Program selection, activities, and window management reimplementation specification

Release profiles

The optional Genera CLIM system declaration names a compiled genera-activities module, but the inspected source set does not contain that module's body. No CLIM frame-registration behavior is therefore part of this L2 contract. CLIM is not the implementation of the native System Menu, activity registry, or Select Key Selector.

Conformance levels

This document normatively defines C46/L2, C303/L2, and G85/L2 at the semantic grain stated here. The C46 claim is source-only. The C303 and G85 runtime claims are limited to the observed menu and selection paths. L3 remains reserved.

Exact source artifacts

Recovered sysmen.qfasl and basstr.qfasl at 33,301 and 33,941 bytes, with SHA-256 b2b75fc4c0f0a9876a994e3c058e1699b487511165bfdae2ed8a845aff64d753 and 622ca5c92187d4e444e47da80aa12c3c75b50dbea14d9da133465eaad4746921, corroborate the C46 module/symbol surface only. They are not body evidence.

Normative evidence map

Selected-module coverage

C46 System 46

Main System Menu: Create, Select, Inspect, Trace, Split Screen, Layouts, Edit Screen, Other.

Other page: Arrest, Un-Arrest, Reset, Kill, Emergency Break, Refresh, Set Mouse Screen.

Create: Supdup, Telnet, Lisp, Edit, Peek, Any.

The manual's M mail entry is not in this exact initial source table. Split Screen can later mutate this list by installing a frame key.

C303 System 303-0 runtime and pinned source

Default Create source choices: Supdup, Telnet, Lisp, Edit, Peek, Inspect, Font Edit, Lisp (Edit), Any.

Observed System Help: Top-L LISP(Edit), E Editor, I Inspector, L Lisp, and P Peek. This live five-entry set is distinct from source calls in unloaded optional subsystems.

G85 Genera 8.5 base world

The 19 observed activity names are Converse, Distribute Systems, Document Examiner, Editor, File Server, Flavor Examiner, Frame-Up, Inspector, Keyboard Control, Lisp, Mail, Namespace Editor, Notifications, Peek, Restore Distribution, Select Key Selector, Terminal, Zmacs, and Zmail.

Read-only runtime observation, 2026-07-19: isolated session d01-hardcopy-item-probe-g85-20260719, generation 1, evaluated only an ASSOC lookup of Hardcopy in the live This-window column. The printed item bound Left and Middle to TV:SYSTEM-MENU-HARDCOPY-WINDOW and Right to TV:SYSTEM-MENU-HARDCOPY-WINDOW-MENU; no button or printer path was invoked. The action log SHA-256 is 398e844474cef70a92f774ae466ed6afa7ae29b5685b21283218a9cb33a52de9, the final evaluator PNG SHA-256 is 9c2034e9e91de5f8e3ffe7f3122a9a5e6806446b73ac3f2f9674193b75cf8838, and its decoded-pixel SHA-256 is c22456f9ddf8a88b6a2d3f185f6341642b724fcbc4064b1fda8f2f714b5923e7. The evaluator image remains ignored and is not a publication asset. The base and private world bytes ended unchanged. The harness did not request Save World or create a process checkpoint; guest Save World and checkpoint fields remain unknown. After the shutdown prompt, confirmation, and cleanup progress, the harness used its bounded forced stop on the known VLM stall. Run-record SHA-256: 71eaa7541ee4a1d19d72ec55b93f597c6f73daa71155d4247aa95874c2dd2c49.

The same run is recorded in the canonical Genera activities and System Menu dossier.

Create: Terminal, Lisp, Peek, Inspect, Edit, Frame-Up, Distribute Systems, Document Examiner, Namespace Editor, Any.

The Activities command table directly contains Select Activity. No closed inventory of a broader Window command table is claimed from D02's selected source modules.

CADR keyboard prefixes

C46 System
├─ unmodified Help or ? -> display current System-key list; wait for flush character
├─ exact effective registered suffix -> dispatch entry
│  └─ initial unmodified E/I/L/P/R/S/T -> targets in the C46 inventory
├─ unregistered unmodified Rubout -> cancel silently
└─ any other unregistered suffix -> beep

C303 System
├─ strip modifiers after recording whether Control was present
├─ Help or ? -> display filtered effective registry; wait for flush character
├─ effective registered base character -> dispatch entry
│  └─ Control present -> force only a valid flavor-valued creation branch
├─ unregistered Rubout -> cancel silently
└─ any other unregistered base character -> beep

C46 Escape shared prefix
├─ unmodified Escape -> clear accumulated argument and minus flag; continue reading suffix
├─ each unmodified 0..9 -> argument := 8 * (argument or 0) + digit; continue
├─ unmodified - -> set sticky minus flag; continue
├─ O -> ignore accumulated argument; select last eligible exposed MRU entry
├─ S -> consume signed argument; use Recent-window selection tree below
├─ unmodified Help/? or another exact registered suffix -> dispatch the effective shared entry
└─ unregistered suffix, including unmodified Rubout -> no operation

C303 Terminal shared prefix
├─ each 0..9 -> argument := 10 * (argument or 0) + digit; continue
├─ - -> set sticky minus flag; continue
├─ B -> bury selected window's selection alias; argument ignored
├─ character #x1D -> Set Mouse Screen; NIL argument cycles, non-NIL opens chooser
├─ O -> ignore accumulated argument; select last eligible exposed MRU entry
├─ S -> consume signed argument; use Recent-window selection tree below
├─ any other registered suffix -> dispatch the effective shared entry
├─ unregistered selected-buffer/global asynchronous suffix -> quote into keyboard input if space
├─ unregistered Rubout -> no operation
└─ every other unregistered suffix -> beep

C46 System and Escape preserve suffix modifier bits, so a modifier-bearing C46 System registration is reachable by exact match. C303 System alone normalizes Meta/Super combinations to the base character while Control with any combination sets force. C303 Terminal preserves modifier bits and matches the exact registered suffix, including modified registrations. In both C46 and C303 System, registered Rubout dispatches because lookup precedes the bare-Rubout fallback. C46 gives Help precedence only to unmodified Help and ?, so exact modifier-bearing registrations for those characters remain reachable; C303 strips the modifiers before its Help test, making every such registration unreachable. C46's base-eight accumulator literally accepts 8 and 9; C303 uses decimal. Minus negates the accumulated value, or one when no digit preceded it. Repeated C46 Escape resets both argument states; C303 Terminal has no corresponding reset branch. Shared registered leaves other than D02's O and S retain their own typeahead and keyboard-process metadata and are outside this application's semantic ownership.

G85 Select and Function prefixes

G85 Select
├─ global Select keys disabled -> beep and return before reading any suffix
├─ =/C/D/E/I/L/M/N/P/Q/T/X -> exact live activity mappings in the G85 inventory
├─ any other firewall-enabled mapped base character -> mapped activity, including digits and Help/?/Rubout
├─ unmapped or firewall-disabled Help/? with KBD-SYS-HELP bound -> Select Help
├─ unmapped or firewall-disabled Rubout -> no-op
└─ every other unresolved/disabled character -> beep

G85 Function shared prefix
├─ global Function keys disabled -> beep and return before reading any suffix
├─ Function -> clear accumulated argument and minus flag; continue reading suffix
├─ each 0..9 -> argument := 10 * (argument or 0) + digit; continue
├─ - -> set sticky minus flag; continue
├─ O -> ignore accumulated argument; select last eligible exposed MRU entry
├─ S -> consume signed argument; use Recent-window selection tree below
├─ firewall-enabled EQL-registered suffix -> dispatch the effective shared entry
│  └─ loaded Help/? registrations -> open Function Help
├─ unresolved Rubout -> no operation
├─ unresolved Abort/Suspend -> asynchronous-intercept fallback
└─ every other unresolved suffix -> beep

G85 Select reads exactly one suffix; it has no numeric-argument parser. It uppercases the suffix, records Control as force-create, then strips all modifier bits. Meta, Super, Shift-derived case, and combinations therefore resolve to the base character, while only Control changes force-create. A digit can dispatch when the table maps it and its firewall cell is enabled, otherwise it follows ordinary fallback. The Select Key Selector omits digits from its displayed Keys pane under a source comment that they are reserved for arguments, but that comment does not override the actual dispatcher; the UI policy/dispatcher tension is a preserved runtime oracle.

The G85 Function prefix uses decimal accumulation and preserves suffix modifier bits for exact EQL registry matching. Minus has the same signed-default rule as the CADR prefixes, and repeated Function resets both argument states. The firewall and registry lookup gate all registered Function leaves. Other registered leaves are delegated shared-prefix behavior, not D02-owned semantics. Select Help's own display/cache limitations remain as specified below.

Pointer and application-local trees

Sheet-level pointer precedence is part of the binding contract, because an application window can shadow the bare-screen System Menu gesture:

C46 keyboard-sensitive window
├─ encoded double-Right -> System Menu escape hatch
├─ any other click while window is not selected -> asynchronously select it; consume click
└─ any other click while selected -> deliver encoded fixnum through :FORCE-KBD-INPUT

C46 default/unhandled sheet bitmask
├─ Left bit present -> asynchronously MOUSE-SELECT target (wins over other bits)
├─ otherwise Right bit present -> asynchronously request System Menu
└─ Middle-only/no recognized bit -> no D02 default operation

C303 KBD-MOUSE-BUTTONS window
├─ encoded double-Right -> System Menu escape hatch
└─ any other click -> on unselected single Left select first, then always deliver encoded button through :FORCE-KBD-INPUT and consume

C303 essential non-KBD application window
├─ encoded double-Right -> System Menu escape hatch
├─ single Left on an unselected selectable target -> select target; consume click
├─ otherwise, handled :FORCE-KBD-INPUT -> deliver full mouse event to application
├─ otherwise, accepted single Right -> System Menu dispatcher
└─ other unhandled event -> beep

G85 essential application window
├─ encoded double-Right -> System Menu escape hatch
├─ single Left on an unselected selectable target -> select target, then conditionally forward the same event through :FORCE-KBD-INPUT
├─ otherwise, handled :FORCE-KBD-INPUT -> deliver full mouse event to application
├─ otherwise, accepted single Right -> System Menu dispatcher
└─ other unhandled event -> beep

C303 default no-window handler (button-bit priority Left > Middle > Right)
├─ Left bit -> select active selectable sheet under pointer when handler exists
│  └─ no eligible/handled target -> no-op; do not fall through to another set bit
├─ otherwise Middle bit -> reset asynchronously when mouse sheet is a screen
│  └─ false screen gate -> no-op; do not fall through to Right
└─ Right -> System Menu dispatcher

G85 default no-window handler (button-bit priority Left > Middle > Right)
├─ Left bit -> select active selectable sheet under pointer when handler exists
│  └─ no eligible/handled target -> no-op; do not fall through to another set bit
├─ otherwise Middle bit -> reset only when active mouse is default-screen's mouse and its sheet is a screen
│  └─ false mouse/screen gate -> no-op; do not fall through to Right
└─ Right -> System Menu dispatcher

G85 unhandled single-Right modifier refinement
├─ unmodified or Shift -> asynchronously request System Menu
├─ Meta-Shift -> separate window-editor path
└─ every other encoded Right modifier combination -> beep

C46 System Menu Other -> restore saved coordinates -> auxiliary-menu second target snapshot
C303/G85 Edit Screen Left/Middle -> direct mouse/default superior
C303/G85 Edit Screen Right -> frozen target -> screen finder
C303/G85 Set Mouse Screen Left/Middle -> non-hairy direct/cycle path
C303/G85 Set Mouse Screen Right -> explicit chooser
G85 Move/Shape/Expand/Hardcopy Left/Middle -> ordinary automatic alias path
G85 Move/Shape/Expand/Hardcopy Right -> alias-versus-concrete chooser

G85 Activities command table
├─ typed Select Activity <activity name> [<user-visible superior>]
│  └─ omitted superior -> terminal stream's screen; explicit argument must satisfy USER-VISIBLE-SCREEN
├─ :SELECT on SYS:ACTIVITY-NAME presentation -> translate to Select Activity
│  └─ use the screen of the window containing the presentation as superior
└─ no D02-installed single-character command accelerator

G85 Select Key Selector
├─ no application-specific single-character command accelerators
├─ :SELECT on SELECT-KEY presentation -> partial Add Assignment, confirm activity
├─ :SELECT on SELECTABLE-ACTIVITY presentation -> partial Add Assignment, confirm key
├─ Shift-Middle key with staged mapping -> Delete Assignment by key
├─ Shift-Middle activity with EQ-identical staged value -> Delete Assignment by activity
├─ :COMMAND-MENU-HELP on either presentation type -> its installed Help command translator
├─ either presentation type in Help context -> its registered presentation-specific Help topic
├─ five local typed commands, each :menu-accelerator T and present in pane menu
│  ├─ Add Assignment
│  ├─ Delete Assignment
│  ├─ Save Assignments
│  ├─ Get From system
│  └─ Put Into System
├─ inherited Help menu accelerator -> source-predicted target mismatch
├─ installed SI::COM-SELECT-ACTIVITY -> typed path, absent from six-cell pane menu
├─ inherited help-program command table -> Help commands/translators above
└─ inherited standard arguments command table -> default typed argument acquisition

Pointer selection of other System Menu cells dispatches the cell's declared ordinary operation through the inherited command-menu selection gesture; only the button-specific branches above differ at this profile boundary. A non-mutating G85 base-world registry query closed the Hardcopy branch: Left and Middle use SYSTEM-MENU-HARDCOPY-WINDOW, and Right uses SYSTEM-MENU-HARDCOPY-WINDOW-MENU. The query printed the item only and never invoked a print path. The implementation MUST expose a binding-tree dump containing context, prefix path, modifier normalization, leaf operation, shadowed registrations, and unbound fallback so the tables and this tree can be compared mechanically.

Invoke and dismiss the pointer System Menu

The context tree above decides whether a right click is delivered to an application, selects a previously unselected window, beeps, or reaches the System Menu. At the default/unhandled boundary, C46/C303 Right invokes the menu. G85 accepts unmodified or Shift-Right, while Meta-Shift-Right is a separate window-editor path and MUST NOT be folded into the menu binding. Encoded double-Right is the menu escape hatch from a keyboard-sensitive application window in every selected profile.

1. The mouse caller freezes the superior and dispatches asynchronous menu work with that superior only. G85 then dynamically binds DEFAULT-SCREEN to it and *CONSOLE* to its console before the enable check, resource allocation, and choice; registered callbacks can observe those bindings.
2. At chooser startup, in its :CHOOSE :BEFORE phase, capture the then-current pointer coordinates and lowest target sheet beneath the menu. Pointer motion between the trigger and this phase changes the eventual target; later motion does not.
3. Resolve the profile's current dynamic item lists. C46 uses main/Other pages; C303 and G85 use three columns.
4. Expose the momentary menu near the pointer and update the highlighted item and pointer documentation during motion.
5. Pointer exit without choice deexposes the temporary menu and restores its underlay; it MUST invoke no item callback.
6. On choice, remove/restore the temporary menu before arbitrary item code runs.
7. Pass the frozen target and coordinates to a direct this-window operation even if the pointer moved while the menu was open.

C46 Other receives the main menu's frozen (window, x, y) tuple but ignores the window identity, warps the pointer back to (x, y), and opens a second window-hacking menu. That auxiliary menu captures a fresh lowest sheet under the restored point in its own :CHOOSE :BEFORE phase. An underlay change before that phase can therefore retarget the operation; a change after the auxiliary menu has taken its snapshot cannot. Exact C46 compatibility MUST preserve that two-stage behavior and MUST NOT substitute the discarded main-menu identity.

In G85, the mouse trigger always schedules the asynchronous System Menu process. The console-wide enable gate runs inside that process before menu resource allocation and :CHOOSE; disabled state beeps there. Enabled invocation is wrapped in the named exit restart; the restart exits the menu but does not roll back an operation already committed. The inspected C46/C303 paths have no corresponding wrapper.

All three chosen-item paths deactivate the temporary menu before arbitrary callback code. C46 has no pointer-return/error wrapper around the callback and can retain its chosen-item slot after failure. C303's inner unwind cleanup clears the choice on every unwind. An ordinary callback condition unwinds while its success flag remains true, so saved pointer coordinates are restored; a THROW 'ABORT is caught by the outer momentary-menu method, which then clears success and deliberately skips the pointer warp. These cleanup rules are distinct from pointer exit without a choice.

G85's chosen-item order is more specific. BASIC-MENU first restores the captured pointer coordinates only when the global restoration flag is true, the mouse sheet is unchanged, and pointer speed is below its cutoff. If the chosen item begins with a string and the current process is still named System Menu, the more-specific process-renaming :BEFORE method permanently renames that process to the item label. The inherited dynamic-menu :BEFORE method then auto-deactivates, and only afterward does the callback run. This rename-before-deactivation order follows the selected flavor component precedence and default most-specific-first daemon combination; it is not an alphabetical ordering inference. The named exit path wraps callback execution. Saved coordinates remain callback data when actual pointer restoration is skipped. C46/C303 have no corresponding speed/flag/same-sheet or process-renaming wrapper in the inspected chosen paths.

Menu refresh has no common generation counter. C46's single-column dynamic menu recomputes its list and compares old/new structures with EQUAL. C303/G85 multicolumn menus compare the column-list identities with NEQ. Their flattened menus share existing item conses: an in-place replacement of an item's tail can become visible without a rebuild, while a same-head destructive link insertion or removal can leave the flattened structure stale. A fresh top-level column-list identity triggers rebuilding. Separately, G85 refreshes Select items before the empty check. C303 checks a reusable Select menu's cached item list before :CHOOSE refresh: an empty-to-nonempty transition may falsely beep, while a nonempty-to-empty transition may proceed to an empty refreshed menu. Exact conformance preserves these predicates and defects; an INF safety profile MAY use explicit invalidation.

C303 System Menu programs-column registration

ADD-TO-SYSTEM-MENU-PROGRAMS-COLUMN is the C303 mutable Programs registrar. It matches an existing label with EQUALP and replaces that item's tail in place. For a new item, after = T prepends; a matched after label inserts immediately after the match; NIL or an unmatched after value inserts after the final item when the column is nonempty. With an empty column there is no final reference and the loop inserts nothing. Because the multicolumn menu's flattened representation shares item conses and uses column-list identity as its refresh predicate, in-place tail replacement can be visible without a rebuild while destructive same-head insertion can leave the flattened links stale. A conformance implementation MUST retain both the registrar's placement rules and this cache interaction in C303 strict mode.

G85 System Menu registration

The raw G85 column and Create registrars use EQUAL name matching. Replacing a matched label mutates that item's tail in place. For new items, after = T prepends; a matched after label inserts after that item; otherwise the Windows, This-window, and Programs registrars append only when the column is already nonempty. With an empty column, any new insertion other than after = T vanishes because their loop has no final reference at which to collect the item. The Create registrar instead uses a NIL default position immediately before final Any; a non-NIL unmatched after value causes no Create insertion. The This-window registrar constructs a fixed three-button dispatch description from its ordinary, right, and middle forms.

The exact raw item shapes are observable. A Windows entry carries :FUNCALL-WITH-SELF; a Programs entry carries :EVAL; a Create entry carries :VALUE. A This-window entry has Left bound to its ordinary form, Middle to middle-form or the ordinary fallback, and Right to right-form or the ordinary fallback. The activity-to-Programs adapter closes over a description snapshot and, when invoked, selects the activity with :SUPERIOR equal to the screen of the menu object passed to the callback. These wrapper and placement contracts MUST NOT be collapsed into one generic (label, callback) registrar.

The activity-to-Programs registrar has a different contract: it matches labels with STRING-EQUAL, updates an existing activity entry, and alphabetically sorts only when adding a new entry. A matched replacement can preserve the enclosing column-list identity yet become visible through the shared item cons; a destructive same-head link change can remain stale, and a fresh list identity rebuilds. Exact G85 mode MUST preserve these interactions; explicit generation invalidation is INF.

C46 System-key selection

1. Capture and uppercase the suffix without stripping modifier bits. Control, Meta, Super, and combinations therefore do not match the initial unmodified entries, but they can match a later exact modifier-bearing registration.
2. Transfer typeahead entered before System into the old selected input buffer.
3. Dispatch asynchronously outside the keyboard process.
4. Unmodified Help or ? displays the current mutable list before lookup. An exact registered suffix then dispatches, including Rubout or modifier-bearing Help/?; only an unregistered unmodified Rubout cancels without a beep, and another unknown suffix beeps.
5. Resolve a target instance or flavor. Reuse searches only the previous-selection ring.
6. If a reusable target exists, deselect the old target, adjust MRU for same-type cycling, and mouse-select the found target.
7. If the current window is the only matching instance, beep rather than create.
8. Otherwise interpret the fourth slot exactly: NIL beeps, T performs default construction, and every other object is passed to EVAL. C46 does not restrict that evaluated form to a list.

C46 has no Control-System force-new contract in this source. Modifier-bearing suffixes are distinct keys rather than force flags. Split Screen directly mutates the list and can replace only the first matching key; Help and dispatch observe the resulting current list. Its Help path leaves KBD-ESC-TIME set while the Help window waits for the flushing character; the flag is cleared only after Help returns.

C303 System-key selection

C303 retains the typeahead and asynchronous boundary, but the registry is a stack of entries. ADD-SYSTEM-KEY normalizes and stable-sorts; an exact duplicate is suppressed, while a different same-character entry can override an older entry. REMOVE-SYSTEM-KEY removes one matching occurrence and can reveal the older one. Help sorts the stack and shows at most the first effective entry per character. Its initial duplicate sentinel suppresses ?. It omits any atomic target for which GET of SI:FLAVOR is false: this includes an invalid symbol and ordinarily a valid specific-window object (including a Split frame) unless that object advertises the property. A cons expression entry is displayed without target validation.

After Control is captured and stripped, Help and ? are tested before registry lookup, so a registered Help or ? entry can never execute. Registry lookup occurs before the bare Rubout fallback, so a registered Rubout entry does execute; an unregistered Rubout cancels silently. Another unresolved suffix beeps.

C303 explicitly clears KBD-ESC-TIME before its Help window waits for the flushing character, allowing the keyboard dispatcher to proceed, and clears it again on normal exit. This differs observably from C46's wait ordering.

C303 captures only Control as make-new, then CHAR-CODE strips every modifier bit. Meta or Super without Control therefore selects the base registration without force; Control combined with Meta, Super, or both selects the base registration with force.

The target can be a window, flavor, or expression evaluated on every invocation. NIL means the expression already performed the action. Control is stripped from the character and sets make-new, but this changes only a valid flavor-valued target: it skips flavor reuse/current-only handling and invokes that entry's creation path. A specific window is still selected under Control, an expression returning NIL is still a no-op, and an invalid flavor still beeps before creation. Normal valid-flavor invocation reuses, beeps on the sole current instance, or creates when permitted. Expression, creation, and selection errors have no rollback and can leave deselection, MRU, typeahead, and KBD-ESC-TIME partial state.

C303 snapshots both SELECTED-WINDOW and its selection alias. Reuse cycling and the sole-current test compare the requested flavor against that alias, not necessarily the concrete selected sheet; when a reusable prior window exists, the alias match also controls whether deselection sends the :END rotation hint. A pane whose alias has the requested flavor can therefore beep/cycle as the current instance even when the concrete pane does not.

C303 alone has the cons-valued target-expression branch. Its evaluation happens before automatic deselection, so an expression error cannot be blamed for later selection effects; C46 has no corresponding target-expression branch. C303 validates an atomic flavor property and beeps for an invalid atom. C46 distinguishes only a DTP instance; every other raw target is passed as a TYPEP flavor designator, so an unknown type can enter the TYPEP error/restart path rather than beep. In either profile a reusable-flavor or atomic-construction path can deselect/mutate MRU before a later construction or selection failure. C46 evaluates every non-NIL/non-T fourth slot for effect; C303 evaluates a cons-valued creation form. Neither evaluated-form branch receives automatic deselect/select handling. Any earlier typeahead transfer remains, and KBD-ESC-TIME can remain set because normal-exit cleanup did not run.

Automatic placement is also distinct from pointer-menu Create. C46's atomic System-key construction uses the window constructor's default-screen context. C303 passes DEFAULT-SCREEN explicitly as superior. Evaluated creation forms in either profile choose their own placement. G85's final activity creator receives the explicit superior when supplied, otherwise the console screen chosen by activity selection.

Recent-window selection

The MRU mechanism is independent of the application registry even when System or activity selection consults it. Its representation and user prefix differ:

O scans the sequence without pruning, retains the last exposed entry that still reports a selection name, and mouse-selects it; because index 0 is most recent, this chooses the least recently selected eligible exposed window. Repetition therefore cycles exposed windows. A no-longer-selectable entry is skipped, but a stale object that faults while receiving status/name messages is not cleaned up by this path. When no eligible entry remains, every selected profile beeps and leaves selection unchanged.

S defaults to numeric argument 2. Argument 0 asks for a window needing attention and selects it if one exists. C46 and G85 simply use their found/selection path. C303 instead calls SELECT-INTERESTING-WINDOW: it first deexposes a matching exposed notification window when one exists, then selects the interesting window, then removes that window's BACKGROUND-INTERESTING-WINDOWS association. A nonzero invocation deselects the current window, moves its pending typeahead to its old input buffer, prunes entries that no longer report a selection name, rotates the active sequence, and selects index 0:

• positive n moves the 1-origin nth entry to the front and shifts the preceding prefix right;
• negative -n moves the old front to the end of that prefix and shifts the other entries left;
• +1 is rewritten as negative active length, moving the front to the back and selecting the next recent entry;
• -1 is rewritten as positive active length, moving the last active entry to the front; and
• an oversized absolute argument is clamped to the active length; +2 and -2 consequently have the same two-entry result.

C46/C303 compute active length by ignoring trailing NIL padding; G85 uses the fill pointer. The active prefix is dense and contains each eligible window/selection alias at most once. The currently selected window and deactivated windows are absent.

Empty rotation exposes a source defect rather than one uniform no-op. With active length zero, omitted/default +2 or another positive argument greater than one is clamped to zero only after initializing from index -1, and can fault. Arguments +1 and -1 are rewritten to zero and skip both rotation branches; a larger negative argument clamps to zero through the negative branch. Those paths can finish with no selected result instead of the positive-index fault. Strict profiles retain these distinctions; an INF safety profile MAY guard empty active length first.

G85 Select dispatch and activity search

Select dispatch performs these gates in order:

1. Check the console-wide Select enable state.
2. Uppercase the character while retaining modifier bits long enough to capture Control as force-create; then strip the bits.
3. Test the character's per-character firewall state before looking up or validating its mapping.
4. Only when the character is firewall-enabled, look up the mapping; if one exists, resolve and validate its activity, start selection input hold, and dispatch selection asynchronously at priority 1. A disabled stale mapping is never validated and therefore cannot raise its stale-activity error on this path.
5. Only when that enabled-mapping branch did not apply, test the Help/?, Rubout, and generic-error fallbacks described next.

If an enabled mapping exists, it wins even when the character is Help, ?, or Rubout. Otherwise Help or ? opens Select Key Help without a second per-character firewall check only when KBD-SYS-HELP is bound; if that function is unbound, the gesture is unresolved and beeps. Rubout is a no-op, and another unresolved or disabled key beeps. Help lists raw mappings that are firewall-enabled and documents Control force-creation. It does not validate the mapped activity name, so a firewall-enabled stale mapping appears in Help even though dispatch later errors during activity lookup. The selected Help implementation forces redisplay only on its first opening: *LAST-HELP-DISPLAY-SELECT-KEYS* begins true and is then permanently set false in the inspected source, with no assignment/firewall invalidation path found. A later Help opening after mutation can therefore display cached old output depending on the SHOW-HELP substrate. Exact freshness is a runtime oracle, not a promise that Help always enumerates the current table.

Stale activity lookup occurs before selection input hold begins and cannot itself leak a hold. For a successfully resolved mapping, and for the Help fallback, the historical path begins the hold before PROCESS-RUN-FUNCTION; release is not guarded by unwind cleanup. A synchronous process-spawn failure can therefore leak either kind of hold. The activity callback's normal-only wrapper also leaks on later apply/selection error. By contrast, once the Help callback starts, KBD-SYS-HELP ends the hold immediately before SHOW-HELP, so a later Help-display error does not retain it. Exact G85 compatibility preserves and tests these boundaries; an INF safety-corrected profile MUST release the hold on every post-acquisition exit.

Activity selection uses this exact search order:

1. Derive a console from the explicit superior or default; no console returns NIL.
2. Determine whether the selected window or its selection alias is a current match within the effective superior subtree.
3. With no explicit superior, run a noncreating current-hierarchy hook pass only when a creator exists and force-create is false. Then run the creator-capable hook pass with the creator. Forced creation skips the first pass and goes directly to the second. The second pass MAY create and return before MRU or exposed-window reuse is tried.
4. Unless forced, accept the current match only when selected-ok or the shadow rule permits it.
5. Search the previous-selection sequence.
6. Search exposed/exposable direct inferiors of console selection screens; move a found window to the requested/usable screen when required.
7. If only the current match remains and is disallowed, perform the configured no-beep, beep, keyword beep, evaluated form, or called function policy and return NIL.
8. If no earlier hook, current, MRU, or exposed path returned a result, invoke the final direct creator fallback.
9. Return values according to the activity class and path. A specific-window compatible path and concrete program/program-choice paths can propagate a frame plus created-p. The general compatible-activity path wraps frame search in OR, which preserves only its primary value on success; its later created-window fallback variable is never assigned. Callers MUST NOT infer a reliable second value from that path in strict G85 mode.

An explicit superior skips the two current-hierarchy hook passes, not current-window matching: the selected window or its alias can still match when it lies in that superior's subtree. Selection runs inside delayed screen management, but deselection, MRU burying, and screen movement can precede a later expose/select error; there is no transactional rollback.

Activity and Select-key registration

Activity names use a case-insensitive table. All aliases of a definition MUST point to one activity object when they are supplied in that completed definition call. Redefinition checks conflicts against source identity before instantiation; refusal leaves the old mapping. Accepted redefinition updates only names supplied in the new call: an omitted old alias continues to point at the old object, splitting the former alias set. Assignments are sequential, and an unexpected error has no proved rollback. The string-valued clobber-p conflict comparison appears to compare a conflict record rather than its name; retain this as a source-predicted, runtime-unverified defect.

A compatible activity can carry a cons-valued flavor specification. G85 evaluates it before console derivation or any search, with TV:ALWAYS-MAKE-NEW dynamically bound from force-create; an error there is pre-selection and pre-MRU. A returned specific window is moved and activated before generic selection.

Compatible creation policy is exact: NIL forbids creation; T creates the first flavor named by the resolved flavor/list specification; another atom names a different creation flavor; and a cons is an arbitrary creation form. The arbitrary form can return a sheet or fall back to the console's selected window. A program-choice activity can return a string notification, NIL no-op, or concrete program name.

On the general compatible list-creation path, G85 renames *CURRENT-PROCESS* to the activity description immediately before evaluating the creation form and does not restore the old name. Evaluation failure can therefore retain the renamed process as a partial effect.

SET-SELECT-KEY-ACTIVITY normalizes the key and resolves conflict before replacement, but it does not validate the new activity name at installation time. Direct callers can therefore install a stale mapping; later lookup validates the reference and errors. Both ADD-SELECT-KEY and ADD-DISPATCHING-SELECT-KEY define an activity first and then attempt key replacement. A declined key conflict can leave the new activity installed under either path. These partial mutations are normative for strict G85 compatibility.

PRECREATE-ACTIVITIES dispatches to the activity method, but the selected source's basic method is a no-op and its compatible-activity specialization is inside a block comment. No effective compatible precreation is claimed without a runtime or another loaded subclass witness.

Select Key Selector

The G85 selector is a native Dynamic Windows program reached by Select =.

The source-defined configuration is a column containing title, choices, and interaction regions. Choices is a row: a left column stacks Keys above Activities, while Assignments occupies the remaining right region. Interaction is a row with the command menu at left and interactor at right. The title is one line; interaction is four lines; Keys is ten lines. The left choices stack and command menu each receive a 0.3 share of their row, with the other member taking the even remainder; unsized vertical regions use the even remainder.

The title uses the Eurex italic huge style. Keys, Activities, and Assignments each have a top inside-box label in Swiss bold, a one-pixel ragged border, two-pixel left whitespace, a left scrollbar visible when needed, and a three-pixel white border. Keys and Activities suppress MORE processing and blinkers. Assignments enables incremental redisplay and a typeout window. These are source-visible layout/style requirements; exact resulting pixels remain blocked on the selector screenshot oracle.

On every top-level entry, the program copies the global Select table into its private assignments table, discarding any prior uncommitted session state. The Keys pane enumerates A-Z; ASCII graphic codes 33 through 126 excluding letters and digits; control codes 0 through 31; the explicit Integral character (internal code octal 177, represented by raw byte 0x87 in this preserved source file); Space; and the 50 character codes beginning at octal 200 when they have names, excluding Select, Function, Rubout, and Symbol-Help. Digits are intentionally omitted under a source comment that calls them reserved for arguments, but the inspected Select dispatcher has no numeric parser. The selector source parser accepts either a recognized character name or any one-character token, including a digit; the end-to-end Command Processor assignment result is retained as a runtime oracle rather than inferred from that parser alone. The Activities renderer reads and sorts the current activity table when called, but its pane declares redisplay-after-commands false. External or mid-session registry mutation is not guaranteed to appear until some other redisplay path runs.

The :SELECT gesture on a SELECT-KEY or SELECTABLE-ACTIVITY presentation starts a partial Add Assignment command with that presented argument supplied; the complementary argument acquisition uses confirmation. Shift-Middle delete translators exist on both presentation types. The key tester requires a current staged mapping for that key; the activity tester scans staged values with eq, so an equal-but-distinct string or another alias does not enable the translator. Each type also has a presentation-specific Help-topic translator and a :COMMAND-MENU-HELP presentation-to-command translator. These gestures are part of the native selector contract, not generic menu accelerators.

Add Assignment, Delete Assignment, Save Assignments, Get From system, and Put Into System are local commands declared with :menu-accelerator T. Help is the inherited standard menu accelerator. SI::COM-SELECT-ACTIVITY is also installed in the command table as a typed path but is not one of the six pane-menu cells. The table inherits help-program and standard arguments; their generic editing and argument bindings remain inherited, while the installed Help/presentation routes above are part of the effective selector tree.

• Add silently adds or replaces one staged mapping.
• Delete by key removes one mapping. Delete by activity removes mappings only when the stored activity-name string is eq to the supplied string object; it does not compare string contents or resolve aliases. It can remove several mappings that share that same object, while an equal-but-distinct string or another alias of the same activity can remain. A miss prints a message. This identity behavior is a strict-profile defect, not portable string semantics.
• Get discards staged changes and recopies the current global table.
• Put replaces the global hash-table object wholesale with a copy of staged state. It is neither a merge nor activity validation.
• Save writes a generated setup form to ZWEI kill history, not a file. The generated removal list is empty, so replay can add/replace but cannot reproduce deletions relative to another baseline.

The visible Help command is not established as a working source profile. The framework requests STANDALONE-SELECT-KEY-SELECTOR-HELP, while the only inspected definition is the differently named STANDALONE-SELECT-SELECTOR-HELP; a source comment says that latter definition seems never to run. Strict reconstruction MUST preserve or explicitly profile this source-predicted mismatch until runtime shows a loaded alias or patch. It MUST NOT invent Help output from the installed prose.

Because Put replaces the table object, external holders retain the old object. Two open sessions implement last-Put-wins and can lose one another's changes. External changes made after entry remain invisible until Get and are overwritten by Put. Putting a stale activity name succeeds but later Select lookup can fail. Executing a malformed setup form applies additions then removals sequentially with no rollback.

Create and Select menu operations

Create first resolves the current choice count:

After that count branch, the exact Create ordering is profile-specific:

• C46 chooses a type, then saves global MOUSE-SHEET, enters unwind cleanup, handles Any by prompting with the requested superior, switches the mouse to that superior, and begins construction. It allocates the instance before :INIT; ESSENTIAL-WINDOW's :BEFORE :INIT then performs the non-abortable mouse rectangle acquisition. A condition or nonlocal failure there can therefore leave an allocated/partially initialized object and its name-count side effect. Cleanup restores the saved global sheet but does not undo that allocation prefix.
• C303 chooses a type, then saves global MOUSE-SHEET. A cons-valued type expression is evaluated before entering unwind cleanup. Inside unwind, Any prompts with the then-current MOUSE-SHEET, not the requested superior; only afterward does it switch the mouse to the superior, acquire abortable geometry, construct, and select. Cleanup restores the saved global sheet. At either corner, a Middle-containing mask aborts, Left places normally, and a remaining Right-containing mask uses the common smart-point helper. Its complete recursive traversal, candidate-overwrite, and inclusive-clamp contract is normatively incorporated from D03 Screen Editor and Frame-Up and applies independently at both Create corners.
• G85 freezes MS = MOUSE-SHEET(SHEET-MOUSE(SUP)) before choosing a type and places a multi-choice menu on MS. A list-valued type expression is evaluated before unwind. Inside unwind, Any prompts with requested SUP, then mouse switching targets SUP; nevertheless CREATE-WINDOW-WITH-MOUSE still receives frozen MS and uses it both for rectangle acquisition and as the new window's superior, with any paired init options. Cleanup restores that mouse to MS.

C46 Any performs its read without an error/abort catcher; a read condition or abort propagates through the already-entered unwind cleanup. C303's helper catches SYS:ABORT and ERROR around the read and returns NIL; invalid/non-sheet flavors also beep and return NIL. The enclosing C303 Create then skips mouse switching and construction. These are distinct from C303/G85 pointer rectangle cancellation after a valid type has been chosen.

Thus a C303/G85 type-expression failure occurs before the unwind/mouse-switch region. C303/G85 instantiate only after successful geometry acquisition, so pointer abort creates nothing. C46 instead allocates before its initializer acquires geometry. Once unwind has been entered, prompt, constructor, or selection failure does not suppress the profile's mouse-sheet restoration.

C46 and C303 finish Create with a direct :SELECT send. G85 finishes with :MOUSE-SELECT, so only the G85 Create path takes the mouse-selection typeahead, activation, and containment ordering. When requested SUP differs from frozen G85 MS, prompt/switch and acquisition/construction intentionally concern different superiors; strict compatibility MUST preserve that mixed result.

Select enumerates all relevant screens, not merely the menu's superior. C46/C303 concatenate each screen's selectable-window list in ALL-THE-SCREENS traversal order. G85 first retains eligible current-console, non-generic-who-line screens in that same order, then adds each *OLD-CONSOLE-SCREENS* member with PUSHNEW; an old-console screen bypasses the generic who-line and current-console filters, while an EQL duplicate is suppressed. The resulting unique screen order is then mapped to each screen's selectable-window list in order. C303/G85 intend an empty-list beep/error. C46 has no explicit empty guard in the inspected operation. C303 also has the cached-list defect described above.

After a choice, the historical callbacks call MOUSE-SELECT without a liveness recheck. C46's mouse-selection path snarf-clears queued keyboard input before selection and beeps on NIL. C303 deliberately preserves queued input and can requeue the action through the mouse process; it activates before containment validation, so an out-of-bounds failure can retain activation/MRU effects. G85's :MOUSE-SELECT :BEFORE moves pending typeahead to the old console input owner; its primary method also activates before containment and can retain activation/MRU on a later failure. A chosen window killed after list snapshot can therefore condition or partially mutate state rather than be safely rejected. A stale-target guard is allowed only in an explicitly labeled INF safety profile.

Per-window operations

Bury, Arrest, Un-Arrest, Reset, and Kill are distinct, but not every profile offers or targets them alike:

G85 additionally has an operation-specific geometry alias matrix:

The G85 geometry path contains a mixed-coordinate edge. OLD-X/OLD-Y are the menu mouse object's coordinates captured at chooser :CHOOSE :BEFORE; the path then subtracts mouse offsets derived from the original frozen target while choosing the nearest corner using the selected victim's size. When an alias and concrete pane differ in offset or extent, exact mode MUST preserve that calculation and report the resulting coordinates. Cancellation leaves the target unchanged. A target killed after display but before callback must be safely rejected in a safety-corrected profile; exact historical race behavior remains a runtime obligation.

Both Hardcopy wrappers flow through the same geometry-target helper used by the other row entries. Conformance MUST replace the eventual printer sink with a harmless trace stub: exercise target routing and coordinate/chooser behavior, but do not submit a print request.

Edit Screen dispatch

C46's single Edit Screen item passes the chooser-snapshotted target through SCREEN-EDITOR-FIND-SCREEN-TO-EDIT, then opens Screen Editor for the result. C303 and G85 use button triples: Left and Middle edit the current mouse sheet (C303) or the menu's mouse-default superior (G85) directly, while Right uses the frozen target and the screen-finder path. The editor transaction itself belongs to the Screen Editor and Frame-Up dossier and D03 specification; D02 defines this routing boundary only.

Set Mouse Screen

C303/G85 bind Left and Middle to the non-hairy path and Right to the chooser. With zero candidates, C46 proceeds toward an empty chooser; C303/G85 non-hairy source proceeds toward MOUSE-SET-SHEET NIL, while the hairy path opens an empty chooser. Every profile builds the candidate list by PUSH while traversing ALL-THE-SCREENS, so chooser and cycling order is reverse enumeration order. The zero-candidate outcomes are source-predicted defects and runtime oracles, not permission for an unlabeled implementation to invent a fallback screen.

Build a Split Screen proposal

The proposal contains ordered planned window entries, a region, and optional frame configuration. Its two-column menu is labeled Split screen element:. The flat source-order fixture begins with every entry returned by the requested superior's pane-types alist, in that order. If and only if that dynamic prefix has odd length, the builder appends one blank :NO-SELECT item. It then appends the exact fixed tail below. Source order is normative; row/column fill orientation remains a runtime oracle rather than an inference from a two-column declaration.

C46 renders Do It and Abort in FONTS:MEDFNB; C303 uses :MENU-STANDOUT; G85 uses style (NIL :BOLD NIL). Every C303/G85 nonblank fixed item has pointer documentation. These are profile-visible distinctions: Error and Debug MUST NOT be silently normalized to one label.

The proposal loop compares fixed command tokens with EQUAL in C46 and G85, but with EQUALP in C303. A case-variant string can therefore enter a fixed branch only in C303. C303 and G85 temporary menus include abort-on-deexpose behavior: external deexposure finds the Abort item and injects its result into the interaction stream. C46's selected menu class has no corresponding deexposure-to-Abort path.

Frame configuration is also profile-specific. C46 exposes use-frame, the default name Split-screen frame, and an optional System character; it has no margin control or frame-PUNT callback. C303 exposes frame name and optional System character, and its Cancel the Frame margin action PUNTs only while frame use is true. G85 exposes Enclose windows in a frame, the same default name, and an optional Select character; turning use-frame off PUNTs, and the PUNT handler unconditionally removes the choose-values window and clears use-frame.

Undo removes only the most recent planned window entry. It does not undo Mouse Corners or Frame configuration. Abort runs unwind cleanup that deactivates transient interaction/preview windows and performs no layout commit. C46 uses a non-abortable pointer rectangle acquisition and unconditionally adopts the returned edges; C303/G85 use abortable acquisition and retain the old region when it returns NIL. C303 has an explicit frame cancel; G85 turning frame use off emits its corresponding PUNT state.

Existing Window differs:

• C46 accepts a selectable-menu result and later reparents it;
• C303 walks the chosen window's superior chain and accepts the direct child of the requested superior; and
• G85 enumerates direct inferiors of the requested superior, excludes transient interaction windows, and falls back from selection name to sheet name.

Existing Lisp is a reuse-or-create operation in every profile, not an unconditional constructor. In C46 and C303, IDLE-LISP-LISTENER scans the requested superior's direct inferiors in order and reuses the first whose :LISP-LISTENER-P result is :IDLE and whose current size equals that superior's full inside size; otherwise it creates a LISP-LISTENER directly. Split then resizes the result into its region, so when a proposal contains more than one region the first chosen Listener normally no longer meets the full-inside-size test and a later Existing Lisp creates another. G85 calls FIND-INFERIOR-OF-FLAVOR on the requested superior for DW::DYNAMIC-LISP-LISTENER, restricted to direct inferiors in sheet order and given the current proposal's already-chosen Listener list as a MEMQ exclusion set. It has no idle or full-size criterion. When that search is exhausted it creates a direct Dynamic Lisp Listener. Busy, resized, and otherwise selectable direct Listeners can therefore be reused once each; nested Listeners are never candidates.

The eventual selection variable is assigned only by Existing Lisp, Existing Window, and generic flavor entries. Plain, Trace, Debug/Error, and combined Trace/Debug special entries never become the selection result, even when they appear first.

For an ordinary, nonfixed choice, every selected builder pushes the raw result onto the proposal list before trying to derive its display label and increments the count only after the label/frob operation succeeds. A label lookup or STRING conversion condition can therefore leave a proposal whose list gained an entry while its count and preview did not. In C46/C303, a symbol raw value means a flavor constructor at commit; every nonsymbol raw value is presumed to be an already concrete window, with no validation at proposal time. G85 instead uses the evaluated flavor/options branch described below for every non-instance raw value.

G85 generic planned creation is itself a commit-time branch under the setup lock and after old-inferior deexposure. It evaluates a list-valued planned type. If the result is a list, its first element is the flavor and its tail supplies additional initialization options; an atomic result is the flavor with no extra options. It then creates the window with actual superior, assigned edges, and those options, assigns the first eligible result to the selection variable, and exposes it. Evaluation or construction failure retains the already-deexposed/created prefix.

C46/C303 do not have that noninstance branch. They treat any planned entry whose first value is not a symbol as a concrete window, without an instance/type check. An arbitrary list-valued value is therefore sent window messages and can fail after the same destructive prefix; it is not evaluated and destructured into flavor/options as in G85.

C303 evaluates menu forms while deriving comparison labels, so a label lookup can side-effect or fail. G85 uses a no-side-effect evaluator for that purpose.

Selected C303/G85 source comments report disk thrashing before the builder appears, an intermittently absent choose-variable-values display, and cases where a requested frame is ignored. These are author-recorded defect oracles, not claims that the identified runtimes reproduced them.

Commit Split Screen

For N < 4, use one column and N rows. For N >= 4, use two columns and ceiling(N/2) rows. Fill row-major using integer division. The final planned window gets its right edge forced to the region's right edge; an odd final item therefore spans both columns. Bottom remainder is not separately corrected.

C46 Do It with N=0 divides by zero. C303/G85 beep and remain in the builder.

Strict historical commit is destructive and non-atomic:

1. Deactivate builder/preview windows.
2. If requested, create and expose a frame and make that frame the actual superior for the children; otherwise retain the originally requested superior.
3. Only in frame mode and only when a non-NIL selector key was requested, install the frame registration. A key value left behind after frame PUNT is ignored. C46 and C303 remove only the first ASSQ match with DELQ, then directly CONS the new entry (CHAR-UPCASE key, specific frame object, frame-name documentation, create = NIL); they bypass the normal sorted registrar and can leave an older duplicate while disrupting sort order. G85 calls ADD-SELECT-KEY with the key, specific frame object, sole frame-name/description, creation disabled, and clobber enabled for both activity and key conflicts. Activity definition still precedes key replacement, so injected failure can split those registry effects. Both CADR paths apply CHAR-UPCASE but preserve modifier bits in the stored key. C46's System dispatcher also preserves those bits, so a modifier-bearing frame key is reachable. C303's dispatcher strips modifiers before lookup: its corresponding generated entry is unreachable, and because ASSQ did not match the unmodified base key during replacement, any older base registration can remain effective.
4. Lock the actual child superior. While holding that lock, deexpose its currently exposed direct inferiors, sequentially reparent or create each planned window, including the G85 evaluated flavor/options branch above, assign truncated geometry, and expose each successful result. In frame mode the locked superior is the new frame, not necessarily the original requested superior.
5. If proposal construction recorded an eligible selection result, select it directly while still holding the setup lock, in both frame and non-frame modes.
6. Release the setup lock.
7. In frame mode after lock release, route that same result through the frame's SELECT-PANE path only when it is among the frame's exposed inferiors. A proposal containing only special plain/trace/debug entries can leave the selection result NIL and commit without selecting a new result.

A failure can leave the frame, an optional key/activity, deexposed inferiors of the actual child superior, and any prefix of new children committed. In non-frame mode, those can be old inferiors of the originally requested superior; in frame mode, the explicit deexposure occurs inside the new frame. When frame mode and a key were both requested, C46/C303 perform their unsorted first-match replacement before children, and G85 invokes the already non-atomic activity/key registration before children. unwind-protect cleans transient UI; it does not roll back live layout mutation.

Trace/debug stream references are also profile-specific. C46 directly assigns its globals. C303 trace/error windows save current values on expose and restore them on deexpose. G85 directly assigns trace output or debugger overrides. A strict implementation MUST preserve these partial stream-reference effects.

An optional INF safety profile MAY stage and roll back the entire layout, but its conformance report MUST label that divergence and retain strict mode for comparison.

Save and restore layouts

Every profile's chooser includes Just Lisp, Save This, and the saved entries visible in that menu resource. Just Lisp finds or creates a Lisp Listener and synthesizes a one-record, full-inside layout for it; this is a creator-capable path, not restoration of a previously saved live-reference record. An empty layout's value is NIL and is indistinguishable from chooser cancellation at the caller's guard, so it cannot be restored through that path.

C46's nested-backquote :EVAL form applies the same direct-inferior, idle, full-inside-size Listener rule described for Split Screen at Just Lisp choice time. Opening or canceling a fresh menu does not call IDLE-LISP-LISTENER; every choice recomputes the Listener and then-current full-inside edges. C303's evaluated Just Lisp item has an additional choice-time global-state coupling: when evaluation begins, it freezes the immediate superior of the then global TV:SELECTED-WINDOW, calls IDLE-LISP-LISTENER with that superior, then separately rereads global TV:SELECTED-WINDOW for the saved record's status while using the frozen superior's inside edges. A selection change between those reads can therefore combine the original superior/listener and geometry with a later selected window's status. A NIL or killed selected window can fail at either message send; there is no atomic snapshot or rollback.

G85 Just Lisp searches only direct LISP-LISTENER inferiors of the layout menu resource's superior, in sheet order, and creates one only if that direct search fails. It neither finds a nested Listener nor uses Split Screen's DW::DYNAMIC-LISP-LISTENER selection rule.

Capture order is not interchangeable across profiles. C46 and G85 walk exposed descendants depth-first in postorder: each exposed inferior subtree is visited in SHEET-EXPOSED-INFERIORS order before its sheet. They PUSH each eligible record, NREVERSE the result to preserve that visitation order, and then move the selected record to the front. C46 traverses and excludes against global MOUSE-SHEET and tests global SELECTED-WINDOW, even when its SCREEN argument selected a different menu resource. G85 also traverses and excludes against global MOUSE-SHEET, but tests (SHEET-SELECTED-WINDOW SCREEN) when moving the selected record. C303 uses MAPCAR over only the direct inferiors of global MOUSE-SHEET, in their existing order; ineligible temporary or mouse-sheet entries become NIL holes rather than being removed, after which global SELECTED-WINDOW is moved to the front only when its record is present.

Restore does not deexpose unlisted windows. C46/G85 do not restore hidden status or a general stacking order. C303 does not reconstruct killed windows and can fail when a NIL hole is treated as a layout record. That NIL-hole behavior is a static source-predicted defect until exercised with a matching inferior population.

C303 saves the layout/menu entry before prompting for an optional System key. Rubout, invalid input, or key-registration failure therefore leaves the layout saved. On success it installs a cons-valued target (RESELECT-SCREEN-LAYOUT ',layout) and also places the raw layout in the registry's fourth slot. Base and Control System dispatch both evaluate that target expression; restore returns NIL, so dispatch stops and never consults the fourth slot. System Help displays the cons entry under its normal expression rules. All three profiles accept a SCREEN argument but mix it with one or more global mouse-screen or global-selection references as summarized in the table; a strict implementation MUST preserve the selected profile's exact cross-screen source behavior.

For G85 specifically, SYSTEM-MENU-LAYOUTS SCREEN places the outer chooser on the explicit screen, but Save This calls the saver without an argument, so the nested save defaults to global MOUSE-SHEET. A direct call to the saver with an explicit screen instead traverses global MOUSE-SHEET while taking selected-window state from the named screen. These are two separate conformance branches.

Saved entries reside in the mutable item list of a reusable SCREEN-LAYOUT-MENU instance, not in a proved single global layout list. Save This is nested while a chooser instance is already in use, but the resource mechanism differs by profile.

C303/G85 use DEFRESOURCE. Their deexposed-window checker ignores the resource's in-use bit: when superior/parameters match and the menu is deexposed and unlocked, the nested allocation can reacquire the same object. In-use state is one bit, not a nesting count, so inner deallocation can mark that shared object free before the outer operation exits; a third allocation can then reuse and mutate it. If matching, exposure, or lock conditions fail, nested Save can instead allocate or reuse a different resource copy.

C46 instead uses its per-screen GET-A-SYSTEM-WINDOW association pool. Availability depends on deexposure and sheet-lock state, with a MORE-THAN-ONE allocation path; there is no in-use bit or inner deallocation that marks the outer use free. Nested Save can nevertheless reuse the now-deexposed same menu, or choose/create another pool member when screen or lock conditions differ. The named SCREEN-LAYOUT-MENU-ALIST variable is unused in the inspected paths.

Eligible-copy preference is also normative. C46 scans the per-screen association pool from its head, so the newest association wins first. C303/G85 DEFRESOURCE allocation scans existing copies from the highest index downward. Tests MUST arrange multiple simultaneously eligible copies; merely proving that some matching menu was returned does not establish this ordering.

Duplicate/replacement rules apply within one menu object. Same-object aliasing and different-copy visibility apply to every profile; premature one-bit release is only a C303/G85 behavior. All three representations remain live-object data in the Lisp environment; no user-facing serialized layout format is established.

LM-3 System 303 System Menu

Runtime observation: System 303-0, session core-env-20260718, generation 1, after a recorded right-click intent and successful displayed-menu outcome, captured 2026-07-18. The visible contract is a lower-right three-column menu with headings Windows, This window, and Programs; the exact labels in the C303 fixture; a box around Attributes; and bottom documentation describing that item. Boot and Listener text is incidental. The frame is 768 by 963 pixels; PNG SHA-256 2abdb00ff42c3d032744785b2964d144b62e468ea92815becb5f479d78519d82. Underlying software and display material remain the property of their respective rightsholders; reproduced for criticism, scholarship, and historical documentation under 17 U.S.C. section 107 and the image-specific CADR catalog review. No affiliation or endorsement is implied.

Genera 8.5 System Menu

Runtime observation: Genera 8.5, System 452.22 under Open Genera 2.0, session core-dossiers-20260718, generation 1, after a recorded Shift-plus-right-button intent and successful displayed-menu outcome, captured 2026-07-18. The visible contract is a titled, bordered, drop-shadowed three-column menu with headings Windows, This window, and Programs; the exact labels in the G85 fixture; a box around Refresh; and pointer documentation below the client. Startup and Listener text is incidental. The frame is 1200 by 900 pixels; PNG SHA-256 e1a8a968d891e68e9f4315ee7d943d4b0b1fb70b103226402ba64d23f91a5d66. Underlying software and display material remain the property of their respective rightsholders; reproduced for criticism, scholarship, and historical documentation under 17 U.S.C. section 107 and the image-specific Genera catalog review. No affiliation or endorsement is implied.

The C303 image MUST NOT be given the G85 title, border, or shadow. Neither image establishes held-button state, target identity, registry membership, reuse/create order, callback effects, or persistence.

Runtime and screenshot closure obligations

The unpublished C303 0007-system-help.png remains intentionally outside the curated catalog pending a specific review. No ignored Genera evaluator capture is a substitute for the Select Key Selector application.