The MIT CADR Error Handler and Window Debugger

Public System 46

The historical source is pinned at Git revision 8e978d7d1704096a63edd4386a3b8326a2e584af. The package declaration is decisive about which duplicate source line belongs to the release: LISPM; PKGDCL 230 loads LMWIN; EH, EHR, EHC, and EHW into package EH. This article therefore does not silently substitute the different LISPM2; EH implementation found on the same recovered tapes.

The System 46 tree is publicly MIT-licensed. No compatible System 46 load band was run for this article, so its visible behavior is source- and manual-grounded only.

Maintained LM-3 System 303

The maintained source is pinned at Fossil check-in 4df393c68d7f083ce42d5c377039d26043cc18a9031ace28258dc97f4137eb91. Its EH system declaration compiles EH, EHF, TRAP, CONDITION-FLAVORS, EHC, EHW, and EHBPT. The source below and the runtime load band are both labelled System 303, but the maintained checkout is reported as a restoration artifact rather than projected backward onto the original historical distribution.

System 46 trap and condition path

System 46's error table maps micro-PCs to error table entries (ETEs). The entry's first symbol has properties for reporting the error, optionally signalling a Lisp condition, and optionally proceeding at a microcode restart point. EHR supplies cases for wrong argument types, arithmetic over- and underflow, divide by zero, array bounds, PDL overflow, illegal instructions, transport traps, function-entry traps, breakpoints, and other low-level events.

Its Lisp condition layer is compact. condition-bind searches dynamically established handlers; ferror and cerror describe whether an error is proceedable or restartable; a property on the condition can customize how Control-C proceeds. If no handler accepts the condition, the interactive handler owns the suspended computation.

System 303 condition objects and resume handlers

System 303 changes the center of gravity. make-condition constructs a flavor instance. A condition object supplies methods for reporting itself, choosing a current frame, entering its debugger loop, listing user proceed types, and documenting or executing those types. signal-condition searches condition and default handlers, decides whether to invoke the debugger, and then either returns a locally offered proceed type or invokes the matching nonlocal resume handler.

Microcode errors are converted into condition objects before interactive debugging. The source explicitly says this keeps the debugger from needing two separate user-interface paths for microcode and Lisp errors. Dynamic proceed choices and resume handlers also explain why the opening list of Super commands varies with the condition.

The function EH can debug a process, a window that yields a process, or a stack group. A stack group enters examine-only mode: frame inspection works, but operations that would resume or mutate execution are rejected, and Resume only exits the examiner. This capability is documented and implemented; it is not present in the System 46 manual's user-facing entry story.

Complete System 46 initial key dispatch

“Complete” here means every non-NIL entry in the initial dispatch table loaded from LMWIN; EHC 36. It does not include condition-specific questions asked by a command, site patches, or dynamically rebound characters.

The manual's shorter summary omits several Control-Meta operations, but its long-form text explains the important argument/local locatives. Meta-R is an especially useful negative finding: the key is visibly reserved, the manual labels it nonworking, and the source body contains only a “write this” marker. The only argument characters are Control-, Meta-, or Control-Meta-modified decimal digits; there is no minus leaf. Digits accumulate in base ten even when the Lisp reader base is octal, and the value is cleared after the next command. Unmodified ordinary characters enter the form reader. Rubout retries at command boundary, Control-G throws to the debugger catcher through the I/O buffer, and Break can enter a nested break loop.

Complete System 303 initial key dispatch

System 303's table is substantially larger. Super-A through Super-Z are a range, not twenty-six universal commands: the currently available proceed and special choices are assembled for the actual condition and printed when the debugger opens.

The topical Help dispatcher is a second-stage tree: G/g General; I/i or E/e Information; F/f Stack Frames; S/s Stepping; P/p or X/x Proceeding plus the current dynamic choices; T/t Transferring; and D/d or C/c Describe followed by one command character. Help or ? prints the topics and remains in Help; Abort, Control-Z, or Control-G aborts it. The older System 46 handler instead prints one fixed help body.

System 303's signed parser is intentionally nonconventional in the pinned source. Minus begins at -1, then a digit computes digit + 10 * old; minus followed by 3 therefore yields -7, not -3. A second minus beeps and preserves the prior argument. This exact arithmetic remains pending runtime confirmation and must not be normalized in a source-compatible implementation. The D04 specification records each command family's use or non-use of the resulting value.

Window-oriented handler

The harness sent host ctrl+alt+w through XTEST and usim's configured Cadet keyboard map. The ordinary handler echoed c-M-W and printed “Transfer to window-oriented debugger!” The live graphical frame then showed:

• an Inspector view of #<Stack-Frame FERROR PC=44> and its stack group, argument pointer, and function name;
• an Inspector-history row for that same frame;
• arguments on the left and locals on the right;
• a stack pane from SI:LISP-TOP-LEVEL through SIGNAL-CONDITION and the condition object;
• the complete fourteen-item menu documented above; and
• a Lisp interactor retaining the synthetic error message.

A deliberately nonselecting right-button probe over Proceed produced no visible menu and no claimed action in this nonproceedable FERROR case. A left click on Exit Window EH returned to the ordinary handler, where the same FERROR frame and error context remained visible. That establishes the distinction between leaving the graphical presentation and abandoning the error. Finally, host ctrl+z was rendered as c-Z and printed “Back to top level in Lisp Listener 1.” No proceed, restart, reset/arrest, setter, breakpoint, trap, frame return, reinvocation, edit, or throw was invoked.

Runtime observation: after the Error Handler received Control-Meta-W, the same suspended computation appeared in this window-oriented debugger on 2026-07-18. The capture is published to establish the pane organization and complete visible command menu, not as a decorative reproduction; inclusion implies no endorsement.

Capture selection and portable provenance

The ordinary-handler and window-handler captures above passed an image- and use-specific review and were copied byte-for-byte into the curated CADR asset tree. These two low-resolution functional displays are the minimum images needed to compare the distinct interfaces beside substantial source-, manual-, and runtime-grounded scholarship. They reveal no private data, manual pages, artwork, or third-party media and are unlikely to substitute for the historical software. All other captures remain ignored raw session evidence.

The exact ordered guest input after start was: n Return at the first date prompt; n Return at its confirmation; n Return when asked whether to specify another time; the FERROR form and Return; (+ 40 2) and Return; ctrl+alt+w; right-button click at (380,839) over Proceed; left-button click at (55,823) on Exit Window EH; and ctrl+z. Screenshots were taken between those operations. The CADR harness version used here does not yet have the Genera harness's linked action ledger, so this article records the ordered sequence explicitly.

The run used display :90, XID 2097202, title LOCAL-CADR [running], and a 768 by 963 framebuffer from 2026-07-18 05:18:45 through 05:28:10 EDT. The base and private working disk began with SHA-256 bb16e46ad81decfe1efe691d36b6aa4ce3fd4ffb82474365de3520989d397cb5; the base remained unchanged, and a direct post-stop hash of the private disk also matched. The final run record has SHA-256 fda24f98827655b1815eaf86f8828e4ef702438aae328b10ac64c572bc2b1997.

Public revisions at session start were l d1250f90044f09b6c92014a9aef65f9574e1bcbf8a7163004e53cc6dbed0f2d6, system 4df393c68d7f083ce42d5c377039d26043cc18a9031ace28258dc97f4137eb91, usim 330d8248ec2e12af071e287920e681600f75df9ffd854aada5f8a64c9adad64d, usite 8f717978b458b40adf1e238aaf177f5bc54ef46881268e03b787ba57b0d30a0e, and chaos db2953fde68d726a605d1d1699bab6c926ef252bd4991f692bae6ee5a634764e. The private system, usite, and chaos copies were made at those same revisions and were unchanged since copy; their tree hashes were respectively 21f5215de973aa6ccbddb817f2d64edd95ee1014c3028a9b0711ea7c741b807e, adbb720339db225e6635977a869cf3f3d50b507e614b37a976f4a6548d212a81, and 34ab197641aae909e9a224edc307020fddec263e732207a74573d51dac0daa87.

usim_sha256_at_start and the separately checked usim_sha256_at_exec both equal 707a77d23e28ea1c45ae0eb0145dc181fa7ba649b9defc30044d4f847ac2c5be. The private machine-artifact hashes were promh.mcr 2c667f99f014a7130a55b255d31df02588d9396beace78abfe9325269e4ff3e6, promh.sym e9e3dd6a541511dd9541ae96b99dae19cb185d8b79fa09959f21fa52224f233d, and ucadr.sym 9071decf16fa8f11d7970c4662db0d6e95600fe43ec86ac41c77b37dbd7caa2a. The screenshot sidecars do not themselves contain the execution-time usim hash; that evidence is joined here from run.json as required by the current provenance layout.

Toolchain provenance used Guix commit 230aa373f315f247852ee07dff34146e9b480aec, manifest SHA-256 3adae999bbe420182f22adc2499fcc82449a46eaf580a362de9c0e718fa6b37d, and Python 3.11.14. Shutdown was clean: usim and Xvfb both exited zero, forced_stop is false, state_may_be_incomplete is false, and no session process remained.