CADR-WEB-303 browser hardening and accessibility reimplementation specification

Tracked foundation status (2026-07-30)

The repository now contains a deliberately separate protocol-v8 shell foundation: cadr-m13-shell.mjs, its focused admission/isolation test, and a build-local CSP/offline policy harness generated by build-cadr-m13-provisional.mjs. The shell descriptor-scans and canonicalizes source-side messages without invoking getters, rejects symbols/inherited/unknown fields, copies admitted buffers, accounts M13META1 metadata, fences v8 session/ID state, and gives the worker a private v8 ABI1.11 adapter envelope rather than a caller object or a storage capability. Its named M10 boundary is an authority-minimising adapter, not a new durable-store claim.

The current source and Chromium probes exercise bounded portions of M13-F01, M13-F02, M13-F04, M13-F05a, M13-F06/F07, M13-F08--M13-F13, and M13-F15/F15b.

cadr-m13-production-app.mjs now adds the deliberately narrow P1 composition layer. It is a source/synthetic coordinator above exactly one existing CadrM13Shell, exactly one injected dedicated worker, and the caller-supplied existing M10 controller. Its reducer accepts only UNCONFIGURED -> RECEIPT_ACCEPTED -> INPUTS_SELECTED -> BOOTSTRAPPING -> BASE_IMPORTING -> MEDIA_MOUNTED -> M10_CLEAN -> PAUSED -> RUNNING, with the ordinary RUNNING <-> PAUSED loop and STOPPED; FAILED, IN_DOUBT, and RECOVERY_REQUIRED are absorbing fences. The coordinator serializes the one public v8 request-ID sequence and does not construct the old v6/v7 browser channel, a storage backend, a second worker, or a replacement shell. Its inert HTML page states only that no machine or media is configured. Synthetic tests cover the reducer, one-worker/one-ID ownership, exact request-field admission, startup neutral-readiness ordering, release and layout cancellation, partial-construction cleanup, stop ordering, failure classification, stale replies, resume single-flight, honest pending-mount state, every absorbing public-API fence, and a recursive transitive no-network/module-closure scan. This is not selected-media runtime, export/restore, browser, accessibility, offline, C-M13, or M14 evidence.

E31 is the browser-specific complement to that P1 source result. On the signed M12 parent ba8d490c186afb8cdc5905923a60611772256b73, a disposable Chromium 151.0.7922.108 campaign serves one public synthetic Wasm module, constructs one real module Worker and one current P1/shell pair, and exercises an identity-only 258-range base stream, supplied-controller CLEAN transition, pause/resume, stop during delayed start, and Worker-loss fencing. CDP and page observers admit only the local source/module/fixture closure and observe no WebSocket; the test also checks page, browser, server-thread, and fixture cleanup. It does not load M12 P2 debugger code, selected media/runtime, an M10 adapter, or IndexedDB. It is therefore browser behavior for the current P1 seam, not a selected-runtime or C-M13 result.

E32 is a separate, narrow M13-to-M10 review-adapter result. The adapter takes a synchronous, descriptor-only deep byte copy of the four-part disk binding before the controller's first await; neither a caller's later typed-array mutation nor a getter/prototype can select a different durable namespace. It constructs the current M10 controller from only that private copy, claims the one branded review authority, and produces a cursor only after the current M10 generic overlay archive's source generation and root match the opaque pinned review closure. It returns no disk handle, root-reference identifier, storage key, raw binding bytes, or replayable authority.

The adapter state model is NEW -> OPENING -> OPEN -> ACQUIRING -> REVIEWING, with RELEASING -> OPEN only after branded M10 lease release succeeds. A rejected acquire that returned no lease is ambiguous: it can be pre-pin loss or a successful post-pin rollback, both of which restore M10's authority to ACTIVE; only a synchronous failure of the same authority's revoke() proves M10 retained its opaque post-pin RECOVERY_REQUIRED record. The adapter therefore attempts revoke first. A successful revoke closes and terminates FAILED or INVALIDATED; a rejected revoke enters opaque RECOVERY_REQUIRED. retryAcquisitionCleanup then must call that same authority's acquire, retain the returned temporary lease, release it, synchronously revoke, and close; any failed cleanup step is UNKNOWN with that method as its only retry route. It never returns OPEN or DISPOSED. An ambiguous completion similarly fences a cursor immediately. retryInvalidatedCleanup handles both an active lease and lease-free replacement failure by obtaining a fresh replacement, then releasing if needed, synchronously revoking, and closing. It publishes one private cleanup flight before its first M10 call: concurrent callers receive that exact Promise/result (or exact failure), and only a later explicit call may advance a retained failed step. A chunk copies and hashes bytes before it checks its epoch/identity and commits nextOffset. Ordinary lease-release loss remains UNKNOWN and retryOpaqueRelease retries only that branded release.

The real Chromium E32 probe uses a disposable actual C-M10-IDB-v1 database with a synthetic base (no selected media, CADR worker, or preserved runtime). It mutates all caller-owned binding arrays while readBaseIdentity is gated and confirms that the original copied binding alone names the IndexedDB metadata. It then observes one real snapshot reference during review, gates a chunk digest, invalidates the review, and verifies zero references, cursor offset zero, exactly one replacement, rejected stale chunk, and rejected reopen before releasing the digest gate. It separately proves a retained pre-operation post-pin rollback loss (one real ref until the second explicit cleanup completes), and real-IDB post-commit loss: reopening purges the old session's snapshot ref, but the authority remains recoverable through its issued-ID idempotence, temporary lease release, and exactly one revoke. Both ordinary pre-operation and post-commit lease-release loss are tested. It also injects successful post-pin rollback and invalidation before pinRoot, proving revoke-first terminal classification without a recovery record. Concurrent successful replacement cleanup joins one Promise/result, replacement, revoke, and close; concurrent replacement failure joins one error and a later explicit retry alone completes. A lease-free replacement failure remains UNKNOWN until a fresh replacement, synchronous revoke, and close complete. CDP sees only the self-hosted source closure and no WebSocket. This proves neither the M13 pinned-object export-record protocol nor restore adoption, paused/reset worker restore, selected-media persistence, a guest-generated changed write, or C-M13.

The ABI1.11 source now also contains the exact CDRM11O1 and CDRPCM1 validators, an eight-record M13 Worklet queue, and a private worker-owned frame-authority adapter that calls the actual ABI1.11 open export and performs a 64-packet-bounded pump after open and acknowledgement, the reducer-driven deadline/device/pause coordinator, and optional public-shell dispatch. Audio remains disabled unless an authority is injected, and context preparation is a separate synchronous method that a direct user-activation handler must call before asynchronous public request validation. Synthetic tests cover autoplay refusal before core open, core-issued fresh epochs, exact worker ownership against the actual empty O0 Wasm core, partial and stale acknowledgements, zero-frame UART, high water, pause/resume, timeout, processor/context/device loss, and worker-loss teardown. A current Chromium 150 probe now composes the selected ABI1.11 O2 Wasm, actual worker, public shell, a real 48 kHz AudioContext, and the real AudioWorklet. Direct click activation opens epoch 2 and pause/resume opens epoch 3. The selected core is empty: its queue remains zero, no preserved guest executes, and the 512/88-frame records are explicitly synthetic downstream fixtures. The 512-frame fixture runs alone in epoch 3; its Worklet reply reaches the actual worker, is rejected stale (status 3), and completes device-loss fencing. A new direct-click resume then opens epoch 4 before the 88-frame fixture repeats that exact stale-ack/loss sequence. Both records therefore have one deterministic acknowledgement and loss, with no core packet acknowledged. This is composed browser boundary evidence, not selected System 303 playback or guest-generated %BEEP; C-M11 and C-M13 remain open. Those earlier probes include a real browser Worker boundary, the exact provisional CSP attack matrix, a keyboard route through every provisional host control, a narrow real AudioContext/AudioWorklet component probe, and deterministic named-parser and ledger campaigns. The current local F03 report passes ASan+UBSan and allocation-failure injection over a selected native ABI1.10 parser/state-machine slice; its clang -E active-profile source closure, exact 13 selected allocation sites, compiler, dirty-worktree identity, and explicit browser/M10/Wasm exclusions are recorded in the M13 checklist. It is current evidence for that identified local tree, not a clean-release result. The AudioWorklet component probe additionally observes rejection of a second full 8,192-frame packet by the real M11 Worklet queue; that is a queue-boundary fact, not evidence that a M13 core has supplied or acknowledged those diagnostic PCM records. The separate disposable-browser F05b probe observes a fixed-Wasm-capacity refusal and a host-watchdog-ended V8 heap stress while proving isolated input hashes unchanged. It deliberately does not reinterpret either result as injected NO_MEMORY, browser loss, durable-store behavior, or a composed M13 workflow. The focused selected-Wasm probe now additionally compiles the current ABI1.11 O2 module through the v8 shell, structured-clones it to the real v8 module Worker, and observes module instantiation plus a nonterminal NOT_READY cold-power result. It also proves that an absent M10 boundary rejects the selected base-import request without requesting base media. This is a normal composition seam only: it neither boots a machine nor supplies a durable store, host completion bridge, audio device, or release artifact policy. The separate F06/F07 disposable-browser probe loads the real M10 IndexedDB backend, controller, and M4 worker-host bridge while recording the selected M12 Wasm as an independent state witness. Its M10 bridge uses an exact synthetic M4 request; the runner does not load the M13 shell or its composite dispatch. Across four injected durable/host failure cases, verified receipts preserve the selected base identity and byte-identical M12 checkpoints, distinguish pre-guest CLEAN recovery from post-acceptance IN_DOUBT fencing plus one replacement, and include a foreign binding rejection. This is lower-layer evidence rather than M13 storage or recovery completion; its exact report and limits are recorded in the M13 checklist. The shared M13 shell now exposes the corresponding narrow dispatch seam when a caller supplies an actual M10 controller and bridge factory: a lower status-8 wait alone may issue the shell-owned host-next-request followed by exactly one copied host-complete. A Chromium probe drives one synthetic exact M4 write through that seam into real IndexedDB and observes durable readback. Its post-completion fault case puts the controller in IN_DOUBT and makes the v8 shell return terminal status 7 while terminating its worker. This establishes dispatcher ordering and fencing, not selected-Wasm behavior, exact-base media, import/reopen/export/restore coverage, or a full M13 workflow. The shell now has a tracked public v8 base-media-mount transition. It accepts only the exact importId that this shell observed a successful selected base-import-finish for; it also requires that the base binding and import service are the same storage boundary, a successful v8 bootstrap, configured selected boot artifacts, an exact factory-supplied selected-Wasm SHA-256 authority, and an M10 controller. The transition copies the four small artifacts and the 269,562,880-byte base through the existing v7 verifier, retains a SHA-256 witness for every canonical 1 MiB range, and returns v8 WORKER_LOST (24, terminal) if any lower mutation or subsequent local adoption fails. M10 base reads remain conditional on re-reading and matching the complete containing range.

E27 now exercises that public sequence in Chromium 150 with the current selected M12 O2 module and exact local base/artifacts. It observes all 258 public import chunks, public mount, clean public M10 reopen, selected cold/boot/start, and the real guest's first block-1 request after 252 bounded slices. That request is base-identical and therefore durable:true,changed:false; a second public reopen reads the same base bytes. A separate, explicitly synthetic post-mount controller write changes block 1 and survives immediate read plus two public reopens. After host completion the worker remains RUNNING; E27 never pauses or resets it. The harness also sends the public export/restore operation names to an explicitly test-only adapter that streams and parses one real synthetic CDRM10W1 archive. That proves closed v8 dispatch plus the existing wrapper serializer/parser roundtrip only. The adapter does not emit normative pinned-object export records, does not adopt the archive, and does not perform composite paused/reset restore. E27 therefore proves the selected binding and narrow synthetic changed-overlay read/reopen behavior, not a guest-generated changed write, normative export/restore, full failure/power-loss algebra, accessibility, audio, or final C-M13 conformance.

The deterministic source-admission corpus uses seed 0x6d313346 and 4,096 bounded candidates across the v8 envelope, code-length/surrogate, ID/session/version, inspector, breakpoint, scheduler, unknown-operation, and extra-field cases. Every one of the current 1,636 admitted candidates is independently post-clone checked and M13META1-encoded; 2,460 candidates are rejected. It is useful partial M13-F01 evidence, not the complete required selected-Wasm/M10 workflow or sanitizer campaign. The companion named-parser corpus uses the same fixed seed for 780 bounded hostile cases across currently exported M6--M13 parser/validator ingress and reaches M4 diagnostic parsing through its public serializer; it does not make private M10/M6 paths or partial-adoption semantics complete. A separate browser-task reducer/AudioWorklet probe is similarly component evidence, not v8 shell integration. The authoritative case-by-case status is the M13 conformance campaign checklist.

Run the tracked foundation checks with:

node tests/test_cadr_m13_shell.mjs
node tests/test_cadr_m13_admission_fuzz.mjs
node tests/test_cadr_m13_artifact.mjs
python3 tests/test_cadr_m12_debugger_browser.py
python3 tests/test_cadr_m13_provisional_browser.py
python3 tests/test_cadr_m13_worker_browser.py
node tests/test_cadr_m13_admission_ledger.mjs
node tests/test_cadr_m13_named_parser_corpus.mjs
node tests/test_cadr_m13_lifecycle.mjs
python3 tests/test_cadr_m13_audio_browser.py
python3 tests/test_cadr_m13_selected_audio_runtime.py
python3 tests/test_cadr_m13_production_browser.py
python3 tests/test_cadr_m13_m10_review_adapter_browser.py

The compatibility boundary is the modern host shell and its exact selected lower-milestone profiles. It excludes historical CADR hardware security behavior, unselected browser versions, M15 networking, and any unperformed runtime gate. ABI1.10 names the frozen cumulative M12 Wasm/core contract, including the browser-safe scalar inspector export. The opt-in M13 build is ABI1.11: it retains the ABI1.10 exports and adds exactly cadr_wasm_m13_audio_open, whose 48-byte CDRM11O1 result is specified below. Protocol v8 is the only shell-to-worker profile that selects that export. ABI1.10 and protocol v7 remain independently buildable and do not acquire it.

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as normative requirements for the selected reimplementation profile.

Protected assets

• immutable public emulator code and public source identities;
• the user-selected base disk bytes;
• private overlay pages, saved snapshots, and exports;
• the browser origin’s unrelated storage;
• the user’s local files and clipboard;
• the surrounding page, browser process, and local network;
• accurate saved-versus-volatile status;
• availability of a bounded stop or restart path.

Hostile or malformed inputs

• every worker message, including unexpected prototypes, accessors, symbols, transfer-list detachment, duplicate identifiers, and unknown keys;
• disk, snapshot, overlay, manifest, configuration, provenance, and diagnostic files with arbitrary bytes and adversarial lengths;
• filenames, MIME labels, drag-and-drop metadata, and browser file handles;
• storage records modified between asynchronous operations;
• quota exhaustion, allocation failure, transaction abort, worker termination, and browser reload at every persistence seam;
• keyboard, pointer, focus, visibility, fullscreen, resize, and device-pixel-ratio events in any order;
• a compromised or accidentally network-capable hosting environment.

Out of scope

M13 does not claim resistance to a compromised browser engine, operating system, or same-origin script that is authorized to execute in the application origin. The release therefore minimizes same-origin code and third-party dependencies; it does not pretend that CSP is an operating-system sandbox.

P1 production-composition ownership and lifecycle

P1 is an inferred host composition policy. It reuses the public v8 shell rather than duplicating its message grammar, M10 bridge, M11 audio boundary, or M8/M9 ingress channel. The P1 receipt schema is cadr-m13-production-p1-receipt-v1; it accepts only this page's exact profile and disposition:"source-only". It is not an M14 receipt and carries no release, selected-media, or provenance authority.

One CadrM13ProductionApp owns the ordered public request queue and allocates every public v8 ID once, beginning at one. The shell remains the sole lower-worker boundary and may make its own private, validated lower requests. P1 must never attach createCadrM8M9WorkerChannel, post a raw v6/v7 request, create a second worker, replace a worker, construct an M10 backend, or expose a generic request method. Its only guest ingress method is the existing shell through the following closed M8/M9 operation names: keyboard down/up/focus-lost/drain/state and pointer motion/down/up/neutralize/warp/state/drain.

P1 freezes an explicit field allowlist for every operation it can issue. The operation name is a separate coordinator argument; operation fields cannot contain type, version, sessionId, id, op, or any other field outside that operation's schema. Admission rejects arrays, inherited prototypes, accessors without invoking them, symbol keys, and extra fields before selection state, FIFO insertion, or request-ID allocation changes. The copied operation fields are placed into the request first and the immutable coordinator-owned v8 authority fields are written last. Thus, for example, keyboard fields cannot replace their operation with reset, debugger, audio, base-import, or M10 work. The shell still performs the normative scalar, byte, and lower-protocol semantic validation after this composition-specific authority check.

The source-only selected-input recipe is exact and ordered: admitted Wasm byte/hash pair; base-import-begin, zero or more base-import-chunk, and base-import-finish; base-media-mount; and m10-reopen. Completion of base import leaves the reducer in BASE_IMPORTING while the public mount request is pending; only its successful response permits MEDIA_MOUNTED. It then requires the caller-owned M10 controller to report exactly CLEAN, open:true, readOnly:false before cold power-on, boot, visible handshake, and pause. The result is not exposed as PAUSED until the shell's explicit awaitInputNeutralization() seam confirms the current release generation. This is still not a boot/runtime claim. A resume calls the shell's existing restore gate: it requires a fresh full frame, clean M10 status, and that same neutral-input acknowledgement. P1 keeps its input gate closed until the subsequent machine-start succeeds for the same coordinator generation.

Resume is one coordinator single-flight. Duplicate calls made while PAUSED, including a call reentrant from the shell restore callback, receive the same promise and cannot issue a second full-frame restore or machine-start. The shell independently applies the same single-flight rule to its real restoreInputIngress() operation.

Layout change, visible Release Input, and ordinary pause first synchronously close the P1 gate, detach its supplied ingress owner, and invoke the shell's existing release fence; only then can the queued machine pause run. The transition from RUNNING to PAUSED waits for both the current neutral acknowledgement and the lower machine-pause reply. A request or reply made stale by that intentional generation advance is a harmless cancellation; it cannot fail-stop the new paused generation or re-arm input.

Stop first applies the same ingress fence, then synchronously pauses/fences supplied audio, debugger, and storage handles. The app retains direct ownership of an immediate, exactly-once worker disposer; shell disposal can detach its listeners without terminating that worker a second time. A worker returned before a shell factory throws, returns an incompatible object, or reentrantly stops the app is therefore terminated once. A stop or failure advances the coordinator generation, and a queued or late reply cannot start a machine or re-arm input. An invalid selected-input recipe is rejected before selection state changes. Any unexpected reducer event, bad receipt, nonzero reply, or missing clean M10 state fail-closes; an M10 recovery status becomes RECOVERY_REQUIRED and an ambiguous host failure becomes IN_DOUBT. Every transition into a reducer-produced terminal state immediately uses the same synchronous cleanup path. FAILED, IN_DOUBT, and RECOVERY_REQUIRED then absorb every reducer event and every public app method without another ID, request, state object, resource action, or worker termination.

Terminal P2 authority cleanup is a separate, observable continuation of that synchronous fence. P1 starts it without awaiting an untrusted worker/shell path and records either REVOKED, WORKER_TERMINATION_PENDING, non-retryable EXTERNAL_RECOVERY_REQUIRED, or a named retryable invalidation, M10 lease-release, recovery-acquire, recovery-release, or revocation state. The exact externally owned Worker is required to implement terminate(). One single-use shell operation fences the shell, invokes that exact captured Worker's synchronous terminate() itself, and may publish WORKER_TERMINATED only after the call returns normally. Callers cannot separately mint or confirm a proof. A throw or missing operation dominates the aggregate terminal result as EXTERNAL_RECOVERY_REQUIRED, retains the M10 lease and pin, and does not advertise a user retry. Only the same captured transaction may monotonically upgrade UNKNOWN to WORKER_TERMINATED; delayed replies and stale transactions cannot perform that upgrade. For an active The shell returns the termination proof synchronously and carries the later transaction-disposition flight separately. A rejection of that later flight cannot undo proven termination or mask P2's retryable M10-release state. authority, M10 revoke() is required to return its receipt synchronously. If the current M10-v5 authority rejects that call because a post-pin acquisition rollback left it RECOVERY_REQUIRED, P2 may call only the same branded acquire(), release the returned opaque lease, and retry revoke(). It retains the original failure object and the private authority/lease for retryTerminalCleanup(); it neither silently converts the rejected flight to success nor exposes a disk handle, pin ID, or replacement authority. This source/synthetic state machine is not a browser runtime, selected-media, durable-store, or release claim.

The shell constructor's default workerOwnership:"shell" preserves standalone worker-loss behavior. P1 supplies workerOwnership:"external" together with a closed loss callback that reports the original worker-error, worker-messageerror, or protocol cause and status. In this mode the shell fences ingress, rejects its lower pending requests, and reports loss but never terminates; P1 fences ingress and every optional handle before its one direct termination. Shell-local base-import, mount, and M10-reopen dispatch races a private terminal-loss signal, so a worker event settles even when the injected storage method remains pending.

Every public submit captures the current shell loss generation before canonicalization. Canonicalization, request-body hashing, Wasm compilation, audio preparation, shell-local storage calls, M10 service, and each selected mount preparation await race the same terminal-loss signal and recheck that generation after settlement. Internal request-ID allocation is generation guarded. #postLower independently checks immediately before pending registration and again immediately before postMessage, and its eventual response races terminal loss as well. Consequently an asynchronous continuation released after worker loss or coordinator disposal cannot allocate another lower ID, mutate shell adoption state, or post instantiate/worker work. Stop or invalid Release Input may first issue the already-specified synchronous best-effort neutralization; no delayed operation posts after the ensuing terminal cleanup. The serialized audio-event tail attaches its rejection consumer in the same worker-message task. A pending audio acceptance invalidated by error or messageerror consumes the already-recorded generation-fence rejection; only a handler failure while the shell is still live can select malformed-audio-event. Thus the original worker-loss cause remains authoritative and the abandoned tail cannot surface as an unhandled rejection or trigger a second termination.

Worker disappearance is a volatile startup failure (FAILED) before M10_CLEAN, including during instantiate, base import, mount, and M10 reopen. A clean running controller also yields FAILED; IN_DOUBT is used only when the existing M10 controller itself reports IN_DOUBT, while a post-clean controller report of RECOVERY_REQUIRED retains that distinct fence. Status 7 alone is not evidence that durable state advanced.

P1 leaves the E27 test adapter test-only. It neither promotes that adapter nor claims a real selected-media mount, changed guest write, durable reopen, pinned export, paused/reset restore, browser activity, no-network closure, or release.

Source-side canonicalization and post-clone boundary

The shell is the source-side trust boundary. Before postMessage, it MUST inspect an external candidate's own property descriptors without evaluating a property lookup; reject an accessor, symbol key, inherited field, unknown key, unapproved composite value, or out-of-range scalar; copy approved bytes; and construct a fresh null-prototype record containing only the exact v8 fields. After confirming that a descriptor is a data descriptor, validation reads only descriptor.value; it never executes a caller getter. It binds every byte field's declared length and SHA-256 before handoff. It never posts a caller object directly.

M13META1 is the deterministic metadata-accounting encoding; JSON, structuredClone, engine object size, and JSON.stringify are not accounting oracles. A record is u32 field count followed by fields in the operation table's order. A field is u16 ASCII key length, the key bytes, a u8 type tag, then: one byte for boolean; four little-endian bytes for u32; eight little-endian bytes for u64 BigInt; zero bytes for null; u32 byte length plus scalar-valid UTF-8 for a string; u32 element count followed by recursively encoded elements for an array; or a recursively encoded record. An ArrayBuffer contributes a fixed 40 metadata bytes—u64 body length plus its 32-byte SHA-256—while its contents are charged to the applicable body/stream cell. There is no variable-length BigInt encoding. Checked addition includes every count, key, tag, length, and payload byte.

Before UTF-8 encoding, recursive canonicalization, byte copying, allocation, or clone, the descriptor walk enforces all of these limits: at most 32 own keys in a record; at most 16 nested record/array levels; at most 256 array elements; fixed schema keys of at most 64 ASCII bytes; at most 4,096 UTF-16 code units and 4,096 encoded UTF-8 bytes in an ordinary string; the narrower exact field limits in the operation table; at most 65,536 M13META1 bytes for one pending request; and the 4 MiB aggregate metadata reservation. It first rejects an over-limit array length, key count/name, or string code-unit count using descriptor metadata and arithmetic only; it then rejects an unpaired surrogate and counts UTF-8 bytes without allocating the encoding. Unknown keys are rejected before their values are traversed. Buffer byteLength and the operation's body limit are checked before copying or hashing.

For M8, code is ASCII with an exact M13 limit of 1..64 bytes. The selected CADR_M8_PHYSICAL_KEYS members have a maximum encoded length of 14 bytes (NumpadMultiply), but an unknown code within the 64-byte M13 bound still reaches M8 and retains M8's rejected result/reason shape. Only an empty, non-ASCII, or over-64-byte code is status 2 before lower-handler dispatch. op is selected from the closed table and is at most 64 ASCII bytes; sessionId, hex256, and uuid128 retain their exact fixed ASCII lengths.

Structured clone may normalize a null-prototype record and has already erased the sender's accessor/prototype history. Therefore the worker makes only a post-clone-observable claim: it checks its received record's own string keys, own data descriptors, permitted post-clone prototype, exact primitive/byte values, and closed field set before mutation or length-proportional allocation. It MUST NOT claim to detect or reject a source getter, symbol, or prototype that structured clone did not preserve. A source-side accessor test proves the former check; a worker test proves the latter, distinct check.

No request may include a host pathname, URL, storage key, function, MessagePort, SharedArrayBuffer, WebAssembly.Memory, WebAssembly.Module, or arbitrary transferable. Approved byte buffers are copied into the canonical record; only the fresh canonical buffer may be transferred, and its declared length and digest are bound before use.

Exact v8 operation, result, and status matrix

This is the complete M13 v8 application-controller surface. shell operations execute in the shell dispatcher and are never posted to the worker. worker operations are canonicalized and posted. composite operations execute the exact shell/worker sequence stated below. internal operations can be issued only by the dispatcher while servicing a correlated guest request; a caller-issued copy is status 2. Every listed ArrayBuffer is copied, length-bound, and hashed before admission.

Request ordering

The worker processes one mutating request at a time. Read-only requests may not overtake a queued mutation unless their lower-layer specification explicitly defines a stable pre-mutation snapshot. Pause, reset, restore, import, overlay commit, export, and debugger controls are serialized.

Worker crash

On error, unexpected messageerror, nonzero exit, protocol violation, or response timeout:

1. synchronously run the local DOM release sequence below and stop accepting input;
2. if the port is still live, send one pointer-neutralize request as a bounded best effort; wait at most 250 ms for its matching v8 response and never present its absence as a guest all-up;
3. reject every pending operation with WORKER_LOST, terminate, and discard the old worker regardless of that best-effort outcome;
4. mark the volatile machine state lost, never saved;
5. if a M10 commit was accepted but does not yet have a shell-owned reread receipt, enter IN_DOUBT rather than selecting either the old or proposed generation;
6. resolve IN_DOUBT only through the shell-owned M10 recovery procedure below; and
7. only after that procedure chooses one validated generation, offer a fresh worker/session from immutable base plus that generation.

The shell never reconnects a new worker to old request IDs, leases, cursors, or ArrayBuffers. A fresh 32-byte session ID fences delayed messages.

Input release and M10 IN_DOUBT resolution

The local release sequence is deliberately independent of worker health. In the same DOM event-dispatch task that observes crash, timeout, blur, explicit Release Input, or the host release chord, the shell MUST: set ingress admission false; unconditionally execute its DOM capture-release path (if there is a recorded pointer ID, call releasePointerCapture immediately; a missing capture or DOM exception is caught, then the shell capture-owner state is still cleared); remove every local pointer/keyboard listener that can deliver guest input; and focus the visible Release Input control. None of these local actions waits for a worker response, host button state, or neutralization result. They establish only DOM containment, not a fictitious guest all-up.

The current P0 shell exposes this DOM-dependent part through a constructor-injected releaseIngress callback. It is invoked synchronously after ingress admission is closed and before releaseInput returns; the callback's sole production role is to detach keyboard/pointer listeners and invalidate their geometry. It receives no worker, request-ID allocator, or guest-operation capability. The shell separately gates each public keyboard edge and physical pointer edge, so a stale listener that does run after the callback cannot admit a v8 guest request. Pointer-capture release, guest-surface blur, and visible-control focus remain shell-owned and synchronous. Every call to releaseInput, including one made while rearming is already pending, advances a monotonic release generation, repeats the idempotent release callback, invalidates any earlier neutral acknowledgement, and starts a generation-bound neutralization attempt when the worker remains live. A late acknowledgement from an older generation neither confirms nor fails the current generation.

Rearming is not a focus side effect. restoreInputIngress() remains closed until the current release generation's one bounded pointer-neutralize request receives status 0, the injected M10 controller presently reports exactly {state:"CLEAN",open:true,readOnly:false}, and a new private display-full response validates as a full CDRDISP1 frame. Only then may the optional synchronous restoreIngress callback reattach input listeners, and the shell reopens ingress. The shell remains the sole v8 public-ID coordinator throughout; the release, full-frame, and neutralization messages use its existing private lower sequence and never create an independent M8/M9 browser channel. restoreIngress is a trusted ownership hook with a strict synchronous contract: all listener attachment must finish before it returns, and it must not schedule attachment outside its returned control flow. Only one restore attempt may be in flight. Concurrent callers share its result and therefore emit one display-full request and invoke restoreIngress at most once. The attempt captures the release generation and checks it after the worker wait, before attachment, and after the synchronous hook; a newer release makes the old attempt terminally fail. Because a reentrant release may run before the callback continues attaching, the terminal path repeats releaseIngress after the callback has fully returned. If restoreIngress throws or returns a thenable after a partial attachment, the shell immediately closes semantic ingress, repeats the synchronous release fence, terminates the worker, rejects pending authority, and cannot retry. It never awaits the untrusted thenable, so a never-settling return cannot wedge the bounded stop. A retained fulfillment/rejection finalizer repeats releaseIngress if the thenable does settle, cleaning attachment performed within that returned chain. This eventual cleanup is defense in depth, not permission for asynchronous hooks: arbitrary side effects scheduled beyond settlement cannot be made atomic after the fact and violate the trusted hook contract. A failed or asynchronous releaseIngress likewise leaves admission failed and closed. Hook-failure status is not overwritten by a neutralization-pending announcement.

The exact keyboard release chord is an uncaptured, capture-phase keydown with event.code === "KeyR", ctrlKey, altKey, and shiftKey all true, metaKey false, and repeat false. The shell calls preventDefault() and stopImmediatePropagation(), runs the synchronous local release sequence before the event returns, and then begins the 250 ms best-effort pointer-neutralize transaction. The chord is documented beside the Release Input control and has the same effect as activating that control. An acknowledgement may establish M9's atomic pointer-up/M8-all-up tail; timeout, rejection, or a crash leaves the DOM released and makes the machine FAILED, never “neutral.”

IN_DOUBT is a shell persistence state, distinct from M10 DIRTY, SAVE_FAILED, CLEAN, and RECOVERY_REQUIRED. It begins as soon as the shell has admitted a commit without an independently reread head receipt; a worker loss at or after the guest/core-completion or head/activation seam is therefore never guessed clean. Before creating a restart generation, the shell MUST discard its old M10 session handles and reopen a fresh durable-store connection using the same verified immutable base/profile/artifact binding. It then calls the M10 reopenDisk recovery path and accepts only that path's reread and hash validation of head, activation, manifest, root, and map:

The shell never resolves IN_DOUBT from a cached generation number, a pre-crash promise, an old worker response, or an in-memory overlay object. Exported files remain separately identified completed exports; they cannot repair an unresolved overlay head.

Main-thread failure

Reload or tab termination has no opportunity to label pending work successful. Saved status is derived only from the last M10 durable receipt already reread and validated. Visibility changes may pause execution but are not persistence events.

Timeouts

Timeouts are host availability guards, not guest-time clocks. A timeout does not cancel a mutation by assumption. The shell terminates the worker unless the operation has a versioned cancellation handshake that reports an unchanged state.

M11 renderer and AudioWorklet boundary

M13 selects the M11 USIM-SDL3-SINE-330D8248-CANONICAL-v1 software-render target, not NO-AUDIO. The ABI1.11 renderer/Worklet transport now has one selected-Wasm Chromium composition probe, but this does not assert selected guest/browser runtime closure: its core queue was empty and its labelled downstream PCM was synthetic. M13 cannot pass until the remaining C-M11-05-WORKLET guest-generated runtime campaign closes. The worker sends only a validated current-generation CDRPCM1 record to the shell; the shell validates its fixed header and forwards only its sample bytes plus generation, consumer epoch, sequence, and frame offset to an AudioWorklet. The Worklet receives no disk, snapshot, message port to the worker, DOM, URL, or storage authority.

PCM delivery is the only unsolicited worker event in v8 and has this exact closed envelope:

{
  type:"cadr-event", version:8, sessionId:hex256,
  event:"audio-pcm", eventOrdinal:u64, consumerEpoch:u64,
  record:ArrayBuffer, recordSha256:hex256
}

There are no id, op, status, ok, terminal, or additional fields. eventOrdinal begins at 1n, increases by exactly one, and never repeats in a session. record is one complete 66..1,088-byte CDRPCM1; the shell verifies its digest, generation, sequence, frame offset/count, 8 kHz mono s16le format, and current consumer epoch before starting a deadline. The shell-to-Worklet message is exactly {type:"cadr-audio-pcm",version:1,generation,consumerEpoch,sequence, frameOffset,samples} and the Worklet reply is exactly {type:"cadr-audio-ack",version:1,generation,consumerEpoch,sequence,frameOffset}. samples is a fresh copied payload buffer. audio-open, pause, and resume are shell/worker composite controls; the PCM event is worker-to-shell; audio-ack and audio-device-lost are dispatcher-generated worker/internal operations. Neither the caller nor Worklet may invoke an internal v8 operation directly.

The Worklet has at most eight queued records, each at most 512 mono 8 kHz frames (1,088 total bytes including its CDRPCM1 header). It may acknowledge only those four bound identity fields. The shell canonicalizes that acknowledgement and v8 audio-ack sends it to the worker; stale, duplicate, wrong-generation, wrong-consumer-epoch, or post-reset/restore acknowledgements have no effect. Queue high water is deterministic M11 backpressure: the worker stops before the next event-producing guest slot and neither drops nor silently acknowledges an event.

Audio context creation occurs only within the shell's direct user-activation handler. Autoplay denial happens before any record is posted: it produces BLOCKED_AUTOPLAY, starts no deadline, retains all worker packets, and therefore eventually applies ordinary M11 backpressure rather than inventing silence.

Every successfully posted record has one exact acknowledgement deadline: 2000.000 milliseconds measured by the shell's monotonic performance.now() clock. The interval starts immediately after the record's MessagePort.postMessage returns successfully, not when the packet was rendered, queued in the worker, or observed by the audio clock.

One online shell audio reducer orders acknowledgements, explicit pause, device errors, and deadlines without waiting for a possibly future equal-timestamp event. A successful PCM post creates a latent deadline item immediately, with timestamp exactly post-return time + 2000.000 and the next monotonically increasing reducer ordinal. Each browser callback is one admission task. At callback entry the shell samples performance.now() exactly once, promotes every latent deadline whose timestamp is no greater than that sample, then admits the callback's pause, acknowledgement, or device-error item with that sampled timestamp and the next ordinal.

The first admission in a browser task schedules exactly one reducer queueMicrotask. Synchronous or reentrant admissions made before that microtask runs join the same open reducer turn. At microtask entry the reducer closes the turn at the current greatest admitted ordinal; that ordinal is its watermark. It detaches exactly the items at or below the watermark, sorts them by (timestamp, priority, ordinal), reduces them sequentially, commits all resulting epoch/deadline state, and only then emits their v8 responses. An item admitted after the watermark belongs to a new turn and schedules a later reducer microtask.

The priority table therefore applies only within one explicitly closed reducer turn:

The browser performs a microtask checkpoint after each task, so a reducer turn commits before the next timer, MessagePort, user-input, or device callback task can admit an event. Priority never reaches backward across that boundary: an equal-timestamp event from a later browser task cannot revoke committed state, replace a response, or retroactively win over an earlier task. Thus an acknowledgement sampled before the deadline commits before a later deadline task; one sampled exactly at start + 2000.000 promotes the due deadline into its own turn and loses to it. Within the same closed turn at that exact timestamp, a pause beats the deadline and a device error beats both. Equal deadlines use their post-time reducer ordinals, so the oldest posted record wins. After a deadline wins, the shell disconnects its port and issues one internal audio-device-lost carrying the expired record's four identity fields and cause:"reply-timeout". No later event from the closed epoch can become audio-ack. A winning pause request receives status 0 with audio state PAUSED. If an equal-timestamp device error wins first, that pending pause receives status 26, reason:"audio-device-lost", and no result. A winning acknowledgement receives exactly one status-0 internal audio-ack response; a fenced acknowledgement creates no v8 request or response. A winning deadline or device error receives status 0 for its one internal audio-device-lost notification; the affected outstanding shell audio action, if any, receives status 26.

An explicit audio-pause stops new posts, disconnects the Worklet, cancels rather than suspends every outstanding deadline, and retires that consumer epoch. It does not acknowledge or remove the corresponding worker records. A user-activated audio-resume creates a fresh Worklet and fresh consumer epoch and begins again from the oldest unacknowledged record. Thus time spent paused is never charged to the old deadline and an old Worklet reply can never resume the stream.

Backpressure and loss have this exact precedence. Before a deadline, reaching the eight-record high water stops the worker before its next event-producing guest slot but leaves existing deadlines active. When a deadline becomes due, device loss closes the epoch first; the worker accepts the one loss notification and retains every unacknowledged record; then it remains stopped at the same or next M11 backpressure boundary. processorerror, context closed, or device loss uses the same order but carries null sequence/frame offset and its corresponding cause. The triggering pending audio operation reports status 26; acceptance of the internal loss notification itself is status 0 with audio state DEVICE_LOST. None of these paths advances guest time, acknowledges a packet, or synthesizes silence. Recovery requires a direct user activation and a new consumer epoch. A worker crash first closes the epoch, disconnects the Worklet, cancels its deadlines, and fences all late replies before applying the ordinary crash/recovery path.