CADR audio, beeper, and Votrax reimplementation specification

ABI1.11 M13 audio records

cadr_wasm_m13_audio_open() exists only in the opt-in ABI1.11 build. It first calls cadr_audio_model_start_consumer_session() and then emits exactly 48 bytes:

One PCM delivery record is exactly 64 + 2 * frame_count bytes, hence 66 through 1,088 bytes because frame_count is never zero:

Generation and epoch are nonzero; sequence may be zero. frame_offset + frame_count must not exceed 512. The outer v8 envelope supplies the SHA-256, which is verified before the sample copy reaches the Worklet. Zero-frame Votrax/UART records never become CDRPCM1: the private source acknowledges their exact M11 cursor with frames=0 and emits no silent Worklet cell.

Evidence codes

The selected source profile wins for its own source-level claim. The Phase 1 queue, wire records, and safety-oriented backpressure rules are INF-M11; they are not attributed to historical CADR software. A later runtime result may refine only the profile it exercises.

Compatibility profiles

The System 303 Votrax source constructs its serial stream with eight data bits, two stop bits, parity/framing checks, and baud 300; its speech loop passes serial values and then -1 to the stream's :TYO operation. The public source establishes that call sequence, but not whether the serial implementation suppresses, transforms, or transmits the negative value on a particular artifact. The public System 303 source supports that narrower claim. The System 46 Votrax source calls MAKE-SERIAL-STREAM without arguments, and the pinned implementation defines those defaults as 300 baud, seven data bits, even parity, and one stop bit. The Votrax call and the pinned serial defaults establish the source-level 300/7E1 profile. Whether a particular loaded System 46 artifact retains those defaults remains a runtime question.

The current upstream SDL3 path fills signed-16 samples from a sine function, asks for 8 kHz mono audio, and receives %BEEP half-wavelength and duration inputs. That is why USIM-SDL3-SINE-330D8248-CANONICAL-v1 is a useful software comparison target, but its host-library math and audio-device behavior are expressly not a CADR hardware specification. Pinned sdl3-audio.c and the IOB dispatch were verified on 2026-07-29.

A second local source check used repository worktree revision f6d3212c03e563b54b19082a97080eb697d6b060 and content hashes for usim/iob.c, usim/sdl3-audio.c, and usim/Makefile.usim. The disposable M11 witness preparer copies only source-form inputs, applies a two-file exact patch in an ignored closure, and records scalar half-wavelength, full-wavelength, duration, and PCM-block metadata only if a separately authorized native run supplies a new output path. The 2026-07-29 closure and SDL3 compile succeeded; it was not run. This is USIM-WITNESS-PREP, not a sound, timing, or CADR runtime observation.

Conformance levels

M11-L0 through the isolated portions of M11-L2 are implemented and tested. One source-bounded synthetic slice of M11-L3 is also observed in real Chromium; the complete level remains reserved. This does not claim an exact historical source interface: the source’s Lisp stream API, devices, phoneme tables, load behavior, and preserved-runtime comparison remain outside this C semantic boundary.

Canonical event

An event has native fields only for manipulation. Native structure alignment, byte order, and padding are never transferred. cadr_audio_event_encode emits exactly 64 bytes in this order:

The v1 numeric serial codes are 8E2 = 0x00020208 and 7E1 = 0x00010207; the low byte is data bits, the next byte is parity (2 = even), and the next byte is stop bits. A canonical UART primary is exactly 0..255. The source-side -1 utterance call has no canonical UART event in this bounded profile because its wire disposition is unknown; 0xffffffff and every other larger primary are invalid. This is a profile nonclaim, not evidence that the preserved stream suppresses that call. There is no phoneme lookup, voice-ROM access, or synthesis implicit in a UART event.

Invariants

1. The logical queue contains at most 64 packet records and each beeper record carries at most 512 frames. Thus its maximum queued synthesized extent is 32,768 frames; UART records occupy a packet but zero audio frames. One accepted beeper job may retain additional not-yet-enqueued frames in explicit pending state.
2. Accepted records are ordered by the host authority's monotonically increasing sequence, and within a generation by (post_slot, intra_slot). Sequence does not restart on a semantic reset. A new post-slot cannot be opened while the 64-packet queue is full.
3. The head offset is in [0, frame_count) only for a beeper head. A UART head has offset zero and is acknowledged with exactly zero frames.
4. A copied native cursor names generation, numeric authority provenance, an integer address token captured while the authority was live, a non-recycled incarnation, the authority's model-issued consumer epoch, sequence, head offset, remaining frame count, and all 64 canonical event bytes. Address token and incarnation must both match the current live authority. Cursor validation never dereferences the saved address token. Two live objects with the same provenance ID cannot cross-ack, and later reuse of the same address cannot revive an old cursor. Neither local capability value is put on a wire or in a snapshot.
5. head_sequence is the sequence at the logical head, or next_sequence when empty. At every valid boundary, next_sequence - head_sequence == queue_packet_count, and the first queued event, when present, has sequence head_sequence. In addition, next_sequence MUST equal the separate host authority's accepted_sequence_high_water. Event append validates both relationships before assigning a sequence, so jointly rewinding both serialized claims still cannot emit a duplicate.
6. H_before_logical_head is the cumulative witness immediately before the current logical head. It changes only when a complete head record is removed. Partial acknowledgement leaves it unchanged.
7. The final witness is cumulative accepted-record evidence, not a digest of the current queue. Pumping a newly available pending-job packet extends it once; acknowledging, peeking, copying, or rendering cannot otherwise change it.
8. A pending beep job retains its source arguments, total frame count, next unqueued frame offset, and post-slot. While pending, the ring is full, the next offset is a nonzero multiple of 512 smaller than the recomputed total, and no other producer event may pass it.

Cumulative witness

Let LE32 and LE64 be fixed-width little-endian encodings, E_(g,k) the canonical 64-byte event accepted at zero-based ordinal k within generation g, and SHA256 standard SHA-256. E_(g,k).sequence is the independent global authority sequence and need not equal k. The exact Phase 1 witness is:

H_(g,0) = SHA256("CDRAUDW1" || LE32(1) || LE32(6) || LE64(g))
H_(g,k+1) = SHA256("CDRAUDW1" || H_(g,k) || E_(g,k))

The domain bytes contain no NUL terminator. Reset starts H_(g,0) for its new generation without resetting global event sequence. H_before_logical_head starts at H_(g,0); removing complete event E_(g,k) sets it to H_(g,k+1) and increments the semantic head_sequence. Therefore a verifier folds every logical queue event over the head anchor and MUST obtain the final witness, while independently requiring the exact head_sequence/queue/next_sequence relationship and equality between next_sequence and the non-adopted authority high-water. The semantic pair alone is not trusted: jointly rewinding it is rejected against the authority. The witness anchor detects distinct acknowledged prefixes even when surviving queue bytes are identical. This hashes canonical bytes, never native structure memory. It is an INF-M11 transport witness and is not a historical CADR checksum.

Initialize and reset

cadr_audio_authority is a host-owned object outside adoptable semantic state. It contains one nonzero transport-lifetime provenance identity, one monotonic consumer epoch, one monotonic accepted-sequence high-water, and lifecycle/attachment state. It has no paired current/high-water fields. Authority storage MUST be zero-initialized. Construction is one-shot: it rejects zero identity, zero epoch, non-virgin storage, an already live authority, an attached authority, and retired authority storage without mutation. The trusted wrapper supplies the nonzero provenance ID; live native capability identity includes the address of the particular authority object, not the numeric ID alone. Initialization captures that address as self_address_token. Every attach, use, detach, and retirement validates it before following the allocator or owner pointer. An initialized authority MUST NOT be moved, relocated, or byte-copied for its entire live or retired storage lifetime.

Each authority lifetime also receives a nonzero incarnation from a zero-initialized, one-shot cadr_audio_incarnation_allocator. One allocator covers one live capability domain and is accessed under the same serialization boundary as authority construction. It issues monotonically increasing values and never recycles them. When its next value is UINT64_MAX, construction returns OVERFLOW without changing allocator or authority. The allocator must outlive construction and every authority it registered, but cursors retain only the issued integer, not an allocator pointer. It holds 64 simultaneous live address/incarnation leases; construction with no free lease returns BACKPRESSURE. Allocator initialization also captures its own address; the allocator MUST NOT be moved, copied, or relocated during that capability-domain lifetime.

The allocator lease is the external check that a self-address token alone cannot provide. Authority use requires the allocator's active entry at that address to carry the same incarnation. Copying detached initialized bytes to another address fails the self-address check; copying those bytes back to the original address after retirement still fails because the old lease is inactive. A legitimate new object at the reused address receives a new incarnation.

Model initialization receives an existing authority, a nonzero generation, and a renderer policy (NO-AUDIO or the reserved SDL3-sine comparison target). It empties the queue and pending job, initializes both semantic sequence claims from the authority's accepted high-water, and derives H_(g,0) for both witness values. A caller that supplies generation zero receives one. Model storage also starts zeroed. Phase 1 uses a single-owner attachment rule: exactly zero or one model is attached to an authority. A second attachment or reinitialization of an attached model fails atomically. All access to the model and authority shares one caller-provided serialization boundary. The authority also stores the exact attached-model owner address. Every stateful operation requires authority.owner == model; a byte-copied model alias therefore cannot acknowledge, reset, start a session, adopt state, or detach/destroy the real owner's authority. Model initialization likewise captures model.self_address_token, and every public model operation tests it before any authority dereference. An initialized model MUST NOT be moved, relocated, or byte-copied for use during its attached lifetime; a copy is never an alias handle.

model_destroy() requires a live attached authority, detaches it, and zeroes the model so no API retains a dangling authority pointer. authority_destroy() is permitted only after detachment and retires the storage permanently; it does not make that storage virgin again. The authority object MUST outlive its attached model. Freeing, moving, byte-copying, or zeroing it while attached is outside the C API contract; public operations never detach, retire, or reinitialize it implicitly. Outstanding cursors need not be counted or explicitly destroyed: they contain no dereferenceable authority pointer and become inert stale values after detach, retirement, session advance, or incarnation change.

Legal teardown is ordered: destroy the exact owner model, retire the now-detached exact authority, then release their storage. A stale byte-copy of the model checks its own mismatched self token first; ack, reset, session advance, and destroy therefore reject it without dereferencing the freed authority address.

start_consumer_session() accepts no caller-selected epoch. It atomically increments the authority's sole consumer epoch. At UINT64_MAX it returns OVERFLOW without mutation. Consequently the public transition from session 1 can be only 2, then 3; it cannot return to 1 and revive a session-1 cursor. Reset is atomic: it increments generation and consumer epoch, clears queue/order/pending state, retains the accepted-sequence high-water as both empty semantic sequence claims, and derives a new H_(g,0); exhaustion of generation or consumer epoch fails without mutation. A pre-reset cursor is stale after success.

adopt_semantic_state(destination, decoded) ignores any authority pointer attached to decoded. It attaches the destination's existing authority to a temporary candidate, validates witnesses, queue relations, and the candidate's next_sequence against the authority accepted high-water, checks epoch capacity, then atomically increments the authority epoch and publishes the semantic candidate. Thus a copied model with both head_sequence and next_sequence rewound, or with a forged epoch/authority attached, cannot roll back the destination authority.

No cadr_audio_authority byte is part of CDRSNAP1. Exact sequence and session continuity across a full host-process restart cannot be proven from the AUDIO chunk alone, especially for an empty queue. A restart that must accept delayed external acknowledgements or preserve exact sequence lineage requires a separately trusted wrapper/head-lineage anchor containing authority identity, consumer epoch, and accepted-sequence high-water. Without that anchor, the wrapper MUST establish a new unique authority identity and close or reject every old delivery channel; it MUST NOT claim continuity from snapshot semantic claims. Starting a session changes no semantic queue, sequence claim, pending job, slot, or witness.

The incarnation allocator closes address reuse only inside its live capability domain. A process restart or allocator-lineage loss has the same boundary as other authority loss: exact continuity requires the separately trusted wrapper/head lineage anchor and a non-reused capability domain. Otherwise all old cursors and delivery channels must be rejected rather than treated as resumable.

Slot reservation and deterministic backpressure

Before a UART event for a guest post-slot, the producer MUST call begin_slot. It first checks queue capacity and the absence of a pending beep. If all 64 packets are occupied or a beep continuation is pending, it returns BACKPRESSURE without changing the active slot. Otherwise the new slot must be strictly later than the currently open slot and no earlier than the last emitted event; it becomes the sole active producer slot.

This rule intentionally makes a full queue visible before the next guest slot is advanced. A producer MAY emit several events within the active slot. It MUST treat BACKPRESSURE as a scheduling boundary, not discard or coalesce the event, and retry only after an acknowledgement has made capacity available.

Synthetic beeper producer

accept_beep_job(post_slot, half_wavelength_us, duration_us) accepts the slot and complete source job at one atomic boundary. It requires a strictly later post-slot, a nonzero argument pair, no earlier pending job, and at least one free queue record. It computes with checked integer arithmetic:

total_frames = ceil(duration_us * 8000 / 1,000,000)
packets = ceil(total_frames / 512)

Acceptance preflights the sequence and intra-slot range for the entire job. It then commits the new active slot and exact pending-job state atomically, emits as many canonical packets as the ring can hold, and retains the next offset if packets remain. Each packet repeats the source arguments, records a zero-based source-frame offset that is a multiple of 512, and has exactly min(512, total_frames - offset) frames. A complete head acknowledgement immediately pumps newly available capacity from that same job before another producer may advance the slot. A partial acknowledgement creates no packet capacity and does not pump.

Thus a 4,096,001 microsecond job computes 32,769 frames: 64 packets of 512 are initially queued and the final one-frame packet is emitted after the first complete head acknowledgement. A ring containing 63 UART records can atomically accept a 513-frame beep into one queued 512-frame packet plus a one-frame pending continuation. If the ring is already full, the same call returns BACKPRESSURE and leaves slot, queue, sequence, witness, and pending state byte-for-byte unchanged. A half-wavelength is semantic input only; Phase 1 must not turn it into samples.

Synthetic Votrax UART producer

enqueue_votrax(profile, byte) requires an open slot, no pending beep, one selected Votrax profile, and a byte in 0..255. It enqueues one zero-frame event with selected 300/8E2 or 300/7E1 format. The model does not apply parity, framing, baud delay, word/phoneme translation, or an audio waveform. Those remain future source-profile and runtime obligations.

Peek, copy, acknowledgement, and render

peek snapshots only the logical head into a cursor and does not mutate model state. copy validates that cursor, copies exactly its 64 canonical bytes when its output capacity is at least 64, and otherwise reports WRONG_LENGTH with zero written. It does not consume anything.

ack(cursor, frames) revalidates the cursor atomically. A zero-frame UART event requires frames = 0 and is then removed. A beeper requires 1 <= frames <= frames_remaining. A short acknowledgement advances only the head offset; an exact remaining acknowledgement removes the head. An empty queue reports EMPTY; a cursor from a prior offset, another acknowledgement, reset, or consumer session reports STALE. Removing a complete head advances H_before_logical_head and then pumps one or more pending-job packets into newly available capacity. The acknowledgement plus pump is atomic: an internal validation failure rolls back the entire operation.

render_pcm_s16le validates a current cursor and renders only a beeper selected for USIM-SDL3-SINE-330D8248-CANONICAL-v1. It uses a fixed signed 32-phase table and integer phase accumulation at 8 kHz; it neither calls sin nor links host libm. The result is deterministic clean-room PCM, not bit-identical SDL3 output, CADR analog behavior, or a host-device observation. It never acknowledges frames. NO-AUDIO, UART, a stale cursor, and an invalid renderer input report the documented failure without fabricating silent PCM.

CDRM11FIX1 fixed-table differential oracle

M11-T20 has an independent Python reference that constructs the canonical CDRAUD1 records, CDRAUDS1 snapshots, witness chain, and signed-16 bytes without loading the C model or a Wasm module. It compiles the actual cadr_audio_model.c twice (native O0 and O2) and imports the same synthetic states into newly created selected-M12 Wasm O0 and O2 instances. Each native and Wasm semantic result must be byte-identical to that reference; agreement between native and Wasm alone is insufficient.

The inner canonical payload is CDRM11FIX1. The outer CDRM11FIX2 result keeps semantic results separate from provenance: it records the complete selected-M12 source/header closure, Makefile and build-script hashes, native executable identities, freshly forced O0/O2 Wasm sizes and hashes, and Guix/clang/wasm-ld build identities. Both layers are compact canonical JSON with one trailing newline; duplicate keys, alternate whitespace, booleans in numeric fields, extra keys, and any non-exact fixture state are rejected.

The fixed table is the signed 32-phase Q0.15 sequence in cadr_audio_model.c. For half wavelength h, event-frame offset e, cursor offset c, and rendered index i, the normative clean-room reference is:

step = floor((1,000,000 * 2^32) / (2 * h * 8,000))
table-index = ((((e + c + i) mod 2^32) * (step mod 2^32)) mod 2^32) >> 27
sample[i] = sine32[table-index]

The product and phase are explicitly reduced modulo 2^32, matching the selected unsigned-C operation rather than host floating-point arithmetic. This fixture's short 500-microsecond / 1,058-microsecond case contains exactly nine signed-16 samples:

0, 23170, 32767, 23170, 0, -23170, -32767, -23170, 0

Their little-endian signed-16 SHA-256 is 8184a534d19b4bc250487a11cb896191d3d34837af8c91cd3536af9e9c1d06cb. A separate 1,025-frame job uses a 499-microsecond half wavelength, partially acknowledges 200 frames, and serializes the resulting 825-frame CDRAUDS1 state as a transport pause, destroys the source native model, adopts that snapshot into a fresh native model before resuming, and does the corresponding fresh-instance Wasm adoption. The exact long-packet hashes are: frames 0..511, 295b2a187b03b4cd96cbbf3f46e189f20e6b0453d4df67bd3b3f10a200ed88dd; the partial frames 200..511, 5468d03d776da739f624a63ce3a85dc8a0d6c1f01838cacf6bda5a51a6f05563; frames 512..1023, 18057f330bac60216ca485aa36eabeaf1343bfa22b55bfe1875eddd895734f38; and frame 1024, 8f96c15501bef61baf5bd943201979595736b66b6a7e3b35c353729ab8d9a561. The reference obtains the 499-microsecond half wavelength and each event-frame offset by decoding the canonical CDRAUD1 event, and obtains the cursor offset from the selected render cursor. Its explicit mutant instead forces both offsets to zero for every resumed packet; every such mutant hash must diverge, preventing a fixed-zero-offset implementation from ratcheting these results. The final adopted state is exactly the empty queue with head and next sequence 3, zero queued frames, and both witness values equal to the established final witness. “Pause” here means that pointer-free transfer boundary; it does not claim an historical CADR audio pause command.

This is TEST-M11-FIXED evidence for the clean-room fixed-table renderer and the selected Wasm transport. It is not evidence that SDL3's floating-point oscillator, an audio device, the CADR beeper, or a listener's audible output has those hashes. The public SDL3 implementation carries oscillator phase across repeated jobs, while the clean-room table starts from each event's encoded frame offset; identical jobs can therefore have different SDL3 hashes without falsifying this fixture.

CDRAUD1 event-queue transfer

CDRAUD1 is a proposed Phase 1 transport record, not an existing shared-core serializer. It carries the logical queue from head to tail; it does not expose a C ring-array layout.

Exactly queue_packet_count 64-byte canonical events follow at byte 168, in logical head-to-tail order. The three authority values appear because this is a live transfer record, not snapshot semantic state. Native address-token/incarnation capability is intentionally absent. A receiver MUST compare the values with its trusted transport authority and bind any resulting native cursor to that exact local authority lifetime; it MUST NOT treat equal numeric IDs as object identity or overwrite retained authority from an untrusted or replayed record. It also rejects another version, a nonzero reserved value, an unknown flag, a zero identity/epoch, unequal accepted-high-water and next_sequence, an inconsistent head/next/count relationship, an invalid event, a sequence/order/head-witness/final-witness mismatch, or a total/count mismatch.

CDRAUDS1 semantic-state sidecar

CDRAUDS1 is the implemented pointer-free semantic queue sidecar. It is distinct from CDRAUD1 live transport and is not a CDRSNAP1 chunk. The first 16 bytes are the magic "CDRAUDS1", version:u32le = 1, and total_bytes:u32le. The remaining 172-byte header, followed by logical head-to-tail canonical events, is:

No cursor, authority identity, native address, or consumer-epoch capability appears in this payload. Import accepts only an empty live destination, validates the whole record before publication, retains a fresh local authority, and starts a fresh consumer epoch; all pre-import cursors are stale. The generic core CDRSNAP1 path does not include this sidecar and restores a fresh empty M11 model. A caller that needs audio continuation MUST save and restore CDRAUDS1 separately and MUST NOT claim that a generic snapshot carried its pending continuation or acknowledgement state. In the M12 direct-Wasm profile, CDRM12S1 composes an unchanged CDRSNAP1 followed by CDRAUDS1 and CDRM12C1; it stages the audio adoption before publishing the replacement machine. Bare CDRSNAP1 still restores an empty audio model, and lower profiles remain byte-for-byte unchanged.

System 303 runtime beeper observation

Runtime observation, 2026-07-30: the isolated Xvfb harness booted a fresh System 303 session, visibly reached Lisp Listener 1, evaluated exactly (SI:%BEEP 500. 100000.), and returned NIL.

The image is the reviewed exact 768-by-963 runtime framebuffer. It establishes the invoked form, Listener return, and surrounding System 303 context; it does not depict or redistribute the sound samples. Its portable provenance and capture-specific fair-use conclusion are in the curated screenshot catalog.

The native witness contains 399 strict alternating records: one header, 199 beep-job records, and 199 corresponding pcm-block records. Every job precedes its PCM block, uses a 500-microsecond half wavelength and 1,000-microsecond wavelength, and reports a 1,058-microsecond per-call duration. Every PCM block contains 9 frames, 18 bytes, at 8,000 Hz. The complete stopped witness is 71,375 bytes with SHA-256 017d26bc3fa0b86cb0e477a2a6def04d71363f70298bf48ef9a6e39b0fed4b25. The trigger ledger's earlier 27,218-byte observation-time prefix has SHA-256 daba28043df2454bb8518ed5dd580644eeccc55a3938584051bbe3518e89d61f; a prefix rehash against the complete stream matched exactly. The distinction matters because the guest continued repeated beeper calls after the first complete pair until the form returned.

The session used System check-in 4df393c68d7f083ce42d5c377039d26043cc18a9031ace28258dc97f4137eb91, load band System 303-0, and identical start/execution usim SHA-256 8b181ceb3207c8356659ffccf52ead64bebf659820a0022a73b1f236cbe3dcea. The prepared executable and runtime configuration SHA-256 values were 8b181ceb3207c8356659ffccf52ead64bebf659820a0022a73b1f236cbe3dcea and c7572f6354263598af7949cd1e95d5fa905f6e45c55da8995bc02bc74b479faf; authenticated Xvfb had MIT-SHM disabled and live-verified absent. Shutdown was clean (forced_stop=false, state_may_be_incomplete=false, both processes exit 0), no children remained, and public and private base-disk SHA-256 stayed bb16e46ad81decfe1efe691d36b6aa4ce3fd4ffb82474365de3520989d397cb5.

This closes the selected System 303 %BEEP trigger and native ordering portion of C-M11-06-ORACLE. It does not yet establish Votrax bytes, System 46 loaded behavior, browser AudioWorklet equivalence, or full C-M11.

The M11-T21 report verifier enumerates exactly 41 consumed wrapper paths. Its named physicalDeviceAudible mutation is injected in both staged and resumed wrappers, so neither receipt can acquire a physical-audibility claim by an unknown nested field. Terminal evidence is separately an exact decision matrix: immediate late allocation has resolve and reject leaves, while before-module, after-module, and after-node have their own still-pending never-settling leaves. The verifier removes and replaces each individual terminal field, then changes its value, so a branch cannot silently omit the close, second-disconnect, or terminal-state result.

M11-T21 correction, 2026-08-11: terminal worker loss is not ordered behind a never-settling candidate start, core open, or core acknowledgement. It immediately revokes boundary ownership, releases every browser candidate that can be disconnected, settles live receipt waiters stale, and fixes terminal DEVICE_LOST. Its sole core hook is the synchronous request-free terminalRelease tombstone, which is permitted to overlap an unsettled nonterminal request precisely because it does not mutate or call the non-reentrant core. Late settlements are fenced; a late valid open is observed after open returns and only tombstones its retired private epoch. A late candidate allocation is disconnected on both resolve and reject. A malformed prepared candidate is disconnected when possible. A valid private open followed by a reducer or frozen port-handler installation failure aborts that reducer epoch and releases candidate and core before a retry. During indefinite successful playback, the boundary retains at most eight staged and eight committed already-settled receipt objects. Receipt identity is exact closed-key data before it is keyed: generation, epoch, and sequence are positive/ranged primitive BigInt values as applicable, and frame offset is a safe u32 integer. Eviction does not relax duplicate or ordering checks because those remain authoritatively bound to live posted records and reducer state. The v3 evidence report records and the independent verifier recomputes the exact base tree, untracked count, and worktree/index equality from the replayed stage; it also binds the externally selected Chromium launcher, the launcher-discovered and live-observed Chromium payload, the policy flags, and the Playwright sync-API module identity. These provenance fields identify a browser evidence run; they do not establish guest-generated PCM, physical audibility or output, Votrax, System 46, or full C-M11 closure.

Selected-Wasm browser pause/resume observation

Local runtime observation, 2026-08-11: Chromium 151.0.7922.108 loaded the freshly built 218,989-byte selected ABI1.11 O2 Wasm with SHA-256 0768c02a0be066cd71ded1882e00e0cdae64e4d1a7197bf89a23801190722c76. The independent fixed-table oracle supplied its 380-byte multi-packet-partial-ack-pause CDRAUDS1 snapshot, SHA-256 020f91f0d950016d7cd9a159644d8db0f83c0730377b1f457ceb7db98ccea30d. No licensed artifact or private runtime entered this campaign.

The campaign reconstructs an isolated tree from the verified signed base and the sealed proposed patch, requires the reproduced Git tree and index/worktree bytes to match, and forcibly rebuilds the selected Wasm there. Its canonical report inventories the transitive source closure, build tools, the 14,424-byte externally selected Chromium launcher (SHA-256 a21701bae5daa6d9256cec064cc90de6f135f6447abc4cc8c6769ca6d5224100), the 320,265,304-byte live-observed Chromium payload executable (SHA-256 5feed0a15033c4230d070cd042800d9aa44b94ada7dc98aec7c7a7b437c5391b), exact network-policy flags, and Playwright 1.62.0 sync-API module identity, every served response, the exact loopback request multiset, CDP-observed HTTP traffic, and cleanup. A separate verifier repeats patch application, source hashing, the forced build, fixture generation, and semantic checks. It independently regenerates the initial and post-512-frame-ack CDRAUDS1 bytes, PCM and 88-byte cursor hashes, head/next/count deltas, and the exact delivery-to-staging-to-commit binding. Its Chromium executable is a required external CLI selection rather than a pathname accepted from the report, and in-memory mutants of those semantic fields and browser identity must reject. This avoids treating a timestamp-reused Wasm or a report-authored identity string as authority.

The selected playback and production runtime import one shipped browser-candidate factory. Terminal worker loss immediately fixes boundary DEVICE_LOST and performs its first candidate-disconnect pass even while start is deferred. For an in-flight start, disconnect records one close request and arms a bounded deadline that starts the one context close even if an AudioWorklet module load or hook never settles. The start finally cancels that deadline and idempotently rechecks the close; every close rejection is consumed. When the deferred start later settles, the boundary performs its second disconnect, which disconnects a node published after the first pass. Real Chromium observations cover both late resolve/reject and all three never-settling hook locations, record one close call and a closed context, and retain exact empty pageErrors and unhandledRejections arrays. The portable document names launcher and payload roles only; exact host paths remain sealed evidence rather than publication claims.

The first user-activated AudioContext loaded the real Worklet but was deliberately suspended. The Worklet returned a staging receipt only after its queue owned generation 1, sequence 0, offset 0, 512 frames, with PCM SHA-256 295b2a187b03b4cd96cbbf3f46e189f20e6b0453d4df67bd3b3f10a200ed88dd. Pause disconnected that consumer with zero render acknowledgements: the before/pause snapshots were byte-identical, retaining three packets and 1,025 frames. Resume created a fresh consumer epoch, redelivered the same semantic cursor and PCM, and the running Worklet produced exactly one render acknowledgement. An explicit committed receipt resolved only after the selected core accepted that acknowledgement, the private source removed its retained record, and the boundary adopted the returned counts. The final selected-core state had head sequence 1, two packets, and 513 frames, with snapshot SHA-256 1fa5e9b62c5e7fc670046834f46bb470a529edcb4513bcdec743f23475c0ae74. Canonical reports and their verifier outputs remain ignored under build/cadr-m11/; their exact hashes belong to the campaign handoff because embedding a patch-bound report hash in the patch itself would be self-referential.

This proves browser consumption and selected-core cursor continuity for that synthetic packet. It does not show that a CADR guest generated the packet, that a person or physical device produced audible output, or that the browser waveform matches CADR hardware, SDL3, Votrax, or the preserved %BEEP session. Those remain HOLDs.

The reviewed Listener screenshot above is appropriate only for the now-completed runtime invocation claim; the queue and waveform claims remain hash/record evidence. Any future CADR runtime observation must use the repository's computer-use harness and retain the session, artifact identities, ordered input, hashes, and termination status under the documented policy. Raw sound captures, voice data, and unreviewed browser recordings remain out of the tracked documentation.