CADR Supdup and Telnet bindings and protocol semantics

Public System 46

The public Git revision is 8e978d7d1704096a63edd4386a3b8326a2e584af. Paths below are relative to its src/ directory.

lispm/pkgdcl.230:96-98 and lmdoc/lispm.files:148-149 select AI: LMWIN; SUPDUP QFASL. Therefore lmwin/supdup.105, not the similarly named LMIO file, controls C46-LMWIN-105. The LMWIN file includes its own older Telnet engine. It is part of the selected file even though later C303 Telnet features are absent.

Maintained LM-3 System 303

The public Fossil check-in is 4df393c68d7f083ce42d5c377039d26043cc18a9031ace28258dc97f4137eb91, tagged system-303 and dated 2025-01-06. It is a maintained restoration branch, not a claim that the check-in itself is an original MIT release artifact.

sys/sysdcl.lisp:174-176 loads only SYS: WINDOW; SUPDUP. The current window/supdup.lisp is byte-identical to revision .323; it compiles the flavors and preactivates one Supdup at lines 2941-2945 but does not register System-S or System-T. Revision .322:3097-3098 did. The current Create menu still contains Supdup and Telnet at window/sysmen.lisp:155-169.

All sizes and hashes in these two ledgers were rechecked with GNU stat and sha256sum on 2026-07-19.

NVT instance

A portable reconstruction MUST expose an equivalent of this state record for tests:

NvtInstance {
  profile
  protocol                   // Supdup or Telnet
  window_identity
  label
  selected, exposed, active
  escape_character
  pending_target             // historical CONNECT-TO
  connection                 // NIL or Chaos connection object
  stream                     // may retain a closed stream after disconnect
  typein_process, typeout_process
  terminal_stream_or_window
  output_buffer
  output_lock_owner
  return_to_caller
  overprint                  // C303 only
  black_on_white             // C303 only
  alias_window               // bound overlay, C303
  program_name
  protocol_state
  display_state
}

The historical source does not use this aggregate literally; it is INTERP. Fields MUST remain independently observable because the strict source permits combinations such as a label changed before greeting completion, a non-NIL stream with no published connection, or a closed stream retained after disconnect.

Process and connection invariants

1. A normal separate C303 window has one typein and one typeout process. A bound overlay borrows the caller's current process for typein and a process resource for typeout. [C303-SRC]
2. Both local typein and protocol commands may write the peer. OUTPUT-LOCK MUST serialize each historical lock scope and MUST unwind only when the current process owns it. [C46-SRC] [C303-SRC]
3. CONNECTED-P is true only when CONNECTION is non-NIL and its Chaos state is OPEN-STATE; a non-NIL object alone is insufficient.
4. Deselect/bury through Call or P MUST retain a live connection. Q, D, and successful L paths close it.
5. Disconnected state MUST not send ordinary keyboard input. Prefix commands that do not require a peer may still run in C303.
6. C303 typeout MUST not begin reading peer output before CONNECTION is published.
7. A strict profile MUST preserve mutations before later failure; none of the connection, graphics, GT40, ARDS, local-edit, or Telnet parsers is transactional.

Protocol-specific state

Supdup adds cursor/display state, output-buffer contents, graphics bounds and modes, and global GT40/ARDS compatibility state. Optional RECORDING-SUPDUP adds a recorded screen model; LOCAL-EDITING-SUPDUP adds resynchronization, local command tables, margins, word syntax, and insertion mode.

C303 Telnet adds:

new_telnet
more_waiting
echo_flag
simulate_imlac
binary_output
supdup_output

System 46 Telnet has only NEW-TELNET-P, MORE-FLAG, ECHO-FLAG, and SIMULATE-IMLAC-FLAG. Its echo flag has different source-visible use and MUST not be interpreted through C303 semantics.

System 46 selected profile

C46-LMWIN-105 has these routes:

The initial System registry is at lmwin/basstr.163:690-697; Create choices are at lmwin/sysmen.105:121-128. SUPDUP-SEPARATE selects an already-connected Supdup when path is NIL; otherwise it reuses an idle Supdup or creates one, assigns the path, exposes cleanly, and selects it. It returns NIL for connected reuse and true for the new/reconnect path (lmwin/supdup.105:312-350).

The selected file has no TELNET-SEPARATE function. Generic TV System/Create construction can instantiate its TELNET flavor, while the callable TELNET function itself is bound-only (lmwin/supdup.105:969-992). A reconstruction MUST not borrow C303's later Telnet window list or TELNET-SEPARATE semantics.

C303 source profile

C303-4DF-SRC has these source-defined routes:

The default SUPDUP-MODE is true, despite its contradictory docstring saying “NIL => New window default” (window/supdup.lisp:859-890). Separate functions first search the appropriate ordinary-window list. With NIL path and a connected match, they select it and return NIL. Otherwise they reuse an idle instance or construct one, choose path, configured default, or associated machine in that order, assign CONNECT-TO, expose cleanly, select, and return true (894-905, 2565-2577).

Bound mode creates a resource window with the caller's edges, aliases it to the caller, borrows the current process for typein, presets a resource typeout process, and runs within WITH-SELECTION-SUBSTITUTE (907-931, 2588-2630). Q or an abort restart returns through the bound call rather than leaving a separate selected instance.

Current source has Create-menu entries but no S/T System-key registrations. The manual's S/T claim and .322 registration do not authorize adding them to C303-4DF-SRC.

Dispatch precedence

For C303 connected input, precedence is:

hardware input
  -> inherited TV global Terminal/System/asynchronous handling
  -> NVT ANY-TYI
      -> cons/error/More/pointer branch
      -> scalar Chaos-state check
      -> configured escape comparison after CHAR-UPCASE
          -> local Network-command prefix
          -> otherwise protocol translation

Super-image mode removes the ordinary asynchronous-character table and suppresses normal Abort/Break handling, but it does not replace the inherited global Terminal and System prefix contract. [C303-SRC] [C303-SUB]

C303 connected scalar and blip input

BASIC-NVT :TYPEIN-TOP-LEVEL at window/supdup.lisp:253-320 MUST behave as follows:

The default ESCAPE-CHAR is physical Network (supdup.lisp:6-8). If C changes it, physical Network becomes ordinary protocol input unless the chosen character mapping itself gives Network a remote meaning. Unlike C46, C303 does not retain Network as an unconditional second prefix.

C303 disconnected input

Disconnected mode disables super-image and binds SUPDUP-IO-BUFFER-OUTPUT-FUNCTION while reading the host line (supdup.lisp:298-342). Its exact application layer is:

Help, when top-level Help is not recursively inhibited
  -> display host-syntax Help and consume the key

uppercased scalar = ESCAPE-CHAR
  -> run the complete local prefix and consume the key

character in TV:KBD-INTERCEPTED-CHARACTERS
  -> invoke inherited TV input-editor handler

other input
  -> return to READLINE

The prompt trims Space and Tab at both ends and reprompts until the resulting string is nonempty. Therefore API-level NIL reaches the parser, but prompt-level empty input does not. During the More wait, ALLOW-ESCAPE similarly consumes any sequence of configured escapes or Help keys before untying the first other event (344-359).

C303 complete Network-command prefix

The first key is the configured escape, Network by default. The prefix displays CMND--> on the bottom line, reads one suffix, applies CHAR-UPCASE, executes the table below, and in an outer unwind restores the saved cursor and clears the prompt (supdup.lisp:402-488).

The prefix has exactly one third stage: escape C new-character. There are no other multi-stage leaves.

Modifier, numeric, repeat, and shadow rules:

1. CHAR-UPCASE normalizes alphabetic case but does not strip modifier bits. Shift-derived case equivalents match; Control, Meta, Super, Hyper, and their combinations otherwise remain distinct and fall through to beep unless they are exactly the configured escape.
2. There is no numeric-argument state, sign state, digit accumulation, universal argument, or repeat facility. Digits are ordinary unbound suffixes and beep.
3. If C assigns A, B, C, D, E, I, L, M, O, P, Q, Help, ?, Rubout, Call, or Break as the escape, the earlier command case shadows the literal-send leaf. A strict profile MUST preserve that inability to quote the selected reserved suffix.
4. A cons or mouse blip arriving while the prefix waits for its suffix is passed to CHAR-UPCASE without a type guard. A strict profile MAY signal the resulting condition; it MUST NOT silently discard the blip as if source did so.
5. B and C set super-image true only on ordinary control flow; they do not restore a saved prior value. Thus a normal disconnected invocation changes the prompt from normal mode to super-image mode. Their internal mode changes are not separately unwind-protected. The outer unwind only restores the bottom line and cursor.
6. Help's dynamic predicates describe handler presence, not successful execution. It omits E even though E is live.

C46 disconnected READLINE and rubout contract

When CONNECTION and CONNECT-TO are both NIL, C46 selects the ordinary I/O buffer, prints a newline followed by Connect to host: , and calls READLINE with no options (lmwin/supdup.105:150-192). TERMINAL-IO is dynamically bound to the NVT window. READLINE detects its :RUBOUT-HANDLER operation and enters it with the empty option list; therefore there is no :PROMPT, :REPROMPT, :INITIAL-INPUT, :PASS-THROUGH, or :FULL-RUBOUT behavior (lispm/qfctns.438:1376-1405; lmwin/stream.14:242-348).

At rubout-handler entry, any unread typeahead suffix is compacted to the start of the edit buffer; otherwise the active length becomes zero. The read index becomes zero, the cursor after the already printed host prompt becomes the starting cursor, and retained typeahead is re-echoed. The following is the complete application-local editing tree:

There is no C46 disconnected application prefix, application Help branch, numeric argument, repeat state, sign state, or blank-line reprompt loop. Direct Help, Break, Network, and other special keys receive only the table above unless inherited TV global Terminal/System routing consumes them first. In particular, physical Network does not enter the connected C46 local prefix while disconnected. A zero-length line is returned to :CONNECT after Return rather than being rejected locally.

The rubout routine performs numeric equality and modifier-field operations without a character/list guard. If a non-character or cons reaches it, the first applicable comparison or bit extraction may signal the historical type condition; strict mode MUST NOT invent a C303-style cons ignore, application Help action, or safe coercion. Global Terminal and System prefixes remain governed by the inherited D02 TV contract before this application-level path.

C46 complete local prefix

In C46-LMWIN-105, default escape is Break. Connected input treats either the uppercased configured escape or physical Network as the local prefix (lmwin/supdup.105:150-186).

The complete selected LMWIN prefix (lmwin/supdup.105:203-262) is:

There are no A, E, or O leaves. C is the sole third-stage prefix. There is no numeric or repeat state. Modifiers remain part of the suffix after uppercasing and otherwise fall through. Setting the escape to a command character shadows literal transmission. B/C can fail to restore the NVT buffer. Direct I may signal when the current flavor lacks :TOGGLE-IMLAC-SIMULATION. The Help text includes M and I together based only on presence of the I handler, while M itself directly invokes generic sheet More.

C46 Escape-N lineage tree

C46-ESCAPE6 is not part of C46-LMWIN-105. Its exact old-window dispatcher at lmio1/escape.6:215-234 is retained only for a separately selected lineage report:

Escape N
├── no argument or numeric 0 -> find or make an old SUPDUP-CLASS instance
├── numeric 1 -> find or make an old TELNET-CLASS instance
├── numeric 2 -> make a new old SUPDUP-CLASS instance
├── numeric 3 -> make a new old TELNET-CLASS instance
└── list/precomma argument -> select the Nth existing instance for the requested mode

Its recovered public Help fragment is available at assets/mit-cadr-online-help/source/lmio1/escape.6.help.lisp. An implementation MUST NOT graft this Escape-N tree onto the LMWIN or C303 profiles.

SUPDUP remote character mapping

Both selected systems implement Maclisp-style list filling: when a nonempty list is shorter than the destination array, FILLARRAY repeats the list's final element through every remaining cell. System 46 advances its list cursor with (OR (CDR L) L); C303 states “it sticks at the last element” and advances only when the cdr is non-NIL (lispm/qmisc.281:621-634; sys/qmisc.lisp:582-600,643-647). That rule is normative for every table below; an initializer listing is not the whole array.

C303's SUPDUP-KEYS is an 0o201-cell (129-cell) array. Its 32 explicit cells are exactly (supdup.lisp:1038-1047):

indices 0o00..0o37, for source character codes 0o177..0o236:
0o4177,
0, 0o4102, 0o4103, 0o32,
0o4101, 0o37, 0o4110, 0o177,
0o10, 0o11, 0o12, 0o13,
0o14, 0o15, 0o4102, 0o323,
0o37, 0o4103, 0o310, 0,
0o233, 0, 0, 0, 0,
0, 0, 0, 0, 0,
0o4102

The final explicit 0o4102 repeats through indices 0o40..0o200, so source characters 0o237..0o377 all map to 0o4102. For a scalar input, C303 extracts the character code, preserves code 0o33 as a special case, maps every other code below 0o40 to ITS control form by setting 0o4000, leaves codes below 0o177 unchanged, otherwise indexes at code - 0o177, and then ORs all Lisp-machine character bits shifted by seven. Thus the exact table-driven domain is 0o177..0o377: 0o176 bypasses the table, 0o177 selects the integral cell, and 0o377 selects the repeated final cell. CHAR-CODE-LIMIT is 0o400, so a valid C303 character code is always below 0o400 and cannot index beyond this array. Passing a non-character may signal during CHAR-CODE instead; the selected entry point supplies no reachable array-bounds path. Cons/blips are ignored before translation by BASIC-SUPDUP (supdup.lisp:1049-1056).

System 46 instead allocates 0o200 (128) cells and supplies these 31 explicit values (lmwin/supdup.105:433-440):

indices 0o00..0o36, for source character codes 0o200..0o236:
0, 0o4102, 0o4103, 0o32,
0o4101, 0o37, 0o4110, 0o177,
0o10, 0o11, 0o12, 0o13,
0o14, 0o15, 0o4102, 0o323,
0o37, 0o4103, 0o310, 0,
0o233, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0o4102

Its repeated tail is indices 0o37..0o177, so source codes 0o237..0o377 map to 0o4102. After its whole-character raw-Escape clause, System 46 extracts the low eight-bit code, preserves extracted code 0o33, maps every other code below 0o40 by setting 0o4000, and indexes only codes at or above 0o200: 0o177 bypasses the table unchanged, 0o200 selects index zero, and 0o377 selects the final repeated cell. %%KBD-CHAR is an eight-bit field, so even an arbitrary packed integer cannot produce extracted code 0o400; a valid scalar cannot reach an array bounds fault. The raw unmodified Escape clause invokes TV:KBD-ESC and returns NIL; the source comment says it is not expected to fire, and normal-return behavior at the caller remains a runtime condition oracle rather than a fabricated send.

System 46 ORs the four-bit historical %%KBD-CONTROL-META field shifted by seven. Despite its name, that field contains Control, Meta, Super, and Hyper; C303's CHAR-BITS additionally admits the Mouse bit. Table origin, array length, integral handling, raw-Escape interception, and Mouse-bit handling are release deltas (lmwin/supdup.105:443-454; lispm/qcom.437:185-188).

Telnet remote character mapping

C303 and System 46 each allocate TELNET-KEYS with 0o200 (128) cells and the same 32 explicit initializer cells (supdup.lisp:2649-2655; lmwin/supdup.105:1009-1015):

indices 0o00..0o37:
0, 0o100101, 0o100370, 0o100364,
0, 0o37, 0o37, 0o177, 0o10, 0o11, 0o12,
0o13, 0o14, 0o15, 0o21, 0,
0o100365, 0o100363, 0, 0o100366,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0o100101, 0

The final explicit zero repeats through indices 0o40..0o177. The lookup condition is strictly code > 0o200, with index code - 0o200. Consequently index zero is unreachable through this branch; source code 0o200 bypasses the table, codes 0o201..0o237 use explicit cells 1 through 0o37, and codes 0o240..0o377 use the repeated zero tail. That intermediate zero transmits as NUL without Meta and becomes 0o200 when Meta is subsequently added. 0o377 is the last valid lookup. C46's eight-bit %%KBD-CHAR extraction and C303's CHAR-CODE-LIMIT = 0o400 make a table index beyond 0o177 unreachable from a valid scalar; malformed non-characters fail at extraction/comparison rather than establishing an application array-bounds path.

For C303, local echo occurs when ECHO-FLAG is NIL. It first displays the local Control marker for a Control-modified character and then displays the extracted character. If SUPDUP-OUTPUT mode is active and that extracted code is End, it sends Control-X then Control-S and skips the remaining table/Meta path. Neither the marker nor the End special case exists in C46.

For every non-special-case scalar in either profile, the shared transform order is:

1. Extract the character code.
2. Control replaces the value with its low five bits.
3. A resulting special code greater than 0o200 indexes the full 128-cell TELNET-KEYS at code - 0o200. A zero explicit or repeated-tail entry remains a real intermediate zero; it is not locally unbound.
4. Meta adds 0o200.
5. Super and Hyper have no separate protocol encoding after character-code extraction.
6. Send the result through Telnet output translation.

System 46 echoes only the extracted character when ECHO-FLAG is true. Both profiles echo before controlification and table lookup. The older negotiation transitions remain specified below (lmwin/supdup.105:1017-1055).

Pointer, menu, and presentation closure

Generic C303 TV pointer routing at window/mouse.lisp:824-843 precedes the application:

double-right
  -> invoke the TV System Menu; never deliver the second click to the NVT

single-left on an unselected NVT
  -> select it and consume the click

otherwise, when its input is handled
  -> enqueue (:MOUSE-BUTTON encoded-click window x y)

TV:LIST-MOUSE-BUTTONS-MIXIN is a compatibility no-op in the selected System 303 source/release notes. Supdup ignores the cons. Telnet serializes it only when SUPDUP-OUTPUT-FLAG is true; otherwise it is ignored (supdup.lisp:2649-2662).

When enabled, Telnet mouse output is exactly:

0o33
three decimal characters for truncate(x / TV:CHAR-WIDTH)
three decimal characters for truncate(y / TV:LINE-HEIGHT)
#/0 + 1 + low-three encoded button bits
    + (1 if encoded bits 3 through 5 are nonzero, else 0)
0o33 0o12

Each coordinate uses hundreds, tens, and units with decimal divisors 100. and 10. (supdup.lisp:2853-2870). There is no range or sign validation. Values outside 0–999 can therefore emit nondigit or truncated-looking fields. The who-line text “Left: Move point. Middle: Select buffer. Right: Get buffer editor” states the remote peer's expected interpretation; the CADR sends all accepted clicks and performs none of those editor operations locally.

System 46 selected Telnet has no corresponding mouse-report method. Other pointer events are therefore generic TV behavior or ignored input blips.

Neither selected profile owns an application menu, menu accelerator, presentation, presentation translator, or CLIM gesture. The Create menu, System Menu, System-key Help, and Peek host menu are TV-owned and incorporated from D02/TV. The exact application-owned presentation denominator is zero.

C303 grammar

PARSE-PATH and EXPAND-PATH at window/supdup.lisp:139-226 define the following API grammar:

The default gateway is the first :ARPA-GATEWAYS site option. For a gateway route, EXPAND-PATH connects to the gateway's Chaos identity and constructs contact TCP host socket using historical octal printing rules; for a direct Chaos route it uses the contact unchanged. Supdup supplies contact SUPDUP and source literal 0o137; Telnet supplies TELNET and 0o27 (supdup.lisp:964-973,2632-2640).

The parser's slash-number calls explicitly select decimal radix 10. at lines 181 and 197. The nearby comment and Help claim octal sockets at lines 148, 370, and 378-379. Strict C303-4DF-SRC MUST parse decimal and MAY reproduce the stale Help; a manual-overlay profile MUST expose the disagreement rather than silently choosing.

At the disconnected prompt, leading/trailing Space and Tab are trimmed and empty input reprompts. Programmatic NIL still means associated machine. Replacing a live connection first invokes the before-connect disconnect and only then parses this grammar, so malformed replacement syntax destroys the old session before failure.

System 46 grammar

System 46's earlier PARSE-PATH at lmwin/supdup.105:97-121 is separately normative. Its ordered algorithm is:

1. Convert a numeric path through CHAOS:HOST-DATA; convert a symbol to its print name; replace NIL with "AI".
2. For a string, split the first Altmode into bridge and path when present.
3. Test (bridge or path) in CHAOS:HOST-ALIST.
4. If that host is not known, an explicit bridge is moved into the direct-host slot, the former target becomes the explicit ARPA contact/name, and bridge defaults to "AI".
5. If no bridge remains, connect directly to the path using an explicit contact when found or the protocol contact otherwise.
6. If a bridge remains, connect to it with contact text ARPA target socket-or-name; absent explicit name uses the caller's ARPA socket rendered in octal.
7. Build the visible label from protocol name plus direct host or bridge-arrow-target.

There is no C303 slash/address decision tree and NIL means AI rather than associated machine. A recreation MUST not use C303 parsing for this profile.

C303 definition through activation

The strict phase order is:

define/load
  -> compile flavor methods
  -> preactivate one Supdup window at file load
  -> instantiate window
      -> allocate/preset typein and typeout processes if slots unbound
      -> set disconnected label
  -> select or expose
      -> reset a process only when waiting in SI:FLUSHED-PROCESS
      -> add window as process run reason
  -> typein and typeout top levels run

See supdup.lisp:82-112,933-951,2941-2945. Preactivation does not prove the subsystem is loaded in System 303-0; that is exactly the source/runtime boundary.

C303 connection transaction

The source-visible order (supdup.lisp:120-245) is normative:

CONNECT(target)
  1. if CONNECTION is non-NIL, DISCONNECT it completely
  2. parse target
  3. expand host/gateway/contact and label
  4. CHAOS:CONNECT
  5. if the result is an error object, return it
  6. set the visible connected-target label
  7. reset typein process
  8. reset typeout process
  9. STREAM := CHAOS:MAKE-STREAM(new-connection)
 10. send/read the protocol greeting
 11. CONNECTION := new-connection        // publication/commit point
 12. BLACK-ON-WHITE := NIL

The new connection is deliberately not published until after greeting. Typeout waits for non-NIL CONNECTION, preventing premature peer reads. However, failure at steps 9–10 leaves an acquired connection or stream outside the CONNECTION slot. Ordinary DISCONNECT cannot close it. The label may already describe the target. Strict compatibility MUST retain this partial failure; C303-SAFE-CONNECT may stage and close it explicitly.

CONNECT-TO is cleared with PROG1 before the connection attempt. A failed pending target is not automatically retried; control returns to prompting/error handling.

C303 connected typein machine

begin iteration
  RETURN-TO-CALLER := NIL
  result := :ABORT

  if CONNECTION:
    enable super-image
    loop:
      if no local input, force peer output under OUTPUT-LOCK
      event := ANY-TYI
      route event through the complete input tree
      remote state/error may throw a reason string

  else if CONNECT-TO:
    clear screen
    target := CONNECT-TO
    CONNECT-TO := NIL
    attempt CONNECT(target)

  else:
    disable super-image
    bind disconnected input hook
    prompt until nonblank line
    attempt CONNECT(line)

after protected body:
  nonstring condition object -> report string
  :ABORT with live connection -> ask whether to disconnect
  string result -> DISCONNECT, print string
  if RETURN-TO-CALLER -> return; otherwise repeat

Abort with a live connection and a “no” answer resumes without disconnect. Abort with no connection produces no disconnect reason. Q sets RETURN-TO-CALLER; D does not.

C303 typeout and error handoff

The typeout process (supdup.lisp:507-546) waits until CONNECTION is non-NIL, blocks for one byte, drains additional immediately available bytes, applies protocol output, and flushes its local output buffer. Before normal output it honors the selected black-on-white/overprint rule.

Peer EOF injects (:ERROR "Closed by foreign host") into typein and then waits forever. A remote-network condition injects (:ERROR report-string) and also waits forever. The process is recovered by the later disconnect/reset; it does not close the connection itself. This wait is intentional lifecycle behavior, not a missing return value.

C303 disconnect and kill

DISCONNECT orders effects as follows:

flush typein process
flush typeout process
if CONNECTION:
  close Chaos connection
  remove Chaos connection
  CONNECTION := NIL
reset typein process
reset typeout process
run protocol after-disconnect method

The method does not clear STREAM. Telnet's after-method resets echo, new-Telnet, SUPDUP-OUTPUT, and binary flags and restores the disconnected label (supdup.lisp:2645-2647). Supdup restores its disconnected label (1035-1036). Window process ownership is reported through :PROCESSES; generic TV kill owns final process termination.

System 46 lifecycle differences

System 46 allocates distinct ordinary and super-image NVT I/O buffers and two processes during initialization (lmwin/supdup.105:15-68). Selection lazily resets them. Its kill wrapper runs inherited/body cleanup first and then kills both processes (70-77).

Most importantly, System 46 :SET-CONNECTION publishes CONNECTION and constructs STREAM before greeting (123-130):

flush processes
CONNECTION := new
STREAM := CHAOS:STREAM(CONNECTION)
gobble greeting
reset processes

A greeting failure therefore leaves the connection visible to ordinary disconnect, unlike C303's unpublished-resource defect. Its disconnected branch performs one plain READLINE; its string error result is then disconnected and printed. Typeout EOF/error injects an error blip and waits forever as in the later lineage (276-296).

Terminal-variable greeting

C303 Supdup (supdup.lisp:964-1033) sends seven 36-bit terminal words, represented as these ordered pairs of 18-bit halves:

Each 18-bit half is emitted as three six-bit bytes in bit ranges 12–17, 6–11, then 0–5 (supdup.lisp:1021-1024). The method then emits Finger identification 0o300 0o302, the local Finger location string, NUL, and a flush.

The greeting reader begins with a synthetic CR, reads bytes until EOF or 0o210, maps control values below 0o40 by adding 0o200, suppresses 0o212 linefeeds, and displays all others. EOF ends greeting without separately proving a healthy peer.

System 46 sends six 36-bit words: header (-5, 0), TCTYP (0, 7), TTYOPT (option, 0o54), TCMXV (0, max-row), TCMXH (0, max-column), and TTYROL (0, 0). It has no TTYSMT cell-metric/local-edit pair (lmwin/supdup.105:394-417). Its Finger location is derived through the older local address/Finger table (419-431).

ITS Intelligent Terminal Protocol output

After translating a local key to an ITS 12-bit character, both profiles use this wire rule:

bits := modifier/function bits
if bits != 0:
  write 0o34
  write 0o100 OR bits
  write low seven bits
else if character == 0o34:
  write 0o34, 0o34
else:
  write character

C303 holds OUTPUT-LOCK around every multi-byte case and the ordinary one-byte case (supdup.lisp:1060-1071). System 46's ordinary one-byte branch does not explicitly take the lock, while its multi-byte branches do (lmwin/supdup.105:456-469); this is a release-specific concurrency surface.

Supdup logout is a release-specific ordered transaction under OUTPUT-LOCK:

C46-LMWIN-105: TYO 0o300 -> TYO 0o301 -> stream :FORCE-OUTPUT
C303-4DF-SRC:  TYO 0o300 -> TYO 0o301 -> stream :FINISH

System 46 Network L invokes that transaction and then QUIT "Logout". C303 does the same when CONNECTION is non-NIL, but calls plain QUIT without logout when it is NIL (lmwin/supdup.105:224-226,471-475; supdup.lisp:431-436,1073-1077). A strict implementation MUST preserve :FORCE-OUTPUT versus :FINISH; their completion guarantees are not declared equivalent here. Failure of either byte write or the final stream operation prevents the subsequent Quit/disconnect. Bytes accepted before the failure remain accepted, and the output lock unwinds according to the common lock contract.

Text buffering and dispatch

For C303, bytes below 0o200 append to a 128-character output buffer; a full buffer is flushed to the sheet before retrying the append. A byte at or above 0o200 first flushes all buffered text, subtracts 0o200, and dispatches when the resulting index is within the 32-entry table. Values 0o240 and above therefore flush pending text and are otherwise ignored (supdup.lisp:1079-1117). This establishes exact text-before-effector ordering.

No effector transaction buffers all its operands. A truncated operand sequence may block or signal after earlier text, cursor, pixels, flags, peer replies, or nested state have already changed.

Exact effector table

Cursor moves interpret peer order as vertical position then horizontal position and scale by line height and character width. Cursor report performs the inverse integer division. Bell coalescing reads nonblocking until the first nonbell and unreads that one byte (supdup.lisp:1119-1171).

Region operations clamp the affected bottom and scroll amount to the visible line-grid region, move retained pixels, then erase the newly exposed band. Region down passes a negative height to BITBLT to select bottom-up copy order. The selected microcode documents signed dimensions and reverse traversal at ucadr/uc-tv.lisp:429-434; the negative height is not a defect.

Command grammar

The decoder repeatedly reads one byte through GRAPHICS-NETI:

• any byte with bit 0o200 exits graphics and is unread for the outer SUPDUP decoder;
• a byte with bit 0o100 selects a drawing command by low nibble; and
• otherwise the full byte selects a state/control command.

Control commands are exact:

Drawing low nibbles are exact:

If command bit 0o20 is set, each point is four seven-bit bytes: low-X, high-X, low-Y, high-Y, sign-extended from 14 bits. Otherwise each point is two signed seven-bit deltas added to current position (supdup.lisp:649-668). Coordinates are optionally scaled, clamped to inclusive logical bounds, offset to the sheet, and Y is inverted. Persistent XOR wins ALU selection; otherwise command bit 0o40 selects ANDCA and its absence selects IOR (670-686).

Nested push is dynamic state restoration, not a peer-visible stack object. A truncated nested stream may have already drawn pixels before the exit byte restores the dynamic variables.

GT40

0o206 invokes the GT40/SUDS interpreter at supdup.lisp:1276-1504. It maintains a global ten-item display-list array, a global current item number, and a global blinker. Display objects contain strings or typed vector/point triples. Commands consume packed 16-bit words represented by three bytes in 6-4-6 layout; insert and delete consume count/item words and trailing checksum words.

Strict behavior includes:

• command 0 chooses insert or delete from the low two bits of a packed word;
• command 1 inserts/replaces the current display item;
• command 2 deletes one or more items;
• character, short-vector, long-vector, point, and relative-point modes mutate and draw the current display object incrementally;
• draw/erase uses XOR, so redisplaying an active item erases it;
• blinking toggles every global item whose leader state is ON or OFF; and
• checksum words are consumed but never validated.

Source-visible GT40 defects are normative in strict mode:

1. SUPDUP-GT40 globally assigns SI:KBD-NEW-TABLE to its SUDS table and never restores the prior table (1301-1306).
2. Because the file is Base 8, (MAKE-ARRAY 17) has length 15 decimal, while (LOGAND 17 BYTE) can produce decimal index 15, one beyond valid indices 0–14.
3. The display-list array has fixed decimal length 10 and trusts peer item numbers without bounds checking (1451-1456).
4. Insert deletes the target before reading the replacement (1386-1395); truncated input leaves the old display erased and the replacement partial.
5. The state is global rather than per window, permitting cross-window interference.

ARDS

0o235–0o237 enter the ARDS compatibility loops at supdup.lisp:1506-1590. ARDS X/Y, scale, and screen-position variables are global. Each invocation derives window dimensions and offsets, then reads only bytes in 0o100–0o177. A control or %TD byte exits, unreads that byte, and moves the text cursor to the last ARDS screen position.

• Set form reads long X then long Y and plots the resulting point when its flag says visible.
• Long-vector form repeatedly reads signed long X/Y deltas.
• Short-vector form repeatedly reads signed short X/Y deltas.
• Coordinate conversion shifts the nominal -512..511 range to 0..1023, scales by the smaller window dimension, applies a centering offset, clips, inverts Y, and draws visible vectors with IOR.

The source itself states that the variables should be instance variables and that scaling/offset is wrong (1508-1510). Strict mode preserves those defects and global cross-window state.

Recording allocation and observable state

Let H = truncate(inside-height / line-height) - 1 and W = truncate(inside-width / character-width). On initialization, and after every size-or-margin change, RECORDING-SUPDUP performs these exact allocations in order (supdup.lisp:1610-1646):

1. SCREEN-LINE-ARRAY becomes an H + 1 element vector; its row strings do not yet exist.
2. OLD-SCREEN-LINE-ARRAY becomes an H-element vector.
3. LAST-COL-TO-SAVE+1 becomes W; FIRST-COL-TO-SAVE is not reset.
4. SAVED-LINE-ARRAY becomes a new LINE-LABEL-MAX vector. The default maximum is bare 2000, hence 0o2000 or 1,024 cells; resize discards all prior saved lines.
5. REDISPLAY-STRING becomes a W-cell fat string with a one-cell leader.
6. Finally, for every screen-vector cell, allocate a W-cell fat string with a three-cell leader and set leader cell zero to W; cells one and two are the line-begin and line-end continuation flags.

The first H rows are displayable by the recording code and row H is the extra record-only row. New row contents and continuation cells receive only their array type's default initialization; this method does not explicitly fill them with Return or reset CURRENT-XPOS, CURRENT-YPOS, the first save column, or the multiposition bounds. A strict implementation MUST preserve that omission. Invalid small geometry can make H, H + 1, or W unsuitable for allocation; there is no prevalidation. A failure during the final row loop occurs after the screen/old/saved/ redisplay vectors and last-save-column mutation have already been published.

Each recorded row cell holds a fat character. Return marks unused text, 0o211 is the tab placeholder, and the high marker bits distinguish the first and subsequent cells of a multiposition character. The leader accessors treat cells one and two as boolean continuation flags.

Recording receive loop

For each received value below 0o200, the implementation MUST (1704-1735):

1. index row CURRENT-YPOS and cell CURRENT-XPOS, and store the value;
2. increment X, then decrement it only when it became exactly W, causing later ordinary bytes to overwrite the final cell repeatedly;
3. when the resulting X equals MULTI-POS-CHAR-END, add 0o400 to the first cell in [MULTI-POS-CHAR-BEG, MULTI-POS-CHAR-END) and 0o1000 to each remaining cell; and
4. append the byte to the visible output buffer only when Y is less than H.

The bounds check occurs only after the initial row/cell store. X already greater than or equal to W, Y outside 0..H, or an invalid multiposition range can signal an array condition before any corrective clamp. Row H records without drawing.

For every value at or above 0o200, the implementation MUST first flush buffered text, reset both multiposition bounds to zero, subtract 0o200, dispatch any index below the 64-cell table length, and, only after the handler returns normally, recompute logical X/Y from the TV cursor. Values 0o300 and above therefore flush, reset, and otherwise do nothing. A handler failure prevents the final cursor sync; earlier text, operands, array mutations, pixels, replies, and marker reset remain.

Complete recording effector table

REC-SUPDUP-%TD-DISPATCH has bare length 100, hence 0o100 or 64 cells. Its initializer has 44 decimal cells (0o00..0o53); because FILLARRAY repeats the last element, every remaining slot dispatches REC-SUPDUP-SET-LOCAL-LABEL. This is the exact table (supdup.lisp:1648-1702):

The operand count is a sequencing contract, not a validation promise. A truncated fixed operand sequence blocks or signals at the missing read after all earlier effects. Variable grammars retain their separately specified exit and unread rules.

Recording mutation algorithms and failure order

The extended handlers MUST preserve these operations, including their order (supdup.lisp:1737-2003):

For valid nonnegative ranges, the row-reference permutations are exactly:

insert-lines N:
  clear rows H-N .. H; snapshot screen[0:H] into old[0:H]
  old[Y:H-N] -> screen[Y+N:H]
  old[H-N:H] -> screen[Y:Y+N]

delete-lines N:
  snapshot screen[0:H] into old[0:H]
  old[Y+N:H] -> screen[Y:H-N]
  old[Y:Y+N] -> screen[H-N:H]
  clear rows H-N .. H

region-down (R = Y + region-height):
  clear rows R-N .. R-1; snapshot screen[0:H] into old[0:H]
  old[Y:R-N] -> screen[Y+N:R]
  old[R-N:R] -> screen[Y:Y+N]

region-up (R = Y + region-height):
  snapshot screen[0:H] into old[0:H]
  old[Y+N:R] -> screen[Y:R-N]
  old[Y:Y+N] -> screen[R-N:R]
  clear rows R-N .. R-1

These are half-open copy ranges; the earlier prose states where the visible TV operation occurs. Save/restore copies row cells only, not continuation leaders. During visible restore, the implementation positions the cursor at FIRST-COL-TO-SAVE, clears from there, but then sends the reconstructed substring beginning at recorded column zero. A nonzero first-save column therefore draws that prefix starting at the first-save column rather than its original X coordinate; a strict implementation MUST preserve this ordering and displacement.

The initial label is low + (high << 7) and is indexed before masking. For nominal seven-bit operands it is 14 bits, but values 0o2000 and above exceed the 1,024-cell save vector and fail on the first active row. Only subsequent increments use label = (label + 1) & 0o1777. Save-column bounds, row counts, region heights, character counts, coordinates, and multiposition spans are not validated. Recording line and region copies are not constrained by the later visible TV handler's clipping. In particular, insert/delete character pixels move before a recorded-array fault, while line and region array mutations precede their visible operations. No handler rolls back.

Zero is itself a discriminating unchecked region count. With N = 0, both region handlers dynamically set X=0/Y=R, call recording EOF with exclusive region end also R, clear EOL at row R if that row is indexable, then start an equality-terminated loop at R + 1 which can never increment back to R; it runs until an array fault. Region-down reaches that fault before its snapshot. Region-up has already snapshotted the first H row references and performed its two empty or self-copy ranges. Neither reaches the visible region operation.

Local-edit state and exact input transaction

LOCAL-EDITING-SUPDUP subclasses the recording flavor and adds these fields (supdup.lisp:2005-2024):

input_char_count, last_resync_char_count, last_resync_code
resync_reply_code, resync_reply_char_count
send_resync_now = NIL, local_editing_enable = NIL, local_edit_meter = 0
char_table[0o2000]              // 1,024 general cells
word_syntax_table[0o200]        // 128 one-bit cells
top/bottom/left/right margins = 0
insert_mode = INSERT

After :SET-CONNECTION it sets input count and meter to zero, last resync code to NIL, SEND-RESYNCH-NOW true, and allowed/enabled false. It does not reset the last resync count, reply fields, command tables, word table, margins, or insert mode. The greeting advertises the local-edit bit. The command-table initializer described below is peer-invoked, not automatic. Process-global JOURNAL-STREAM defaults to NIL; when non-NIL, its writes are part of the strict transition order rather than diagnostically invisible side effects (supdup.lisp:872-873).

For a cons/blip, the override calls :NET-OUTPUT with the cons directly. The base Supdup numeric bit extraction then signals a type condition before incrementing the input count; unlike BASIC-SUPDUP, this flavor does not ignore the cons.

For a scalar, the exact transaction is (2032-2086):

1. If editing is allowed but not enabled and either SEND-RESYNCH-NOW is true or more than decimal 200 inputs separate the counters, send logical ITS character TOP-BIT | S; then choose the next resync code (0o40 initially, incrementing through 0o176 and wrapping to 0o40), send it, and only then copy the current input count to the last-resync count.
2. Translate the key by the C303 SUPDUP table and modifiers specified above.
3. Only when editing is enabled and the translated code is below 0o1000 (512), invoke CHAR-TABLE[code], substituting NOT-HANDLED for NIL.
4. On a true result, optionally beep, increment the local meter, write "L:" to a non-NIL journal, recompute X/Y from the TV cursor, send logical ITS TOP-BIT | E, then send 1. On a false result, set enabled false.
5. In every non-signaling scalar path, send the original translated character even after successful local execution or local refusal, format the original Lisp character plus a Space to a non-NIL journal, then increment input count.

The pre-echo notice therefore precedes rather than replaces the original character. A translated code at or above 0o1000 skips local handling without disabling it. Writes and local display mutations are incremental: failure of the S, resync-code, E, 1, original-character, or journal write preserves every earlier state change. In particular, a journal failure after the original remote send prevents the input-count increment.

SEND-RESYNCH-NOW is never cleared anywhere in the selected file. Once 0o241 allows editing, every scalar input while editing is not enabled takes the resync branch, regardless of the intended decimal-200 fallback. This executable behavior, rather than the “from time to time” source comment, controls strict mode.

Resynchronization state machine

The following table is normative for LOCAL-EDITING-SUPDUP. It does not replace the standalone recording-flavor 0o240..0o243 deltas in the complete effector table.

A reply while allowed but before a successful resync can attempt to add its count byte to an unset last-resync count. The exact condition is implementation-defined at the Lisp runtime level, but no fallback value is supplied. The stream probe does not consume peer data permanently because it immediately unreads a non-NIL byte. A journal failure occurs after reply-field mutation but before the subsequent match, wait, or resend-flag transition at its source position; there is no rollback.

Exact definition-code table

0o242 reads two raw bytes and constructs ARG = (first << 7) + second. The low nine bits select CH (0o000..0o777); the high five bits select one of the following 32 cells. An atomic cell, including NIL, is assigned to CHAR-TABLE[CH]. A list cell invokes its named meta-operation with CH and does not assign the character table.

The table has bare length 40, hence 0o40 or 32. The initializer explicitly ends at code 0o35; FILLARRAY supplies the NIL cells at 0o36 and 0o37 (supdup.lisp:2167-2264). The five-bit extraction makes every resulting code index valid. The operands are not checked or masked before the shift and addition, so non-seven-bit values can overlap or carry into the selected low-nine/high-five fields; the resulting field values, not a sanitized 14-bit pair, control dispatch.

Definition-code 0o33 initialization

The initializer performs this complete state transition (supdup.lisp:2266-2295):

Only CHAR-TABLE[0o000..0o777] is addressable by a nine-bit definition and eligible under the local-input threshold; the upper half of the allocated 1,024-cell array is source-visible but unreachable through this protocol. The scanners interpret word-syntax one as a word constituent, despite the nearby comment calling one a separator. Initialization does not alter allow/enable, resync fields, counts, meter, recorded rows, or cursor.

Implemented local command transitions

In this table, “marked” means that LDB-TEST 0o1010 detects multiposition metadata, and “tab ahead” searches the current row from X through W - 1 for placeholder 0o211. A false result disables local editing before the original key is sent; a true result produces the pre-echo notice and original key described above.

Top and bottom margins are settable but unused by every implemented handler. The right margin is consulted only by forward-character; the left margin only by the two backward character/delete handlers. Word motion, word killing, beginning/end of line, and insertion do not enforce those margins. The exact-equality fullness test in insert/replace is not >=: a row whose sole unused cell is its final cell has end-x = W - 1 and is refused despite that space, while a completely full row has end-x = W, passes, and can lose its tail cell during insertion. Forward motion/kill also refuses at end rather than accepting a final word without a following separator.

Strict bounds and recovery summary

The C303-LOCAL-EDIT profile MUST preserve all of these source-visible boundaries:

• the 64-cell recording effector table, including the two-operand repeated tail at every byte 0o254..0o277 and ignore-only behavior beginning at 0o300;
• allocation, record, saved-label, save-range, region, line, character-count, multiposition, and cursor bounds exactly at their first array or TV operation;
• standalone RECORDING-SUPDUP's distinct 0o240..0o243 behavior;
• no automatic definition-code 0o33 initialization and no restoration of tables or margins at reconnect;
• NIL definition cells as active unbindings, plus the exact 0o36/0o37 repeated table tail;
• the unreachable upper half of CHAR-TABLE, inverted “no-tabs” checks, BOL and backward-kill Y tests, unused top/bottom margins, and exact-equality insert bound;
• SEND-RESYNCH-NOW remaining true, with resync/output/local mutation order as specified; and
• no rollback after any missing operand, bounds condition, handler condition, peer write failure, or visible operation failure.

A safety-oriented implementation MAY validate and stage these operations only under separately named options. It MUST NOT report strict C303-LOCAL-EDIT conformance after silently changing a tail cell, consuming a different number of operands, normalizing a range, initializing a table early, clearing the resync flag, or making an incremental operation atomic.

C303 input and ordinary output

C303 Telnet is BASIC-NVT + TV:FULL-SCREEN-HACK-MIXIN + TV:LIST-MOUSE-BUTTONS-MIXIN, with a saved-bits TELNET window (supdup.lisp:2538-2552). Its key mapping and pointer rules are specified above.

BASIC-TELNET :NET-OUTPUT (2697-2706) holds the output lock and:

1. if the value contains protocol modifier bits, emits IAC first only in new-Telnet mode and reduces the value to its low eight bits;
2. emits the byte;
3. emits LF after CR; and
4. doubles a literal IAC in new-Telnet mode.

Binary negotiation does not disable outgoing CR-to-CRLF conversion.

Incoming ordinary output (2708-2731) obeys this priority:

1. IAC enters option negotiation.
2. A byte at or above 0o200 is ignored as old-Telnet negotiation.
3. Control-G rings the local remote-terminal bell unless both Imlac simulation and binary output are active.
4. CR reads one more byte: LF continues normal newline display; NUL is suppressed after moving to column zero; another byte moves to column zero and then processes that byte as output.
5. 0o177 enters Imlac escape only when Imlac simulation is active.
6. Formatting controls 0o10 through 0o15 except vertical tab are converted to Lisp-machine control characters by adding 0o200, unless binary Imlac mode is active.
7. Other bytes buffer for display.

C303 IAC negotiation

Constants are IAC 0o377, DONT 0o376, DO 0o375, WONT 0o374, WILL 0o373, SB 0o372, SE 0o360; options are SUPDUP-OUTPUT 0o26, Logout 0o22, Timing Mark 6, Suppress Go Ahead 3, Echo 1, Binary 0 (supdup.lisp:2680-2695).

Connect first calls TELNET-ECHO T, normally sending IAC DO ECHO. On the first incoming IAC, before reading its command, the source sends DO ECHO again, sends DO Suppress Go Ahead, and sets NEW-TELNET-P true (2733-2738). The duplicate is strict behavior.

There is no case for command byte IAC following IAC. An escaped literal IAC is therefore consumed by the negotiation parser and produces no display byte. Unknown subnegotiation scans until IAC SE; a truncated stream blocks or fails without rollback (2739-2771,2815-2825).

System 46 Telnet deltas

System 46's selected Telnet (lmwin/supdup.105:969-1197) lacks C303 binary-output and SUPDUP-output state flags, pointer reports, Send-IP, overprint, separate-window entry helper, and ALLOW-ESCAPE in its More wait.

Its echo transitions are source-visibly different:

• input is echoed locally when ECHO-FLAG is true;
• connect toggles the initially false flag through TELNET-ECHO T;
• TELNET-ECHO T sends DO Echo, while false sends WILL Echo;
• WILL Echo calls TELNET-ECHO NIL; DO Echo calls true; DONT Echo calls NIL; WONT Echo calls true.

Its complete IAC option delta is:

Its bell is always local, without C303's binary-Imlac exception. Its More typein branch consumes one key directly and does not call ALLOW-ESCAPE; Network/Help therefore receive no special prepass during that wait. These are strict C46 results, not behaviors to normalize through C303.

Imlac compatibility

C303 Imlac output sees 0o177, forces pending display output, reads one byte, adds 0o176, and either quotes a literal 0o177 with simulation temporarily disabled or subtracts 0o200 and dispatches through the SUPDUP %TD table (supdup.lisp:2773-2780). Only the upper bound is tested. A malformed small operand can make the resulting index negative and signal an array error.

SUPDUP-OUTPUT subnegotiation

On WILL SUPDUP-OUTPUT, C303:

1. sets SUPDUP-OUTPUT-FLAG true;
2. emits IAC SB SUPDUP-OUTPUT 1;
3. emits terminal variables with character insertion/deletion forced on;
4. emits IAC SE; and
5. flushes (supdup.lisp:2802-2813).

The flag mutation precedes all writes. A write failure leaves it true.

For incoming SB SUPDUP-OUTPUT 2, the parser reads one byte as a remaining byte count, temporarily wraps the stream so each :TYI decrements that count, and sends bytes through the SUPDUP display decoder. When the count reaches zero it consumes two advertised cursor bytes, then requires IAC SE. Rendering occurs before count, cursor, and footer validation; malformed framing may leave partial pixels or state before signaling SUPDUP-OUTPUT subnegotiation out of phase (supdup.lisp:2827-2845).

More, logout, and interrupt

C303 Telnet More (supdup.lisp:2879-2895) sets MORE-FLAG. If called in typeout it injects (:MORE) and waits for typein to clear the flag. Typein calls ALLOW-ESCAPE, then consumes any one other event, not specifically Space, and clears the flag.

Network L sends IAC DO LOGOUT before Quit. Network A flushes ordinary output, allocates a Chaos packet, writes IAC IP IAC DM, sets its length to four, and sends it with Chaos opcode 0o201 (2897-2912). Packet allocation or send failure may leave cleanup to Chaos internals; no local unwind cleanup is present in this method.

Clean registration observation

The clean session software-catalog-20260718, generation 1, booted System 303-0 and displayed System Help containing only Top-L Lisp(Edit), E Editor, I Inspector, L Lisp, and P Peek. No S/T registration was present. The System Help frame remains local and unpublished under the ignored session tree, pending a separate image-specific publication review; it MUST NOT be described as reviewed or linked as a curated asset. It is local runtime evidence only for that exact registry state. Its PNG SHA-256 is 06253bde02161f986fccd80f084a60dbbb7174e60c92c91f2aacdeaec4938aa6 and decoded-pixel SHA-256 is 1344fd3d9e779aa2df89a6f255c444005a6883ed12ab72273339d904b77a7617. The session stopped cleanly with unchanged base disk. Full provenance is recorded in D02.

Source-injected static shells

Session d10-network-terminal-cadr-20260719, generation 1, used load band System 303-0 and a local read-only FILE bridge to inject maintained source after ordinary subsystem loading failed. Raw capture 0020-supdup-connect-prompt.png shows only a sparse frame labeled Supdup 1 -- not connected; despite its filename, the source-predicted Supdup. Type the HELP key ... Connect to host: prompt was not visible. Raw 0025-telnet-disconnected-shell.png shows an explicitly constructed Telnet shell with NIL process slots after ordinary TELNET-SEPARATE reached an unbound TYPEIN-PROCESS failure.

These two images are presented by the main D10 specification only as source-injected/static shell visual evidence. They establish bounded surface, who-line, labels, the Telnet shell's visible text cursor, and shared full-screen relationships. They are not pristine compiled-band application observations and do not establish:

• ordinary subsystem load or initialization;
• successful typein/typeout process creation;
• the disconnected prompt loop;
• any key or pointer dispatch;
• host parsing, connection, greeting, Telnet negotiation, or SUPDUP output;
• cleanup behavior; or
• identity between pinned source and compiled System 303-0 definitions.

The CADR session stopped cleanly with forced_stop=false, state_may_be_incomplete=false, emulator/Xvfb exit status zero, and unchanged base disk. Its source injection and failures nevertheless make application state contaminated for behavioral-oracle purposes. The main specification records exact session, disk, source, emulator, image, pixel, sidecar, and run-record identities. Raw sessions remain ignored. Curated use is governed by the screenshot publication review and the CADR harness contract.

Named runtime blockers

No clean representative application screenshot exists for System 46 or the full C303 behavioral profile. A future page about visible connected behavior MUST either close the appropriate obligation and publish a reviewed minimal image or retain the blocker explicitly.

Profile and module selection

Complete input enumeration

For every selected profile, the harness MUST enumerate every physical keyboard character/function key across all modifier combinations representable by the target keyboard. It must run the matrix in disconnected Supdup, connected Supdup, disconnected Telnet, connected Telnet, Telnet More, and C303 prefix-second-stage contexts.

CADR-NT-K11 boundary sequences MUST include Return at length zero; Rubout at lengths zero and one; A B Rubout C Return returning "AC"; A Clear Return returning the empty string; retained input across Form and Vertical Tab; modified Clear/Form/VT/Rubout; an edit followed by a parse restart; input spanning the rubout buffer's initial 0o1000-cell allocation; and a non-character fixture at each comparison boundary. The report MUST distinguish bytes in the returned host string from characters merely echoed or retained in the edit buffer.

Pointer and selection

CADR-NT-M01 MUST cross product selected/unselected state, left/middle/right, every available click count, and Control/Meta/Super/Hyper encodings. It MUST prove that the first unselected left click selects and is consumed, double-right invokes System Menu, Supdup ignores delivered blips, Telnet ignores them with SUPDUP-OUTPUT false, and Telnet emits exact bytes when true. Boundary fixtures MUST include -1, 0, 9, 10, 99, 100, 999, and 1000 cell coordinates.

Entry and lifecycle

Host grammar

CADR-NT-H01 MUST test NIL, symbol, known and unknown fixnum, host object, known Chaos string, unknown Internet string, valid octal numeric string, invalid numeric string, slash contact, decimal socket, leading-zero socket, explicit gateway, missing gateway, nonnumeric explicit-gateway suffix, whitespace-only prompt, programmatic empty string, and C46 Return on an empty edit buffer. It MUST compare C46 and C303 results independently and capture actual Chaos target, contact string, label, condition, prompt repetition or absence, and whether an old connection was already closed.

SUPDUP wire and display

Graphics, GT40, ARDS, and local editing

Telnet

Acceptance

A conformance report MUST name the exact profile, level, optional axes, corrected options, source identities, adapter versions, and every skipped test. L2 requires the exhaustive input and pointer denominator, not a hand-picked command list. L3 requires byte/state traces and malformed-input tests. L4 additionally requires the preserved comparison procedure below and closure of every relevant runtime blocker.