compared to a service/boot partition with its own command environment than to the complete Genera filesystem. That analogy is only operational: it does not imply a Unix partition layout or file format.

Physical FEP input model

Fact — public manual: at the physical prompt, HELP describes command input; Control-/ or Control-? requests completion or a list of possibilities, and pathnames have completion support. Boot files can invoke command sequences and load FEP overlays. On Ivory hardware, Control-Abort can stop supported long-running operations. Older 3600 documentation often prints hyphenated command names where Ivory material prints spaces; this dossier uses the spaced display names.

The physical command set below is complete at the Site Operations command-name grain. It does not enumerate every release-dependent keyword of every hardware diagnostic. Commands marked destructive/high risk should never be explored on unique media.

Ordinary boot and operating commands

Color and display/device commands

Set Disk Label, despite appearing in the manual's color/platform grouping, is a storage mutation and is classified by effect here rather than by chapter placement.

Maintenance commands

Expert and diagnostic commands

Safety conclusion: the Show family, directory scan, version, and status commands are the preferred museum probes on duplicate physical media. Formatting, filesystem creation, disk-label/type mutation, restore, memory tests, FEP loads, and state-clearing commands require expendable copies and a recovery plan. None of these physical commands should be typed into an Open Genera Lisp Listener merely because a similarly named Genera command exists.

FEP-related Genera Command Processor commands

These commands run from a Lisp Listener's Command Processor while Genera is alive. They reach or prepare the physical FEP; they are not additional commands at the FEP prompt. The direct surface in Site Operations is:

The world suffix is platform-significant: the manual identifies .load for 3600-family worlds and .ilod for Ivory worlds and restricts copies to compatible families. Copy World also knows the parent relationship of Incremental Disk Save worlds; it is not a raw one-file copy when parents are requested. Detailed world construction and distribution behavior belongs in the system-construction dossier.

The manual also connects crash evidence to Zmacs Insert Crash Data, which inserts the recovered record into the current editor buffer or a report. A museum capture should show only the minimum synthetic or already-public diagnostic fields needed for analysis; board serials, addresses, stack contents, and licensed report prose must not be published by default.

FEP-related maintainer functions

These are programmatic maintenance entry points rather than ordinary commands, but they bound what the manual exposes beyond the Command Processor:

Observation — runtime: si:machine-model returned Virtual Lisp Machine in the recorded Open Genera session. The numeric identity was deliberately not published. The FEP block/file repair functions were not invoked on the VLM.

Defined communication regions

The modern public source declares four fixed communication regions in Ivory address space:

Fact — source: structures and queue fields cover virtual disk, console, network, RPC, SCSI, Cold Load, host-file, and command channels. The FEP-named area is a compatibility ABI between guest code and Life Support.

Inference: retaining an address and structure named FEPComm lets Ivory-era Genera code speak a familiar control protocol without requiring an actual IFEP processor. It is an interface seam, not a simulated proof of physical hardware.

Host process initialization sequence

The modern public main path establishes this order:

1. build configuration from defaults, files, and command-line values;
2. initialize the Ivory processor and Life Support;
3. load the world image;
4. load the VLM Debugger;
5. establish virtual-memory and world bounds;
6. initialize processor state; and
7. enter the instruction sequencer.

Termination is coordinated through a dedicated signal-wait path and Life Support teardown. This public design does not establish that every historical binary exits cleanly on every guest state; the current museum runtime observation below proves a bounded forced stop in one paused-state case.

Main display versus Cold Load display

The main Genera display is guest X11 traffic relayed through the VLM. The Cold Load display is a separate Life Support control window used by the VLM Debugger and early/failure states. They have independent display, geometry, iconic, foreground, background, border-color, and border-width configuration resources.

The Genera computer-use harness protects this boundary carefully. Its compatibility layer modifies only pinned, byte-exact X11 requests needed by this old VLM on the isolated Xvfb and delegates other bytes unchanged. It does not interpose world, TAP, arbitrary file, or unrelated socket I/O.

Command-line switches

The public Open Genera guide documents these host controls. The table is complete at the documented switch-name grain; build-conditional developer switches are separated afterward.

The release-era guide describes -network using numbered units. The current museum executable was instead launched with the later TUN/TAP form tun0:10.0.0.2;mask=255.255.255.0;gateway=10.0.0.1, and the modern public fork explicitly describes TUN/TAP support. Observation plus source cross-check: this is a real interface evolution; it is not appropriate to silently rewrite the old manual's numeric syntax as though both releases documented the same parser.

Fact — source, modern fork: the inspected current public descendant adds -testfunction. It also contains -trace and -tracePOST paths only in tracing builds.

Observation — binary audit: printable strings in the local 1,533,760-byte VLM contain -testfunction but not exact -trace or -tracePOST strings. String absence is not parser proof, so those tracing switches remain build-conditional and unverified for this executable.

Configuration files and resources

Configuration is applied in increasing precedence:

1. built-in defaults;
2. /var/lib/symbolics/.VLM;
3. .VLM in the user's home directory;
4. .VLM in the current working directory; and
5. command-line switches.

The syntax follows X-resource conventions. A specific genera. resource is more specific than a wildcard * resource. The effective ancestor-world search path can come from the built-in default, WORLDPATH, a worldSearchPath resource, or the higher-precedence -searchpath command-line value. It changes lookup, not the contents of a world.

The Open Genera manual's minimum/default sizing belongs to its release era. The modern source enforces a 125 MB minimum, while the manual describes 200 MB as the default. The museum harness explicitly requests 2048 in its isolated configuration; the guest reported 409.0 megawords requested and 398.0 megawords available. These quantities should be recorded, not normalized into an invented single “canonical” size.

Halt Genera controls

Observation — runtime: this session executed Halt Genera :Logout No :Shutdown No :Query No :Delay None. The main screen then directed the operator to use the VLM Debugger :Start command to continue. This verifies the pause path and those keyword spellings in the Open Genera 8.5 world.

Fact — public manual: if :Start encounters a bad process, a first retry tries the remaining processes; a second retry resets the offending process. That is a recovery rule, not a guarantee that application invariants survive.

Input and display conventions

• Numbers use the current base, initially octal in the documented debugger. With Control, Meta, Super, or Hyper modifiers, relevant numeric arguments use decimal.
• A numeric argument followed by a dot establishes the point. The input reader is not an arithmetic expression evaluator.
• Symbolic addresses accept register names such as %REGISTER-...; #' selects a function cell and ' selects a symbol address.
• Backquote input supports Q, O, and S object/input forms.
• Segment modifiers are @V, @P, @R, and @U for the documented virtual, physical, region, and unmapped/address-space interpretations.
• Escape/lozenge acts as a command modifier that changes a second or default argument where the command defines one.

The typeout formats are complete at the documented one-character format grain:

Point stack accelerators

Stack display commands

Stack motion commands

DDT location commands

The same ^ character participates in context-dependent open-location behavior; the operator must verify whether a location and argument are active before typing. This is exactly the kind of compact debugger convention that makes casual exploration unsafe.

Lisp-object and address-description commands

Miscellaneous debugger commands

Open question/TODO: verify whether Mail Bug Report in this Open Genera build offers a host pathname destination or only release-era destinations. Do not send a report or publish crash content merely to answer that question.

VLM-only top-level commands

Open question/TODO — exact runtime capture: the computer-use harness can now target the mapped Cold Load client exactly and fail closed on zero or ambiguous matches. In a fresh private session, pause with the verified Halt Genera form, target --window-kind cold-load, capture :Show Version and :Show Status, then use :Start and verify the listener resumes. Record the ordered input ledger and review the specific image under the screenshot-publication policy before adding it. No tracked screenshot is substituted here because that VLM Debugger command run has not yet been performed.

Physical netboot versus VLM stubs

Fact — source: the full NETBOOT system is declared for physical 3600 and I-machine targets. The VLM instead loads NETBOOT-STUBS. In the inspected stub, the predicates and entry point that would request or perform netboot return false or no action, while a required Ethernet-related constant remains defined for compatibility.

Conclusion: Open Genera can use networking after host Life Support supplies an interface, but it does not run the physical FEP netboot workflow. A loaded NETBOOT registry entry must not be converted into a claim that the VLM fetched its VLOD over the wire.

Bus access

Fact — source: BUS-ACCESS is a utility subsystem conditioned for :IMACH and names a VME-bus implementation. The corresponding VME implementation source is absent from the inspected distributed subset, and no VME device is exposed by the isolated VLM harness.

Open question: whether a particular physical Ivory model and release supported each bus operation requires that model's hardware manual and the missing source witness. Runtime :NEWEST status on VLM is insufficient evidence.

Keyboard translation

The low-level keyboard system translates host/console key identities into the Symbolics modifier and character model expected by Genera. Its declared source includes keyboard layouts and PC keyboard support; the host X modifier map is therefore part of the execution contract, not merely an aesthetic preference.

The user-facing Keyboard Control activity—inspect, test, compare, edit, revert, print, and serialize mappings—is fully documented in RPC, embedding, UX, and Macintosh integration. This page records only the architecture consequence: a VLM can execute Ivory code correctly while still being unusable if host keycodes/modifier maps do not satisfy the expected translation layer.

Embedding and host channels

The embedded communication area supports queues, buffers, message channels, host files/processes, RPC, and remote-program services. That is a deliberate host integration API, not evidence that the guest can access arbitrary host memory. The museum harness narrows it further with namespaces, a private runtime tree, read-only exact inputs/helpers, no external route, and no guest-visible file service.

For transport agents, exported APIs, Keyboard Control, UX, MacIvory, HyperCard, Mac-Dex, and platform exclusions, use the dedicated embedding dossier.

Compress File

Compress File is installed in the File Command Processor table. Its direct surface is:

Errors are handled per file rather than requiring the entire wildcard operation to be described as atomic. Output can acquire a new file version, and copied metadata and preamble choice are part of the artifact's provenance.

Fact — source / possible defect: the inspected UI definition for the Heuristicate choice in Compress File supplies the internal value :DOCUMENTATION, while the downstream translation logic expects :HEURISTICATE. The decompression command maps that choice consistently. This is a source-visible mismatch, not yet a proven runtime bug.

TODO: on scratch public-domain files in a private world, invoke Compress File with Translation Strategy Heuristicate, record the actual accepted value and output, and avoid publishing any licensed input or compressed derivative.

Decompress File

Decompress File obtains preamble/format information from the input; it therefore does not expose the compressor's Preamble Type choice.

Zmacs buffer encryption

The encryption system defines two direct Zmacs commands:

Fact — source: the inspected implementation offers the historical Hermes method through these commands. The algorithm is not reproduced here.

Safety conclusion: these facilities are historical compatibility and preservation subjects, not modern confidentiality recommendations. An undo record and hidden prompt do not establish contemporary cryptographic strength, secure key erasure, authenticated encryption, or safe handling of secrets in editor swap or world state. Zmail's separate encryption surface belongs in the Zmail command dossier.

Physical Ivory workflow

1. IFEP initializes or verifies hardware and its filesystem.
2. Operator/autoboot policy selects boot options, microcode/processor support, world, paging files, and network/device configuration.
3. IFEP loads the world and starts Genera.
4. A halt or fatal failure can return control to IFEP/IFEP Debugger.
5. Operator may inspect, continue/start, load another world, or shut down.

Exact order varies by workstation model, release, and boot file. The command tables above describe capabilities, not a universal recipe for unique museum hardware.

Open Genera workflow

1. Host configuration selects the VLOD, VLM Debugger, memory, displays, search path, and network unit.
2. The host starts the VLM and Life Support, maps communication regions, and loads the world/debugger.
3. The Ivory interpreter executes Genera while Life Support services explicit queues and coprocessor requests.
4. Halt Genera :Shutdown No pauses to the VLM Debugger without writing a world.
5. :Start resumes the still-live process; :Shutdown terminates it; a separate successful Save World is required for a persistent new VLOD.

Recovery hierarchy

Use the least invasive level that can answer the question:

1. inspect status/version and capture read-only evidence;
2. pause and resume without memory edits;
3. debug a selected process or examine addresses;
4. reset only a demonstrably bad process;
5. load a fresh private world;
6. mutate debugger locations, device structures, or boot media only on expendable copies with an exact rollback plan.

Session and results

The ignored session was named d52-ivory-vlm-layers-20260718, generation 1. It ran in the isolated Genera computer-use harness from 2026-07-18 12:21:47 through 12:30:07 EDT.

The complete action ledger includes failed/partial delivery of one overlong probe and a subsequent input-clear recovery. Claims in the table rely only on successful forms whose output was visible. The ordered action/outcome record has SHA-256 7cf61cc0d2d1c049c09ba6f721d3e5f7e2b788b47310d0d10283ca554e25b1ad.

Execution environment and provenance

The runtime facts above are joined deliberately from the generation-level run.json, ordered action ledger, and capture sidecars. A screenshot sidecar does not claim to contain the execution-time VLM hash; that value comes from the run record.

The local VLM is an x86-64 ELF for Linux, contains debugging information, is not stripped, and carries a GCC 3.4.5 compiler comment. These binary properties help separate it from the modern public source head; they do not by themselves identify an exact historical commit.

Shutdown result

The harness stop began after Genera was already paused. It observed the shutdown prompt and sent yes, but did not observe accepted confirmation or cleanup progress. It therefore used its bounded forced stop and recorded:

• forced_stop: true;
• forced_after_confirmed_shutdown_stall: false;
• state_may_be_incomplete: true;
• private world unchanged; and
• save_world_performed and guest_checkpoint_created not established.

Observation boundary: this is not the separately documented running-state cleanup path where the current public VLM begins cleanup and later stalls at a Cold Load channel mutex. Here, confirmation acceptance itself was not observed. The session is evidence for this exact paused-state run only, and it must not be called an orderly shutdown.

Screenshot status

Four raw local captures document the machine/architecture probe, implementation system states, and pause message. They remain under ignored session storage:

These are raw, unreviewed local evidence rather than curated assets. Before publication, review a capture-specific scholarly need and crop, and record every required run/configuration/input field in the curated catalog. A visible architecture page would normally embed a reviewed runtime image; this page instead ships with the explicit blocker because the central control surface—the Cold Load window—was not safely selectable through the current harness.

Licensed local artifact set

The ignored session's run.json also records configuration SHA-256 5ce6509f5adf2cf2d054d34eb4ba777ce462285b8cd9b01bc071bf819139e086, the exact execution-time VLM hash, private-copy hashes, harness-source hashes, toolchain provenance, namespaces and network mode, and shutdown flags. The files themselves must not be distributed. A curated screenshot must carry the applicable full values into its tracked asset catalog rather than relying only on this table.

The extracted licensed sys.sct tree contained 5,075 files totaling 174,490,231 bytes. Selected source witnesses were:

The encryption witness labels are normalized descriptions because the exact local versioned filenames are not publication-relevant. The byte size and hash, not the shorthand label, identify the inspected file.

Public VLM source cross-check

The public descendant was inspected at Git commit 55b2a3b1cf884f827d85829713587657c435cb29, verified 2026-07-18.

The fork describes itself as an x86-64 Linux VLM derived through Brad Parker's work and includes TUN/TAP networking plus later fixes and extensions; its COPYING file is GPL version 3. That lineage statement and license apply to the public fork, not automatically to the licensed Symbolics world, VLM Debugger, or local historical executable. The exact ancestry of that executable remains a TODO.

Public manuals

Public manual PDFs were verified on 2026-07-18: