Trace, Stepper, Breakpoints, and Call Analysis on Lisp Machines

MIT CADR System 46

The historical source is the public System 46 snapshot at Git revision 8e978d7d1704096a63edd4386a3b8326a2e584af. The files used here are:

No compatible System 46 load band is currently configured in the museum harness. Runtime observations below therefore do not project System 303 behavior backward onto this release.

Maintained LM-3 System 303

The later public source is the maintained LM-3 System repository at Fossil check-in 4df393c68d7f083ce42d5c377039d26043cc18a9031ace28258dc97f4137eb91, tag system-303. It is maintained restoration work, not silently treated as an unaltered historical distribution.

Licensed Genera 8.5 material

The Genera source observations use the locally purchased Open Genera 2.0 archive and the Genera 8.5 world it supplies. These files remain ignored and are not linked or redistributed. Original descriptions here are evidence summaries, not reproduced source.

The public manuals used for intended behavior are Symbolics's Program Development Utilities, Genera 8 and the Genera 8.1 Release Notes, both verified 2026-07-18.

Common control flow

All three implementations replace or encapsulate the named function with an intermediary that owns the call boundary. The intermediary can:

1. decide whether tracing applies in this dynamic context;
2. print the entry depth, function, arguments, and requested extra values;
3. enter a break loop, debugger, or interpreter stepper;
4. call the preserved definition while temporarily allowing nested traces;
5. collect all returned values;
6. print requested exit information or break on exit; and
7. return the original multiple values.

An INSIDE-TRACE dynamic flag prevents the trace implementation's own calls from recursively tracing themselves. A total trace depth supplies indentation, while a counter attached to each trace wrapper numbers recursive entries of that function. :WHEREIN asks whether another function is active anywhere above the call, not merely whether it is the immediate caller.

The implementation strategy changes at the release boundary. System 46 installs a generated NAMED-LAMBDA in the function cell and records the old and new definitions in TRACE-TABLE. UNTRACE restores the old definition only if its own wrapper is still present, avoiding destruction of a later redefinition. System 303 and Genera use the general encapsulation machinery. Their manuals and source explicitly preserve tracing across a redefinition by moving the encapsulation to the replacement definition.

Complete parser option matrix

“Yes” means that the inspected parser recognizes the option, whether or not the default menu offers it.

The last four selector forms deliberately consume everything following them. They must therefore be last if later words are intended as options rather than expressions to print.

System 303's parser offers both :BREAK options even though its default menu comments them out. Genera provides separate Zetalisp and future Common Lisp TRACE entry points; the latter supplies the ANSI-style default subset rather than the complete Zetalisp option language tabulated above.

Entry paths

Calling TRACE with no specifications returns the currently traced function specifications. Calling UNTRACE with none removes all traces. The safe runtime rule is correspondingly simple: inspect (TRACE) before work, untrace the research function in cleanup, and confirm that it is absent afterward.

Complete default Trace menus

The order below is the source order. It matters because these are concrete visible menus, not a union of all parser options.

System 303's source explains its omission directly: it regards this kind of break loop as unhelpful in lexical Lisp. That is a menu-design choice, not removal of the parser feature. Its state machine also improves interaction: choosing an already selected flag removes it, choosing an expression option again replaces the expression, and Untrace acts immediately. System 46 only appends choices; once Untrace changes the displayed form, other option clicks beep and Do It is still required. Genera retains that latter two-stage Untrace interaction but adds keyboard Abort and End paths.

Output changes that manuals do not fully explain

System 46 prints a compact parenthesized entry/exit record. Its manual mentions a proposed SPRINTER pretty-output mode and immediately says it is unsupported; the inspected implementation has no working SPRINTER path.

System 303 can grind individual arguments and write to a special editor buffer. Genera instead adds four live formatting variables: columns per call level, whether to draw vertical bars, the bar interval, and an old-style compatibility switch. Thus Genera's call-tree bars are policy in the trace printer, not glyphs emitted by the traced program.

Architecture and limits

The Step facility is an evaluator hook, not a compiled-code debugger. It keeps an array of pending forms indexed by evaluation depth, prints the current form, lets one keystroke choose how far evaluation may proceed, gathers all values, and asks again on return. Macro forms are expanded and displayed distinctly.

System 46 temporarily redirects EVAL through its hook. System 303 uses lexical environment-aware eval and apply hooks and records whether a displayed event is an evaluation or an impending function application. Genera passes an optional lexical environment but returns to the older evaluation-only display model. Genera also prevents deep indentation from squeezing output against the right margin: after a configurable fraction of the window width it restarts at the left with an ellipsis.

The practical boundary is the same in the manuals: STEP and Trace :STEP operate on interpreted forms. System 303 and Genera direct compiled-code work to the debugger's lower-level stepping machinery.

Complete Step command matrix

System 303's source has an internal automatic mode callable by program: it can simulate repeated Control-N, optionally without normal printing, until disabled. It is not a default interactive key and is therefore not counted as another row.

System 46's source comment wishes for Control-A, but its command loop does not implement it. System 303 implements and documents it while retaining the stale wish-list comment. Genera 8.5 again has the wish-list comment and no Control-A case. This is unusually clear evidence that the maintained System 303 feature must not be assumed to exist in Genera simply because Genera is later.

The displayed event markers also differ. All releases distinguish ordinary form, macro expansion, returned value, and additional returned value. System 303 adds a fifth marker for an impending function application, required by its Control-A path.

1. Trace break loops

Trace :BREAK and :EXITBREAK suspend inside the generated wrapper, where ARGLIST and, on exit, VALUES are dynamically available. These are Lisp read-eval-print break loops. They are not patches in compiled instructions.

2. Function-entry and frame traps

System 303's BREAKON is an encapsulation that arranges a trap on the next call when a condition is true. Repeated conditions for one function are combined; UNBREAKON can remove one condition, one function, or every breakon. The debugger separately supports trap-on-call and trap-on-exit bits:

Genera retains named Trap on Call and Trap on Exit debugger commands. Its compiled single-step command deliberately steps over a called function; the manual's procedure for stepping into it is to set Trap on Call first and then single-step.

3. Compiled instruction breakpoints

No compiled-instruction breakpoint command appears in the loaded System 46 Lisp Error Handler source. The feature exposed there is Trace's break loop. System 303 adds an EHBPT module whose setter validates that the PC lies on an instruction boundary, requires a compiled function with a debugging-info slot, saves the original instruction, writes a breakpoint instruction, and records the patch for restoration.

The complete System 303 default key surface for that module is:

The comments beside the list and clear functions claim different keys; the actual COMMAND-DISPATCH-LIST above is authoritative for the loaded default. More importantly, the source that should proceed through an encountered patched instruction is commented out and marked unfinished. Setting and restoring the patch is implemented, but reliable hit-and-proceed behavior in this maintained checkout remains TODO rather than being inferred from the command names.

Genera turns this into a Command Processor and presentation-based interface:

Conditional accepts Always, Mode-Lock, Never, Once, or an expression in the frame's lexical context. Action accepts Show-All, Show-Args, Show-Locals, or an expression in that context. The implementation keeps breakpoint metadata in the compiled function's debugging information, updates source/disassembly presentations, and uses temporary cleanup breakpoints to step across control flow. The manual's safety warning is unequivocal: breakpoint only the user's program, never I/O, input editing, storage, hardware, or garbage-collection functions on which the system itself depends.

4. The separate CADR console mechanism

System 46's CADR console debugger operates below Lisp function semantics. It sets a machine breakpoint by changing the MF field of a C-memory microinstruction and maintains permanent and temporary address lists. Its complete breakpoint colon-command set is:

These are microcode console addresses, not Lisp source locations or the later Debugger's compiled-function PCs. They were source-audited but not exercised in the application harness.

System 46: scan definitions now

WHO-CALLS maps over symbols in a package, examines each function definition and compiled-function-valued property, and reports references to the requested symbol. For compiled FEFs it distinguishes value-cell use, function call, property-list access, constant use, and a supported microcoded-instruction call. For an interpreted definition it tree-walks the lambda and can only say that the symbol is used somehow. UNBOUND-FUNCTION is a special query for calls whose target is not defined. The function prints findings and returns NIL.

System 46 Zmacs exposes Edit Callers and List Callers. This release's public source snapshot contains their generated command documentation and the supporting LIST-CALLERS scanner, but not a trustworthy source-form definition for every compiled command. The boundary is therefore two evidenced commands, not the later command family projected backward.

System 303: broader scan and reusable results

System 303 moves the machinery to SYS2; ANALYZE. WHO-CALLS accepts one symbol or a list, defaults to all packages, optionally includes packages that inherit from or are inherited by the named package, prints each relationship, and returns a de-duplicated caller list. It understands:

• variable, ordinary function, misc-instruction, and constant references;
• unbound function calls and macro expansion dependencies;
• flavor dependencies;
• interpreted uses whose exact role is unknown;
• compiled-function-valued properties, methods, and initialization forms; and
• an encapsulated definition hidden behind tracing or advice.

Zmacs supplies exactly four named commands at this release: Edit Callers, List Callers, Multiple Edit Callers, and Multiple List Callers. Ordinary invocation searches the current package; one Control-U searches all packages; two Control-U prefixes prompt for a package. The “Multiple” variants continue accepting callees until an empty final answer, then operate on the union of results.

Genera: maintain a callers database

Genera no longer searches every definition from scratch for each question. A persistent database is keyed first by the relationship and then by the callee. Its modes have materially different scope and cost:

A query first applies queued updates unless told not to. It filters obsolete compiled definitions, can remove duplicates, and can restrict by relationship, package, or system. Source-visible special handling follows SETF and LOCF derived functions, presentation translators, flavor dependencies and instance variables, and CLOS constructors.

The complete relationship vocabulary in the inspected 8.5 source is:

Variable, Function, Microcoded-Function on applicable 3600 builds, Constant, Unbound-Function, Instance-Variable, Macro, Defined-Constant, Condition, Flavor-Component, Generic-Function, Setf, Locf, Presentation-Translator-From, Presentation-Translator-To, Defines-Instance-Variable, Resource, and Constructor, plus an unknown interpreted-use category.

The 8.1 release notes list only the then-public subset. The larger 8.5 list is a real source/release difference, not a claim that the release note was complete for future releases.

The Callers Command Processor table exposes one command:

Show Callers function [Called How ...] [Package ...] [System ...]

The Zmacs source defines the following complete named-command family at the inspected grain:

A numeric argument to the ordinary commands asks for the exact “called how” relationship. Results are function-spec presentations; the list display can be used to begin editing them rather than serving as dead text.

Research function and safety protocol

Both runnable systems were given private interpreted definitions equivalent to:

(defun museum-d13-leaf (x) (+ x 1))
(defun museum-d13-caller (x) (museum-d13-leaf x))

Only these researcher-defined names were traced or stepped. No system function was traced, broken on, or patched. The experiment recorded the initial trace and breakpoint lists and used ordinary trace output. The System 303 run exited Step with Control-X, checked the lists again, and removed both research definitions. The Genera run untraced the leaf before entering Step, but the Dynamic Listener's Input Editor intercepted the attempted single-character Step controls; that run therefore does not claim a verified Step exit or post-Step Lisp cleanup. Its unchanged private-world hash and shutdown record establish that the remaining definitions were discarded as unsaved state. Compiled breakpoint mutation was intentionally not exercised; read-only “show/list” paths and source inspection establish those surfaces without risking system code.

LM-3 System 303 runtime

The fresh Xvfb session was d13-analysis-20260718, generation 1, booting load band System 303-0 between 2026-07-18T05:05:50-04:00 and 2026-07-18T05:10:36-04:00. The base and private disk both began with SHA-256 bb16e46ad81decfe1efe691d36b6aa4ce3fd4ffb82474365de3520989d397cb5. Both still had that hash after shutdown, and the base was explicitly reported unchanged. The executed usim hash was 707a77d23e28ea1c45ae0eb0145dc181fa7ba649b9defc30044d4f847ac2c5be at both start and execution.

The public revisions at session start were system 4df393c68d7f083c..., chaos db2953fde68d726a..., usite 8f717978b458b40a..., usim 330d8248ec2e12af..., and machine tree l d1250f90044f09b6.... The private copies were made from those same system, chaos, and usite revisions. Their tree hashes were respectively 21f5215de973aa6c..., 34ab197641aae909..., and adbb720339db225e..., and all three were unchanged since copy. The private machine-artifact hashes were promh.mcr 2c667f99f014a713..., promh.sym e9e3dd6a541511dd..., and ucadr.sym 9071decf16fa8f1.... The Guix toolchain record pins channel commit 230aa373f315f247852ee07dff34146e9b480aec, manifest SHA-256 3adae999bbe420182f22adc2499fcc82449a46eaf580a362de9c0e718fa6b37d, Python 3.11.14, and the exact Xvfb, xdotool, ImageMagick, coreutils, make, and util-linux store paths in run.json. That 6,833-byte record has SHA-256 196a2975d02d3911f19eeee6241a7d24fa1861b58f04bd74bfa4f5e08489e283.

After declining to set a wall-clock time, the ordered application inputs were:

(trace)
eh:*fefs-with-breakpoints*
(defun museum-d13-leaf (x) (+ x 1))
(defun museum-d13-caller (x) (museum-d13-leaf x))
(list (compiled-function-p (fdefinition 'museum-d13-leaf))
      (compiled-function-p (fdefinition 'museum-d13-caller)))
(trace museum-d13-leaf)
(museum-d13-caller 41)
(untrace museum-d13-leaf)
(step (museum-d13-caller 5))
Help, x to dismiss Help, Control-X
(who-calls 'museum-d13-leaf *package* nil nil)
(list (trace) eh:*fefs-with-breakpoints*)
(list (fmakunbound 'museum-d13-caller)
      (fmakunbound 'museum-d13-leaf))

Both initial lists were NIL, and both function definitions were confirmed interpreted. Trace printed ENTER MUSEUM-D13-LEAF: 41, then EXIT MUSEUM-D13-LEAF: 42, without altering the return value 42. Step paused on the value 6, its live Help displayed the command and marker vocabulary tabulated above, and Control-X returned 6 to the Listener. The package-local WHO-CALLS scan reported MUSEUM-D13-CALLER as an interpreted function using the leaf and returned it in the result list. It also reported the leaf itself as an unknown interpreted use, a concrete example of why the NIL relationship must not be rewritten as the more precise “calls.” Final trace and compiled breakpoint lists were both NIL; both research definitions were then removed.

Runtime observation: this exact System 303 display on 2026-07-18 combines the nonmutating Trace result, returned Step value, and package-local WHO-CALLS output for the museum-owned functions. It is published as the minimum visual evidence for the three live behaviors beside the implementation analysis; inclusion implies no project endorsement by MIT or LM-3 contributors.

Representative raw 768-by-963 captures remain ignored and unpromoted:

Shutdown was clean: usim and Xvfb both returned status 0, forced_stop=false, and state_may_be_incomplete=false. The ignored saved emulator state has SHA-256 a51de14bf92f10aac5ab6527be7510c36dafebb6cd3f5a8344bca21ba8d42899; it is runtime evidence, not a published load band.

Genera 8.5 runtime

The fresh isolated session was d13-analysis-genera-20260718, generation 1, running from 2026-07-18T05:18:42-04:00 until 2026-07-18T05:35:21-04:00. Xvfb display :200 contained the selected main window Genera on DIS-LOCAL-HOST, XID 4194310, 1,200 by 900 pixels at host-X coordinates (72,55). This is a runtime observation in an unconfigured museum world, not a configured Symbolics site.

The licensed input archive was 206,213,430 bytes, SHA-256 89fb3e76b91d612834f565834dea950b603acf8f9dbacacdd0b1c3c284a2d36e. The base and private world were each 54,804,480 bytes with SHA-256 a8ee5e86cc7e322f7385af3e0cd579d7650d4dcfc3ce328acbf8b25515dd0672. The debugger was 346,880 bytes, 2db918cfe8f35f52c7ff4b7695b0ecd3bb85e41a3327ea5a94874edf05edb54a, and the VLM executable was 1,533,760 bytes, 9f5e18d5770f973879716182b6856ef5a8ee9d3b2bb907476ea0cf35986aa4c7. The VLM hash at execution was the same. The 285-byte private configuration had SHA-256 5ce6509f5adf2cf2d054d34eb4ba777ce462285b8cd9b01bc071bf819139e086.

The exact compatibility and harness identities were:

The generated sandbox hosts and name-service files had hashes 645a9c7cd536cf84abe87ee5a2643fa82ba35e7f2dceaae59b82b9de0f44b36f and bfc6be87fadc435bad993523e78249bc43ed4c84f1ca6cb05b832d43087dc25b. Bubblewrap used separate user, mount, network, PID, IPC, and hostname namespaces. The host root was hidden; only the read-only Guix store, exact read-only helpers and X socket, generated /etc files, and writable private runtime were exposed. Private tun0 had no external route, no default route, and no guest-visible host file service. Xvfb disabled MIT-SHM and verified it absent. The replacement extension name used by the compatibility layer was also live-verified absent. The run observed both required exact guest-relay X substitutions; nonmatching writes remained byte-for-byte delegated.

The one-shot raw-Ethernet RFC 868 responder sent one validated reply and exited 0. Its evidence SHA-256 was baab25e538be357af75059708a18b74ec33d2d2383bfd2c15221de877f4d5e2e; the completion record was 08dcf19fda38837e49097b53f2647f20bfb05582536c716eb9c94770edb15052. The Guix record pins channel commit 230aa373f315f247852ee07dff34146e9b480aec, manifest SHA-256 3adae999bbe420182f22adc2499fcc82449a46eaf580a362de9c0e718fa6b37d, Python 3.11.14, and exact store paths for every invoked tool. The final 25,715-byte run.json has SHA-256 0dd0b4de5446bdc6dc29c5289e967106ff761151a15f84694f2deb4f5d8742f3.

The ordered meaningful guest inputs were:

Show Breakpoints
,si:*who-calls-mode*
,(trace)
,(defun museum-d13-leaf (x) (+ x 1))
,(defun museum-d13-caller (x) (museum-d13-leaf x))
,(list (compiled-function-p (fdefinition (quote museum-d13-leaf)))
       (compiled-function-p (fdefinition (quote museum-d13-caller))))
,(trace museum-d13-leaf)
,(museum-d13-caller 41)
,(untrace museum-d13-leaf)
,(step (museum-d13-caller 5))

Show Breakpoints reported that there were currently no breakpoints. The initial callers mode was :UNINITIALIZED, and (trace) returned NIL. Both research definitions were confirmed interpreted. Tracing the leaf and calling the caller printed:

1 Enter MUSEUM-D13-LEAF 41
1 Exit MUSEUM-D13-LEAF 42
42

UNTRACE returned (MUSEUM-D13-LEAF) before Step began. Step visibly paused before evaluating (MUSEUM-D13-CALLER 5) and printed its Eval: prompt. This confirms entry into the interpreter stepper; it does not by itself establish the behavior of every Step command.

Runtime observation: this exact Genera 8.5 state on 2026-07-18 is the minimum capture that establishes both the controlled trace and entry into Step while retaining the initial breakpoint and callers-mode observations. It contains only researcher-entered forms and functional system output; Symbolics retains interests in the licensed software, and inclusion implies no endorsement.

An integration limit appeared at that prompt. The Step implementation reads a single character through TRACE-OUTPUT, but this Dynamic Listener had its Input Editor active on the same stream. Help and control gestures were handled by the Input Editor instead of producing a visibly verified Step response; F12 displayed Dynamic Listener help, not Step's own help. This behavior makes the source's nearby doubt about rebinding STANDARD-INPUT to TRACE-OUTPUT operationally relevant. It is a runtime/source finding absent from the manual, not a basis for guessing which layer consumed any one key.

For reproducibility, the remaining ordered X input intents were Help, F5, ctrl+x, Control_L+x, space, KP_Subtract, a left click at (400,780), explicit Control_L down, x, Control_L up, Delete, Control_L+x, F12, Control_L+q, Control_L+x, Return, the text ,(si:who-calls (quote museum-d13-leaf)) with Return, Delete, Return, Control_L+g, Control_L+a, Control_L+d, Return, the text ) with Return, and Control_L+KP_Subtract. Every host dispatch completed, but a successful XTEST dispatch is not evidence that the intended guest layer accepted it. The attempted callers text entered the Step reader's correction path after the leading comma; no callers query result was obtained and the dossier does not present one.

The exact mode-specific blocker is nevertheless established without enabling or rebuilding a licensed world's global database: the live world returned :UNINITIALIZED, and the inspected 8.5 lookup branch groups :UNINITIALIZED with :DISABLED and emits Who-calls database is disabled. Enabling :ALL would have been a substantial global operation, while :NEW would have changed the system's maintenance policy; neither was justified for this read-mostly probe. Call-analysis behavior beyond that exact disabled-state boundary remains source-grounded rather than runtime-confirmed here.

The final action log contains 70 intent/outcome records in a 33,665-byte JSON file, SHA-256 baa9b2806a8fa1adb3add0aac399c4112d99e0f4f316ad5bf665456dc2b133db. Representative ignored 1,200-by-900 raw captures are:

Shutdown retained every stage separately. The prompt was observed, yes was sent, confirmation was accepted, and cleanup progress was observed. The VLM then reached the already characterized shutdown stall and was killed only after that confirmed stall. Consequently forced_stop=true, forced_after_confirmed_shutdown_stall=true, launcher return status was 137, orderly_vlm_host_shutdown=false, and state_may_be_incomplete=true; Xvfb returned 0 and no VLM, launcher, supervisor, or Xvfb process remained. This is not an orderly VLM shutdown. The private world did not change and still matched the unchanged base hash above, so the harness records unsaved Lisp state as discarded. The harness invoked neither Save World nor a host-process checkpoint, but save_world_performed and guest_checkpoint_created remain unknown rather than inferred from the unchanged file.

Screenshot selection and rights

The two embedded captures passed image- and use-specific review and were copied byte-for-byte into the curated system asset trees. One System 303 image combines Trace, Step, and WHO-CALLS evidence; one Genera image combines the corresponding controlled trace, Step entry, and initial breakpoint/callers states. This is the minimum cross-system pair needed for the visible comparison. Neither contains source, manual prose, private data, or third-party artwork, and neither can substitute for the interactive systems. All remaining raw captures stay ignored and unreviewed. The selection is excluded from any repository-wide license and does not authorize redistribution of the Genera world or other licensed inputs.

Established by source and manuals

• Trace wraps the function boundary while Step hooks interpreted evaluation; neither is a substitute for compiled-instruction stepping.
• System 303's Trace menu intentionally omits break-loop choices while its parser retains them.
• System 303 adds Control-A to Step; Genera 8.5 does not retain it.
• Genera's callers facility is a maintained semantic database rather than a package scan performed wholly at query time.
• Compiled breakpoint safety depends on exact PC validation, retained original instructions, and guaranteed cleanup.

Interpretation

The tools form a deliberate escalation ladder: ask who might call the code, observe actual calls, step a small interpreted expression, trap a controlled function boundary, and only then patch compiled code. That ordering is an interpretation of their capabilities and risk, not a quoted vendor workflow.

Open questions

• A System 46 load band is needed to confirm the exact visible Trace menu and stepper markers in that release.
• System 303's commented breakpoint-proceed machinery needs controlled microcode-level investigation before its compiled breakpoint feature can be described as end-to-end operational.
• Genera Step should be rerun through a stream or listener configuration that demonstrably passes its single-character controls through the Input Editor; this run establishes Step entry but not a verified key-to-Step path.
• Genera callers lookup should be exercised in a disposable world whose database is already enabled with a provenance-recorded mode. The inspected world's :UNINITIALIZED state establishes only the disabled-state boundary.
• Genera's complex Control-Meta-Right breakpoint dialog is source-grounded but was not invoked, because a read-only runtime probe was sufficient and safer.