CADR-WEB-303 ABI 1.5 monochrome display and browser renderer reimplementation specification

Status and reconstruction claim

CADR-WEB-303/ABI1.5/protocol-v5/M7 defines a new, browser-facing transfer and presentation layer for the selected LM-3 System 303 monochrome display. It preserves the declared logical screen shape, raw-word bit order, black-on-white control bit, and selected source-visible redraw effects. Nonclaim: it excludes X11-window, phosphor, browser-chrome, CSS-layout, monitor-timing, and color-TV compatibility.

The implementation and synthetic cross-target checks described here are complete. The M7-only native-capture support, strict private-record verifier, portable Form-C checkpoint wrapper, and fail-closed P4/P5 campaign orchestrators are implemented and unit-tested, but C-M7 is not yet closed. It has two independent runtime obligations: raw native/Wasm identity at one real System 303 boundary (TODO-RUNTIME-M7-01) and a real-browser presentation capture proving integral fit and fullscreen behavior (TODO-RUNTIME-M7-02). Neither long campaign has completed successfully. The current native/Wasm comparison uses a deliberately synthetic two-word frame. That is useful evidence for bit order and transfer correctness, but not evidence that a real Listener screen has identical pixels in the two machines or that a browser presents it correctly.

This specification claims the following compatibility levels only:

No level above is historical binary, source, X11, or full-system compatibility. In particular, CDRDISP1 is a new portable record, not a Lisp Machine file format or a historical device protocol.

Normative language, selected profile, and evidence

The terms MUST, MUST NOT, SHOULD, and MAY state requirements for an independent implementation of this reconstruction. They do not attribute the new worker protocol or dirty-record representation to historical CADR hardware.

The selected source profile is public LM-3/System 303 source revision 4df393c68d7f083ce42d5c377039d26043cc18a9031ace28258dc97f4137eb91 with usim revision 330d8248ec2e12af071e287920e681600f75df9ffd854aada5f8a64c9adad64d. The runnable profile template fixes monitor = other; source initialization then selects width 768 and height 963. The System 303 disk is an excluded local input with the identity recorded in the profile, never a tracked test fixture.

Evidence-derived display model

U303-TV stores a 32K-word monochrome screen backing array. For the selected monitor, only the first 768 * 963 / 32 = 23,112 words constitute visible pixels; the remaining backing words MUST NOT appear in a logical-frame transfer. For a pixel at (x, y), where coordinates are zero based and the rectangle is 0 <= x < 768, 0 <= y < 963, the raw bit is:

word-index = y * 24 + floor(x / 32)
raw-bit    = (screen[word-index] >> (x mod 32)) & 1

Thus bit zero is the leftmost pixel of each 32-pixel word. The native screenshot routine walks the same word/bit pair in increasing linear-pixel order. Its textual PBM uses 1 for a set raw bit; that observation says nothing by itself about the displayed black/white palette.

TV mode bit 2 is the source's black-on-white (BOW) control. It leaves the raw screen words unchanged and changes only displayed polarity:

The portable core retains the raw 32K-word backing state and mode/control state in its existing machine state. It does not import the source's X11 bitmap, callback, or host-time state. Color TV is not an alternative M7 presentation profile.

Architecture and state model

guest TV writes / snapshot restore
             |
             v
portable cadr_machine state (authoritative raw words and tv_mode)
             |
             +--> derived cadr_display_tracker --CDRDISP1--> dedicated worker
                                                          |
                                                          v
                                      CadrMonochromeFramebuffer -> canvas/export

The machine state is authoritative. cadr_display_tracker is a derived cache with a 23,112-word mirror, per-row dirty word intervals, last observed BOW bit, a framebuffer generation, and a permanent overflow-failure bit. It is deliberately absent from CDRSTATE* digests and CDRSNAP1; it MUST NOT change a pre-M7 snapshot or canonical-machine digest.

The framebuffer generation belongs to the host machine instance, not to snapshotted guest state. Creating a new host machine, including a standalone restore that returns a new machine, initializes the tracker from the current raw screen with framebuffer_generation = 1 and requires a full refresh. Cold power-on and reset on an existing machine reserve the strictly next framebuffer generation before mutating core state, rebuild the tracker at that reserved generation, and require a full refresh. A same-worker restore creates the replacement core but adopts the old host instance's strictly next framebuffer generation before the worker swaps machines. It therefore does not resurrect a snapshotted dirty cache or restart the renderer-visible counter.

Before every display query, the tracker first counts changed active words and a possible BOW edge without mutating tracker state. If all increments fit, a second pass updates the mirror and dirty intervals atomically and advances the generation by that count. A BOW edge invalidates all row intervals and requires a full refresh. The scan-and-coalesce rule, number of generation increments, and row-rectangle strategy are INF-M7 transport policy; they are not claims about a historical dirty-region API.

An unchanged TV-word write can still be visible to other core observations, but it does not change a display word. It MUST yield an empty CDRDISP1 delta and MUST NOT advance the derived framebuffer generation. If synchronization, lifecycle replacement, or recovery-full generation would overflow, the tracker latches failed and returns NOT_READY; it MUST NOT wrap or partially change the mirror, dirty set, lifecycle state, or published bytes.

CDRDISP1 transfer record

All multi-byte fields are little endian. C structure layout, alignment, pointers, and typed-array host byte order are never part of the record.

ZERO_IS_BLACK MUST be set exactly when BOW is clear. FULL requires exactly one rectangle covering (0, 0, 768, 963). Every rectangle has nonzero word-aligned x and width; it lies wholly inside the logical display; records are canonical row-disjoint order; and their exact payload sum is required. A non-full record may have zero rectangles and zero payload. That canonical empty record is a successful no-changed-visible-pixels observation, not a failed request.

The tracker constructs each row interval from the least and greatest changed word. Adjacent rows with identical intervals coalesce into one rectangle. The resulting rectangle can include unchanged words inside the same dirty span; this is intentional over-transfer, not a claim that every payload word changed.

Core and Wasm operation contract

The ABI major remains 1. M5 and the M6 protocol extension both use ABI minor 4 (ABI1.4); M7 is exactly ABI minor 5 (ABI1.5) and protocol version 5. The literal values are a conformance surface, not derived from a milestone count. The tracker field, public display declarations, lifecycle hooks, display source, and active minor are compiled only with CADR_M7_CORE. The ordinary library and M3--M6 Wasm profiles retain ABI1.4, the pre-M7 cadr_machine shape, and no display symbols; M7 uses a dedicated native library and Wasm source closure. M6-DEVID keeps its separately selected source and export behavior. Protocol v5 retains M3--M6 operations and adds only:

display-update -> CDRDISP1 delta, possibly empty
display-full   -> one full CDRDISP1 record

Versions 1 through 4 MUST reject both operations with INVALID_ARGUMENT. A protocol-v5 instantiation MUST verify that the Wasm module exports both display entry points before it creates the machine. The worker owns the module and serializes requests; the main thread owns its received transferable byte array and browser UI.

display-info first synchronizes the derived tracker and returns its exact machine and framebuffer generations. display-update-size synchronizes and reports the required byte count. display-update-take synchronizes again, requires both caller generations to equal the current values and sufficient destination capacity, then encodes, validates, publishes, and clears the dirty set. A stale generation or short buffer writes zero result bytes and retains the dirty set. display-full synchronizes first, reserves the strictly next framebuffer generation, encodes and validates one full record with that generation, commits it, and clears the pending dirty/full state. A size failure, short capacity, validation failure, or overflow commits neither the generation nor pending-state acknowledgement.

The Wasm adapter obtains a fresh display-info, reserves a bounded host-owned arena, then calls one of those core operations. It transfers a copy, never a live Wasm-memory view. The worker validates CDRDISP1 again before exposing the frame. Invalid core output becomes INVALID_ARGUMENT; an empty delta returns no frame property.

Failure, abort, and recovery semantics

Malformed records, wrong fixed dimensions, unsupported flags, noncanonical rectangles, arithmetic-size disagreement, missing/full-inconsistent payload, stale generation, undersized output capacity, ABI mismatch, and a failed tracker are all rejected without publishing a partial transfer. A caller that loses or rejects a delta recovers by requesting display-full; its successful strictly newer full record supersedes and acknowledges the pending dirty state. A restored machine starts with a mandatory full record, so a renderer never merges a delta from a prior core with a restored raw screen.

The worker treats a malformed Wasm transfer as an INVALID_ARGUMENT response rather than passing it to the renderer. A browser renderer treats malformed or stale input as a synchronous exception and retains its previous complete framebuffer. None of these recovery paths writes guest memory, saves a snapshot, or labels volatile state as persistent.

Browser framebuffer and presentation contract

CadrMonochromeFramebuffer.apply first parses and validates the complete record. Every record, including FULL, MUST have a framebuffer generation strictly greater than the last accepted record. A change in machine generation additionally requires FULL; that full may represent reset or restored guest state, so the machine generation itself need not increase. FULL replaces all 23,112 words atomically. An initial delta, an equal or stale full, a stale delta, or a machine-generation-changing delta is rejected. Rejection MUST leave the old pixels, generations, and BOW state unchanged. A valid delta copies the old array and patches only its declared word rectangles.

The renderer exposes two separate evidence products:

The PBM container's bit order is an export-format rule; it does not invert CADR word bits. The displayed-pixel products are presentation observations and must not be used as a substitute for the raw frame when diagnosing device state.

integerPresentation(viewportWidth, viewportHeight) chooses the largest positive integer scale that fits the full logical screen and centers it with integer left and top letterbox margins. If either dimension cannot admit scale 1, it returns fits = false; a caller MUST offer scrolling, another viewport, or an explicit failure state rather than fractionally resampling the guest. Full-screen and fit-to-window hosts use this same rule with their chosen viewport. Entering browser fullscreen remains a caller-controlled, user-gesture-sensitive browser operation, not a capability of the guest or worker.

Canvas presentation allocates its backing canvas at the selected viewport dimensions, disables image smoothing, and sets image-rendering: pixelated. Its CSS width and height MUST equal the backing dimensions or an integer multiple. Device-pixel ratio, window manager composition, and other browser behavior are outside logical framebuffer conformance; the raw PBM and deterministic pixel buffers are the conformance surfaces.

Conformance suite and evidence limits

Run the implementation-level gate with:

make -C cadr-web m7-unit

The canonical target includes both campaign-schema regressions; neither starts a private runtime without a separate explicit --execute.

The M7 cross-target fixture writes source-native words 0x80000001 at word zero and 0x00000002 at word 25, then writes the same values into a portable snapshot. The test compares all 739,584 raw logical pixels from native P1 output and from the Wasm CDRDISP1 record, not an interpolated canvas. It proves source-bit-order agreement for those selected values, including positions 0, 31, and (33, 1). It is intentionally synthetic and must never be relabeled as a System 303 boot or Listener screenshot.

m7-unit is the self-contained clean-archive gate and is a prerequisite of ordinary make test. It has no dependency on the ignored native checkout and compares every O0/O2 logical pixel to an independently constructed expected array. Ordinary make test also requires m7-native-source-unit. That checkout-only differential target rejects a missing, symlinked, or hash-mismatched tv.c, tv.h, bus-interface.h, ucode.h, utrace.h, usym.h, trace.h, or BSD notice; it generates a fresh private native PBM and compares all of its pixels to both Wasm builds. A source release without Git history or the separately pinned public native checkout can run the clean milestone targets, but cannot claim the full checkout suite.

Neither target invokes a long private runtime campaign. The two explicit runners refuse to start without --execute, so schema tests cannot accidentally cold-boot a private CADR session. Those remain the separately named TODO-RUNTIME-M7-01 and TODO-RUNTIME-M7-02 gates below.

The test PBM/PPM outputs are transient synthetic test artifacts. They are not curated runtime screenshots and are not embedded in this knowledge base. No visible System 303 claim is made on this page, so no published screenshot is substituted for the open runtime oracle; this follows the repository's screenshot-publication review.

Receipt-bound M7-DEVID intervention evidence and offline recovery

The retained 776a427 M7-DEVID intervention child completed its bounded 1,130,000-guest-boundary run, but the ordinary final receipt was not published. This is a validator defect in the outer publication path, not a failed guest run. It is recoverable only by a separately committed, no-replace offline recovery tool. That recovery completed from commit 97a95ae62d779cfca5a8059b7679947ff21bb64a and published only the separately labeled ignored recovery receipt described below. The intervention remains narrower than M7-P4 and does not close C-M7.

M7-DEVID-RAW is local, ignored evidence. The child envelope is .8cdaef46c7a239112b4352d01fb06c87.m7-canary-envelope.json, 28,023 bytes, SHA-256 efd29682e90adfa6413412aa051787802cbdd3fd571180cc73ca1d53ed1061ba. It names base ab6536353360d48bb6620e7da04275935f51f37a, its sole-parent candidate 776a427b71a52911df531e1c2aaef29089300be4, and the two-file textual patch (cadr-web/Makefile and tests/test_cadr_m7_devid_o2_canary.mjs) with SHA-256 2b747c58932c2a51896555ff3b8522a05ea2c0cac22b260e364473d54c250b17. The retained child record reports persistent status zero, no outstanding request, 535 accepted disk-evidence events, 23 tail events, and completed boundary 1130000. These facts are bounded to that recorded child and do not establish native-frame or browser behavior.

The accompanying outer failure is final-receipt.json.failure.json, 1,170 bytes, SHA-256 6646a8f81747d9c5c8e3097c3559a5a0c564f0d90c4dc67f21d78aaa6301bea7. It records successful submission and child exit status, successful accounted systemd completion, retained child envelope, successful cleanup (no cleanup failure), and the two original reasons: outer final-receipt-publication-failed and validator candidate-identity-failed. The outer wrapper performs its cleanup before it attempts final-receipt validation/publication; this record therefore supports reconstructing the two cleanup booleans only after the raw pair and wrapper semantics are revalidated together.

The defect was in sourceClosureFromGit: it selected candidate bytes for every path in the base tree. The staged tree, however, is the base archive overlaid only by the two-file payload patch; the candidate additionally changes the fixed manifest, whose bytes are not staged by that overlay. The faulty all-candidate recomputation produces SHA-256 26bbbee0a17688ff82a5b42f16ced571d490e3c5a4fb988affc76d620122418f. The actual staged closure and the candidate's closed manifest agree on 81a13568e95fdf6cd951ac50bb07a4f9045d09684b5ca4ddd83cb8caeb5bb2f1 (1,154 files and 22,896,951 bytes). The corrected validator reads candidate bytes only for payload-patch paths and base bytes for every other path.

recover-cadr-m7-devid-o2-canary.mjs implements the only authorized recovery procedure. It requires an explicit --execute, and an exact committed two-module local ESM closure: the entry point and the crypto/record-only cadr-m7-devid-o2-recovery-core.mjs, in that order. It does not import the M6/M7 runner, stage executor, systemd wrapper, or any guest-capable module. Each verification opens both retained raw records as owned mode-0600 nonsymlink files, checks their fixed identities and canonical UTF-8 JSON encodings, derives source_evidence and the reconstructed final receipt only from those freshly read records, then exact-deep-compares the candidate receipt to that derivation. It independently repeats the raw-derived comparison immediately before publication and again after reopening the published canonical no-replace receipt. Thus a caller-supplied embedded source_evidence or reconstructed_final_receipt cannot substitute for the retained raw pair.

The verifier also requires the sole base/candidate/manifest lineage, successful accounted unit/submission/child/cleanup invariants, and both the faulty and corrected closure digests. It writes only inside the existing private 0700 evidence directory, rejects an ordinary final-receipt.json, an existing or symlinked output, and any output outside that directory. It never invokes a system manager, guest, native emulator, or browser; its focused tests include a successful PATH-spy derivation and coordinated mutations of repeated unit, accounting, guest, gate, launcher, toolchain, control-plane, frozen-release, and helper-module fields.

EVIDENCE-M7-03 completed once with the exact committed two-module tool closure at 97a95ae62d779cfca5a8059b7679947ff21bb64a. It created the ignored mode-0600 file recovery-receipt.json, 30,836 bytes, SHA-256 5e5e389a3d7d536535066ab65209de6d6dedfad33cca0e3744bf6f08cf46ce4a. The receipt has schema cadr-m7-devid-o2-canary-recovery-v2, outcome recovered-final-receipt, and the exact root keys schema, outcome, source_evidence, recovery_tool, diagnosis, and reconstructed_final_receipt. It binds the unchanged raw pair, candidate 776a427b71a52911df531e1c2aaef29089300be4, completed boundary 1130000, the corrected and faulty closure digests above, verified unit cleanup and root removal, and the ordered committed identities of both recovery modules. The ordinary final-receipt.json remains absent and both raw inputs retain their original identities. This bookkeeping repair was not a retry and does not claim M7-P4, M7-P5, or C-M7 closure.

TODO-RUNTIME-M7-01: close raw native/Wasm checkpoint identity

The support described in steps 1--3 exists as an M7-only, unexecuted capture path; the supervised runtime campaign remains planned. It closes M7-P4 only if both halves name the same completed Form-C guest slot and compare the raw words. It cannot by itself close C-M7, because it does not exercise a real browser's layout or fullscreen path.

TODO-RUNTIME-M7-02: verify a real browser presentation

After TODO-RUNTIME-M7-01 supplies the source-bound portable full record, load that record through the production worker and renderer in a real supported browser, not a Node canvas mock. Retain browser/version, OS/display scale, device-pixel ratio, viewport and screen dimensions, module and renderer hashes, input-record hash, and the ordered operator actions.

The run MUST exercise and capture both an ordinary fit viewport and fullscreen entered through a real user gesture. For each state, inspect the canvas backing dimensions and bounding rectangle; prove that the entire 768 by 963 frame is visible, the selected scale is a positive integer, each source pixel maps to an exact integral rectangle, letterbox margins match integerPresentation, image smoothing is disabled, and no CSS or device-pixel-ratio transform introduces fractional resampling. A deliberately too-small viewport MUST expose the defined non-fit behavior rather than silently scaling fractionally.

Retain raw screenshot bytes, PNG and decoded-pixel hashes, browser automation log, fullscreen entry/result, and exit result in the ignored session tree. Any selected image for docs/assets/mit-cadr-screenshots/ additionally requires the repository's per-image rights review and catalog provenance. This campaign closes M7-P5; C-M7 closes only when both M7-P4 and M7-P5 are closed.

run-cadr-m7-browser-conformance.py is the P5 entrypoint. It binds the manifest session ID to the supplied directory basename and revalidates the complete closed P4 schema, including unchanged private disk, clean native/oracle/portable termination, session evidence, every redundant checkpoint hash, and fresh hashes of all nine P4 sidecars. It independently parses the rehashed fixed-size CDRM7N1, types every header field, and derives BOW from the uint32 TV mode before accepting the manifest capture identity. Before starting its server it snapshots the exact CDRDISP1, generated HTML, production JavaScript, renderer, and CSS bytes. GET and HEAD share one explicit loopback allowlist with Cache-Control: no-store; every other repository path returns 404, and no request rereads changing repository assets or falls back to m7-synthetic-record.mjs. On explicit --execute, it requires nonempty hashed Chromium and Xvfb command identities and the reviewed Chromium 150 profile, creates a new 0700 ignored session and a fresh 0600 Xauthority cookie, passes that cookie to Xvfb with -auth, and exposes XAUTHORITY only to Chromium. It starts headed Chromium on isolated 1920-by-1200 Xvfb with devicePixelRatio = 1, and binds the served host, renderer, and CSS snapshots by exact path and hash in the closed result. It independently recalculates integral fit, validates and retains integral canvas/stage/source-clip bounds, proves the source placement from stage origin plus letterbox offsets, verifies canvas backing and computed CSS dimensions, pixelated/no-smoothing policy, full source-frame pixel rectangles, and decoded ordinary/fullscreen PNG hashes. It requires a 767px zero-fit result. Fullscreen entry and exit are trusted host-control clicks and both must succeed; denial, a fallback message, fractional coordinate, cacheable frame route, missing full-frame capture, or failed exit invalidates the campaign. Raw captures and logs remain 0600 ignored session payloads. No P5 browser run has yet been performed.

For v3, P5 additionally rehashes and validates the complete identity stream and CDRM6HS1 sidecars, bringing the P4 sidecar count to eleven. It never serves either evidence sidecar: both GET and HEAD remain outside the explicit allowlist and return 404. This source behavior is unit-tested but has not yet produced a P5 runtime result.

Artifact boundary and sources

Tracked implementation material is the portable C/JavaScript code, synthetic fixtures, tests, and this specification. The public usim source is BSD-2-Clause under the exact source-map provenance. The System 303 disk, PROM and microcode payloads, raw native captures, private snapshots, and any real display capture remain outside this M7 tracked deliverable unless their separate rights and provenance reviews permit a narrowly selected image.

Primary sources and local witnesses:

• usim, tv.c, lines 21--75, 169--245, and 283--366; verified 2026-07-29.
• CADR core source map, selected revision and public-source identity record; verified 2026-07-29.
• CADR-WEB-303 profile and runnable template, selected monitor and private-artifact boundary; verified 2026-07-29.
• M7 core transfer implementation, browser renderer, and native/Wasm fixture test; verified 2026-07-29.