MIT CADR and LM-3 TV window system reimplementation specification

Release profiles

The TV-46 source profile and the preserved System 46 compiled surface are not identical labels. In particular, stream.qfasl has a stream.10-level definition surface while the highest readable file is stream.14; the exact boundary is recorded under Compiled-artifact method and source skew.

Conformance levels

A product may claim a lower level without implementing the higher ones. It MUST state its release profile and level together, such as TV-303/T3. T0 through T4 are enough to recreate the architecture and tested user-visible behavior described here; they do not by themselves promise that arbitrary System 46 or System 303 application source will compile unchanged.

Release-bounded operations-paper corroboration

Moon and Wechsler's April 1981 MIT AI Laboratory Working Paper 209, Operating the Lisp Machine (stable MIT record), materially corroborates the user-visible model: bit-raster screens allocated among programs and menus, windows as independent subdisplays and streams, selection as keyboard focus, exposed/deexposed states, rectangular cursor blinkers, popup menus, Output Hold, notification for deexposed output, and selection causing exposure (especially §§2.1-2.3). The examined 2,586,142-byte PDF has SHA-256 a16d45f5d425e05c6df7c67a5d785c3dd62424a37bed5be8575b7ebbf1e8ff23.

The paper explicitly says that it is a draft accurate as of System 67 and is not guaranteed to remain fully accurate. It therefore supplies MIT-WP209 corroboration for concepts and visible interaction only. It is not evidence for System 46 or System 303 array redirection, coordinates, clipping, ALUs, saved-bit algorithms, lock ordering, API names, or release deltas. Any claim derived from it MUST retain the System 67 qualifier beside the claim; source and runtime evidence govern the two profiles specified here.

Coordinate system

• The origin MUST be the top-left of a screen or sheet. X increases right and Y increases down. (S46-SRC, 303-SRC, MIT-MAN)
• Rectangles MUST use half-open edges [left,right) × [top,bottom). Width is right-left; height is bottom-top. High-level clipped rectangle operations may accept a negative origin and discard the portion before the clip edge; they issue no raster primitive when the post-clip width or height is nonpositive. Negative requested dimensions are not a general high-level drawing feature. Signed dimensions at the lower-level historical BITBLT boundary are different: internal move code uses their signs to select overlap-safe traversal. (S46-SRC, 303-SRC, 303-RUN)
• A sheet's x-offset and y-offset are relative to its superior. Drawing coordinates and cursor positions are local to the sheet. Device coordinates are obtained by summing offsets through the superior chain. (S46-SRC, 303-SRC)
• An inferior MUST remain entirely within its superior before it becomes exposed and while an exposed move or reshape commits. An attempted violating visible operation MUST fail before changing visible geometry. Activation establishes membership and ordering but is not, by itself, evidence that every inactive construction path performed the same containment check. (S46-SRC, 303-SRC)
• Margins are local nonnegative widths. The inside rectangle is [left-margin,width-right-margin) × [top-margin,height-bottom-margin). (S46-SRC, 303-SRC)

Screen pixel storage

A screen implementation MUST expose these logical properties even if the host GPU or framebuffer differs:

Screen {
  name
  width, height
  bits_per_pixel
  raster_storage
  locations_per_line
  default_font
  device_properties
  root_sheet_state
}

TV-46 MUST support the historical one-bit monochrome path. Multi-plane or indexed color MAY be supplied through the screen's depth and properties; it MUST NOT change the sheet coordinate or hierarchy rules. The compatibility layer SHOULD expose a pixel array and the coarser backing-word view expected by diagnostic software.

Boolean raster operations

The compatibility raster substrate MUST implement the ALU selectors directly established by the manuals and inspected source. A backend MAY implement all 16 Boolean functions of source bit S and destination bit D, but this audit has not established stable public names or identical multi-plane semantics for that complete truth-table set. The required compatibility names are:

BITBLT(alu,width,height,source,sx,sy,destination,dx,dy) MUST combine the corresponding pixels over the requested rectangle. It MUST produce memmove-like results for overlapping source and destination regions: traversal direction or an equivalent temporary representation MUST prevent source pixels from being destroyed before use. It MUST preserve pixels outside the destination rectangle. (S46-SRC, 303-SRC, MIT-MAN)

Clipping is operation- and release-specific:

• In System 46, :DRAW-RECTANGLE translates inside-relative coordinates and clips on all four inside edges. Its stream :BITBLT only limits destination width and height at the right and bottom; negative origins are not repaired. The :BITBLT-FROM-SHEET, :PIXEL, and :SET-PIXEL methods add no explicit clipping. A safe implementation MAY add checked variants, but MUST NOT label that extension exact TV-46 behavior. (stream.14:L133-L172; S46-SRC)
• System 303 adds BITBLT-CLIPPED, which clips both source and destination against all four array edges, and its sheet methods use inside-aware clipping. Its source contract says negative dimensions are not allowed; the readable body clamps the resulting extents to zero and omits the primitive BITBLT when either extent is zero, but does not visibly establish that a negative argument signals a condition. Negative dimensions are therefore outside the public BITBLT-CLIPPED contract, not a required error result. (window/sheet.lisp:L33-L57, window/shwarm.lisp:L94-L201; 303-SRC)
• The low-level BITBLT used for margin and overlap moves still permits signed dimensions as a traversal-direction convention. A host backend may normalize the operation through an immutable temporary copy, but MUST preserve the same final pixels. (sheet.383:L758-L782; S46-SRC, 303-SRC)

Lines, rectangles, and text

• Axis-aligned fills MUST reduce to a clipped rectangle operation.
• System 46 :DRAW-LINE accepts a DRAW-END-POINT argument whose default is true; after inside-coordinate translation and clipping it passes that flag to the %DRAW-LINE microcoded primitive. :DRAW-LINES deliberately passes false for every segment, which makes it suitable for closed polygons without drawing shared terminal points twice. A reconstruction MUST preserve that endpoint-control contract. The inspected public tree declares but does not contain a readable body for %DRAW-LINE; exact tie breaking, octant pixel sets, and reversal invariance remain TODO-RUNTIME, not normative claims. (stream.14:L508-L573; S46-SRC)
• A font is a fixed-height collection of bitmap glyphs with baseline, default width, optional per-character widths, optional left kern, optional indexing for wide glyphs, and an optional character-existence table. Wide glyphs occupy the indexing-table interval between a character entry and the following terminal entry. A NIL existence table means every character code is assumed to exist, not that none do. (tvdefs.181:L342-L385; sheet.383:L507-L545; S46-SRC)
• A sheet font map MUST normalize to 26 entries. A shorter nonempty map repeats its last font through entry 25. Entry zero supplies the initial current font and default character width. The common baseline is the maximum mapped-font baseline; line height is the maximum mapped character-cell height plus vertical spacing (VSP, initially 2 in TV-46). Each glyph is vertically adjusted to that common baseline. (sheet.383:L507-L545; S46-SRC)
• Raster extent and cursor advance are distinct. Drawing applies left kern, draws every indexed raster segment, and advances by a per-character width when present or the font default otherwise; italic or kerned pixels may extend beyond the nominal advance. A character is positioned by aligning its baseline with the sheet baseline.
• Character drawing MUST use the sheet's character ALU; erasing and blank areas MUST use its erase ALU. Reverse video is expressed by changing those logical operations, not by changing character codes.
• If a glyph is missing according to a font's existence table, the compatibility layer SHOULD fall back according to the target profile rather than reading uninitialized raster data.

The font source and recovery and font-use audit specify the public font representation and release-bounded uses. Font bytes are inputs to this window specification, not redefined here.

SHEET

A conforming sheet MUST retain the following logical state:

Sheet {
  name
  superior: Sheet | null
  inferiors: ordered list<Sheet>
  exposed_inferiors: ordered subset of inferiors
  active: boolean derived from membership in superior.inferiors
  exposed: boolean
  x_offset, y_offset, width, height
  margins: {left, top, right, bottom}
  screen_array: visible or saved raster mapping | null
  old_screen_array: mapping used when direct visible storage is unavailable
  bit_array: optional persistent off-screen backing
  temporary_bit_array: optional underlay saved by a temporary window
  locked_temporary_windows: list<Sheet>
  cursor_x, cursor_y, more_vpos
  font_map, current_font, baseline, baseline_adjustment, line_height, char_width
  char_alu, erase_alu
  flags
  blinkers: list<Blinker>
  deexposed_typeout_action
  lock_owner_or_temporary_owners, recursive_lock_count
  invisible_to_mouse
  screen_manager_metadata
}

An implementation MAY derive fields or store them in components. It MUST preserve the following distinct predicates:

Conflating these states breaks saved bits, frames, and temporary menus. An exposed inferior of a deexposed saved-bits parent can be logically exposed without appearing on the physical display.

SCREEN

A screen MUST be a sheet with no superior, fixed zero-relative origin, physical storage, device depth, default font, and a mouse-blinker collection. It MUST reject an attempt to expose it at a different origin. Multiple screens MUST form independent root trees, while selection and mouse-screen policy MAY span them. (S46-SRC, 303-SRC)

BLINKER

Blinker {
  sheet
  position or follows_sheet_cursor
  visibility: hidden | solid | blink | selected-only-on | selected-only-off
  deselected_visibility
  phase
  half_period
  time_until_toggle
  renderer_and_arguments
  geometry
}

A blinker renderer MUST be reversible. The rectangular and character blinkers use XOR-like complementing so the same operation removes the mark. Before any output can touch a blinker rectangle, the sheet MUST “open” that blinker by removing its visible phase. A later clock opportunity restores the phase appropriate to visibility and selection. This prevents typeout from baking a cursor into the backing pixels.

Changing a blinker's position, size, renderer, sheet, or visibility MUST first remove its old visible effect. A cursor-following blinker derives its position from the sheet; a roving mouse blinker does not need a text cursor owner.

Input buffer

The input system has both a global hardware/software keyboard queue and private per-stream I/O buffers. The selected window caches one selected I/O buffer. A reader first drains its private buffer; only a reader whose private buffer is the selected I/O buffer may then drain global typeahead. An unselected reader waits even if the global queue is nonempty. The historical manuals do not promise deterministic arbitration between two readers of one shared stream, so a compatibility layer MUST NOT invent such a guarantee. (S46-SRC, 303-SRC, MIT-MAN)

Each I/O buffer is a circular queue with an input pointer, output pointer, capacity, optional input/output and interrupt hooks, state, and property list. One slot is reserved so equal pointers unambiguously mean empty; (input+1) mod capacity == output means full. Pointer updates MUST be atomic relative to keyboard and mouse producers. (S46-SRC, 303-SRC)

The state controls whether data can be inserted or removed. A producer MUST NOT overwrite unread input. In the inspected System 46 ingress path, a full buffer simply does not receive the additional key; no source branch establishes a beep or blocking write. The compatibility profile MUST preserve that drop behavior unless a later runtime probe establishes a different TV-303 path. TYI-NO-HANG returns immediately when empty; LISTEN reports availability without consuming; UNTYI makes one item available again according to the stream contract; forced input enters the target buffer or structured-blip path rather than pretending to be a physical device transition.

Creation transaction and initial state

TV-46 WINDOW-CREATE is an ordered construction sequence under delayed screen management, not allocation followed by unrelated public mutations. A compatible implementation MUST preserve this observable order:

allocate the requested flavor in sheet storage
enter delayed screen management
  invoke :INIT with a private copy of the option list
  if saved backing exists, force access and perform a complete refresh
  if :ACTIVATE-P, activate
  if :EXPOSE-P, expose with the supplied or default exposure arguments
leave delayed screen management; if its queue is nonempty, flush/reconcile it once as a batch
return the initialized object

:INIT is recursively sheet-locked. A queued screen-management pass cannot run between initialization steps, and the object does not enter the superior's active inferior traversal until activation. Arbitrary flavor initialization methods may still have side effects; the source does not promise global rollback or isolation if one of them fails. TV-303 retains this construction model while treating the older MAKE-WINDOW name as a compatibility entry and changing the Flavors initialization method combination; an adapter MAY accept both names but MUST keep profile-specific warnings and argument behavior separate. (sheet.383:L371-L387, tvdefs.181:L585-L606, window/sheet.lisp:L671-L691; S46-SRC, 303-SRC)

The TV-46 sheet initializer accepts at least these option families:

• outer geometry: :LEFT/:X, :TOP/:Y, :RIGHT, :BOTTOM, and :EDGES;
• pixel, inside, or character-based width and height;
• font map and vertical spacing;
• blinker creation, renderer, and deselected visibility;
• reverse video, More processing, integral sizing, and saved bits; and
• right-margin marker, line truncation, and backspace policy.

Its defaults include vertical spacing 2, More enabled, a rectangular following blinker whose deselected visibility is :ON, and output initially held while the sheet is not displayable. Normal video uses ALU-IOR for glyphs and ALU-ANDCA for erase; reverse video exchanges those roles. An implementation MUST install all derived font, margin, ALU, cursor, blinker, and exception state before activation. (sheet.383:L397-L456; S46-SRC)

Size deduction precedence

Construction MUST solve size options by the historical precedence rather than by host-widget defaults:

1. Compute fonts, line height, and decoration margins before interpreting character sizes.
2. Numeric character width means count * default-character-width + left-margin + right-margin. For string width, TV-46 uses the final X advance returned by SHEET-STRING-LENGTH, while TV-303 uses its maximum-X result; each then adds the horizontal margins.
3. Numeric character height means count * line-height + top-margin + bottom-margin. In TV-46, string height is (1 + number-of-CR-characters) * line-height plus vertical margins. In TV-303, string height is the vertical result of SHEET-COMPUTE-MOTION plus margins.
4. TV-303 clamps decoded character width and height to the superior's inside width and height. The inspected TV-46 decoder does not perform those clamps.
5. If an origin is absent but the opposite edge and an explicit size exist, derive the origin from them.
6. Otherwise an absent left/top defaults to the superior's inside left/top. If width or height remains absent, subtract that chosen origin from the explicitly supplied right/bottom edge; use the superior's inside right/bottom only when the corresponding opposite edge is also absent.
7. Integral sizing adjusts the bottom margin so the inside height contains a whole number of text lines.
8. Set the initial cursor to the inside top-left in whole-sheet coordinates.

Redundant fields follow that precedence; they do not generically signal a conflict. For example, an already bound origin and explicit size can make a supplied right/bottom redundant. In TV-303, processing :EDGES clears any width/height already accumulated from defaults so the supplied edges control deduction, and it explicitly rejects nonpositive edge width or height. Other invalid results MUST NOT be assigned a historically invented error condition: reproduce the selected source path or declare a safety-corrected validation extension. (sheet.383:L507-L591, shwarm.162:L730-L785, window/sheet.lisp:L704-L789; S46-SRC, 303-SRC)

Resize and margin transaction

On its successful path, changing size, margins, borders, or a label MUST preserve this operation order:

1. erase obsolete margin pixels while the old geometry is still valid;
2. preserve the cursor relative to the old inside origin;
3. parse options, update margin fields, and derive offsets and outer dimensions;
4. deexpose children that no longer fit;
5. remove blinkers, recompute font/integral sizing, and clamp cursor and blinker positions;
6. grow backing arrays when necessary without discarding retained pixels;
7. redirect the stable screen-array view to the new storage, offset, and stride;
8. move surviving inside pixels with overlap-safe signed BITBLT and clear newly uncovered or unreachable storage; and
9. erase/refresh the new margin regions and hand any queued damage to screen management.

The readable TV-46 method is not atomic on failure: it erases old margins before option parsing, mutates recognized margin fields as it walks the option list, and sets geometry before later raster work. A strict historical-failure profile MAY reproduce those partial effects. The recommended safety-corrected rule is INFERRED: validate and stage the mutation, then commit atomically or restore the old geometry and pixels. An implementation using that rule MUST disclose that its abort behavior is safer than exact TV-46; it MUST still produce the same successful final state and MUST NOT reinterpret retained client pixels as margin pixels. (sheet.383:L681-L827; S46-SRC, 303-SRC, INFERRED)

Border descriptor grammar

The TV-46 border option has this grammar:

Thickness contributes to the corresponding margin, plus the TV-46 default extra border margin of one pixel. Canonical draw coordinates may express right or bottom positions as negative offsets from current width or height; reshape MUST resolve them against the new dimensions. (baswin.428:L675-L809; S46-SRC)

TV-303 additionally canonicalizes a side whose extent in its perpendicular axis is zero to the sentinel :ZERO. DRAW-BORDERS skips that side, but the non-NIL sentinel still contributes the configured extra border margin. This is observably different from NIL, which removes the side and its extra margin. The later parser also folds existing margins into canonical coordinates in left, right, top, bottom order; implementations MUST NOT substitute NIL for :ZERO. (window/baswin.lisp:L898-L1024; 303-SRC)

Label measurement grammar

In TV-46, a label occupies a top or bottom margin, defaults its text to the window name, and uses a configurable label font. In TV-303, accepted descriptors include string, font, :TOP/:BOTTOM, vertical spacing, centering, multiline extent, and boxed variants. Label height MUST be measured before final inside geometry. For a nonempty string the later code measures it through the sheet motion engine using a line increment of font-character-height + (label-vsp or 2); without a label string it reserves one font-character height. Centering changes horizontal placement, and boxed variants add their rule space to the relevant margin.

Drawing, erasing, or changing a label MUST preserve the client cursor. A label change reparses the descriptor, recomputes margins, marks/restores the decoration region, and redraws through margin refresh rather than emitting client text. (baswin.428:L812-L945, window/baswin.lisp:L1047-L1342; S46-SRC, 303-SRC)

Locks

Each sheet has a recursive normal lock and can also be temporarily locked by one or more temporary windows. Normal ownership is by the executing process or an equivalent unique identity. Reacquisition by the owner increments a count; release decrements it and frees the lock at zero. (S46-SRC, 303-SRC)

A conforming implementation MUST obey these rules:

1. Geometry, exposure, saved-bit changes, and direct sheet drawing occur while the affected sheet is stable against incompatible changes.
2. Locking a sheet for drawing also prevents blinkers from independently changing the pixels being updated.
3. A temporary window may lock every exposed overlapping target without permanently deexposing it. It MUST acquire the whole compatible set or wait and retry; a partial set MUST be unwound.
4. Waiting MUST occur with scheduler inhibition or the host equivalent released. After waking, geometry and ownership MUST be rechecked because the world can have changed.
5. Reparenting an active subtree MUST preserve or recompute inherited lock accounting so no descendant appears unlocked while an ancestor transaction owns it.

A modern implementation MAY use mutexes, condition variables, and transaction objects. It MUST retain the retry-after-wait behavior and MUST NOT hold a global non-reentrant lock while calling an arbitrary window method.

Preparing a sheet

Before direct raster access, the implementation MUST:

1. acquire or verify compatible sheet access;
2. remove intersecting visible blinkers;
3. select or map the correct raster storage and depth;
4. clip the operation to the appropriate local region;
5. perform the update; and
6. permit blinkers to reappear after the grouped operation.

Several consecutive drawing operations MAY reuse prepared state, but a process switch, storage remap, exposure change, or different target MUST invalidate that state.

Activation and deactivation

ACTIVATE makes a sheet an active inferior without necessarily exposing it. It MUST be idempotent. It MUST insert the sheet into the superior's active inferior order and propagate device-stride parameters through the subtree. (S46-SRC, 303-SRC)

Activation and containment are separate assertions. The inspected source directly rejects out-of-superior geometry when a sheet is exposed or an exposed position change commits; activation alone does not prove that every inactive geometry was already displayable. A caller MAY prepare an inactive sheet before final placement, but EXPOSE MUST reject it until its bounds fit the superior's inside rectangle. (sheet.383:L1018-L1047; S46-SRC, 303-SRC)

DEACTIVATE MUST first deexpose the sheet, then remove it from the superior's active inferiors. Killing a base sheet includes deactivation, followed by any higher-level resource and process cleanup. A deactivated sheet MUST NOT be exposed until activated again.

Moving, reshaping, and reparenting

• Moving a deexposed sheet changes its offsets and remaps any direct superior-backed view without touching visible pixels.
• Moving an exposed non-temporary sheet MUST deexpose every overlapping sibling that would violate exclusivity, then atomically update its mapping and position.
• Moving an exposed temporary sheet SHOULD use deexpose/re-expose so its saved underlay remains correct.
• Reshaping MUST validate bounds and minimum inside dimensions before committing. Persistent backing storage must grow when needed and must clear unreachable tail storage when shrinking so stale pixels do not reappear on regrowth.
• Reparenting MUST deexpose first, remove active membership from the old superior, change inherited raster parameters, install membership under the new superior, and request screen management for both affected regions.

Higher-level wrappers MUST notify a frame or superior through inferior-change protocols so constraint layouts cannot be bypassed by a pane reshaping itself.

Invariants

The implementation MUST maintain all of these invariants:

1. exposed_inferiors is an ordered subset of inferiors.
2. Two ordinary exposed siblings do not overlap. Temporary windows are the explicit exception and protect their underlay with temporary locks and saved pixels.
3. A sheet cannot be device-visible if an ancestor lacks visible or saved backing.
4. A sheet with persistent bit_array can retain its own contents while deexposed.
5. A sheet without persistent backing relies on redisplay or the still-valid pixels inherited from its superior; it MUST NOT save another window's pixels by mistake.
6. Selection cannot remain inside a subtree being deexposed.
7. Mouse dispatch cannot remain inside an invisible subtree.

Expose algorithm

The following pseudocode is normative at the behavior level:

expose(sheet, turn_on_blinkers=false, bits_action=default, x=current_x, y=current_y):
  require sheet is active, unless sheet is a root screen
  choose bits_action = restore if persistent backing exists else clean
  retry:
    validate target geometry within superior
    if target origin changed: move sheet safely; retry
    if already exposed: return no-change
    ensure superior provides visible or saved raster access
    if sheet is temporary:
      determine all exposed overlapping targets
      if mouse currently dispatches to one, force mouse reconsideration and wait
      atomically acquire compatible temporary locks on all; otherwise wait and retry
    else:
      deexpose every overlapping exposed sibling; if any wait occurred, retry
    mark logical exposure and insert at the front of superior.exposed_inferiors
    map sheet.screen_array to superior storage when visible
    if temporary: save the exact underlay rectangle
    perform bits_action:
      noop     -> retain current device pixels
      restore  -> restore persistent saved pixels and refresh dependent adornments
      clean    -> home cursor and perform complete redisplay
    update blinker selection state
    expose retained inferiors as required
    wake mouse routing
    return changed

The implementation MAY optimize, but it MUST retain validation, atomic overlap handling, saved-underlay ordering, and retry after waiting. (S46-SRC, 303-SRC)

Deexpose algorithm

deexpose(sheet, save_bits=default, screen_bits_action=noop,
         remove_from_superior=true):
  if selected window is sheet or descendant: deselect it
  if not exposed: return no-change
  force mouse routing out of sheet and descendants
  if forced saving requested and no persistent backing exists: allocate it
  if saving enabled and backing exists: copy current pixels to backing
  if temporary:
    restore the saved underlay before releasing every temporary lock
  else:
    deexpose or detach exposed inferiors as required by backing policy
    perform the requested uncovered-area action
  clear visible raster mapping where it is no longer valid
  remove from superior.exposed_inferiors when requested
  mark not exposed
  invoke screen management for uncovered regions
  wake mouse routing

A temporary window MUST restore its underlay even when aborted. Cleanup SHOULD use an unwind-protect/finally mechanism. This is the mechanism that permits a momentary menu to disappear without requiring the underlying application to repaint everything.

Bury, expose order, and visibility

The front of exposed_inferiors is the top of the local stacking order. Expose moves a sheet to the front. Bury moves it below applicable siblings and invokes the superior's screen-management protocol. If no other window can cover the vacated region, the superior clears or redisplays it according to policy.

The order is local to each superior. A frame pane cannot jump above its frame by changing its position among siblings.

Priority and automatic exposure

Each superior maintains an ordered active-inferior list and a separate exposed subset. Reordering is stable and occurs atomically. The intended comparator is:

1. an exposed inferior sorts ahead of a deexposed inferior;
2. two exposed inferiors retain their existing stacking order, regardless of numeric priority;
3. equal priorities retain their existing order;
4. among deexposed unequal-priority inferiors, an explicit numeric priority sorts ahead of NIL/default priority; and
5. among two numeric priorities, the numerically higher value sorts ahead.

BURY deexposes the target and moves it to the end of its stable priority class. It does not override another class's numeric priority. Changing priority accepts only a number or NIL and schedules screen reconciliation. (S46-SRC, 303-SRC)

The two release profiles differ at a source defect. System 46 sheet.383:L345-L369 contains an impossible branch, (AND (NULL PRI-S1) PRI-S1), where the adjacent comment requires testing PRI-S2. System 303 window/sheet.lisp:L645-L669 uses the corrected (AND (NULL PRI-S1) PRI-S2). Therefore:

• a named strict-priority-bug mode layered on TV-46 MAY reproduce the malformed NIL-versus-number case, but MUST identify it as a defect-compatibility option and contain any resulting type error; and
• TV-46 without that optional mode, TV-303, and TV-DUAL SHOULD use the corrected comparator above. (S46-SRC, 303-SRC, INFERRED, TODO-RUNTIME)

Deexposed visibility is distinct from exposure. A deexposed sheet contributes saved pixels to uncovered regions only when it has a backing bit array and its priority is NIL or nonnegative. Automatic exposure considers active, deexposed, fully contained inferiors in priority order, excludes priority -1 or lower, and exposes a candidate only if it is uncovered and would not cover an earlier candidate. If this operation leaves the mouse screen with no selected window, it selects the first eligible named window. (S46-SRC, 303-SRC, TODO-RUNTIME)

Damage is queued by superior and rectangle. A rectangle already contained by a queued rectangle for that sheet is discarded; a new enclosing rectangle replaces contained entries. Dequeueing groups regions for one sheet, skips a locked sheet in nonblocking passes, services other sheets, and retries later. The System 46 background interval is ten ticks, described in source as approximately one sixth of a second. A new damage engine MAY use different storage, but MUST retain region coalescing, per-sheet locking, eventual retry, and independence from an unrelated locked sheet. (S46-SRC, 303-SRC, TODO-RUNTIME)

Refresh

REFRESH accepts a kind of work rather than a Boolean:

The base sheet MAY clear for a complete refresh. Higher-level streams and applications override the method to replay their own model. Therefore saved bits and refresh are complementary: one preserves pixels; the other reconstructs them.

Screen management

Screen management reconciles rectangles made visible by deexposure, movement, reshaping, or hierarchy changes. It MUST operate in superior-local coordinates, subtract the coverage of higher exposed inferiors, then ask the appropriate lower window or superior to restore each remaining rectangle. It MAY temporarily delay management across a group of operations, but the outermost group MUST reconcile the accumulated damage before returning to ordinary interaction.

Stream protocol

A basic TV stream MUST support at least:

TYO, STRING-OUT, LINE-OUT
TYI, TYI-NO-HANG, UNTYI, LISTEN, CLEAR-INPUT, FORCE-KBD-INPUT
FRESH-LINE, READ-CURSORPOS, SET-CURSORPOS, HOME-CURSOR
CLEAR-SCREEN, CLEAR-EOL, CLEAR-EOF
INSERT-LINE, DELETE-LINE, INSERT-CHAR, DELETE-CHAR
DRAW-RECTANGLE, BEEP, NOTIFY
RUBOUT-HANDLER or profile-equivalent input editing entry

The object MUST be usable through the Lisp stream calling convention for its profile, not only through host-language methods.

For TV-303, the selected RH-ON load installs the native alternate rubout handler as the stream default. Its complete mutable base command map, dispatch precedence, decimal argument grammar, C-Q second-stage tree, Help variants, pointer/System-Menu filter, full-rubout handshake, and parser-error retry are normatively incorporated from the System 303 Attributes input tree. That application supplies no command/activation/editor override, so it is also a bounded executable witness for the generic handler. A site profile MUST still dump RH-COMMAND-ALIST; local additions do not rewrite the source-initialized base map.

Cursor and character processing

• Cursor X and Y are local pixel positions, normally constrained to the inside rectangle.
• Printable characters draw at the current position, using left kern and the full indexed glyph raster, then advance independently by the character width.
• Return moves to the inside left edge. Line feed advances by line height. The usual CRLF performs both. Backspace moves according to the profile flag and must not move outside the left inside edge.
• Tab advances to the next configured tab stop; a compatibility implementation MUST reproduce profile tab arithmetic, not use host terminal tabs.
• Font-change characters select entries in the font map. The sheet recomputes baseline adjustment so mixed fonts share a baseline.
• An otherwise printable code whose existence-table bit is absent follows the profile's missing-character path. When the existence table itself is NIL, every code is treated as present.
• Nonprinting effectors are state transitions, not host-terminal escape sequences. Return, line feed, tab, backspace, font selection, and profile control codes update cursor/exception state; an unhandled invisible effector is rendered through the visible-lozenge compatibility path rather than silently discarded.
• A line-overflow exception either wraps, truncates, draws a right-margin marker, or delegates to a class-specific handler according to sheet flags and stream method.
• End-of-page sets the appropriate exception state before invoking scrolling, wraparound, or More processing.

:STRING-OUT MAY batch raster operations, but MUST finish with the same glyphs, advance, font, exception flags, and logical cursor as repeated TYO, except where a profile explicitly documents an optimized boundary. SHEET-LINE-OUT is a separate editor redisplay primitive: it draws at most one line in its normal mode and returns the next input index and resulting X, but deliberately leaves the actual sheet cursor undefined. Generic code MUST NOT infer LINE-OUT semantics from it. The no-op stream completion messages :CLEAR-OUTPUT, :FORCE-OUTPUT, :FINISH, and :CLOSE are required compatibility responses for readable late System 46 source even though the preserved older stream.qfasl symbol surface lacks them. (shwarm.162:L338-L465, stream.14:L490-L503; S46-SRC, S46-QF, 303-SRC)

Exception dispatch and More processing

The sheet's packed exception field represents output hold, end page, More, and a residual invalid state. Its dispatcher MUST test them in this order:

output hold -> end page -> More -> residual exception error

The order is observable because one handler can set or clear another state. End of line can draw the profile's right-margin marker, move to inside left on the next line, clear that line, and service a pending More. End of page homes or wraps to the top, clears the new target line, and schedules the next More threshold. The threshold is derived from line height and the penultimate available text line; its delayed marker means “arm on the next pass,” not simply cursor-y >= inside-bottom. (sheet.383:L1289-L1416, window/sheet.lisp:L1873-L1927; S46-SRC, 303-SRC)

When More is enabled and output crosses the armed threshold, the default handler MUST perform one same-stream transaction:

1. clear the More flag and temporarily defer rearming;
2. clear the end of the current line and draw **MORE** in font-map entry zero without ordinary stream side effects;
3. perform the configured input operation, normally :TYI, honoring the profile's hold/stop characters and permitted timeout;
4. erase the prompt and restore the prior cursor X without damaging adjacent output;
5. set the resulting end-page/wrap or input-wait state; and
6. return the character read, including NIL when the chosen timeout path permits it.

Ordinary input resets the threshold. Global and per-sheet flags may disable More. This is an exception-handler state machine within the raster stream, not a separate modal dialog. (sheet.383:L1289-L1416, window/sheet.lisp:L1929-L1990; S46-SRC, 303-SRC, MIT-MAN)

Deexposed typeout action matrix

Output held because a sheet is deexposed MUST dispatch on the selected profile's action before obtaining a drawable mapping:

TV-303 adds :NOTIFY, which sends :NOTICE :OUTPUT and then follows the common output-hold wait rather than silently exposing the sheet. :PERMIT clears the packed output-hold flag only when a backing SCREEN-ARRAY is present. Because that clearing happens in the exception path on an actual output attempt rather than at deexposure, software can distinguish “writing was permitted” from “a deexposed write was attempted.” A reconstruction MUST retain this first-write detection and MUST NOT model :PERMIT as an unobservable Boolean bypass. No action may draw through a stale mapping into a sibling occupying the old visible rectangle. (sheet.383:L1418-L1445, window/sheet.lisp:L1992-L2021; S46-SRC, 303-SRC)

Window composition

The historical implementation uses Flavors mixins. A new implementation MAY use classes or components, but it SHOULD keep capabilities independently composable:

The base compatibility flavor names SHOULD remain available, but compatibility is judged by required methods and behavior rather than linearized class identity.

Selection

Selecting a window MUST:

1. resolve any pane or alias to the actual selectable frame/window;
2. activate and expose the required ancestry;
3. deselect the previous target and adjust its blinkers;
4. move pending typeahead to the old target before switching the selected input buffer;
5. set the global selected window and input buffer;
6. update recent-selection order;
7. enable selected visibility for the new blinkers;
8. select or wake its process when appropriate; and
9. update the who line and mouse routing.

Selection MUST be idempotent except for explicitly documented cycling behavior. Deexposing or killing the selected subtree MUST trigger a safe replacement or leave a known no-selection state.

Only one top-level selection team can own keyboard input. A frame/team leader is the selection identity while its current representative pane can supply the effective I/O buffer, process, status, notification stream, and blinkers. Selecting another pane inside the same team changes that representative without creating a second top-level keyboard owner. Mouse selection MUST run outside the global mouse process when it can block on exposure or process work.

TV-303 generalizes this with recursive selection substitutes. A conforming later profile MUST resolve the ultimate substitute for selection lists and forwarding, and support its release-specific deselection/restoration modes (:DONT-SAVE, :BEGINNING, :LAST, and :FIRST). A new memory-safe implementation SHOULD detect a substitute cycle and signal a bounded error; the inspected recursion has no proved cycle guard, so this safety behavior must be identified as a deliberate correction rather than a historical observation.

The recent-selection structure is a unique, NIL-padded MRU sequence. It excludes the current target, removes duplicates and dead/deactivated entries, filters for the requested eligibility, and falls back to an idle Listener when nothing usable remains. TV-46 grows its vector in blocks of ten; a new representation may differ but MUST reproduce the observable order and filters.

Process association

A process-owning window associates a process and stack group with its stream. Input selection directs keyboard events to the window's I/O buffer; it does not blindly run application code in the keyboard interrupt path. Creation MAY start a process; selection MAY wake or reset one according to its class. Arrest, reset, kill, and error notification are process operations surfaced through window management.

Call, Break, and Abort address the effective selected process. Call arrests or suspends the busy context and selects a Listener-like control context; Break forces a break in the associated process; Abort resets it. A window that merely reports a process does not necessarily own its lifetime, while a process-owning mixin creates or adopts a process and kills the owned process only after inherited window cleanup.

Keyboard routing

Keyboard ingress MUST be one atomic decision against the current selected I/O buffer:

1. Snapshot the selected buffer, its property list, raw/converted input mode, and available capacity.
2. In raw mode, enqueue the raw code and run the optional input interrupt only when space exists.
3. Otherwise translate the hardware code to a Lisp Machine character and record keyboard activity.
4. Recognize Terminal/Escape and System prefixes before ordinary enqueueing.
5. Apply the release-specific asynchronous rule. TV-46 intercepts Call and Abort as selected-window operations unless the buffer requests super-image mode. TV-303 instead intercepts Terminal, System, and Control-Clear globally, then consults the current selected buffer's asynchronous-character table; its base defaults include Control-Abort, Control-Meta-Abort, Control-Break, and Control-Meta-Break. The C303 Call path is commented out and MUST NOT be invented.
6. Enqueue an ordinary converted character and invoke its input interrupt only when space exists.

This ordering is observable: the selected profile's intercepted asynchronous characters cannot appear as ordinary text in normal mode, and a prefix key cannot leak to an application before the selector reads its suffix. (S46-SRC, 303-SRC)

The exact release-specific Terminal/Escape and System prefix leaves, numeric/minus state, Help precedence, mutable registrations, and unknown-suffix outcomes are normatively enumerated in D02's complete CADR keyboard-prefix trees.

Before a System or Terminal operation changes selection, pending ordinary typeahead MUST be transferred in order from the global queue to the old selected window's private buffer, up to its defined capacity. This prevents text intended for the old window from following focus. The prefix and its selector suffix are control input and MUST NOT be transferred as ordinary text.

Terminal command entries contain a character, function, documentation, and options. The default execution path runs the command outside the keyboard process; :KEYBOARD-PROCESS opts into that process and :TYPEAHEAD requests preservation of pending old-window input. Unknown options in the TV-46 registry are forward-compatible and SHOULD be ignored. Terminal Help enumerates the effective registry.

System selection runs in its own control process. Help or ? reports the live registry; Rubout cancels; a concrete window is selected directly; a flavor/program kind first searches and cycles existing matching windows before using its separately declared creation path. Invalid or absent non-creatable targets beep. TV-303 MUST provide mutable add/remove registration and MUST NOT freeze the five entries observed in one fresh band as a universal list.

Mouse overseer

One mouse process or equivalent event loop MUST:

1. read relative movement and button transitions;
2. apply device scaling and clamp to the selected mouse screen;
3. update the roving pointer blinker;
4. choose the deepest eligible exposed sheet under the pointer unless ownership is seized;
5. deliver enter/leave or HANDLE-MOUSE transitions when jurisdiction changes;
6. send motion and button events in coordinates local to the owning sheet; and
7. reconsider ownership when visibility, hierarchy, selection, or the handler asks.

Hit testing MUST respect invisible_to_mouse, active/exposed ancestry, stacking order, and any method/capability filter supplied by the caller. (S46-SRC, 303-SRC)

The ownership value has two sentinels in addition to a concrete sheet: an anonymous grab suppresses normal target actions when the owner cannot name a window, and a Stop state suspends mouse dispatch. The overseer MUST catch a handler failure at its outer boundary so one application cannot permanently kill global pointer service.

For ordinary, non-grabbed button dispatch, the order is: concrete owner's button method; eligible exposed handler immediately under the pointer; mouse selection; desktop/System Menu fallback. The default System 46 behavior selects asynchronously on Left and opens the System Menu on Right. A keyboard-mouse window instead encodes a click in an already selected input window into its I/O buffer; right double-click opens the System Menu. Some forced mouse blips can overtake pending keyboard input in another queue. A strict compatibility mode MUST preserve and document that ordering hazard rather than falsely promise one merged event queue.

Default TV-46 tracking has configurable physical/device thresholds: 10 pixels of scroll-bar entry reluctance, a 3-pixel sensing strip, 300 pixels of exit reluctance, 10 inches/second maximum scroll-entry speed, and a 30 inches/second fast-motion threshold with a temporary 40-pixel cross. A host implementation MUST calibrate physical-speed quantities instead of treating CSS pixels as inches. A hysteretic window retains ownership within a 25-pixel halo. These are profile defaults, not universal constants.

Seizing and releasing the mouse

A modal interaction MAY seize the mouse for a particular sheet or for an anonymous operation. While seized, ordinary under-pointer jurisdiction MUST not steal events. Release MUST wake the overseer and recompute the owner from current geometry. If a temporary window would cover the current mouse target, exposure MUST first force the overseer out of that target or wait; this prevents dispatch into visually inaccessible state.

Buttons and pointer documentation

Button events preserve button identity, press/release transition, and modifier state. The compatibility layer SHOULD expose logical Left, Middle, and Right names while allowing a host mapping. Bounce filtering and double-click recognition belong above raw transition capture and MUST use profile-configurable time thresholds.

A mouse-sensitive window SHOULD update the who line with the actions currently available at the pointer and under the present modifier/button context. Leaving the sensitive region MUST clear or replace that documentation.

The standard scroll-bar gestures in TV-46 are:

Entry is allowed only from the proper side, below the speed threshold, and after reluctance; high-speed crossing passes through. Exit uses the larger hysteresis region. If the drawing lock is unavailable during exit, visual cleanup MUST be deferred without blocking the mouse service.

System-window resources

Reusable infrastructure windows are created through a registry keyed by symbolic type. An entry supplies a creator, whether multiple live instances are permitted, a reusability/busy predicate, and per-screen instances. A request first reuses an eligible object on the requested screen. For a busy singleton it either waits or reports unavailability according to the call; otherwise it creates, reparents to the screen root, and returns the instance. Unknown types are errors. This registry is the extension point for Screen Editor, choice windows, inspectors, debuggers, and similar tools; they MUST NOT be hidden host-global singletons.

Menu item grammar

A menu item is semantic data, not only a string. The compatibility representation MUST support:

MenuItem {
  display_label_or_form
  return_value
  action: return | evaluate_form | call_function
  documentation
  font_or_style
  selectable_when_or_restriction
  optional_submenu_or_profile_metadata
}

The TV-46 shorthand expansion is precise:

The defined operators are :VALUE (return without evaluation), :EVAL, :FUNCALL, :NO-SELECT, :WINDOW-OP, :KBD, and :MENU for a submenu. Unknown operators MUST signal an error rather than degrade to values. A no-side-effects query may inspect only simple/:VALUE cases and MUST NOT evaluate an arbitrary item while asking what it would do. Item properties include :FONT; TV-303 also supplies per-item :DOCUMENTATION.

Dynamic item lists are recomputed before the operations defined by their class. If a producer has side effects, permanently caching one result is nonconforming. A new implementation SHOULD snapshot one list for an active choose transaction and label that as its evaluation boundary until exact later runtime behavior is measured.

Geometry and interaction

• The menu computes row/column geometry from its item extents, requested orientation, maximum dimensions, label, and margins.
• Moving the pointer into a selectable item highlights it reversibly and publishes its documentation. Moving away removes both.
• A selection runs the item's declared action and returns its semantic value. A disabled item cannot run and SHOULD give visual or audible feedback.
• A momentary menu saves the covered pixels, holds the necessary temporary locks, tracks until selection or cancellation, and restores the exact underlay on exit.
• Leaving a pop-up or using the aborting button cancels without invoking an item.

The system MUST support ordinary momentary choice, command menus, dynamic menus, and multiple-choice state. TV-303/T3 MUST also retain the documented multicolumn and who-line behavior of its maintained implementation.

An ordinary chooser tracks current, last, and chosen items separately. The click that first exposes an unexposed menu MUST only expose it; it does not also choose an item. Any button can choose the current item in the basic chooser, with ordinary double-click/System meanings suppressed inside that transaction. Sparse final columns MUST use the computed row/column item map so a point cannot select a phantom grid cell.

A command menu posts a structured (:MENU item button-data menu) blip into its I/O buffer instead of evaluating application work in the mouse process. A multiple menu toggles ordinary items and uses a distinguished completion item such as Do It to return selected values. A momentary menu must deactivate and restore its underlay before running the chosen action; deactivation or blocking work runs outside the mouse process.

Choice interfaces

A choice item binds a visible label/control to a mutable value and a declared kind, such as Boolean, one-of, or action. The choice display MUST derive its current mark from the value, update only after a valid gesture, and run any declared callback after the model change. Done and Abort have distinct commit semantics when the containing interface supports a transaction.

The profile includes three related facilities:

• margin choices map labeled boxes in a margin to callbacks; a hit starts the callback outside the mouse process and a miss beeps;
• multiple-choice windows retain Boolean values, implication rules, displayed boxes, completion choices, a saved pre-invocation snapshot, and a completion/abort result; implication propagation follows declaration order and MUST detect an oscillating or cyclic conflict in a safe implementation; and
• variable-value forms support Boolean, one-of, numeric, string, Lisp-form, function, and action-like descriptors at the selected release boundary. Editing parses into a temporary value before assignment; Rubout before any input leaves the model unchanged; a parse/type failure reports and retries rather than publishing a half-read value.

The modal choice transaction saves the old selected window and values, exposes the form, loops until Done/Abort/deexposure, and restores selection on every exit. Abort restores the snapshot and returns no committed choice.

Model-based scroll window

A scroll window retains an application display model independent of pixels:

ScrollState {
  display_item_model
  top_item, target_top_item, bottom_item
  screen_image: ordered visible entries with line extents
  truncation_policy
  selected_or_sensitive_items
  optional_typeout_window
}

Redisplay walks the model from top_item, converts entries into one or more display lines, records their screen extents, and stops at the inside bottom. A full redisplay reconstructs the image; an incremental redisplay MAY retain unchanged entries but MUST invalidate entries whose content, position, font metrics, selection, or window width changed.

Relative scrolling reuses pixels with BITBLT when safe and draws newly exposed lines. Absolute scrolling chooses a top item from the requested fraction or item position. The screen image is a cache, never the authoritative application model.

Scroll bar

The scroll bar occupies a margin strip. Its thumb/markers derive from the visible range relative to total items. Pointer movement near the configured strip can engage scrolling after hysteresis; dragging maps position to an absolute target; button gestures above or below the thumb request relative movement. The bar MUST erase or redraw when margins, visible range, total size, or always-visible policy changes.

Typeout overlay

A typeout window is subordinate transient output for Help, errors, or long command results. It grows over its superior's inside rectangle, is excluded from ordinary screen management and mouse selection, and aliases the superior in selection lists. An owning window can construct the overlay from a flavor/options specification and MUST resize it while deexposed whenever the owner's inside rectangle changes. (typwin.53:L197-L251; S46-SRC, S46-QF, 303-SRC)

The overlay retains at least:

TypeoutState {
  superior
  bottom_reached: pixel_y | null
  incomplete: boolean
  had_mouse: boolean
  sensitive_items: list<{type, object, left, top, right, bottom}>
}

First exposure resets bottom_reached and marks the overlay incomplete. Any character/string/line output marks it incomplete. Cursor movement preserves the greatest vertical extent reached; clear-screen, clear-to-end, refresh without saved bits, and end-of-page handling mark or invalidate the affected extent. Deexposure clears the reached extent, and MAKE-COMPLETE marks the transient result consumed. Selecting the owner while incomplete selects the typeout representative; deexposing that representative returns selection to the superior before its pixels disappear. (typwin.53:L295-L341; S46-SRC, 303-SRC, TODO-RUNTIME)

The overlay handles pointer events only over the region actually reached by output. Outside that region it converts coordinates to the superior, forwards motion or the button event, and sends one final transition so stale highlighting can be removed. Crossing into the overlay disables the owner's text blinkers; crossing back restores them. This is partial-region delegation, not a full-window modal grab. (typwin.53:L256-L293; S46-SRC, TODO-RUNTIME)

A mouse-sensitive typeout item stores semantic type, application object, and its rendered rectangle. Refresh, clear, new typeout exposure, and end-of-page transitions MUST discard regions whose pixels no longer represent that object. Motion highlights the current item. Left-single posts a structured (:TYPEOUT-EXECUTE operation object) action to the I/O buffer; right-single may open the type-specific operation menu in another process; right-double invokes the System Menu. Application work MUST NOT execute in the mouse process. (typwin.53:L6-L193; S46-SRC, 303-SRC, TODO-RUNTIME)

EXPOSE-FOR-TYPEOUT activates before taking the sheet drawing lock, exposes without clearing retained output, waits until exposure is real if the superior currently has no screen array, homes the cursor, and clears only to end of line. This order avoids the superior/typeout lock inversion documented in typwin.53:L343-L355. Removal either restores saved underlay or requests owner redisplay. Automatic removal on the next input and explicit More continuation remain class policies, not assumptions of every typeout window. (S46-SRC, S46-QF, TODO-RUNTIME)

Frame contract

A frame is a superior window whose inferiors are panes. The frame owns pane geometry, exposure, and selection. A pane's attempt to expose, deexpose, bury, move, or select is forwarded through the frame so the frame remains coherent. Selecting a pane normally selects the frame and records that pane as the frame's current input pane.

A frame MUST expose, deexpose, activate, kill, and restore its panes as one managed unit. The frame's selection name represents the complete application; panes normally do not appear as independent System-key programs.

Pane definitions

A constraint frame maps stable pane names to pane instances. A pane definition specifies at least a flavor/capability set and initialization options. The frame MUST support lookup by name, sending an operation to a named pane, and broadcasting to all or all exposed panes.

Constraint representation

The layout model is a tree. Interior nodes stack children horizontally or vertically; leaves refer to panes or whitespace. Named configurations choose a tree and set of panes; pane substitutions are resolved before calculation. Unknown panes, substitutions, and configurations MUST fail before visible mutation. (S46-SRC, 303-SRC)

The historical size language includes:

Line and character units convert through the pane's current cell dimensions and margins. Ask callbacks receive remaining extent, total extent, and stacking orientation. Nested horizontal/vertical nodes change the sizing axis. The parser MUST reject an unknown special keyword, duplicate/missing pane name, invalid unit or rounding form, repeated incompatible stacking node, a mixed :EVEN/non-even group, or an :EVEN group before the final descriptor group. System 46 recognizes an :IF node shape but its implementation signals that conditional constraints are not implemented; TV-46 MUST preserve that bounded failure rather than silently choose a branch. (frame.120:L455-L527, L551-L717; S46-SRC, TODO-RUNTIME)

The solver MUST:

1. parse names and macros into a validated tree;
2. calculate raw extents in descriptor order, passing current remaining and total context to extensible rules;
3. calculate the final :EVEN group from the remaining extent;
4. round line/character constraints to whole cells and add margins;
5. apply declared minima and maxima in the source-defined rounding phase;
6. assign cumulative positions on the stacking axis and the full available size on the cross axis; and
7. verify that every configured pane accepts its candidate edges.

Configuration application is a two-phase transaction:

set_configuration(name):
  resolve and parse name, panes, substitutions, and constraint tree
  calculate all candidate extents and positions without changing pane edges
  ask every pane to verify its complete candidate rectangle
  if any pane rejects: return its reason or "Not all panes fit"; mutate nothing
  deexpose panes belonging to the old configuration as required
  commit every accepted edge
  draw configured blank regions
  expose the new configuration's panes in configuration order
  reread or invalidate cached positions

Verification stops at the first rejection, but no earlier pane may retain candidate geometry. A frame resize performs recomputation while its panes are deexposed so a half-old/half-new layout is never visible. Blank nodes consume exact layout extent but never become panes. (S46-SRC, 303-SRC, INFERRED, TODO-RUNTIME) The calculation, rounding, and positioning paths are frame.120:L719-L876; configuration verification/application is frame.120:L260-L452.

TV-303/T3 MUST permit named configurations and runtime configuration changes. A change invalidates current constraint positions, recomputes all pane edges, exposes the configured panes, and deexposes panes not in the new configuration. System 303 integrates the frame's selected pane with the general selection-substitute mechanism; System 46 uses the earlier frame-selected-pane forwarding. Both MUST remain one selection team.

T0 raster tests

T1 sheet and stream tests

T2 interaction tests

T3 reusable-family tests

T4 environment tests

Focused System 303 sheet-core observation

The named harness session tv-core-spec-20260718, generation 1, exercised a researcher-entered rectangle operation in System 303-0. The selected live Lisp Listener reported outer edges (0 0 768 939), inside edges (2 2 766 925), selected status, saved bits enabled, exposed-p=T, output-hold zero, and one following rectangular blinker. These values describe that object at the observation instant, not class defaults. (303-RUN)

The exact input operation was issued twice:

(send tv:selected-window ':draw-rectangle 40 30 -20 -10 tv:alu-xor)

Because the listener inside origin was physical (2,2), inside clipping predicts a 20 by 20 intersection at half-open physical rectangle [2,22) × [2,22). Comparing the pre-operation and first-operation captures found exactly 400 changed pixels, with inclusive changed bounds (2,2) through (21,21). Comparing the top-left 40 by 40 region before the first XOR and after the second found zero changed pixels. The running band therefore confirms negative-origin inside clipping and reversible XOR for :DRAW-RECTANGLE; it does not by itself confirm generic BITBLT clipping or the complete ALU space. (303-RUN)

Portable session provenance:

The focused input sequence recovered the Listener with Abort, queried the selected window and its source associations, recorded the pre-XOR state, issued the two identical operations, and stopped cleanly. Raw captures remain in the ignored session tree and are not linked or published here because intermediate date/error states are not needed for the scholarly claim.

Live :SOURCE-FILE-NAME properties associated key callable TV definitions with logical source areas SYS: WINDOW; SHEET and SHWARM; the pathname version queried as :UNSPECIFIC. This proves resident callable behavior plus a source-area association. It does not identify the compiled source revision or show that the band was built from the pinned Fossil checkout. The session did not query TYPEP/COMPILED-FUNCTION-P on symbol functions, method functions, or combined Flavor methods, so it also makes no compiled-function-object representation claim.

Compiled-artifact method and source skew

The System 46 QFASLs were inspected inertly: the audit reused the evacuation and nibble-decoding helpers from the tracked public-asset extractor, then considered only plausible FASL SYMBOL and STRING group payloads. It never loaded or evaluated a QFASL. For tvdefs, sheet, baswin, shwarm, and frame, every simple top-level function, macro, variable, flavor, and method flavor/message name from the highest readable companion source was present in the compiled module's symbol inventory. That corroborates a definition surface only; it does not establish method bodies, constants, lambda lists, or whether a source-visible defect was compiled. (S46-QF)

stream.qfasl supplies an exact counterexample to treating the highest source and compiled file as one witness. Its symbol inventory contains DRAW-RECTANGLE-INSIDE-CLIPPED and lacks %DRAW-RECTANGLE-CLIPPED, matching the change present by stream.10. It also lacks all nine later names:

CLEAR-OUTPUT  CLOSE  CURGEN  DRAW-CUBIC-SPLINE  FINISH
FORCE-OUTPUT  INCREMENT-CURSORPOS  LINE-IN  SPLINE

Source history adds splines and :DRAW-CUBIC-SPLINE in stream.11, generic stream completion/close methods and :LINE-IN in .12, and :INCREMENT-CURSORPOS in .13; .14 retains that relevant surface. The strongest justified conclusion is therefore that the preserved stream.qfasl has a stream.10-level definition surface. Its bodies have not been disassembled. A compiled-surface-compatible System 46 facade MUST treat those nine names as later extensions, not as proved members of the compiled module. (S46-QF)

Public System 46 representatives

These compiled files were inventoried and hashed, not disassembled in this audit. S46-QF therefore corroborates that each module family had a compiled payload in the public snapshot; it does not prove that the QFASL was produced from the highest numbered readable source beside it.

Preserved System 303 runtime

The primary behavior witness is public disk-sys-303-0.img, 269,562,880 bytes, SHA-256 bb16e46ad81decfe1efe691d36b6aa4ce3fd4ffb82474365de3520989d397cb5. The harness guide records the current source, emulator, machine artifacts, and per-session evidence. The maintained source identities for representative modules are pinned by the System 303 Fossil check-in in the Sources section. The runtime closure table above distinguishes those source identities from behavior not yet exercised in the band.