MIT CADR System 303 browser and WebAssembly implementation roadmap

M0 — Freeze the target and golden artifacts

Deliverables:

• CADR-WEB-303 profile manifest containing all pinned revisions;
• SHA-256 identities for the selected disk, microload/control-store inputs, configuration, keyboard map, and initial machine state;
• native build command and toolchain identity;
• immutable golden boot log and initial framebuffer hash;
• disposition record for every candidate artifact: public, generated, local-only, or unresolved.

Tasks:

1. Rebuild or verify the native usim from the pinned tree.
2. Run the existing System 303 harness from a clean private copy.
3. Record stable checkpoints: reset, microcode loaded, disk boot underway, first usable screen, and idle Listener.
4. Establish whether the exact distributable disk can be regenerated entirely from material with established license provenance. If not, the public browser requires local disk import even though the emulator is public.
5. Freeze a manifest schema before creating browser saves.

Exit gate C-M0:

• every input is identified and classified;
• native boot is repeatable three times;
• base bytes remain unchanged; and
• no unresolved artifact is silently placed on a public distribution path.

python3 scripts/verify-cadr-web-profile.py

M1 — Define the portable core and host ABI

Deliverables:

• a platform-neutral core library build;
• cadr_host_api.h or equivalent versioned ABI;
• one headless native host using that ABI;
• compile-time rejection of direct X11, SDL, socket, filesystem, signal, or wall-clock calls from core modules.

The host ABI should contain explicit operations such as:

read_base_blocks(request_id, first_block, count)
read_overlay_blocks(request_id, first_block, count)
commit_overlay_blocks(transaction_id, blocks)
present_framebuffer(generation, dirty_rectangles)
emit_audio(generation, guest_timestamp, samples_or_event)
emit_chaos_frame(frame)
monotonic_guest_tick()
log_event(category, payload)
halt(reason, recoverability)

Rules:

• callbacks that can complete asynchronously return a request identifier;
• guest execution yields until the matching completion is delivered;
• stale generation/request completions are rejected;
• no callback receives a raw mutable pointer with a lifetime beyond the call;
• a host failure becomes a typed machine-host condition, never an arbitrary partial write.

Exit gate C-M1: native headless execution reaches the same 100,001 outer clock-slot boundary states S0 through S100000 as the pre-refactor build. This includes inhibited slots, the same-slot polling schedule, canonical state hashes, and every ordered mutation range. It does not silently equate a clock slot with a retired microinstruction.

cadr-web/build/cadr-headless \
  cadr-web/profiles/cadr-web-303.ini.in \
  l/sys/ubin/promh.mcr l/sys/ubin/promh.sym l/sys/ubin/ucadr.sym \
  l/usim/disk-sys-303-0.img 100000 \
  build/cadr-web-m1-final-boundaries.txt
python scripts/compare-cadr-web-trace.py \
  build/cadr-oracle/m1-identity-final-capture-1/trace.cdrtrc1 \
  build/cadr-web-m1-final-boundaries.txt \
  --expected-identity-bundle \
    5e31742c67576a291dc071b91673c5e4ef3952edb2a1d9c3081a4f4adbc01390 \
  --expected-profile-sha256 \
    1b8d63db98acd46e40adf99a8a3ceb5e0558d4ac027cb2cb4a439665b14b5d2a \
  --expected-boundaries 100001

M2 — Establish deterministic instruction tracing

Deliverables:

• compact binary and human-readable trace formats;
• trace selectors for micro PC, decoded word, A/M source, destination, Q, VMA, MD, macro PC, faults, interrupts, and device transactions;
• deterministic trace hashing;
• snapshot and restore of all core-owned state at an instruction boundary.

The default trace MUST omit host paths and nondeterministic timestamps. Guest clock and interrupt decisions are explicit trace events. A full trace can be large, so the tooling needs range, event, and hash-only modes.

Exit gate C-M2:

• save/restore produces an identical continuation trace;
• two native runs with the same input schedule have identical trace hashes; and
• a deliberately perturbed ALU, byte, jump, and dispatch result is detected at the first differing boundary.

M3 — Compile and run the headless core as WebAssembly

Deliverables:

• reproducible WASM build;
• machine worker bootstrap;
• no-display, read-only-memory test runner;
• native-versus-WASM differential test command;
• explicit integer-width, sign, shift, byte-order, and overflow assertions.

Tasks:

1. Replace nonportable undefined C behavior before enabling optimization.
2. Represent 48-bit microinstructions in a stable 64-bit carrier with the high sixteen bits masked at every import/export boundary.
3. Audit host-size assumptions involving long, pointers, time_t, file offsets, and structure padding.
4. Compile without SDL/X11/Chaos host services.
5. Run every CADR-U01 through CADR-U05 conformance test from the processor spec.

Exit gate C-M3: all core conformance vectors and a minimum one-million-step boot prefix match native boundary state exactly.

M4 — Port disk-controller execution without persistence

Deliverables:

• asynchronous block-reader adapter over an immutable in-memory or streamed image;
• deterministic disk latency model;
• controller request/completion trace;
• malformed/truncated/wrong-image errors.

The first implementation may preload the image. The final interface MUST support range reads so large images do not require duplication in JavaScript and WASM memory. Controller timing is expressed in guest scheduler ticks, not fetch latency from the browser cache.

Exit gate C-M4-BOOT-MEDIA: for the selected immutable System 303 image, native and Wasm emit the same ordered register accesses, CCW reads, block requests and completions, page-transfer witnesses, controller-state changes, and interrupts from disk START through the first source-identified terminal boot-media read chain. The release record names exact start and terminal predicates, leaves no pending or orphaned host request, and proves the selected base-image SHA-256 unchanged. This is not a filesystem-mount claim.

C-LMFS-MOUNT is a later, separate CADR-WEB-303-LMFS-OVERLAY profile. It uses identified media containing the selected LMFS partition and a private copy-on-write overlay; native and Wasm then reach FILE-SYSTEM-RUNNING with expected PACK-LIST membership and identical ordered mount reads and writes, including pack-header incarnation and clean-flag changes. The base image remains unchanged and every write enters the overlay. It is neither an M3 result nor a prerequisite for C-M4-BOOT-MEDIA.

M5 — Implement the deterministic machine scheduler

Deliverables:

• run-budget/yield loop in the worker;
• guest tick source;
• device event priority queue;
• pause, single-step, reset, stop, and bounded shutdown operations;
• tab-hidden and worker-termination policy.

State machine:

NEW --cold-power-on--> CORE_RESET --boot--> PAUSED --start--> RUNNING
RUNNING --host request--> WAITING_FOR_HOST --completion--> RUNNING
RUNNING|WAITING_FOR_HOST --pause or hide--> PAUSED
RUNNING|PAUSED|WAITING_FOR_HOST --stop or shutdown--> STOPPED
RUNNING|WAITING_FOR_HOST --fatal status--> FAILED

The scheduler MUST NOT derive guest correctness from host frame rate. When a tab is throttled, guest time either pauses or advances by an explicit configured policy; the choice is recorded in the save metadata and trace.

Exit gate C-M5: injected simultaneous disk, clock, keyboard, and sequence-break events reproduce the native priority and restart results.

M6 — Reach a headless System 303 boot oracle

M6-DEVID1 is a separate, non-ready evidence-continuation profile: it preserves the frozen M4 512-event record and commits later final events through CDRM6E1. It deliberately disables snapshots and does not change this M6 Listener-ready exit gate. See the M6-DEVID1 disk-evidence continuation policy.

Implementation foundation, not M6 closure: the M6-DEVID1-only C fast runner advances bounded slots internally and returns CDRM6FAST1 at the first endpoint, debug delta, host wait, or terminal status. Its protocol-v4 wrapper chains each stop with CDRSTATE5 and CDRM5Q1; READY4 additionally binds the selected target and CDRM6E1 summary without changing READY3. Direct and three-run campaign tools preflight all bytes before a worker exists, and their receipt comparator requires legacy, O0 fast, and O2 fast identity equality at 1,130,000 slots before a measured O2 rate can support a twelve-hour projection. Those tools have only synthetic/static validation at this revision, so this does not alter the M6 exit gate or claim a READY4 campaign.

The production benchmark and READY4 supervisors now define the executable source boundary rather than trusting the caller's checkout after validation. The boundary covers the collector, campaign, evidence, validator, benchmark, identity, direct and systemd runners; the headless driver; the worker and its unconditional renderer and batch imports; the block service; the build files; the selected core, adapter, runtime, include, and trace sources; and the canonical release record. The outer process rejects any worktree byte that differs from the selected commit, extracts that commit into a private stage, builds there, rechecks the staged closure immediately before each launch, and executes only the staged entrypoint and imports. Tests prove both a dirty pre-stage executable and a changed staged executable fail closed.

Benchmark child results remain private and are not comparator inputs. A separate outer receipt binds the actual transient-unit invocation and its private nonce, validated effective policy and accounting, unit absence, private root removal, and final shared-source-stage removal. Only that outer-attested schema is accepted for the three-way comparison; setting the child environment marker or presenting a plausible raw child record is insufficient. The comparison and READY4 handoff also bind both the byte-exact canonical release record and the input schedule derived from it. This is a control-plane and provenance closure, not evidence that the private long benchmark or READY4 campaign has run.

Benchmark observation, 2026-07-30: the clean a42cfd6 source closure completed the outer-attested legacy/O0/O2 comparison with identical residue and state receipts at 1,130,000 slots. Legacy took 2,572,494,326,894 ns, fast O0 took 85,978,795,596 ns, and fast O2 took 11,465,958,791 ns. The measured O2 rate was 98,552 slots/s and projected the selected READY4 bound at 9,985 seconds. The private benchmark.json is 1,506 bytes with SHA-256 d358fb32f2618b196b40c6409cf07d1510cd5a9188e18d69906c21b220448344. This validates the benchmark and performance handoff for that exact commit; it does not close CW1-BOOT, and a final READY4 campaign must bind the later joined M8--M13 source closure used by the museum release rather than silently reusing this earlier benchmark.

Deliverables:

• automated WASM boot test;
• semantic boot markers independent of framebuffer pixels;
• captured Listener-ready state identity;
• bounded failure report containing the last state hashes and device transactions.

Exit gate CW1-BOOT:

• three clean boots reach the selected semantic marker;
• the expected macro/microcode and disk identities are visible in the test record;
• no host callback is pending or orphaned at idle; and
• a wrong or truncated image stops before guest mutation with a useful diagnostic.

M6-DEVID1 runtime status, 2026-07-29: the separate O2 evidence-continuation canary completed at exactly 1,130,000 nonterminal clock slots, with 535 accepted disk events, 23 committed tail events, no outstanding host request, an unchanged base disk, and verified unit/root cleanup. The private receipt is 18,609 bytes with SHA-256 47131339865ae4c07eb4b88603d6feceb0c5889b7a9bc27cf30a9c3f4a1ec2ac. This closes the named continuation canary only. It does not supply READY4, a Listener-ready semantic marker, or the three clean boots required by CW1-BOOT; those M6 exit-gate obligations remain open.

Selected-image negative production observation, 2026-08-02 UTC: one execution of the pinned-Node supervisor at repository commit 8519fc3de65f8aba98a67842d1340c1374cc58a0 produced the canonical cadr-m6-selected-image-negative-supervised-v3 receipt selected-image-negative-8519fc3-20260802T005017Z.json. The receipt is 9,575 bytes with SHA-256 5159e672660285dcb252db65a325cb40c38037dd494f0607074ee520565cef0b; its accounting and effective-policy SHA-256 values are respectively f527a583b35abf1f61f3ffc0e7a629afa8fbec3a0d0daf476ca27b3d7a3a5833 and a85b39ec4234494ffe7c353b1ac1b0c211f955cdf04b739502e2dfc809b97625. The supervised record sets transient_unit_absent, source_stage_removed, and private_root_removed to true, records equal before/after base identities, and sets guest_execution_attempted, wasm_build_attempted, and worker_constructed to false with materialized_image_bytes zero. This closes only the production wrong-image, truncated-image, pre-mutation negative sub-obligation. It is not READY4 or CW1-BOOT; the required three actual boots remain open.

Implementation evidence for this supervisor is pinned to systemd v261.1 commit eff9446d505d62c075bed37d606860b38cfe51fb. Its systemd-run implementation resolves the executable before transient-unit bus dispatch and serializes the resulting path plus literal argument vector (run.c lines 2863--2888, run.c lines 1395--1439). Disabling environment expansion selects ExecStartEx and records the no-env-expand execution flag (run.c lines 1215--1223). systemctl show renders an exited status without a signal suffix and a signaled status as number/name (systemctl-show.c lines 1535--1559); the pinned signal formatter spells every realtime signal `RTMIN+N` (signal-util.c lines 148--161). The selected validator profile is intentionally nonportable: on its Linux x86-64/glibc ABI it accepts realtime numbers 34 through 64 only as RTMIN+0 through RTMIN+30, not the inverse parser's RTMAX aliases.

M7 — Render the CADR display

Deliverables:

• browser renderer for the native monochrome framebuffer;
• dirty-page or dirty-rectangle transfer;
• exact logical dimensions and bit order;
• integer scaling with nearest-neighbor sampling;
• full-screen and fit-to-window modes that letterbox rather than fractionally sample;
• raw framebuffer and displayed-pixel screenshot tests.

The logical framebuffer is the conformance surface. Browser chrome, CSS scaling, and monitor density are host presentation choices. A “fit” mode may choose the largest integer scale that fits; it MUST NOT blur one-bit fonts.

Exit gate C-M7 has two independent required prongs: a known real-System-303 native framebuffer checkpoint has identical raw logical words and pixels at the same portable Wasm guest boundary (TODO-RUNTIME-M7-01), and a real supported browser proves ordinary-fit and user-gesture fullscreen presentation with every source pixel preserved as an integral rectangle (TODO-RUNTIME-M7-02). Neither prong alone closes the gate.

Implementation status, 2026-07-29: M6 remains ABI1.4/protocol-v4; M7 is ABI1.5/protocol-v5. The M7 transfer and renderer implementation closes the synthetic layout, dirty-transfer, lifecycle replacement, bit-order, polarity, integer-presentation, O0/O2 Wasm, and direct-native-fixture checks. Its contract is recorded in the monochrome display and browser renderer specification. C-M7 remains open: the fixture is intentionally synthetic, no source-bound native System 303 framebuffer checkpoint has yet been paired with portable Wasm at the same guest boundary, and no real-browser ordinary/fullscreen capture has verified integral presentation. TODO-RUNTIME-M7-01 and TODO-RUNTIME-M7-02 in that specification define these separate obligations; completing the raw identity oracle alone cannot close C-M7.

Phase-A host-foundation status, 2026-08-11: GO is limited to the inert source-A foundation and its deterministic receipt-generation step. Source A defines the immutable Guix package inputs, fixed 611:612 account declaration, no-argument service-entry discipline, descriptor-only runner/dropper inputs, and prospective receipt schema. Its synthetic control records set production_evidence: false; they are not a host action or an installation record.

The signed one-path Receipt-B commit c6606a9e2bf2a50676d23d98f8222ab146cdb5a9 is a direct child of signed Source A e098940d063cab7a4704402d14e5e075fcb692ec. Three clean generations produced the same 3,536-byte receipt, SHA-256 90934979c25432b1fdc2038cd6b4f93f7a5af23c4247c9998d3d0a6477eee0c7. It binds source tree 5e8a30666bceeeda09b9acded3df2c36a1c59760, the Guix derivation and output, requisite closure, program inventory, host artifacts, and the observed site nologin identity. The receipt remains production_evidence: false.

The receipt is merged into the continuing mainline only as historical/source integration. A two-parent mainline merge is not itself an admissible Receipt B: the production validator requires the exact signed B commit with Source A as its single immediate parent. Any later runnable post-M11 profile therefore needs a fresh receipt-free A followed by its own fresh direct-child B; it MUST NOT treat the mainline merge commit as release evidence.

HOLD, post-B: production-authority READY, process spawn and reaping, effective-unit inspection, capability-drop evidence, cgroup-emptiness evidence, and every live-host claim remain unperformed. No service or account has been installed or enabled and no authority has been launched. The current production authority also fail-closes before READY at its still test-domain-only Guix endpoint revalidation, while the direct host supervisor refuses unconditionally. A later post-B cycle must fix and independently review those paths, then prove READY, terminate/reap, and empty-cgroup cleanup under the installed effective unit. The Source-A synthetic READY/result/exit/reap tests and inert prospective-B fixture do not close any of those gates or either M7 runtime prong.

Failure-evidence hardening, 2026-07-30: the private P4 runner now preserves a canonical, bounded status-12 M6 diagnostic when the portable machine terminates before Form C, and preserves the frame, witness, frozen-release binding, and identical-or-first-difference comparison when a later failure occurs after Form C. The worker is executed from a private immutable staged JavaScript closure whose only permitted Node built-in is node:worker_threads; token-aware import discovery rejects commented, nonliteral, and non-local import evasions. The receipt calls the two adapter-file hashes a contemporaneous_adapter_observation: they describe the repository files present at execution time and are deliberately not claimed to be the producing source of the already-built Wasm module. Executable provenance is the bound Wasm byte hash at this gate; a reproducible producing-source closure is a separate release-build obligation. These stronger failure receipts do not close either runtime prong of C-M7.

Root-cause and intervention observation, 2026-07-30: an independent clean M5 O0 run reproduced the M7 failure exactly at boundary 1125883, with terminal status 12 and no post-call attempted boundary. Its private 22,140-byte failure receipt has SHA-256 a740226ac3da14ca265dc2fee94462667fe0f57972e80192d875c41d26fc7c10. The matching post-terminal witness records the frozen evidence array at count/capacity 512 with overflow set, CPU guest-fault clear, canonical overflow clear, and no outstanding disk operation. Source inspection establishes the transition: the 513th evidence event returns GUEST_FAULT, and the disk controller makes that the persistent machine status. This is inherited M5 diagnostic exhaustion, not a display fault.

The P4 runtime now selects a distinct m7-devid profile rather than changing ordinary M7's snapshot contract or merely enlarging the fixed array. The receipt-validated O2 composition canary crossed the former fault at the exact boundary 1130000: lifecycle remained runnable, persistent status and outstanding request were zero, all 535 evidence events were accepted, 23 were in the continuation tail, and source/private base identities were unchanged. The ordinary final receipt was not published because the outer verifier incorrectly recomputed the staged base-plus-selective-patch closure from all candidate bytes. A separately committed, read-only recovery tool validated the retained success envelope and outer accounting record and produced the explicitly labeled 30,836-byte private recovery receipt with SHA-256 5e5e389a3d7d536535066ab65209de6d6dedfad33cca0e3744bf6f08cf46ce4a; its committed recovery-tool revision is 97a95ae62d779cfca5a8059b7679947ff21bb64a, and its Wasm identity is a3537ccaa6e8c953060f2354c8f8678734fdd583e2bf635afc52a247bf42f986. This recovered-after-publication-failure evidence closes the specific M7-plus-continuation intervention check, but it is not an ordinary final receipt and does not close the long Form-C native/portable identity or browser-presentation prongs of C-M7.

Later source-grounded failure observation, 2026-08-02: the retained P4 session m7-p4-6d768e3efc634183aba025c9a13f109b, bound to M6 report 137b28193d13b6b6f7a1fd473da4e91baf9ba085597a2899f768657adfc374ac, reached boundary 1352885 and microinstruction 1262797 before its CDRM7U1 site-3 guarded-bus read rejected physical word 017772045 with a zero result. The pinned System 46 PROM source reads that exact physical word, branches cold when bit 5 is clear, and then reads the keyboard data word to distinguish RETURN from RUBOUT. The CADR bus formula maps the physical word to IOB CSR 0764112; the selected maintained usim iob.c returns the CSR latch at that address, and the pinned System 46 IOB description defines CSR bit 5 as Keyboard Ready. The narrowly selected compatibility repair therefore admits only that M7 physical read through the pre-existing bus/IOB route. It does not admit an IOB range or a write, keeps the M3 prefix fail-closed, and does not close either M7 runtime prong.

Subsequent source-grounded failure observation, 2026-08-02: the clean authority session m7-p4-d9c4a33528164d79859a2a920d6cf411 retained a complete native Form-C frame, then terminated the portable M7-DEVID run at boundary 1364498 and microinstruction 1271773. Its canonical M6 failure record has SHA-256 46ad5bfddf8a48d3e1acd5df002ab8d7f984d31dbf6cc3831026c2ce2b91926e; the diagnostic wire record has SHA-256 01b09b9982e5027ead1890d5186cf820d1d9e791f9c4d67d530cda90987ab966 and reports a site-4 write of 0xffffffff to physical word 017051765. The pinned usim uvmem.c source explicitly uses that address as its TV-remap example; its bus adaptor maps the complete 017000000..017077777 32K-word range to the monochrome TV backing store. The portable lower bus and TV model already implement the same range and canonical state update. M7 therefore admits exactly that source-defined range, for reads and writes, through the normal bus route; adjacent Xbus space and the pre-M7 profile remain fail-closed. The native transcript does not serialize every bus transaction, so this classification is a pinned-source conclusion rather than a claim that the same-boundary native write was captured. This repair still does not close either M7 runtime prong.

Effective-page identity hardening, 2026-08-02: the default-disabled P4 companion now preserves the original M4 LBA-1 commit and exact replay first, then, only after the exact selected boot suffix and a reason-1 quiet record at or after boundary 1030044, can acknowledge one strictly newer, byte-identical one-block write anywhere within the selected base. LBA 1 is checked against the effective overlay; all other LBAs use an overflow-safe bounded base read. M6, not the block service, creates the public receipt after successful completion, an independent effective-page reread, and exact linkage to unique adjacent CDRM6HS1 issue/completion records for the candidate and all three arm operations. The validator independently receives the expected base identity, checks page bounds, and derives the canonical overlay root from that base plus the authoritative initial LBA-1 commit hash.

The selected target is the retained generation-1 request/transaction 135 for LBA 1299 at boundary 1366722, page SHA-256 ba1b1cc2228edbe5028760e47687c6889023fc72221bd5c5f5be85c4cfbb6a00, with overlay generation 1 unchanged. P4 now requires exactly one such receipt and the selected arm tuples (1,1,1,1), (1,2,0,1), and (1,3,0,0) plus the exact boundary-1030044 quiet record. It binds the receipt's canonical digest into the campaign execution receipt. Synthetic positive and adversarial tests establish the state-machine and verifier rules; the corrected wiring has not yet completed a successful long campaign, so it does not close either runtime prong of C-M7.

Failed runtime observation, 2026-08-02: signed release 652756f9d5d6b08b18f45d4aee43f1581c9d2392 produced clean native Form-C capture cf59250db3acc33fe0b72e6b3c126cf708b3ba0cb3225ba66b3c03f2921aea42 in ignored session m7-p4-cb196332a04b4ba889f9d832178ecf70, with selected private disk SHA-256 unchanged at bb16e46ad81decfe1efe691d36b6aa4ce3fd4ffb82474365de3520989d397cb5. The portable half nevertheless issued and completed request 135 with legacy host status 1, then terminated at the old boundary 1366780 with machine status 16. Its top, portable, M6, and worker-log failure hashes are 74a8461b8e86a098347040748d8123d528c879f62e74e0b11b9ef44050a762d8, 019012c5c21ad46332ebe7931da80ff9488d9964253fc6f8c631a215501d509b, 209bc3e1b75aa827fa4563a40ff495c0248f1ff2088bc6294b13190a4650acfb, and c9a09e571d123aafb4752bce12be8987ab77b069d13a4f77e573da027897f8d2. The 270-record transcript ends with request 135; no request 136 or later base-different write was issued. Source inspection established the cause: the ordinary checkpoint campaign still selected frozen runM6HeadlessBoot, whose block service did not receive the default-disabled M7 policy. The M7 checkpoint entrypoint now selects a dedicated exact companion that supplies that policy, derives base authority from preflighted selected media, forces the authoritative quiet-boundary observation, and binds the resulting arm, transcript-linked receipt, and digest. Ordinary M6 still deletes any caller-supplied M7 policy before entering its frozen path. A new long campaign remains required. The later M12 and M13 source status below is unchanged.

Second failed runtime observation and bounded v2 response, 2026-08-02: ignored session m7-p4-6db56e8355ca42c9b9975896b766bf1c directly observed that the stream continues beyond request 135. Request 134 read LBA 187956 at boundary 1366543 with status 0 and completion hash ba1b1cc2228edbe5028760e47687c6889023fc72221bd5c5f5be85c4cfbb6a00; request 135 wrote the identical page to LBA 1299 at boundary 1366722 and succeeded. Request 136 then read LBA 187957 at boundary 1366946 with status 0 and completion hash 566dc7dd89247cf44f8784741c4400ca28b25d69b836fbfb8ff67729b34d6f1a; request 137 wrote those bytes to LBA 1300 at boundary 1367125 but retained legacy host status 1. Machine status 16 followed at boundary 1367183. The native capture remained cf59250db3acc33fe0b72e6b3c126cf708b3ba0cb3225ba66b3c03f2921aea42 and the private disk remained bb16e46ad81decfe1efe691d36b6aa4ce3fd4ffb82474365de3520989d397cb5. The top, portable, M6, and worker-log failure hashes were respectively 8a00abea95ae2f1314430228a0a611a09a8e900705902393a36d64d95978dfcd, fbdc542f17188056a9ca4b5df22c91e579c17b196892a8a4be31053222a8bd04, 539d992645fa0243575ea728655f1600d467414c82a0d4f199885818715e6a49, and 05187da6c4c154180580455ffbbb939619c18f95fbdce588f1c9a4b25c70a1ee.

Source v2 therefore retains the exact v1 arm and request-135 anchor, then streams ordered identity acknowledgements. It requires generation 1, transaction ID equal to request ID, equality to fresh pre-success and post-completion target rereads, a global completed-host-request high-water including reads and no acknowledgement-member replay. The exact committed request-1 LBA-1 descriptor-and-payload replay remains the sole exception even after streaming begins and creates no acknowledgement member. Any malformation, mismatch, read/fault/completion failure, detach/reset, drift, or exhaustion poisons the stream without media/root/generation mutation. M6 emits candidate v3, acknowledgement v4, and IDENTITY_ACK_STREAM v1 evidence with ordered witnesses and optional adjacent-read provenance. P4 retains private 0600 canonical stream and transcript sidecars; P5 hashes and validates but never serves them. The observed future stream length remains unknown, so a fresh campaign is still required and no P4 or P5 gate is closed.

Bounded-control revision, 2026-08-02: the prior signed-source run whose ignored session identifier begins m7-p4-81dfa exhausted the 1,024-transaction P4 limit at boundary 1382343. It reported phase host-service, status 9, last completed request 1024, unserviced request 1025, next request ID 1026, and 2,048 transcript records. Its retained tail proves only successful reads 1017 through 1024 of LBAs 188487 through 188494 with host status zero; the old failure schema did not retain the complete transcript. It therefore does not prove requests 134 through 1016, acknowledgement count or progress, all adjacent-read equalities, the highest written LBA, request 1025's descriptor, an eventual READY boundary, or a safe cap.

The v3 P4 control fixes its wrapper at 2,048 host transactions while leaving ordinary M6 at 1,024. It has no cap override, extension, or resume mechanism; request 2049 remains unserviced on exhaustion and a rerun must use a fresh session. A 10,800,000ms monotonic deadline starts before staging and compilation, bounds each request by min(120000ms, remaining), and actively terminates and cleans up on the first terminal result. The fixed budget and canonical execution accounting are redundantly bound in root and portable success/failure records, expected closure, and P5. Every post-preflight M6 failure now retains a complete private CDRM6HS1 sidecar and reparses its framing, artifact-set identity, count, digest, tail, and final machine accounting. The schemas are cadr-m7-frame-conformance-result-v3, cadr-m7-frame-expected-closure-v2, cadr-m7-portable-failure-v4, and cadr-m7-frame-conformance-failure-v3. This control is ready for a new bounded campaign; it is not evidence that 2,048 transactions suffice and closes no P4 or P5 gate.

The deadline terminal cause is carried independently of exception wrapping, including M6-to-M7 failure conversion. Operations that cannot be cancelled are joined after deadline loss before a failure receipt is installed; abortable work may instead terminate directly. Setup expiry therefore produces closed portable/root failure evidence without allowing a staging, read, compile, artifact-read, or private-write loser to modify the session afterward. Success close is deadline-arbitrated and shares exactly one worker termination attempt with failure cleanup, so expiry cannot be reclassified as success after a slow close. The setup failure receipt preserves nullable identities exactly as obtained and records worker-not-started; it cannot claim termination for an uncreated worker. Runtime failure receipts retain strict complete identities and worker termination. Python P5 is intentionally success-only: it opens manifest.json and rejects anything other than the successful P4 schema and identical outcome. Failure receipts are closed by the JavaScript root/portable failure validator instead; they are not a second P5 admission format.

M8 — Implement complete keyboard input

Deliverables:

• physical-event normalization layer;
• complete CADR key vocabulary including Control, Meta, Super, Hyper, Shift, Top, Greek, System, Network, Help, Break, Return, Rubout, and special function keys;
• on-screen keyboard for inaccessible or browser-reserved combinations;
• configurable physical mapping stored outside guest state;
• event-trace viewer showing physical event, normalized key, and delivered scan code.

Rules:

• matching uses physical code where position matters and explicit text input only where the CADR expects a character;
• browser-reserved chords have discoverable alternatives;
• keyup loss on focus change releases all host-held keys without inventing guest repeats;
• repeat is generated by the selected guest/host contract, not accidentally by both.

Exit gate C-M8: enumerate and inject every scan-code/key transition accepted by the pinned maps and verify modifier chord press/release order against native usim.

Implementation status, 2026-07-30: M8 now has its complete 100-key physical map, accessible onscreen surface, focus-loss all-up transaction, a shared browser request-ID channel, and an installed dedicated v6 worker branch. The ABI 1.8 M9 Wasm profile now transfers a strict 40-byte CDRINP1 record only at a completed core boundary, calls the selected keyboard IOB subset, and exposes a post-delivery CDRIOB91 observation. Generic scheduler kind 3 remains closed. A disposable, exact native pre-IOB witness/driver patch prepares and compiles against the pinned public source without launching a machine. C-M8 remains open until the all-100 browser/core trace and the source-mapped native X11 subset are recorded and compared in their isolated runtime campaigns. Source-unmapped descriptors and live shifted-key modifier chords remain explicit native exceptions; the latter still require their own ordered chord campaign. The static native build and direct-core tests do not close the runtime gate.

The M8/M9 READY4 campaign selects the additive m9-devid Wasm build rather than the ordinary M9 module. It retains the M7 display/core route and the M9 input ABI while adding only the M6 DEVID runner and fixed evidence export; its O0/O2 byte identities and exact export surfaces are pinned by the M8/M9 unit gate. In particular, the inherited CDRM7U1 guarded physical read of 017772045 continues to route only to IOB CSR 0764112; it is not replaced by an IOB range or a write capability. It also retains CDRM7TV1's normal-bus TV range; the M9 profile must route reads and writes within 017000000..017077777 to the TV backing store without widening either adjacent Xbus space or pre-M7 profiles.

Source-A rebaseline, 2026-08-02: the four O0/O2 M9 identities below were rebuilt from signed M7-TV receipt head 51d5426c1691bdd00783e15fb6fd44f6ddbfff56 plus this M8/M9 source closure. They are deterministic build-test identities, not native-campaign evidence. The M8/M9 DEVID unit gate runs the inherited CSR and TV boundary tests compiled against the additive M9 profile before checking these bytes.

M9 — Implement pointer and interactive lifecycle

Deliverables:

• pointer motion, button, capture, and coordinate conversion;
• exact inside/outside clipping and button chord order;
• focus acquisition that does not consume the first intended guest click;
• pause/resume/reset confirmations and recovery UI;
• browser reload/close warning only when private state is dirty.

Exit gate CW2-INTERACTIVE: complete a synthetic Listener/editor/window workflow through both native and browser machines with equivalent logical input trace, framebuffer checkpoints, and Lisp results.

Implementation status, 2026-07-30: M9 now has tested EDGE32/capture/lifecycle host contracts, accessible controls, a shared browser request-ID channel, and an installed dedicated v6 worker branch. Its ABI 1.8 core ingress validates generation and one shared ordinal per CDRINP1, maps EDGE32 after-state to the selected mouse IOB words/readiness/vector subset, and deliberately rejects v6 snapshots because that input state is not in the M5 snapshot wire layout. Generic kinds 3 and 4 remain rejected. The native oracle patch records pre-IOB keyboard/pointer calls at a driver-selected post-M6-idle boundary. The tracked strict native-capture and paired run-cadr-m8-m9-input-conformance.mjs entry points make a bounded direct-driver native pre-IOB campaign and browser worker/core campaign executable with fresh private copies, provenance, and cleanup. The browser half retains distinct expected and actual worker CDRINP1 bytes and one actual post-core CDRIOB91 receipt for every record. The direct native driver does not traverse Xvfb/XTEST, X11, or Cadet and therefore cannot close C-M8 or CW2; its records are never labeled X11-observed. No native session has been launched for this change. A separate unexecuted run-cadr-m8-m9-x11-campaign.mjs route selects a witness-enabled X11 usim inside the existing Xvfb computer-use harness, gives all 100 mappings an explicit source-bounded disposition, exercises pointer transitions, and retains Listener/Zmacs screenshots plus shutdown provenance. Its native evidence still requires a matched browser workflow. CW2-INTERACTIVE remains open until an isolated native and browser Listener/editor/window campaign retains the same logical input trace, framebuffer checkpoints, Lisp results, and required harness provenance. The public preflight is make -C cadr-web m8-m9-unit; it is not the native/runtime oracle.

Unfulfilled native-authority prerequisite, 2026-08-02: building the immutable captured-Python authority and starting either native campaign require the host-global Yama policy /proc/sys/kernel/yama/ptrace_scope to be exactly 3. Mode 2 is rejected at every authority layer: Yama permits CAP_SYS_PTRACE in that mode, while this Bubblewrap design creates a child user namespace whose parent-namespace owner retains all child-namespace capabilities. Neither the child user/PID namespaces nor a fresh /proc mount removes that parent-creator relationship or independently roots a Yama decision. The outer host preflight, canonical builder receipt, in-child bootstrap, native runner, and browser/X11 receipt join all demand 3; the in-child reread is a coherence check, not a substitute authority. The regression uses static and receipt adversaries rather than faking /proc.

The current development host was observed at scope 1 on 2026-08-02. No sysctl was changed, the authority was not built or executed, and no CADR runtime was launched. Consequently this prerequisite and every dependent C-M8/CW2-INTERACTIVE runtime gate remain open. Meeting this host-policy prerequisite alone would authorize no compatibility claim: the isolated native and matched browser campaigns still have to complete and pass their evidence checks. See the pointer and lifecycle specification for the bounded kernel evidence and inference.

The authority is not selected by a caller-provided Guix store directory. Its canonical builder opens and hashes the exact reviewed wrapper, builder, derivation, launcher, guard, and bootstrap sources; opens the Guix client before resolving it; invokes that descriptor under a closed build environment; and records the derivation and output paths. The resulting receipt records the copied bootstrap hash, a launcher ELF64 identity with neither PT_INTERP nor PT_DYNAMIC, and a guard ELF64 shared-object identity with PT_DYNAMIC and no PT_INTERP. Before native execution, the runner independently evaluates the same derivation and dry-run output through the receipt-bound Guix client, then descriptor-walks and rehashes every selected output. The legacy CADR_M8_M9_PYTHON_AUTHORITY direct selector is rejected; a future authorized run must name the canonical receipt with CADR_M8_M9_PYTHON_AUTHORITY_RECEIPT.

The child receipt also fixes sys.path to the immutable stdlib, platstdlib, and lib-dynload directories, removes archive import hooks, and permits only the recorded built-in, frozen, and FileFinder import surfaces. Every stdlib FileLoader target is descriptor-walked and hashed. Captured programs that request zipimport, directly request __main__ or sitecustomize, use the enumerated frame/function reflection attributes, mutate the importer namespace, or leave that surface changed fail closed at the selected source-admission or exit checks.

The authority bootstrap is a sealed sitecustomize gate, not the program's __main__. The static launcher replaces its entire environment, adds only its literal startup PYTHONPATH, and starts the sealed root pathname as CPython's actual script after sitecustomize returns. The gate validates the root and every helper's byte/hash identity, replaces runpy.run_path, io.open_code, and the built-in compile, exec, and eval entries, then leaves no saved original compile or exec object in the gate's module dictionary or a Python caller frame. Captured helpers are subsequently loaded by the ordinary guarded loader from their own validated sealed mounts. The adversarial regression attempts recovery through __main__, sys.modules, the startup module dictionary, a guarded-loader function's globals, and a caller frame; each must fail before it can run an injected code string.

This is a narrowly bounded source-closure authority reduction, not a claim that arbitrary hostile Python is a generally safe sandbox. In particular, the selected seven reviewed sources remain trusted inputs, the filesystem/namespace/ptrace boundary is enforced independently, and a successful static regression cannot substitute for a future authorized native capture at Yama scope 3.

The selected native child begins below a new tmpfs / and Bubblewrap's fresh minimal /dev; it never receives a host-root or repository bind, nor even a repository-root environment locator. It also does not receive the whole Guix store. The parent obtains the selected store interpreter's recursive guix gc --requisites closure through the receipt-bound Guix descriptor, canonicalizes that exact store-item list, opens each item as a held directory, and mounts only those directories individually. The synthetic device receipt enumerates null, full, zero, random, urandom, tty, and pts/ptmx; the pts and shm directories; and Bubblewrap's core, fd, standard-stream, and ptmx symlinks. All remaining mounts are a fixed descriptor-held permit: native configuration, every prepared file individually, five configuration-selected media files, selected static profile/template/release/patch/mapping evidence, input script and campaign, and the one private output directory. The prepared receipt rejects symlinks, non-regular leaves, and execute bits outside the exact three selected usim executables. The seven reviewed Python programs cross as one root pipe plus one separate helper pipe per non-root source; Bubblewrap materializes those bytes as read-only files below the sealed program root rather than exposing a repository tree or retaining an in-memory source bundle. The child descriptor-walks its actually mounted startup gate, launcher, and guard and requires their identities to equal the canonical receipt; after exit the parent requires an explicit bootstrap-start token, then rehashes its retained Python, Bubblewrap, authority, every Guix-store directory, every prepared file, and all other permit descriptors and again compares the authority artifacts and ELF profiles to that same receipt.

The committed campaign join now requires reciprocal O0/O2 provenance manifests rather than accepting two independently plausible reports. It binds the same exact ordered source-authority set, recursive import closure, selected media and O0/O2 executable identities, direct start/end observations, M6 transcript/idle/mapping evidence, all 208 derived input states, all 100 key transitions, and the exact worker-message suffix. A rights-safe synthetic M6 producer exercises that join without private media. This closes the report-composition and provenance mechanism only; the live direct and X11 campaigns described above remain unexecuted.

M10 — Add private persistent disk overlays

Deliverables:

• immutable base image identity;
• sparse block overlay;
• journal with schema version, generation, base hash, dirty set, and commit checksum;
• atomic save generation;
• import/export format and verifier;
• explicit discard, clone, compact, and recover operations.

Commit order:

1. validate base and current overlay generation;
2. write new/changed blocks under a new generation;
3. verify block hashes;
4. write and verify the generation manifest;
5. atomically advance the active-generation pointer;
6. only then report durable success to the user.

Browser termination before step 5 leaves the previous generation active. Base media is never writable. Guest writes can be acknowledged before durable host commit only if the UI clearly distinguishes machine-completed from browser-persisted state and a later flush is mandatory.

Exit gate CW3-PERSISTENT: power-loss injection at every commit step yields either the old complete generation or the new complete generation, never a mixed disk.

M11 — Audio and speech profiles

Deliverables:

• core audio event/sample stream;
• browser audio adapter with guest timestamps and bounded buffering;
• deterministic capture mode independent of realtime playback;
• documented profiles: base CADR sound, optional restored audio, and VOTRAX speech.

Unknown physical-device behavior remains selectable. Silence is acceptable only in a declared NO-AUDIO profile; it cannot be reported as complete hardware emulation.

Exit gate C-M11: deterministic sample/event hashes match the selected native software model, and pause/resume neither duplicates nor loses queued guest events.

Implementation status, 2026-08-02: M11 now has a machine-owned core mapping for IOB 0764110, pointer-free CDRAUDS1 queue-state save/restore, an isolated protocol-v7 M12-Wasm subhandler, deterministic fixed-table signed-16 PCM, and a bounded AudioWorklet queue/acknowledgement bridge. Strict C, Node, and O0/O2 Wasm tests pass. The v7 path composes M8/M9 CDRINP1 ingress before M11 post-slot beeper events and keeps their sequence domains separate. The M12 direct-Wasm CDRM12S1 version 2 stages frozen CDRSNAP1, the exact 72-byte digest-bound CDRM9D1 companion, CDRAUDS1, and CDRM12C1 in that order and rolls back before publication on any malformed component. Lower profiles and frozen CDRSTATE5 are unchanged. A source-bound System 303 session evaluated (SI:%BEEP 500. 100000.) and retained 199 ordered job/PCM pairs; the independent CDRM11FIX2 clean-room oracle also closes narrow C-M11-04-PCM across native O0/O2 and freshly rebuilt selected-M12 Wasm O0/O2. These results do not exercise selected-Wasm browser playback, pause/device-loss semantics, Votrax serial output, or a guest-generated browser audio workflow, so full C-M11 remains open. An opt-in ABI1.11 source slice now adds core-issued CDRM11O1 epochs, exact CDRPCM1, private retention of acknowledgement frame counts, zero-frame UART handling, an eight-record Worklet, a worker-owned adapter that calls the actual ABI1.11 export and pumps at most 64 semantic packets per automatic turn, and synthetic shell lifecycle coverage. The real worker/empty-core seam is exercised, but no selected guest PCM was available in that test. It does not alter ABI1.10/v7 and is not runtime closure.

A separate selected-Wasm Chromium campaign now adopts the independent synthetic multi-packet CDRAUDS1 fixture into freshly built ABI1.11 O2 Wasm. It stages one 512-frame selected-core packet in a suspended real AudioWorklet and requires the Worklet's distinct post-enqueue staging receipt before pausing with zero render acknowledgements. It proves the selected snapshot is unchanged, resumes under a fresh consumer epoch, and requires the same cursor and PCM hash to receive the sole render acknowledgement. A separate committed receipt resolves only after the core ack returns, the private source record is removed, and boundary counts update. The campaign forcibly builds in an exact signed-base-plus-sealed-patch stage and independently verifies its canonical source/tool/browser/network/cleanup report. Nonterminal activation, acknowledgement, pause, and ordinary loss operations use one lifecycle queue. Terminal close is instead immediate ownership revocation: it cancels the boundary's logical waits, disconnects prepared, starting, and live candidates, retires waiters, and fixes DEVICE_LOST without waiting for a browser start, private open, or private ack promise to settle. Its only core hook is synchronous, request-free terminalRelease: a worker-owner tombstone that MUST NOT invoke open, ack, pause, or ordinary deviceLost. It can therefore overlap an unsettled nonterminal request without concurrent non-reentrant-core mutation. A late open is observed only after open exits and is then tombstoned with its retired epoch; a late acknowledgement cannot publish counts or a receipt. A candidate which allocates after cancellation is disconnected again on either late resolve or reject. An invalid prepared candidate is disconnected when possible; a post-open reducer or port-handler installation failure rolls the epoch back and releases both candidate and core before retry. Pause/loss block reopen until their authoritative counts are adopted. Staged and committed receipt evidence retain only the most recent eight already-settled receipts of each kind; live duplicate and order checks remain with the posted-record map and reducer. Full receipt identity is exact-type and closed-key checked before it is keyed: the three identity counters are ranged primitive BigInts and frame offset is a safe u32 integer. The verifier selects Chromium externally and independently reconstructs the fixture's initial/final snapshot, PCM/cursor hashes, queue deltas, and delivery/staging/commit chain, with targeted mutant rejection. Digest admission rechecks consumer, epoch, generation, ordinal, and control watermark after hashing; activation failures disconnect their started candidate and have exact retry/terminal-close behavior. The verifier also requires exact activation booleans, AudioContext state/rate/disconnect records, status order, and browser-reported Wasm bytes/hash equal to the independently rebuilt and served artifact, with a mutant for each listed semantic field, replayed source fact, and consumed report wrapper; it does not claim exhaustive mutation of every report field. It does, separately, mutate every field of the terminal resolve/reject leaves and every never-settling branch. The verifier enumerates exactly 41 consumed wrapper paths. Every nested report object, including both staging wrappers, is exact-key validated and bound to the canonical delivery/receipt objects; missing and unknown-field mutants at every wrapper include attempted physicalDeviceAudible: true injection in the staged and resumed wrappers. This advances only the pause/resume no-loss portion of C-M11-05-WORKLET. Fresh observation on 2026-08-11 used Chromium 151.0.7922.108 through the externally selected launcher, while the running Playwright browser process was observed as its launcher-discovered payload executable. The report binds both file identities, the policy launch flags, and Playwright's sync-API module identity; sealed evidence retains the machine-local paths. The shared shipped factory immediately disconnects a deferred candidate on terminal worker loss and arms one bounded context-close deadline, so a never-settling module load or hook cannot retain the context. Start settlement cancels the deadline and idempotently preserves the single close; the boundary then makes its second candidate-disconnect pass, which reaches any real late-published node. Real Chromium probes cover deferred resolve and reject for late node publication, plus before-module, after-module, and after-node hooks left genuinely pending through the independent deadline close. They record one close call and a closed context, DEVICE_LOST, and exact empty page-error and unhandled-rejection arrays. The packet was not guest generated, and the campaign makes no physical-device, audibility, Votrax, System 46, SDL3, or historical-hardware identity claim. Full C-M11 remains open.

M12 — Debugger, trace, and preservation controls

Deliverables:

• register/memory/control-store inspector;
• micro and macro single-step;
• breakpoints and trace filters;
• machine-state export for bug reports without disk contents;
• provenance panel showing all public artifact hashes and browser build identity;
• opt-in local diagnostic bundle with privacy review.

The museum debugger controls this emulator instance. It MUST NOT be confused with the historical CC console, whose full profile assumes a separate debuggee.

Exit gate C-M12: each control stops at the documented boundary and resume produces the same continuation as a run with the equivalent preinstalled breakpoint.

Implementation status, 2026-08-11: a narrow cumulative M12 ABI 1.10/protocol-v7 profile has a real one-slot core adapter, source-bounded QMLP/DMLP candidate-loop map, O0/O2 Wasm export checks, an installed closed v7 worker branch, and pointer-free CDRM12C1 breakpoint-configuration save/restore through direct Wasm and the worker. Direct generic M12 Wasm snapshots now use CDRM12S1 v2: restore stages CDRSNAP1, requires CDRM9D1 to bind the exact recomputed frozen CDRSTATE5, adopts CDRAUDS1, validates CDRM12C1, and only then publishes the replacement while staling old audio cursors and inspector leases. Malformed-envelope and successful publication tests pass in O0 and O2 without changing lower snapshot formats. A separate compile-gated public synthetic test profile now boots only from cadr_wasm_create and drives the unchanged worker through a real same-process replacement. It has the exact production export surface, cannot enter an ordinary --m12 build, and does not restore or bypass a production snapshot to reach its initial state. A cross-variant test restores its fixture into fresh production O0/O2 modules, resaves it, and compares the exact 72-byte CDRM9D1 and its public CDRSTATE5 binding. A separate hostile O0/O2 transaction replaces only the audio sidecar with an independently serialized, witness-valid generation-two CDRAUDS1; the generation-one machine rejects it before publication and retains byte-identical machine, debugger, audio, keyboard, and pointer state. Cold power now clears audio at the current machine event generation while renewing only its local consumer authority, so accepted snapshots establish generation equality at creation rather than repairing it on restore. A separate public-usim candidate-loop witness prepared and compiled without being run. Native and worker tests establish the selected source-level M8/M11 order, but not a runtime observation. Generic snapshot configuration composition and source-level M9 protocol-v7 continuation are closed at the direct-Wasm/worker boundary. A selected load-band macro trace and historical console behavior remain open; C-M12 remains open. The formerly open pure-source ABI 1.10 lifetime boundary is now covered in the composed adapter: nonmutating failed-initial-boundary retry, semantic-zero first initialization, normal teardown retaining a monotonic domain counter, same-address adapter reuse that keeps the old lease stale after new-owner publication, copied-adapter rejection before copied-machine access, and nonmutating owner-incarnation exhaustion preflight all have native tests. Internal C-M12 status 21 is not a v7 debugger result and cannot be mistaken for terminal debugger statuses 19/20; direct Wasm lifecycle and composed snapshot bridges map it to existing public status 15 before mutation/publication, while a v7 backend-protocol attempt to emit 21 is closed as status 2 without a result. The native boundary vector also issues UINT64_MAX-1 exactly once, reaches the unissued sentinel, and proves that the immediately following status-21 attempt leaves the final owner and its lease unchanged.

An additive, source-only M12 P2 review coordinator now sits behind the ABI1.11/v8 P1 application's awaited, one-way debugger handoff. The handoff synchronously fences new P1 admissions, drains P1's existing FIFO, and gives P2 closures over the same request-ID allocator rather than a shell or second allocator. It consumes only canonical status-19/20 stops, validates a complete CDRM12S1 v2 stream (including the full CDRAUDS1 queue grammar), and retains no public snapshot capability. Its exporter stages bounded copies and uses synchronous accept as the only publication point; reset, loss, and every delayed lower reply are fenced by a sticky epoch and cancellation/zeroization receipt. Each review uses a fresh private snapshot transaction. A private save marks worker snapshot ownership before its reply is parsed: a dropped, timed-out, malformed, or post-disposal reply therefore fail-stops the owned worker (or reports terminal loss to P1) and yields WORKER_TERMINATED, never ABSENT; a late reply cannot recreate the transaction. Cleanup orders invalidation, worker disposition, and then opaque M10 lease release, retaining only the lease when worker disposition is unknown and retrying only idempotent unpin after an ambiguous release acknowledgement. The source/synthetic regression suite covers this response-loss ordering and two fresh review cycles. Because M10 admits only one branded authority claim, a P2 constructor-only failure retains P1's lease-free claimed authority for one retry. The current source/synthetic M10-v5 + P2 regression additionally forces a post-pin continuity failure, two failed rollback unpins, and then a P1 terminal loss. It records AUTHORITY_RECOVERY_RETRY_REQUIRED with the exact aggregate failure, retains the one branded authority and opaque pin, and succeeds only after an explicit retry drives that same authority through recovery acquire(), lease release(), and synchronous revoke() in that order. This is a fail-closed terminal-cleanup foundation; it does not claim an M10 browser campaign, a live selected-media machine, browser-runtime composition, or historical debugger behavior. An ambiguous worker-snapshot disposition does not authorize M10 release: the external-Worker profile requires a single-use shell operation that itself invokes the exact captured Worker's synchronous terminate(), and upgrades UNKNOWN only after that call returns normally. Missing or throwing termination proof is the non-retryable EXTERNAL_RECOVERY_REQUIRED state and retains the pin; an accepted proof permits exactly one WORKER_TERMINATED disposition and unpin. The schema-3 IndexedDB adapter separately purges stale transient review refs on reopen while retaining clone/export refs. The compile-gated test profile reaches a genuine status-20 stop at 1,048,576 slots in O0 and O2. These are current local source/synthetic test results, not selected-media, browser-runtime, or historical-debugger evidence. Full C-M12 and C-M13 therefore remain HOLD/open.

M13 — Hardening and accessibility

Deliverables:

• fuzz tests for disk imports, configuration, save manifests, and host messages;
• resource ceilings and clean out-of-memory handling;
• keyboard-only host controls;
• accessible labels and status announcements outside the guest framebuffer;
• no network by default;
• content-security and dependency inventory;
• worker-crash recovery that never labels volatile guest state as saved.

Exit gate C-M13: malformed host inputs cannot write outside their overlay, mutate the immutable base, issue network traffic, or wedge the page without a bounded stop.

Implementation status, 2026-08-02: the tracked source now promotes the former selected-media setup seam to public v8 base-media-mount. The operation is fenced behind the selected adopted import ID, v8 bootstrap, one same-boundary range binding, the four selected artifacts, an exact factory-owned selected-Wasm digest, and clean M10 reopen; selected import calls are rejected before bootstrap. Its synthetic contract matrix checks every lower mutation/read/adoption failure position and terminally discards a partially mutated worker, while the production binding test covers all 258 retained and revalidated range indexes including the final 77-block range. Maximum public ID terminalization is common to mount success, precondition rejection, and worker-loss failure. E27 now runs the public import/mount/reopen path in Chromium 150 against the current selected M12 O2 module and exact local base/artifacts. The real guest reaches its first base-identical block-1 write in 252 bounded slices and public reopen reads the same bytes. An explicitly synthetic controller write after that public mount then survives immediate read and public reopen. The worker remains RUNNING after host completion. Public export/restore names are exercised only through an E27 test adapter which streams and parses a real synthetic CDRM10W1; it emits no normative pinned-object records, adopts no snapshot, and performs no paused/reset composite restore. All source inputs remain byte-identical. This closes neither a guest- generated changed write, normative export/restore, the complete F06/F07 power-loss/ failure algebra, composed M8--M12 accessibility/audio workflows, nor final C-M13. E31 adds a separate current-P1 Chromium seam on signed M12 parent ba8d490c186afb8cdc5905923a60611772256b73: public synthetic Wasm, one actual module Worker, the P1 coordinator/current shell, an identity-only 258-range base stream, supplied-controller clean transition, pause/resume, delayed-start stop, and worker loss. Its local server/CDP boundary observes only self source/module/fixture requests and no WebSocket. It does not load M12 P2, selected media/runtime, M10, or IndexedDB.

E32 closes five prior M13 adapter HOLDs only at the narrow adapter boundary: a copied four-part binding prevents mutable-binding TOCTOU; branded review-lease release owns the only transient root pin across ordinary and ambiguous lifecycle paths; invalidation is terminal for that adapter rather than a route to reopen; a cursor advances only after its chunk hash resolves and its epoch remains current; and a disposable Chromium run observes those operations against real C-M10-IDB-v1. The generic M10 overlay archive is compared to the pinned review closure before exposure. Ordinary unpin response loss retains the opaque lease until its one branded retry succeeds. A no-lease acquire rejection first attempts same-authority synchronous revoke: pre-pin loss and successful post-pin rollback are proven terminal by a successful revoke, while only rejected revoke enters adapter RECOVERY_REQUIRED and requires same-authority acquire/release/revoke/close. The probe distinguishes a retained pre-operation root from real-IDB post-commit loss, where session rollover has already purged the snapshot but issued-ID unpin retry remains idempotent. Replacement cleanup is one private flight: concurrent success shares one Promise/result/replacement/revoke/close; concurrent failure shares one error, preserves its step, and needs a later explicit retry. Failed replacement may also be lease-free and remains UNKNOWN until a fresh replacement, revoke, and close complete. This is intentionally not the normative M13 pinned-object export record, restore adoption, or paused/reset composite restore; it does not use selected media or establish an M13 exit gate. The M13-AUDIO1 source profile now composes optional audio dispatch through the public shell and retains the no-audio default. Its real private v8 worker owns the ABI1.11 source, calls the actual open export, and pumps at most 64 semantic packets after open or acknowledgement. O0/O2, exact-record, overflow, source, worker, and synthetic lifecycle tests remain implementation evidence. A separate Chromium 150 probe on signed base 779812a now composes the selected ABI1.11 O2 module, actual worker, public shell, click-created 48 kHz AudioContexts, and real AudioWorklet; pause/resume changes epoch 2 to 3. The selected core remains empty. One explicitly synthetic 512-frame downstream record reaches the Worklet in epoch 3; its one acknowledgement reaches the actual worker, is rejected stale, and completes loss fencing. A new click-created context and epoch 4 then repeat the exact sequence with one synthetic 88-frame record. Three fresh captures have identical request/response order and canonical report bytes. Thus the run proves no selected guest PCM or successful automatic repump. The current public selected-media harness was rerun separately on the same signed base and byte-identical selected inputs and still stops at the first host wait rather than a Listener %BEEP. Guest-generated selected-media playback, composed autoplay denial, accessibility review, and the remaining failure campaign therefore remain open.

M14 — Reproducible museum release

Deliverables:

• deterministic build manifest and source map policy;
• browser compatibility test matrix;
• offline application packaging;
• user guide covering import, controls, save/export, reset, and rights boundary;
• release conformance report for CW0–CW4;
• generated artifacts carrying their exact source/license provenance.

Exit gate CW4-MUSEUM: two independent clean source extractions can build the same logical WASM artifact, load only policy-permitted inputs, pass all conformance gates, and complete the guided smoke workflow without a network.

Scaffolding status, 2026-08-02: the tracked M14 release note and cadr-web/release/ policies define a deterministic logical manifest, complete direct-input source map, closed static inventory, three-engine evidence matrix, rights inventory, deterministic guide/report generators, and a v1 receipt-admission policy. The candidate is derived from the exact canonical logical manifest; stable M6--M14 cases and blockers map to the existing definition-of-done clauses. The production adapter registry is intentionally empty, so any supplied receipt rejects and a zero-receipt aggregation remains entirely not-evaluated with release claim none. Runtime no-network behavior is still not-evaluated. The scaffold omits the final Wasm/worklet and leaves CW0–CW4 and all browser rows not-evaluated; it is not a CW4 claim.

The next M14 seam is now a source-tested but production-unmintable static comparison-report capability. It captures two direct M14 logical-manifest/source-map pairs through retained O_NOFOLLOW, one-link descriptors; rechecks descriptor, pathname, parent, and caller-supplied independent policy/comparator/evidence-engine hashes against both retained bytes and evaluation-time module identities; and produces only an unadmitted canonical report. The report's retained pair descriptor is not a duplicate match axis. The production constructor cannot mint while its registry is empty. Synthetic tests can bind report bytes only to the fixed sibling test-published root, never the production root, create a private temp and ready file under the retained publication directory, independently pin the retained static Linux link helper's bytes, and use a retained descriptor-relative Linux link for the sole final linearization point. It verifies the held and freshly reopened final identities, removes only ready, then syncs the directory and verifies those identities again. A post-link failure retains final and gives a closed durable, cleanup, durability, or identity-indeterminate receipt with no retry/overwrite. It never publishes either archive. A lost helper completion probes the retained directory: only an exact final report is published, with cleanup left unconfirmed; an absent or wrong leaf is respectively not-published or identity-indeterminate. The actual policy registry remains empty, and the CLI therefore refuses to mint a capability or create a link. This is neither public publication nor a distribution-rights decision, and cannot advance releaseClaim: none, any CW gate, browser evidence, or final-reproduction status.

M15 — Optional isolated Chaos networking

Deliverables:

• versioned WebSocket or WebTransport-style frame-broker protocol;
• explicit address and peer policy;
• offline loopback fixture;
• packet capture with guest and broker timestamps;
• rate, size, origin, and peer limits;
• UI that makes connection and remote peers visible.

The browser never receives raw host networking privileges. The broker MUST NOT expose the historical EVAL, file, remote-disk, or debugging services to untrusted peers by default.

Exit gate CW5-CONNECTED: a loopback-only synthetic peer passes packet-order, retransmission, disconnect, and malformed-frame tests; external connection remains an explicit user action.

M16 — Optional dynamic translation

Interpretation remains the reference. Optimization proceeds only after CW4.

Candidate tiers:

1. cache decoded 48-bit microinstructions;
2. translate straight-line microinstruction blocks terminating at jumps, dispatch, memory faults, interrupts, device accesses, OA modification, or writable-control- store operations;
3. translate stable macroinstruction blocks while preserving a microcode fallback.

Every translated block carries:

• control-store and code generation numbers;
• source PC range and decoded-word hash;
• assumptions about maps, interrupt checks, and restart phase;
• deoptimization exit mapping to exact interpreter state.

Exit gate CW6-OPTIMIZED: randomized and application workloads produce identical boundary traces with translation enabled and disabled; control-store writes and code mutation invalidate all affected blocks before reuse.