CADR-WEB-303 C-M12 debugger reimplementation specification

Status and reconstruction claim

CADR-WEB-303/ABI1.10/protocol-v7/C-M12-DBG-v1 is a Phase 1 debugger contract with a deliberately narrow integrated M12 build profile. Its reference model implements a 64-record breakpoint table, one-complete-outer-slot micro-step, a mandatory generated/native-oracle-gated macro-step, read-only paused inspection, an installed copied trace-filter state, and bounded canonical evidence records.

The narrow M12 profile now provides the cumulative ABI 1.10 core adapter, scalar-only protocol-v7 worker branch, O0/O2 Wasm builds, a browser-accessible scalar-inspector panel, and a pointer-free CDRM12C1 breakpoint-configuration sidecar. Its adapter calls the real core exactly once for a successful micro-step, binds the five read-only inspector arrays to the live machine, and invalidates/rebinds that owner across machine replacement. It recognizes only the public System 303 source labels QMLP (I-MEM 0164) and DMLP (I-MEM 0200) as candidate macro-loop boundaries.

ABI 1.10 also closes the adapter's source-level lifetime and exhaustion boundary. The adapter's first initialization accepts only a semantically zero, stable-address domain/debugger/owner tuple; a byte-copied live adapter is rejected before it can follow its copied machine pointer. Normal teardown clears the active payload but retains that address-bound domain's monotonically increasing incarnation counter. Consequently, an old lease remains stale even after a new owner is installed at the same debugger and owner addresses with the same machine generation. Internal owner-lineage exhaustion remains C-M12 status 21; direct Wasm lifecycle and snapshot bridges map it to the preexisting public resource-exhaustion status 15, and no v7 debugger request admits 21.

The M12 direct-Wasm generic snapshot is now the CDRM12S1 composed envelope, which retains frozen CDRSNAP1 and adds digest-bound CDRM9D1, CDRAUDS1, and CDRM12C1 records and gives their adoption one staged publication boundary.

It claims semantic and selected wire-representation compatibility for those clean-room rules and that narrow adapter only. It does not claim a preserved-system or hardware observation of the selected M8/M11 order, AudioWorklet behavior, a historical CADR debugger, preserved System 303 load-band behavior, or that the two source labels fully establish historical macro-step semantics. In particular, changing a location counter or revisiting an arbitrary PC is never evidence of a macro boundary.

The implementation comprises the reference model cadr_m12_debugger.c, machine adapter cadr_m12_machine_adapter.c, and closed protocol subhandler cadr-m12-debugger.mjs. It updates the ABI, M12 Wasm build, and worker surfaces without changing their earlier protocol branches. CDRM12C1 is available through direct Wasm exports and closed v7 save/restore operations. The v7 build composes M8/M9 CDRINP1 ingress with M11 audio and M12 controls. Direct generic Wasm and v7 worker save/import use exact CDRM12S1 version 2. Full M12 closure remains conditional on provenance-bound runtime evidence.

MUST, MUST NOT, SHOULD, and MAY are normative below.

P2 source-only production review coordinator

CADR-WEB-303/ABI1.11/protocol-v8/M12-P2-DBGPROV1 is a host reconstruction decision layered above, not a replacement for, the closed ABI 1.10/v7 debugger branch. It binds a direct status-19 breakpoint or status-20 macro-limit stop to one private worker snapshot transaction. Status 20 is accepted only with the exact 1,048,576 completed-slot stop record. The public v8 grammar never exposes the private save/next/release operations or their snapshot identifier.

The coordinator has the states PAUSED, STOP_BOUND, REVIEW_READY, EXPORT_PREPARED, RELEASE_REQUIRED, and absorbing FAILED. Review is admitted only from STOP_BOUND; it pauses and joins injected audio, performs a clean M10 reread/pin, streams a bounded generic CDRM12S1 v2 snapshot, and validates all four constituents before making a read-only review view. The maximum raw envelope is exactly 18,132,272 bytes: 48-byte header, 18,126,780-byte CDRSNAP1, 72-byte CDRM9D1, at most 4,284-byte CDRAUDS1, and 1,088-byte CDRM12C1. The JavaScript validator mirrors the native audio grammar, including the valid 64-packet pending-active queue case; it does not accept an abbreviated audio witness.

Export is a bounded staging protocol: commit may be asynchronous, accept is the sole synchronous publication linearization point, and cancel must confirm unpublished, erased staged bytes. Every await in review preparation, streaming, parsing, staging, and commit is followed by an invalidation-epoch check. Reset, worker loss, rejection, and private-transaction invalidation advance that epoch, own host zeroization and cancellation, and leave FAILED sticky; a stale reply or token cannot publish or resurrect a review. Failure to confirm worker snapshot erasure is protocol status 25 and terminates the owned worker.

P1's awaited handoffDebugger call synchronously fences later P1 admissions, drains P1's existing FIFO, and transfers a branded single-use capability without allocating an operation identifier. P2 therefore submits through P1's exact tail and request-ID allocator; it receives closures for debugger submission, fresh private snapshot transactions, and the restricted M10 review authority, never the shell, controller, disk handle, snapshot identifier, or root-reference identifier. An unused transferred authority remains P1-private; P2 receives no second claim.

Every review obtains a fresh private snapshot transaction. Issuing its private save is already an ownership edge: before the shell has parsed an identifier, a dropped, timed-out, malformed, or post-disposal response can still correspond to an allocated worker snapshot. Therefore such a response loss fail-stops the one worker owned by the shell (or reports the same loss to P1, its external owner), produces WORKER_TERMINATED, and fences any delayed response. It MUST NOT produce ABSENT, reopen the transaction, or install a late snapshot identifier.

Terminal cleanup first cancels and zeroes host state, then obtains the worker disposition ABSENT, RELEASED, WORKER_TERMINATED, or UNKNOWN, and only after that disposition releases the opaque M10 lease. UNKNOWN retains that lease in RELEASE_REQUIRED; an ambiguous unpin acknowledgement retries only the idempotent M10 release and does not re-release the already closed snapshot. A confirmed discard renews the private transaction through its factory before the next review cycle. Source/synthetic regressions exercise two independent save/release cycles, an allocation followed by a dropped and then delayed save reply, and prove that the M10 release is ordered after the known WORKER_TERMINATED disposition. The frozen P1 public stream limit remains 18,131,492 bytes; P2's 18,132,272-byte raw limit and a possible 18,132,632-byte future wrapper are separate receipt/profile values, not public restore widening.

M10 permits only one branded review-authority claim per controller. If P2 construction fails after P1 has claimed that still lease-free authority, P1 retains it privately for exactly the next attempted handoff rather than revoking it and trying to mint an impossible second claim. P1 terminal loss first completes the worker/snapshot cleanup above, then records an explicit terminal-authority state: IDLE, INVALIDATING, WORKER_TERMINATION_PENDING, non-retryable EXTERNAL_RECOVERY_REQUIRED, the named invalidation/M10-release retry states, AUTHORITY_REVOKING, AUTHORITY_RECOVERING_ACQUIRE, AUTHORITY_RECOVERING_RELEASE, the named authority retry states, or REVOKED. Normal M10 revocation is synchronous. If it rejects because the current M10-v5 authority is RECOVERY_REQUIRED after a post-pin rollback failure, P2 invokes only that same branded acquire(), which performs M10's opaque rollback recovery and returns a lease; P2 releases that lease and only then retries synchronous revoke(). An acquire, release, or final revoke failure retains the exact failure object and the privately held authority/lease in a retryable state. P1 observes the rejected flight so it cannot become an unhandled rejection, but does not convert it to success; retryTerminalCleanup() starts the next real cleanup attempt. No state exposes an M10 disk handle, pin ID, or second authority. This is an inferred host-safety rule, not a claim about historical CADR debugger authority.

An UNKNOWN worker-snapshot disposition is never itself retryable permission to unpin. For the production external-Worker profile, a single-use shell operation fences the shell and itself invokes the exact captured Worker's required synchronous terminate(). Only normal return from that call permits the one-way UNKNOWN to WORKER_TERMINATED upgrade; callers cannot mint a separate confirmation. The debugger then replaces only that same transaction's memoized unknown-disposition failure and releases M10 exactly once. A missing or throwing operation leaves EXTERNAL_RECOVERY_REQUIRED with retryable:false and retains the lease and pin. The synchronous termination receipt separates that proof from its asynchronous disposition flight: a later observer or durable-unpin rejection remains P2's named retryable M10-release state and never reclassifies the already terminated Worker.

This is source and synthetic-conformance evidence only. It deliberately does not close C-M12, claim a selected load-band/debugger observation, or promote the full historical console debugger from HOLD.

Evidence boundary and compatibility level

The public System 303 console-debugger discussion is useful historical context, but C-M12 does not copy its command language, modify control memory, or claim a second debuggee link. See the separate CADR microcode, microassembler, and console debugger dossier.

M12-L0, the narrow cumulative ABI 1.10/protocol-v7 adapter seam, composed M8/M9/M11 input and audio order, direct-Wasm CDRM12C1 save/restore, and direct-Wasm composed snapshot adoption and source-level protocol-v7 M9 input continuation are implemented and tested. Provenance-bound runtime evidence remains open.

Architecture and explicit integration obligations

ABI1.10 core complete-slot adapter
        -> C-M12 debugger state model
        -> CDRDBGSTOP1 / CDRPROV1 / CDRBUG1
        -> protocol-v7 worker branch

public System 303 QMLP/DMLP source labels ----^  (candidate loop map only)
generated/native execution oracle ----------------^  (still required for closure)

caller-owned incarnation domain -> debugger -> registered owner/incarnation
                                           -> read-only inspector lease
retained-trace owner -> installed copied C-M12 filter predicate

State model and invariants

The debugger starts paused with a nonzero generation, a current boundary (micro_pc, raw_lc, fault, device_request), zero completed slots, and an empty table. A C-M12 operation is serialized; a callback runs while the debugger is internally non-paused, so a reentrant inspector request cannot observe moving state.

The direct inspector arrays are exactly A memory (1024 words), M memory (32), dispatch memory (2048), PDL (1024), and micro stack (32). Before any debugger is initialized, the caller zero-initializes and initializes one stable-address incarnation domain. A virgin debugger accepts that valid domain. The separate reinitialize operation accepts only a valid paused debugger with no owner and the same domain; it cannot select another lineage. A domain self token rejects an initialized domain that was copied or moved, and its lifecycle/reserved words are validated before use. This is a DEC-M12 live-host safety rule, not a historical CADR representation and not a serialization format.

Virgin debugger validation compares every named field to its semantic zero value; object padding is irrelevant. Initialization installs the debugger's own address token and live lifecycle. Every later operation validates those fields before it can follow the owner route. Thus a bytewise copy or move is invalid at its new address, and even lease-open rejects such a copy before dereferencing a dangling copied owner pointer. Owner bind records the exact validated debugger self identity; retire, lease-open, and lease-read require that same identity.

The caller binds arrays through a stable owner object and the domain allocates the owner incarnation monotonically. Bind validates the debugger, domain, owner, and all five array shapes before reserving an incarnation. UINT64_MAX is an unissued exhausted sentinel: bind returns the dedicated nonterminal INCARNATION_EXHAUSTED = 21 with the domain, debugger, and owner byte-identical. Otherwise the reservation and publication have no later fallible path, and an issued value is never recycled. A lease holds only debugger/owner identity, incarnation, and generation. A read first proves the registered route, generation, and incarnation still match and only then dereferences the owner and selected array. Retirement clears every debugger route before zeroing the owner, so an old lease can be checked after old owner and array storage has been freed without dereferencing it. Rebinding the same owner address after same-address debugger reinitialization receives a distinct domain incarnation and does not revive an old lease. There is intentionally no bus read, memory deposit, control-memory edit, or arbitrary address route.

The composed adapter extends that rule to its containing storage. Its first initialization requires every named domain, debugger, owner, filter, machine, and adapter field to be semantically zero; debugger padding is still ignored. It validates the initial machine generation and complete debugger boundary before changing that virgin storage, so an invalid initial boundary leaves it byte-identical and a corrected retry may succeed. Before an adapter-facing operation reads machine, it proves that the embedded domain and debugger self tokens point back into the containing adapter. Thus a byte-copied live adapter rejects configuration serialization and other adapter operations without following the copy's possibly dangling machine pointer.

destroy retires the owner and zeroes the debugger, owner, machine route, filter, and adapter flags, but retains the live same-address domain and its next-incarnation counter. Reinitialization accepts that exact reusable state and allocates the next owner incarnation instead of restarting at one. If an old lease is presented after the new owner is installed—even when debugger address, owner address, and machine generation all match—the incarnation comparison returns STALE_GENERATION before array access. At UINT64_MAX, reusable initialization returns internal status 21 without changing the retained domain or empty payload.

cadr_m12_machine_adapter_rebind_preflight validates the replacement boundary and checks the unissued UINT64_MAX incarnation sentinel before the old owner is retired. Both ordinary rebind and CDRM12C1 rebind use it, so internal status 21 leaves the live adapter, owner, lease, and machine selection unchanged. The latter two adapter functions return the C-M12 status type rather than the generic core status type. At a direct Wasm lifecycle or composed-snapshot boundary, status 21 is mapped to public CADR_STATUS_NO_MEMORY = 15; the C-M12 spelling is not an undocumented generic ABI result.

Breakpoints and deterministic stop order

At any pre-boundary C-M12 tests MICRO_PC_BEFORE, then RAW_LC_BEFORE; after a complete slot it tests CLOCK_SLOT_AFTER, then FAULT_AFTER, then DEVICE_REQUEST_AFTER. Within each kind it scans fixed record indices in ascending order. The first match wins and produces DEBUG_STOP = 19; no later predicate is evaluated for that operation. This kind-and-index ordering is DEC-M12, tested by an intentionally lower-index fault record losing to a higher-index clock record.

resume-one-boundary requires the previous stop to be a breakpoint stop. It arms only that record's index. The next pre-boundary scan skips that one index and then clears the arm. A duplicate condition in a different record still stops. This avoids accidental repeated stops without silently disabling an entire condition.

Stepping contract

evaluate ordered pre-breakpoints (with exactly one-record suppression)
if matched: return DEBUG_STOP, execute zero slots
call core_complete_slot(before) -> completion
if callback did not report exactly one completed slot: return NOT_READY; retain state
commit post boundary; clock_slots++, generation++, boundary_ordinal++, run_ordinal++
evaluate ordered post-breakpoints
if matched: record and return DEBUG_STOP
return OK

require oracle YES at initial PC
repeat at most 1,048,576 completed slots:
    perform the complete micro-step boundary and its breakpoint checks
    if a breakpoint stops: return DEBUG_STOP
    ask oracle about resulting PC
    if YES: return OK before executing that PC
    if a supplied generic oracle is unavailable: return ORACLE_UNAVAILABLE
return LIMIT_REACHED = 20 and record a macro-limit stop

Canonical records and privacy boundary

All multi-byte fields are little-endian. Native C structure layout is never a wire format.

Protocol-v7 reference surface

CadrM12ProtocolSubhandler recognizes only a well-formed v7 positive-u32 request ID and dispatches these isolated operations to its injected future backend:

Unknown operations return null to the outer worker; extra fields are rejected before backend invocation. Every recognized response has the ordinary cadr-response envelope, v7, matching ID and operation, numeric status, ok, and terminal. ok is true only for status zero. The backend envelope itself is closed to {status,result?} and each operation has a closed status and result schema:

A nonzero nonterminal response has no result. A malformed backend envelope, extra result field, operation-inappropriate status, or terminal status/stop mismatch is mapped to status 2 with the fixed reason backend-response. Exceptions are mapped to status 2 with fixed reason backend-rejected; backend messages, paths, byte payloads, and private fields are never reflected. Statuses 19 and 20 are marked terminal: true but are transient control outcomes, not persisted lifecycle states. Status 21 is excluded from every v7 debugger-operation set: no debugger request owns a rebind. A backend that supplies 21 is therefore an operation-inappropriate backend response and receives the same closed status-2, nonterminal, no-result backend-response envelope; it cannot be converted into a stop or disclosed as an adapter detail. The module deliberately has no generic scheduler, trace-output, generic array/address/byte-range, snapshot, PCM, worker, or Worklet operation; debug-inspect-read is its only scalar inspector route.

Failure and recovery

• Invalid breakpoint kind/value, table index, callback output, direct-array shape, nonvirgin or copied/moved debugger, virgin/live/copied/moved/reinitialized domain, mismatched reinitialize domain, stale lease, record byte, protocol field, or filter range is rejected with no partial C-M12 mutation.
• Adapter initialization validates the complete initial machine boundary before it initializes a virgin domain or publishes a debugger. An invalid boundary leaves every named adapter field unchanged, and retrying after correction is supported. Destroyed same-address storage retains only its valid domain and monotonic incarnation counter; a failed retry leaves that reusable state unchanged.
• A live owner rejects debugger reinitialization without changing the debugger, domain, or owner. Bind validates every input before it tests reservation; at the UINT64_MAX exhaustion sentinel it returns nonterminal operation status 21 and leaves the domain, debugger, and owner byte-identical. Rebind performs the same exhaustion check before retiring its owner. Status 21 is not a debugger lifecycle value, CDRBUG1 terminal status, or v7 debugger result. The direct Wasm lifecycle and composed-snapshot bridges map it to generic status 15 before core mutation or publication; a v7 debugger backend that attempts to return 21 is rejected as a closed status-2 backend response.
• A core callback may propagate only statuses 2, 7 through 12, and 14 through 18; C-M12 restores its paused marker and does not fabricate a completion. Any other nonzero callback status, including 19 or 20, maps to INVALID_ARGUMENT. Only C-M12 breakpoint evaluation or macro-limit accounting can create a canonical stop and return those terminal statuses.
• NOT_READY from zero-slot completion is retryable and preserves current state and leases. A bad completion is not a retryable inferred zero slot.
• ORACLE_UNAVAILABLE never becomes a guessed macro step. It remains the result for a generic unavailable oracle; the integrated adapter instead has the closed two-label source map and remains gated on native execution evidence.
• A breakpoint DEBUG_STOP or macro LIMIT_REACHED retains only a bounded stop record. Resuming after a macro limit has no suppression because it was not a breakpoint stop.
• Any future snapshot restore must invalidate all direct-array leases even when its machine contents compare equal; the Phase 1 model has no restore API.

Conformance suite

Open oracle backlog and nonclaims

No historical console command grammar, symbolic decoding, control-memory patching, temporary historical breakpoint behavior, source compatibility, native binary compatibility, source-to-band identity, exact timing, or screenshot claim is made. The browser panel is a modern accessible host control, not a historical UI, and has no CADR application key, menu, pointer, presentation, or Help binding inventory.

After the separately running M6 benchmark has released the private-runtime slot, the following exact native-capture form may collect the public-usim candidate-loop witness. It was not run for this work. Replace only the bracketed private-runtime path and date/session fields; use a fresh empty 0700 output directory under build/cadr-oracle/ and current-owner regular non-symlink configuration and private disk files within a 0700 runtime.

python3 scripts/cadr-m12-native-debugger-oracle.py native-capture \
  --prepared build/cadr-oracle/m12-debugger-witness-campaign-20260729-v2 \
  --config <private-runtime>/usim.ini \
  --private-runtime <private-runtime> \
  --private-disk <private-runtime>/disk-sys-303-0.img \
  --output build/cadr-oracle/m12-runtime-YYYYMMDD \
  --session-id m12-YYYYMMDD-1 --candidate-pause-resume --execute

The entrypoint requires explicit --execute, makes a fresh executable copy beneath the output directory, clears ambient locale/timezone state, and rejects an altered private disk or a missing/non-real witness. --candidate-pause-resume is M12-only: it writes a private 0600 control file, waits for the hook's candidate-loop candidate-pause-enter record, writes resume, and requires the matching candidate-pause-resume record. This is a controlled witness pause/resume at a source-named candidate loop, not historical CADR debugger behavior. A successful metadata record hashes the public closure/patch/executable, private configuration and disk before/after, witness and logs; records the portable toolchain and ordered actions; and retains clean versus forced-stop state. It does not prepare private runtime artifacts; the project runtime-preparation policy remains a prerequisite. A refused or invalid capture exits nonzero.

Artifact identities and sources

Last verified: 2026-07-30.