ZMail and mail composition reimplementation specification

Release profiles

The public System 46 snapshot contains no full ZMail system. Consequently ZM-C46-ZMAIL is not a valid profile name. A runner MUST reject it rather than substituting System 303 behavior.

Conformance levels

An L2 claim MUST name which storage overlays and transport adapter are enabled. It MAY use an inert recording transport. It MUST NOT claim successful historical mail delivery merely because the application accepted a draft.

Feature closures and selectable adapters

Rows labeled as storage or transport adapters can be selected independently for a conformance claim. Calendar is different: it is in the historical G85 declared build and normative application surface. CALENDAR names its conformance subset; it does not load or unload calendar.lisp. Every ZM-G85-ZMAIL L2 claim MUST include that subset.

Public CADR and LM-3 artifacts

All public source observations use portable repository-relative paths. Byte counts and SHA-256 values were recomputed from the pinned local copies.

The remaining selected System 303 files are mfhost2, refer, lmfile, file/zmail, mult, button, cometh, rfc733, and lex733. The 18 unique system paths total 666,208 bytes; their pathname/byte/hash manifest has SHA-256 03fba3258c2baa74d618a6e6d0e3eb2407ca115b04f2d9fd64db7937bf147115. lmfile is selected but entirely commented; the active local-filesystem integration is file/zmail. lm.lisp is not selected, PARSE is commented out in the system declaration, and cometh installs methods/resources but no transport. These are closure facts, not optional code a clone may silently activate.

Licensed Genera evidence-only artifacts

These files remain untracked local inputs. The table records identity and factual ownership only; it does not reproduce their bodies.

The 37-file analytical Zmail application-core subset totals 1,781,224 bytes and has sorted portable-manifest SHA-256 263df1e5a3329d60daf5cb5c931eb656c682cf405777a44a087601f582388e45. The system declaration additionally serializes its parser dependency on RTC, the Converse subsystem, and all eight KBIN implementation files. That exact declared build closure contains 47 files totaling 2,076,239 bytes, manifest SHA-256 327c325390e71dbc45ae8da530921134da2e524b0bc70503819d941ac2898eae. The exact per-member records and canonical serialization are incorporated normatively from the declared-build source manifest. Its generation-binding selection-v1 digests are 925a26d7f23c3eb8c40f39ddb2821b200f321860809169acc3b454eaefe293f8 for the 37-member analytical core and d0b7ccf46f870005dcdfb676cf55cce6ba9ab6122f0d2bd7994de4ea70630306 for all 47 selected files. The patch directory identifies the inspected source as System 452.1 / Zmail 442.0. The runtime witness identifies a Genera 8.5 world, but no function-by-function source-to-loaded-bytecode comparison has proved that every selected source body is resident in that world. Source and compiled-world profiles therefore remain separate even when their visible behavior agrees.

Normative evidence map

User-interface substrates and CLIM nonrelationship

ZM-C46-COMPOSE and both System 303 profiles are ZWEI applications hosted by the TV window system. Their command tables, editor closures, sheets, menus and mouse-sensitive summary items predate CLIM.

ZM-G85-ZMAIL is a Flavors/ZWEI application combining TV frames with selected Dynamic Windows presentation/margin services and Command Processor hooks. Its active summary rows still use the older TV scroll-window SUMMARY-MOUSE blip protocol; the source's proposed Dynamic Windows conversion is disabled commentary, not an active translator. ZM-G85-COMPOSE is a ZWEI mode; its zero-argument draft chooser does emit Dynamic Windows buffer presentations. The Genera system declaration has no CLIM dependency, the selected source defines no CLIM application frame or port, and the runtime surfaces are the Zmail/TV/Dynamic Windows ones. Therefore a conforming implementation MUST identify the substrate as Flavors + ZWEI + TV + selected Dynamic Windows/Command Processor integration, not CLIM. A port MAY use CLIM internally, but that is an implementation choice and MUST NOT change the selected observable tree.

The TV window-system specification, Dynamic Windows specification, and editor-family specification own their generic event, sheet, presentation, editor and redisplay protocols. D08 owns the mail-specific objects, table overlays, panes, menus, presentation handlers, state transitions and service calls.

Five related but distinct program layers

ZWEI/Zmacs Mail mode ── draft buffer ──┐
                                      ├─ message parser and D08 submission interface
full ZMail/Zmail reader ─ integrated draft ┘
             │
             ├─ mail-file/inbox adapters and background file worker
             ├─ transport-access-path adapters
             └─ optional store-and-forward Mailer service (D21, separate process/system)

The System 46 composer writes a request file for another facility to consume. The System 303 composer delegates actual transmission to ZMail's send function. The Genera composer checks that Zmail is loaded and shares its parser and submission machinery. None of those facts makes the interactive Zmail background process a Mailer daemon.

Required subsystem interfaces

Message

A message MUST retain at least:

ZM-G85-ZMAIL additionally retains insertion tick and flags including the fattened-message bit. A clone MAY use immutable values internally, but it MUST expose the same state changes and cache invalidation.

Its exact parse-state domain is not merely unparsed/in progress: NIL means use the owning buffer as format provenance; a message-buffer object means use that specific provenance; T means parsed; :KILLED means dead or errored unless a caller explicitly permits it; and a process object owns an active parse while other processes wait. Parse acquisition is compare-and-swap-like. Nonlocal exit restores the prior null/buffer provenance rather than publishing success. The Unparseable restart, status/header compaction, hook, reformat and summary stages occur in source order, and Deleted is always represented after parsing. Shared compaction excludes the scroll displayer, original-header interval, Deleted, Recent and Unseen state.

Creating an empty message constructs a top interval and display child. Copying forces parse and deep-copies text, status, boundary pointers and summary. Killing marks the message killed before destroying text, sets interval/summary/tick to the killed sentinel, and retains only reference and identifier information. A file-buffer insertion copies a message rather than sharing it across file owners, marks the origin Filed and optionally Deleted; a temporary collection may instead share identity. Insertion rejects indexes greater than length, accepts length as append, and grows the underlying array by approximately one quarter. These semantic results must hold even if a clone uses different storage.

Header names are not an untyped dictionary. Address, sender/recipient, date, reference, single-line and internal properties have distinct parsers and printers. A changed header MUST invalidate every derived value whose source interval changed.

Sequence, collection and buffer

A sequence is an ordered, mutable message population with:

• an adjustable array or equivalent ordered store and active length;
• a current/saved message;
• a name and property set;
• a point/history stack;
• a mutation tick and, for Genera, expunge/save-requiring ticks; and
• a read/write lock domain.

Disk-backed message buffers add pathname, header/file interval, format, stream, status and format-specific options. Temporary collections MUST NOT masquerade as disk-backed files; actions such as Remove operate on collection membership without implying deletion from permanent storage.

Genera sequence modification has hard and current-source “soft” paths, but both currently require save; a comment suggesting future differentiation is not active behavior. Expunge selects a nearby undeleted message before compaction, clears its expunge tick during partial work, compacts in place, kills buffer-owned deleted messages but merely drops shared collection references, repairs save/Recent/current state, and kills an empty temporary collection. A file-buffer wrapper first flushes or requeues parse work and finishes I/O or aborts an active save.

ZM-C303-ZMAIL distinguishes ordinary ZMail buffers, disk buffers, mail-file buffers, inbox buffers and temporary buffers. ZM-G85-ZMAIL distinguishes sequence, collection, message buffer, file-mail buffer, inbox and format-specific subclasses. Equivalent host types are conforming if the same predicates and transitions remain observable.

Disk and background status

The implementation MUST model status as a state machine, not a boolean busy flag.

The Genera :LOADED and :SAVED states are foreground-notification boundaries: background work has completed, but the foreground has not yet incorporated the response. A port MUST NOT collapse them if a test can observe response ordering. The C303 comment beside the status slot spells two states :SAVE-REQUIRED and :AWAIT-NEW-MAIL; executable branches instead use the longer names in the table. Strict compatibility follows executable state symbols and records the stale comment as documentation evidence, not an alias declaration.

Draft

An integrated draft MUST contain header and body intervals, a summary string/cache tick, source messages for reply/forward, sent state or per-recipient submission record, last window configuration, optional draft pathname/saved message, per-window points, and a starting tick.

A standalone ZWEI/Zmacs Mail buffer is a separate editor object. It contains a header region, the profile's exact separator line, body region, Mail-mode state, modified state, and in Genera a retained recipient/submission property for retransmission handling. It MUST NOT become a reader sequence merely because both paths share the sender.

Frame and view state

The full reader state includes:

• unique/selectable frame identity within the profile's selection domain;
• foreground editor closure and input queue;
• background worker, request cell/queue, response queue and locks;
• current/default/primary sequence, list of open buffers and current message/index;
• message point stack, drafts, filters, universes, keywords and profile values;
• current configuration and panes;
• typeout/overlying/minibuffer state;
• default move/select menus and command-button identity; and
• dirty, saving, parsing, shutdown and error state.

The core reading configurations are Summary only, Both, Message only and the filter-oriented view. Integrated composition, filter construction and profile editing are task configurations over the same frame state, not separate reader processes.

For G85, exact public labels include Summary only, Both, two distinct entries both printed Message only, Filtering commands, Summary//Message only, Send, Calendar, Month, Four weeks, Week and Year. The second Message-only entry omits the command menu; that explanatory distinction is not additional visible label text.

Filter, universe and reference state

A filter is a named predicate over parsed message properties. A universe supplies the candidate population, potentially spanning multiple sequences. Applying a filter produces a stable ordered selection for the duration of a command unless the selected command explicitly mutates that population. A reference index maps message identifiers and reply links into conversations and MUST be invalidated when its source sequences change.

The selected executable filter languages, universe grammars, definition recovery, mapping order, cache invalidation and partial-failure behavior are the exact contracts in the incorporated C303 and G85 companions. They are not an abstract predicate API. In particular, a strict implementation retains each profile's executable-input boundary and source-visible defects; a safer parser or transactional evaluator is a separately named overlay.

Profile options

Profile definitions are typed metadata, not arbitrary strings. The implementation MUST support the selected release's boolean/inverted-boolean, menu choice, number, pathname, pathname list, address list, string list and Lisp-form-equivalent value classes. Validation MUST occur before committing a changed value. Profile-dependent commands MUST read the effective value at invocation time; a menu label alone does not freeze the action.

The exact selected denominators are 69 active textual option declarations in C303 and 81 textual forms in G85: 80 active forms plus one form inside a block comment. The inactive G85 form is evidence in the inventory but MUST NOT become an active runtime option. Each companion's applicability restrictions, persistence class, derived-documentation updates, Save/Compile/Reset order and failure prefixes are normative; a count-only option implementation is nonconforming.

Invariants

1. The current message, when non-null, belongs to the current sequence at the recorded index.
2. Every disk-backed message has one owning message buffer; a temporary collection references messages without stealing ownership.
3. A sequence write mutation occurs under its selected write lock; read operations MUST NOT observe a partially resized active array.
4. Parse state in progress is never published as successfully parsed.
5. A derived header, summary or reference cache is valid only for its recorded source tick.
6. Delete/undelete changes status; expunge changes membership/storage. They are not synonyms.
7. Removing a message from a temporary selection does not delete it from its owning file.
8. A draft is marked sent only from an adapter result that satisfies the selected profile's success rule. Opening or closing a draft is not success.
9. A failed save or send MUST retain enough draft/buffer state for the profile's recovery path; it MUST NOT report clean state merely because a stream closed.
10. Background requests and responses are applied in the selected profile's exact ordering; an implementation MUST NOT replace that ordering with an assumed FIFO.
11. The reader background worker and the store-and-forward Mailer remain distinct processes and state domains.
12. User/site/profile overlays are applied after the pristine release graph and are reported separately in conformance output.

Locking contract

C303 uses a recursive owner lock whose unwind releases only when the current invocation acquired it. G85 uses multi-reader/single-writer sequence locks: a writer is reentrant; the same process may read under its write lock; a sole reader may upgrade; and a multi-lock writer waits until every requested lock is available, then acquires all interrupt-atomically and restores them on unwind. Parent plus inbox operations request parent then inboxes, while inbox plus parent operations request inbox then parent; all-or-none acquisition prevents a partially held deadlock. G85 warm boot clears locks on every live sequence and each inbox being inserted. No equivalent C303 warm-boot reset is established by the selected source. Tests MUST cover C303 owner reentry, non-owner contention and acquisition-owning unwind, plus G85 reentrancy, upgrade, contention, all-lock acquisition, unwind and warm-boot reset, rather than replacing either profile with an unobservable generic mutex claim.

Normative companion incorporation

The exact finite mappings and detailed semantic contracts are normatively incorporated from these repository companions:

Incorporation means that every exact row, generated digit range, ordered menu, completion-name list, declaration denominator, grammar, state transition, failure prefix and stated parent edge in those pages is normative for the named profile. The effect contracts below are also required. A companion is not permission to ignore numeric arguments, applicability predicates, profile-driven button meanings, prefix fallthrough, unbound behavior, source/runtime separation or runtime overlays. The command denominator is exactly 86 C303 definitions and 152 G85 completion candidates; passing those counts without matching every ordered effect and failure boundary in the command-effect closure is nonconforming.

Every incorporated companion's conformance suite and profile-applicable TODO-RUNTIME-* backlog is also normative without renumbering. L2 requires all source-profile tests applicable to the selected feature set. L3 additionally requires closure of the union of applicable runtime obligations in this page and those companions; this page's later short backlog is not permission to ignore a companion oracle.

Entry tree

ZM-C46-COMPOSE
├─ Lisp (MAIL [who [what]]) -> reusable standalone ZWEI Mail editor
├─ Lisp (BUG [program]) -> same editor, initialized as bug mail
└─ source-present COM-MAIL -> current editor Mail mode
   └─ exact System 46 Zmacs key ingress: TODO-RUNTIME-ZM-C46-ZMACS-ENTRY

ZM-C303-ZMAIL
├─ System M, only if M was unclaimed when ZMail initialized
│  └─ select/create ZMAIL-FRAME
├─ System Menu > Mail -> select/create ZMAIL-FRAME
└─ programmatic selection of ZMAIL-FRAME

ZM-C303-COMPOSE
├─ Zmacs Control-X M -> COM-MAIL
├─ extended command Mail -> COM-MAIL
├─ Lisp MAIL user text call-editor-anyway
└─ Lisp BUG program text call-editor-anyway

ZM-G85-ZMAIL
├─ Select M -> SETUP-ZMAIL-FRAME, primary label Zmail, alias Mail
├─ System Menu > Zmail -> same activity
└─ Select Activity Zmail/Mail -> same unique selectable frame

ZM-G85-COMPOSE
├─ Zmacs Control-X M -> Mail
├─ extended command Mail -> same command
├─ Lisp/ZL:MAIL or bug-report caller -> standalone/reusable Mail editor
└─ numeric argument zero -> presented list of existing Mail and bug-mail-frame drafts

System 46's public snapshot proves the command and standalone functions but lacks the Zmacs overlay which would prove a Control-X M cell. A clone MAY offer that familiar route as a labeled extension; it MUST NOT call it ZM-C46-COMPOSE source fidelity.

System 46 Mail-mode local tree

The source defines Mail as a ZWEI major mode whose local table is sparse. Its local delta is complete:

There is no source-local special Abort cell. The command's prose says Control-G quits, but the active local table binds Control-]; strict conformance follows the table and records the prose discrepancy. Mail mode clears Lisp comment syntax, adds - as a paragraph delimiter so filling respects the body separator, and appends the visible End/Control-] reminder to the mode line.

System 303 ZMail top-level table

The incorporated System 303 companion supplies 47 ordinary direct cells, 44 generated numeric cells, the fixed main/filter menus, principal summary gestures and 86 completion definitions. The transient filter, universe, profile, chooser and typeout contexts added below are also normative. The effective local tree has these branches:

ZMAIL-COMTAB
├─ direct character -> local command from companion
├─ minus/digit under plain, Control, Meta, Control-Meta -> numeric argument state
├─ pointer in summary -> SUMMARY-MOUSE dispatcher
├─ pointer on command/menu/mode-line item -> item-specific left/middle/right action
├─ named command completion -> one of the 86 release definitions
├─ Help/self-documentation -> D07 over this effective table
└─ absent cell -> unbound ZMail command error; no Standard text-insertion fallback

The top-level reader is not an ordinary editable Zmacs buffer. Printable letters such as D, M, R, S, U and X are commands, not insertion. The N and P commands consult profile movement policy; direct Control-N/Control-P select their source-defined down/up commands. Space, Control-V, Hand-Down and their backward counterparts scroll the message surface. Summary scrolling is a distinct command.

System 303 ZMail message and draft tables

The message-editing table delegates absent cells to the active ZWEI mode. Its local leaves are End, Control-Escape, and Abort to leave message editing. Its Control-X child adds A, C, S, and T for More Text, Cc, Subject and To, then delegates absent child cells to the Standard/Zmacs Control-X table.

The integrated reply/new-draft table overlays:

The reply child adds 1, 2, 3, M, O, Y, Control-R, Control-S, Control-W, and Control-Meta-S for one/two/three-window layout, recursive mail, other window, prune, restore/save/write draft, and save draft as message. It then inherits the message child and ordinary ZWEI child tables. Reply direct-key misses delegate to the selected mode, not to the message direct table; only its Control-X child chains through message Control-X and then the selected mode's child. A port MUST preserve those parent edges.

The C303 reply extended-command list has this exact 17-item order: Add To Field, Add Cc Field, Add FTo Field, Add Fcc Field, Add Subject Field, Add In-Reply-To Field, Add More Text, Add From Field, Zmail Yank Current Msg, Prune Yanked Headers, Send Message, Abort Send, Restore Draft File, Write Draft File, Save Draft File, Save Draft As Msg, Change Subject Pronouns. Its right-button list has this exact 15-item order: Add To, Add Cc, Add Fcc, Add Subject, Add In-Reply-To, Add More Text, Add From, Prune Yanked Headers, Send Message, Abort Send, Restore Draft File, Write Draft File, Save Draft File, Save Draft As Msg, Change Subject Pronouns. Thus FTo and Yank Current are completion-only in this comparison.

C303 Reply chooses the product of seven recipient policies—All, All-Cc, Cc-All, To, To-Cc, Cc-To, Sender—and three view/yank policies—Like Mail, Show Original, Yank—for exactly 21 choices. Left uses the primary profile pair, middle the middle profile pair, and right presents that ordered product. Numeric 1 substitutes the one-recipient profile; numeric 3 or 4 forces Yank; other numeric values are accepted without changing the default pair. The G85-only Prune dimension below MUST NOT be backported to this 21-choice C303 tree.

System 303 separate ZWEI Mail-mode tree

This mode is not the integrated ZMail draft table. Its complete local delta is:

The child table adds A, C, S, and T for More Text, Cc, Subject and To. Its named list also exposes In-Reply-To, From and Change Subject Pronouns. Absent child cells inherit the Zmacs Control-X table; absent top-level cells inherit Text mode, active minor modes, Zmacs and Standard ZWEI in the D05 order.

Control-X M in top-level Zmacs enters this mode. Control-X M inside an integrated ZMail draft instead means Recursive Mail. Context MUST therefore participate in key identity.

Genera 8.5 Zmail top-level tree

The incorporated Genera companion supplies the fixed reader table, 44 generated numeric cells, eight-cell Control-X child, ordered 20-cell normal menu, calendar/filter variants, the principal submenus, the 21-item right-button auxiliary menu, summary-row gestures, and 152 clean-release completion candidates. The presentation translators and transient filter/calendar contexts added below are also normative. Neither companion alone is claimed to be the full live tree.

Top-level dispatch has the same broad shape as System 303 but includes Genera named keys, Undo/Redo, separate typeout scrolling, mini-buffer-repeat commands, and Dynamic Windows/TV event dispatch. The Control-X child is Zmail-owned and MUST NOT be replaced with the Zmacs child:

Missing Zmail child cells are unbound unless the selected source explicitly installs an indirection; they MUST NOT inherit Zmacs solely because the spelling is Control-X.

The main menu's visual Jump cell invokes Goto, while keyboard J invokes Jump. The former selects through filter interaction; the latter uses a numeric message number when present and otherwise the first undeleted message. A clone MUST retain that label/command distinction.

Genera command panes, modes and pointer tree

The normal command pane is the exact four-row, five-column matrix in the companion. Calendar retains its geometry but substitutes Compose and blank cells. Filter mode has a six-command no-message form and a 15-position full form with one deliberate blank. The Next, Previous, Map Over, Mail and Other submenus are ordered arrays, not sets.

Command-pane button identity is dynamically bound during invocation:

• left performs the item's primary/default action;
• middle uses the applicable profile-selected quick action where one exists;
• right opens the item's option menu where one exists; and
• an inapplicable item MUST remain unavailable rather than dispatching a stale command.

Active Genera summary rows use the older TV SUMMARY-MOUSE blip protocol. The exact tree is:

The conditional menu filters Continue to drafts, Delete/Undelete by status, Remove to temporary collections, and Reply away from drafts. The profile-middle menu omits the draft-only Continue choice. Source text proposing Dynamic Windows translators for these rows is disabled and MUST NOT replace the active blip protocol in strict G85 mode.

Genera integrated message and draft trees

The shared address/header overlay adds Hyper Forward, Backward, Kill, backward Kill and Exchange Address, Control-Shift-W Whois Address, and Control-X A/C/S/T for More Text, Cc, Subject and To. Mark Address is named but has no literal local cell. Setup copies these address/header cells into the active mode and its active Control-X child; they are not four leaves owned by the otherwise-empty message Control-X overlay.

Editing an existing message always selects Text major mode, then overlays End/Control-Altmode to Quit, Abort to Zmail Abort, and Mouse-R to the ordered 22-action message-edit menu. Its extended list has one additional entry, Show Expanded Mailing List.

Reply/new-message composition defaults to Text but accepts the source-supported Text, Fundamental, or Lisp draft major mode before applying the following overlay:

The reply child maps 1, 2, 0, M, O, Y, Control-R, Control-S, Control-W, Control-Y, and Control-Meta-S exactly as inventoried. Its extended list adds Show Expanded Mailing List to the 34 menu actions. The 41 defined draft commands, including unkeyed entries, are the exact completion denominator in the companion.

Genera separate Zmacs Mail-mode tree

The local fixed delta is complete:

Invocation distinguishes three numeric states:

The zero-argument list uses Dynamic Windows buffer presentations. This does not make the surrounding Zmail summary a Dynamic Windows presentation surface.

System 303 transient input tree

These contexts complete the fixed companion inventory. They do not consult the top-level ZMail comtab unless a branch explicitly requeues an event to that loop.

The shared utility-frame parent accepts these atomic keys:

Its special-event parent executes SUMMARY-EXECUTE, :TYPEOUT-EXECUTE, and :EXECUTE; consumes background-response, redisplay, and configuration-change events; scrolls the named window; enters a pane for SELECT-WINDOW; and requeues a raw mouse-button event before selecting the current pane. An unknown special event is requeued only when the active dispatcher advertises that operation; otherwise the handler declines it. There is no universal unknown-event beep.

The C303 reader mode line has three dynamic selectable regions. The buffer filename appears only while a buffer exists and invokes Rename Buffer. The current-keywords region invokes Keywords: left repeats the last stored add/remove sets or barfs if none, middle derives keywords from matching filters, and right chooses the complete set and updates the stored default. The message-more region invokes Mode Line Scroll: left advances one screen less one line, middle goes backward by that amount, and right opens Forward, Backward, Beginning, End in that order. A single left click on the summary pane's label has a separate geometric tree: in the central half it toggles Both to Summary and every other state to Both; in either outer quarter it selects Message. Other label buttons do not invoke that transition.

Marking mode first clears marks and exposes Summary. SUMMARY-MOUSE toggles the clicked message; End commits a temporary buffer; any other compound blip commits, requeues that blip, and returns; Abort or Control-] aborts; any other atomic key beeps and remains. Unwind always removes marks and restores documentation and the old layout. Compound-blip commit precedes atomic abort testing.

The filter-selection frame has no keyboard table: every atomic key beeps. Pointer button identity is ignored for Abort, Not, and Universe. Abort aborts; Not toggles accent/state; Universe opens its chooser and commits only a non-null result. Keyword, System and user-filter menu events return the selected predicate; System choices are All, Deleted, Unseen, Recent, Answered, Filed, Search, From/To and Subject. New Filter enters the definition frame, and canceling it aborts selection. Other compound or random nonaccent clicks are ignored.

The filter-definition task uses the utility parent outside its editor. The editor binds End/Control-Escape to finish standalone edit, Abort to leave only the editor, and otherwise inherits Standard ZWEI; it additionally copies the extended search Control-H prefix. Menu insertions cover Any/named keyword, named user filter, Deleted/Unseen/Recent/Answered/Filed, Search, To, To/Cc, From, Subject, Other, and Before/On/After date predicates. Not, And, Or, and Close perform the same insertion/navigation on all buttons. Sample left/middle uses the current sequence while right chooses a universe. Done parses/evaluates/compiles; Abort returns null. Name left prompts for a new name, while both middle and right open the existing-filter menu despite documentation mentioning only right. Summary click extracts a predicate; typeout/summary execute events explicitly barf.

The universe-definition task has the same outer/editor parent, though its mode line incorrectly says Editing Filter. File/temporary-buffer menu items insert buffer-name strings; Primary and Current insert those symbols; named universes insert a one-item list; All inserts (ALL). Union, Intersection, Not, Close, Done, and Abort ignore button identity; Name uses left for new and middle/right for the existing menu. The (ALL) representation versus direct symbol expansion is TODO-RUNTIME-ZM-C303-UNIVERSE-ALL.

The profile task uses the utility parent before editing and standalone ZWEI while editing. Control-R, selecting the editor pane, or clicking Edit enters it. Application buttons have this exact left / middle / right policy:

Variable-choice events delegate the actual button to the TV value pane, tick profile state, and refresh associated documentation. The Keywords popup uses the same standalone End/Abort editing contract. Random nonaccent clicks are ignored.

CHOOSE-MSG-FROM-SUMMARY consumes exactly one event: SUMMARY-MOUSE returns the message; anything else barfs and is not requeued. The typed-or-summary chooser uses ordinary minibuffer editing, returns a clicked summary message, and substitutes its default for empty typed input.

System 303 typeout presentations have exact left defaults/right menus:

Left emits a typeout-execute event, right chooses an operation, and other single buttons beep. The typeout reader returns only numeric/keyboard input or the named typeout, summary, menu, mouse, mode-line and mouse-button opcodes; it discards other compound events. Multiple-header and single-field selectors accept exactly one typeout-execute event and barf otherwise. Filter extraction accepts typeout actions, changes source message on summary click, returns on Space, and requeues any other input before returning.

Extended-search minibuffer input inherits the ordinary minibuffer but adds Help and this exact Control-H child: ( open, ) close, Control-_/Control-O Or, Control-D/&/Control-A And, Control-N/~/Control-E Not, Space whitespace, - delimiter, A alphabetic, * repeat-next, Control-X any character, and Help documentation. The ordinary parent accepts Return, Control-Return, End, Control-G, Abort, Control-Shift-Y, Control-Meta-Y, Control-Shift-S, Meta-Shift-Y, and double left click; Control-Z, Meta-Z, and Control-Meta-Z are hard undefined before Standard fallthrough.

The experimental :NEW task is a multi-stage tree. Universe left reuses the last universe, middle chooses current buffer, and right chooses/saves a new default; Filter left reuses the last filter, middle always barfs, and right chooses/saves. A filter selected while scoped to one message promotes scope to the current buffer. A menu event terminates operand collection, resolves Other Commands repeatedly, then dispatches in this order: current-message command; current-buffer associated-all; other-buffer associated-all under dynamic selection; materialized filtered temporary buffer for associated-all without map form; associated map command; otherwise barf. An input that is neither menu nor mouse-button is requeued and exits. Unwind restores the labels Just current message and All.

Mark Survey is a distinct transient loop, not a synonym for ordinary summary selection:

SELECT-WINDOW, WINDOW-WAKEUP-SELECT, WINDOW-WAKEUP-EXPOSE, WINDOW-WAKEUP-REFRESH, WINDOW-WAKEUP-REDISPLAY, and WINDOW-WAKEUP-VIEWPORT-POSITION-CHANGED are ignored. Any other compound blip commits, requeues that exact blip for the enclosing loop, and returns. Commit with no marks is an error. Unwind always clears transient marks and restores the prior configuration and documentation state.

The G85 default special-event dispatcher is also an input tree:

The main Zmail frame overrides only these leaves and inherits the rest:

Callback or command failure retains any prior callback-visible effect; the dispatcher does not invent a transaction. Requeued input MUST preserve the original compound event rather than reconstructing an approximate pointer action.

Genera noneditor, pointer, and presentation tree

Before a filter, universe or profile editor is entered, the standalone frame accepts only Refresh, Control-R to enter editing, Break, and Abort; other keys barf. Its table is an input-loop sentinel, not an editor parent. Stray menu, mode-line and summary blips beep; input-editor requests barf; Dynamic Windows wakeups are ignored. Filter, Universe and Profile all use Lisp as their clean major mode. Entering edit dynamically rebinds the standalone table to that mode comtab; the sentinel never becomes a normal editor parent.

The G85 filter task exposes Not, And, Or, Close, Sample, Done, Abort, Documentation, keyword/user/system/header/date menus and Name. It copies only the extended-search Control-H delta into Lisp mode. Sample right chooses a universe; other buttons sample the current sequence. Name left creates a name, while middle and right select an old one. This executable branch disagrees with the pane documentation that groups left and middle as “new”: READ-NEW-NAME compares the mouse character by exact identity with MOUSE-1-1. Summary click inserts extracted filter material. The universe task exposes Union, Intersection, Not, Close, Buffer, Collection, Universe, Name, Done and Abort; an evaluation error from Done reports the error and stays in the task. The profile task exposes Filters, Universes, Mail files, Keywords, Hardcopy, File options, typed choose-variable-values, Exit, Reset, Defaults, Save and Edit; its left/middle/right associations and Save menu are part of the effective graph, not generic editor input.

Normal/calendar/filter command-pane items use a common button policy. Middle requires a configured quick default, rewrites the effective button to left and invokes it. Right opens the options menu at the prior choice; cancel is a no-op, while a choice updates the remembered value and button. Left or keyboard with no default barfs. Summary rows are a separate TV path: left selects; middle invokes the profile summary operation but leaves the global button recorded as right while the local action sees left; right opens the conditional menu.

The clean source profile registers exactly 44 executable application-owned Dynamic Windows forms. This denominator excludes the commented proposal in window.lisp to replace the live TV summary-blip path: commentary is not an effective translator. The 37 presentation-to-editor-command forms are:

Two additional Command Processor presentation-to-command forms are COM-SHOW-EXPANDED-MAILING-LIST and COM-SHOW-EXPANDED-MAILING-LIST-ALL-LEVELS. The remaining five are pure presentation converters: DAY-TO-UNIVERSAL-TIME, DAY-TO-REMINDER-DATE-TIME, ADDRESS-TO-FILE, USER-AT-HOST-OR-SITE-TO-ADDRESS, and ADDRESS-TO-USER-AT-HOST-OR-SITE. A registry export MUST report these groups as 37 + 2 + 5, as well as any site/world additions in a separate effective denominator.

Their application-visible gesture tree is:

no specific gesture means an operation-menu candidate, not an implicit Select. Header/address/path/subject presentation nodes are generated on demand. Parse failure may suppress them, and merging a file recipient suppresses namespace lookup; absence can therefore be the correct applicability result. Address/path/user-host and day converters, and the two CP address-command translators, are part of the graph and MUST report conversion failure separately from command inapplicability.

Calendar's duplicate labels are normative: the configuration registry contains two literal Message only entries, one for the ordinary message layout and one for the no-command-menu layout. Summary//Message only is a pseudo-toggle which alternates the real Summary and Message configurations rather than a constraint layout.

Genera numeric, prefix, Help, and unbound details

The G85 main loop resets the argument to one, presence false, digit count zero and argument tag NIL before each command. The top reader preserves five tags, not four collapsed values: NIL, :SIGN, :DIGITS, :CONTROL-U, and :INFINITY. Control-U multiplies by four while retaining :CONTROL-U; Z creates signed positive or negative octal 37777777 and tags it :INFINITY; minus and digits exist in all four modifier banks. Each command's registration independently accepts or rejects the resulting value and tag. C303 retains the same five-way top-reader distinction.

The top Zmail table has no parent indirection. A null or hard-undefined cell clears pending input and reports that the key is undefined; a symbol without a function reports not implemented. Prefix input rejects mouse characters. When it must prompt, it uppercases unmodified letters; when the next character was already typeahead it does not, an exact historical quirk tested at ZM-G85-PREFIX-CASE-01.

Message/reply editor tables differ. During setup, address/header bindings are copied into the active mode and mode-Control-X tables. Existing-message editing selects Text; integrated drafts select their configured Text/Fundamental/Lisp mode, cleanly defaulting to Text. Message direct keys then inherit that mode, and the empty message Control-X overlay points to the mode child. Reply direct keys also inherit the mode; its eleven Control-X leaves fall through the empty message child and then the mode child. Complete effective enumeration therefore includes the pinned D05 parent and live site/user changes; a list of D08 local cells alone is not a conformance result.

Zmail Help on ?/Help accepts a key, menu item or *. Star sorts the command-name association list in place and documents all. Character lookup uses the active Zmail table and reports undefined input. Selecting Extended Command prompts for a command. Help can descend the Map Over and Other submenus through their right-button behavior, but it does not recursively flatten arbitrary menus. A report names membership in main/Other/Map and prints at most four key paths, falling back to Meta-X. Generic self-documentation mechanics belong to D07; this app-owned traversal is D08. G85 prints a post-report prompt saying that Space removes the display and another character or command-menu click executes a command. The application body contains no second input read; it runs inside a relative typeout-window wrapper. Exact event reading, dismissal and forwarding therefore remain TODO-RUNTIME-ZM-G85-HELP-FORWARD rather than a source-closed MUST. C303 has no corresponding post-report prompt.

Numeric arguments, repeat and unbound behavior

Numeric reachability is dispatcher-specific:

:DIGITS and :CONTROL-U MUST remain distinct even when their integer values are equal: summary scrolling branches on that provenance in both full-reader profiles. :INFINITY is top-Zmail-only because Large Argument is not installed in the editor comtabs. A local command which rejects an argument MUST fail before its semantic mutation. Commands whose source ignores the argument MAY behave identically but MUST remain distinguishable to Help/testing from a command that consumes it. Utility-loop tests MUST NOT synthesize numeric variants merely to fill the table.

For G85 Repeat Last Mini Buffer Command, numeric zero lists prior commands and positive N selects the Nth prior command. Repeat Last Matching first restricts history by the accepted substring and applies the same selection. Negative and out-of-range behavior is inherited normatively from the selected D05 mini-input history contract; D08 preserves the incoming numeric tag when delegating.

An absent fixed cell follows only the selected parent edge. A hard undefined cell stops lookup. A named command without a key remains reachable by completion but MUST NOT acquire a guessed binding. Menu accelerators, presentation gestures and System or Select entry keys are separate ingress classes.

Exhaustive enumeration requirement

For each selected context, an L2 runner MUST enumerate the release's complete character/modifier domain, recursively descend every prefix, enumerate each menu and pointer-button variant, and enumerate typed presentation or TV blip handlers. Each row MUST record:

1. active frame, pane, editor mode and task state;
2. candidate table/handler chain in lookup order;
3. numeric-argument state and applicability predicates;
4. chosen, shadowed, hard-undefined or unbound result;
5. owner and effect-contract section;
6. Help's effective report; and
7. pristine-release versus site/profile/user provenance.

The runner MUST separately cover top-level reader, summary, message editing, integrated draft headers/body, separate Mail mode, filter, universe, profile, calendar and typeout/minibuffer contexts present in the selected profile. A static list of direct keys without these contexts is not a complete D08 binding tree.

Calendar state and day-grid representation

Every calendar day grid MUST have shape (N, 3) plus two leader cells. Leader 0 is the exclusive active-range end and leader 1 is the inclusive active-range start. All collection, rendering and hit-test loops use the half-open interval [start, end). The three row cells have these exact profile-dependent meanings:

Month and Four Weeks share a 42-row backing grid even when only four or five rows are visible. Week uses seven rows. Each of the twelve Year month panes uses 31 rows and sets its exclusive end to that month's actual length. Pane-backed frames also retain the current message identity; Year retains the selected year, while Month retains month/year and Four Weeks and Week retain a start day/month/year. Reset clears those date selectors but does not invent a replacement date.

The minimum observable state machine is:

For a full rebuild of a pane-backed grid, retain the leading holiday strings, remove the prior message suffix beginning at the first non-string, traverse the selected sequence, append every message valid for each date, then stable-sort each day's items. The exact ascending sort key is:

Reminder-time takes precedence over Start-date when both are present. Equal keys retain the holiday-source or message-universe traversal order. An incremental add uses the same stable order; a delete removes the identical message. The left scroll bar exists exactly when item count exceeds the pane's inside-line count. The exact source styling is bold text plus an arrow for the current message and italic text for holiday strings.

Reminder headers, parsing, and day predicate

The overlay adds these parsed message properties:

Period input is read in the Time package and MUST expand as a valid date expression; an invalid expression signals the Time parse condition. Reminder-period serializes as the Time-package printed Lisp form after its header name. Reminder-time parsing retains seconds, not merely hours and minutes, but its serialized header prints only two-digit hour and minute and therefore does not preserve nonzero seconds. Start-date parsing retains whether a time was explicitly supplied so its standard date printer includes clock time only for a time-bearing value; repeated values use the selected header layer's separate-field convention. Replacing or invalidating the parsed status MUST also discard its expanded-period cache.

For a candidate day represented by midnight D0, civil day/month/year and D1 = D0 + 86,400, the validity predicate MUST evaluate the present properties in Expiration, Period, Start order. Every property that is present MUST pass, and at least Period or Start MUST be present:

1. Expiration passes only when D0 < expiration; equality is expired.
2. Period lazily expands and caches the expression, then invokes it against the candidate civil day/month/year. A nonexpandable malformed in-memory value fails.
3. Start selects the last represented start value and passes only when its universal time is strictly less than D1.
4. Expiration alone never makes a message a reminder. A failed present property terminates with false.

The Start comparison intentionally has no lower bound. Thus a start-only reminder continues to match later days unless Expiration or Period constrains it. A clone MUST preserve this source behavior rather than silently turn Start into a one-day event.

The reminder-date-time accepted value is a one-element list containing (universal-time time-specified-p). Its printer distinguishes no date, date only, and date with time. Reminder-time input accepts no value or a time of day and returns NIL or seconds since midnight. Expiration input defaults to no expiration when there is no Start; when Start exists, it defaults to midnight of the following civil day. Explicit no-expiration input becomes NIL. Survey-date input defaults to today's local midnight.

Reminder commands and composition templates

These commands are part of the overlay's effect closure:

Compose Reminder has this exact input branch:

All reminder templates compose via local mail and the selected source profile's shared draft machinery. Their mail payload starts from the basic reminder template, which selects RFC733 headers plus standard Date and Message-ID:

When no time is supplied for an on-day reminder, encode midnight and set includes-time-p false. The summary printer gives Reminder-time precedence over Start-date, displays a Start day/month when present or a period marker for periodic messages, and displays clock time only when a time was explicit.

Layout, rendering, and hit regions

Year is twelve equal month panes arranged as three rows of four. Each pane draws a month heading, a weekday heading adjusted for Sunday- versus Monday-first operation, and a seven-column date grid. It refuses geometry smaller than margins plus 24 character widths by margins plus nine line heights. Its requested vertical extent is the lesser of the remaining height and 16 + 27 * (TVFONT character height + 2). A day with at least one valid reminder is XOR-highlighted only when the Show Reminders in Year Mode option is true. Rebuilding with that option false clears old highlight state. Year never renders message text inside a day.

Year hit testing returns a Day over a real date cell, Week-containing-day over the valid partial row surrounding date cells, and Month over the rest of the month presentation. It MUST NOT turn leading/trailing blank cells into nonexistent dates.

Month and Four Weeks use a two-line header followed by equal seven-column rows. Month selects an exact four-, five-, or six-week constraint from month length, starting weekday and configured week origin; inactive cells remain blank. Four Weeks uses four rows and a heading that names the inclusive start and end dates. The weekday header begins Monday when the option is true and Sunday otherwise. The requested pane height is the lesser of three quarters of the remaining height and two line heights plus number-of-weeks * (inside-width / 7).

Week contains seven equal day panes for consecutive dates beginning at its stored start date. Each pane has a full weekday/date label and renders the ordinary message summary line. Month/Four Weeks day panes label only the day number and choose short-subject, then Subject, then first text line. All day panes place holidays before reminders through the sort keys above, visually mark the current message, truncate sensitive item text to the pane, and recompute scroll-bar presence after contents or geometry change.

These relationships are source-derived but have not been visually exercised in the named G85 runtime. A conforming source-profile implementation MUST implement them; a claim of pixel or preserved-world visual fidelity remains blocked by TODO-RUNTIME-ZM-G85-CALENDAR-VISUAL.

Calendar presentations and navigation

The Day presentation is (day month year); Month is (month year); Week-containing-day carries (first-day month year last-day), though the Week translator normalizes from its first day and ignores the fourth element. Day parses through the Time date parser. Month prepends day 1 to typed input; with neither typed input nor default it reports missing month. The pure Day conversions are normative: Day to universal time returns midnight, while Day to reminder-date-time returns the one-element date-only representation.

The five calendar editor-command translators have these exact branches:

Entering a named calendar configuration through its command-pane item derives a starting value from the current clock, then applies this exact button tree:

Right/keyboard dates for Four Weeks and Week are used as entered and are not renormalized. After date state is installed, post-setup repopulates from the current sequence/current message. Choosing the same date may avoid redundant geometry reconstruction, but configuration selection and required refresh behavior remain observable.

Changing the week-origin option has an exact historical asymmetry. The ordinary profile update method recomputes Year, Month and Four Weeks but omits Week; an already displayed Week may therefore retain its old start. The separate full recompute method resets and restores all four views, including Week. Strict compatibility MUST reproduce the omission. An implementation MAY offer a labeled safe extension that updates Week too, but its results MUST NOT be reported as the strict profile.

Calendar failure, abort, and mutation order

• Period acceptance rejects parse/expansion failures before template mutation and repeats until the Time confirmation succeeds. Declining confirmation returns to the period prompt.
• Date, reminder-date-time, time, Month and Year acceptance errors leave calendar and message state unchanged. The Year accepted ranges above are exact.
• A Year month pane that cannot fit its minimum dimensions refuses the new edges with a pane-too-small error; it does not silently clip into a different layout.
• The Day operation candidate for changing Start is absent when there is no current message. When present, it completes both the time and expiration prompts before mutating. It then writes Start followed by Expiration inside delayed redisplay. This is not a transaction and creates no command-level undo record in the selected source: failure of the second header write can expose the first.
• Set Start and Set Expiration each finish their one prompt before their one undo-recorded header update. Prompt abort therefore performs no header mutation.
• Rebuilding a calendar calls message parsing while traversing the sequence. A parse failure may leave earlier day collections updated; there is no overlay-wide rollback. The implementation MUST surface the failing message and partial result.
• An empty or absent sequence still permits the configured dates and holidays, but contributes no reminder messages.

Reader selection and startup

Reader construction and reader invocation are separate profile-specific transactions. Neither C303 nor G85 waits for a completed login and opened mailbox before making its newly initialized frame selectable.

ZM-C303-ZMAIL initialization kills an old frame if present, creates the frame and its editor/background state, initializes the command table, conditionally registers System M, registers the Mail System Menu item, resets pathname/user/view state, and then activates the frame. Programmatic ZMAIL separately handles :RELOAD, forces login, queues STARTUP-ZMAIL-BUFFER, selects the already active frame and waits for exposure. Selection through the frame process can force login after selection, install the null-startup view when no ZMail user is set, run the command loop, then deselect and bury the frame.

ZM-G85-ZMAIL initialization kills an old frame unless invoked from one of its inferiors, resets declared initialization state, creates the unique frame, initializes both ordinary and Control-X tables, snapshots pathname/template state, resets the user and background worker, and activates the frame. SETUP-ZMAIL-FRAME initializes if absent, moves the unique frame to the usable default screen, and reinitializes it if it is not selectable. Programmatic ZMAIL rejects a remote terminal, optionally reloads, forces login, queues sequence selection, selects, and waits for exposure. The frame process may itself wait for selection or login enablement, force login in its message-pane typeout window, install the null-startup view, run the command loop, and bury the still reusable frame on return.

Only after those entry-specific steps do profile loading, default-sequence selection, inbox discovery, and an initial configured view occur. Failure at login or file-host resolution leaves exactly the empty/prior/selectable state produced by the selected entry; it MUST NOT invent a mailbox or retroactively claim that activation waited for login. The Genera runtime proved that local login can reach an empty reader, while integrated Mail immediately failed on unavailable DIS-SYS-HOST file operations.

Foreground command transaction

For one reader command:

1. Finish any prior response incorporation and required redisplay.
2. Reset per-command argument/button/current-command state.
3. Read a keyboard, TV blip, menu, pointer or presentation event.
4. Resolve it through the effective context tree.
5. Validate sequence/message requirements and dangerous-command policy.
6. Execute under required sequence/buffer locks.
7. Update ticks, caches, status, current selection and point stack in source order.
8. Enqueue background or service work only after its request object is complete.
9. Return a redisplay degree and update panes/typeout/mode line.

An editor BARF, unbound input, parse condition, file condition or explicit abort returns through the selected command-loop recovery. Mutations completed before the failure remain unless the command itself records and performs an inverse. D08 does not promise transaction-wide rollback.

Background worker ordering

The foreground and background worker communicate through explicit request/response state. They MUST NOT concurrently mutate a sequence outside its lock domain.

For ZM-G85-ZMAIL, ordinary background requests are pushed and selected from the front, making them LIFO despite a nearby source comment calling the queue FIFO. Preload requests alone are appended and therefore FIFO. The runner MUST test both orders. The process is named Zmail background, has priority -1 and scheduler quantum 10. Independently, background load processes at most 20 messages per work quantum; save and parse process at most 10 before yielding. A port MAY use different scheduling primitives, but at an L3 observation point it MUST reproduce these ordering and yield boundaries.

Background work MUST yield for the selected interaction policy. Genera requires at least five seconds of keyboard inactivity for ordinary work, pauses for pointer speed above 2.5, reserves at least 12 response-buffer entries and 25 percent of the buffer for foreground work, permits configured work while deexposed, and separately requires exposure for periodic mail checks.

ZM-C303-ZMAIL has a separate background process, lock, request cell, response queue and preload queue. Ordinary requests are pushed onto the request-cell list and the worker selects its first element, so they are LIFO. Preloads are appended and popped from the front, so they are FIFO. One load or active preload quantum reads at most five messages, one parse quantum parses at most five previously unparsed messages, and one save quantum emits at most 50 lines. The clean source gives the process default priority -5. Its selected defaults enable background checks and saves because the inhibit options are false. Exact live scheduling, pauses and finish races remain TODO-RUNTIME-ZM-C303-BACKGROUND; queue order and the 5/5-message/50-line work limits are source-closed requirements, not part of that oracle gap.

Composer entry and initialization

Composer entry MUST decide reuse before changing text:

• C46 no numeric argument resets *MAIL*; a numeric argument preserves it.
• C303 no argument invokes the default Zmacs mail template; resume preserves the special buffer.
• G85 uses the three-way numeric behavior specified above and refuses entry if Zmail is not loaded.

On initialization, construct the To field, optional recipient/subject/other headers, the exact profile separator and optional body. Select point by this priority: missing recipient, required missing subject, caller-provided body index, otherwise body end. Run a selected template only after the base structure exists. The clean C303 path discards undo history and marks the new template unmodified; later edits make it modified.

Quit and abort

Quit without transmission is profile-sensitive:

• C46 announces a resume route and exits the special buffer; it does not erase the draft.
• C303 kills an unmodified freshly initialized buffer after exit; a modified draft is retained and the user is told how to resume. A caller requesting top-level exit also leaves the editor after cleanup.
• G85 rejects a pending numeric argument with a beep. During keyboard-macro entry it aborts to top level rather than abandoning composition. Otherwise it may save a parseable standalone draft into a Zmacs buffer, reports the appropriate resume route, and exits without update.
• Integrated ZMail/Zmail Abort Send follows its ordinary confirmation/preservation policy; the C303 Super-Abort path is the explicitly stronger variant.

No abort path may be reported as a send. If the user cancels a destructive prompt, message, draft and file state MUST remain at the prompt's pre-mutation boundary.

Reader quit, bury, kill, and reinitialize

Ordinary Quit is not frame destruction. In C303 it selects Save, Ask, or Don't Save, then deselects and maybe buries the reusable frame; optional Logout occurs afterward. In G85 it performs the selected save policy, optionally logs out, throws from the command loop, and the process top level buries the reusable frame. Neither ordinary Quit kills the background worker or makes the frame permanently unselectable.

Frame kill/reinitialization is a separate operation. It abort-closes owned streams as the selected source specifies, unlinks/kills auxiliary frames, and in G85 explicitly kills the Zmail background process. Reinitialization may kill the old frame and create a new unique frame. A failed save prevents any success claim and leaves exactly the source-produced dirty/partial state. Force closing the host VLM or emulator is neither ordinary Quit nor orderly frame kill and says nothing about mail persistence.

Selection and movement

Selecting a sequence MUST save the prior sequence's current message, install the new ordered population, restore its saved current message when valid, otherwise apply the selected first-message policy, update displayed indexes, invalidate summary state and select/redraw the required panes.

Movement commands select by predicate and direction over the current sequence: ordinary, undeleted, unseen and recent variants MUST remain distinct. First/last variants scan from the corresponding endpoint. If no matching message exists, the command reports failure without changing current message. The message point stack stores sequence plus message identity, not merely a row number, so a pop can return across sequences or report that the target no longer exists.

Jump with a numeric message number validates the displayed range before selection. Filter-based Goto constructs a predicate/selection interaction. Those are distinct operations in G85 even where a menu prints Jump.

Message and summary display

The message pane displays the current message's selected header view and body. Header reformatting MUST preserve an accessible original-header representation until the selected command explicitly discards/restores it. Changing a message, header style, character style or parsed property invalidates the message and summary caches which depend on it.

The summary is an ordered projection. Each row MUST retain message identity independent of its displayed ordinal. Its template controls fields such as number, length, date, sender/recipient and subject/text. Rebuild MUST update displayed indexes atomically with the row list so a pointer event cannot select the wrong message after a sort or filter change.

Summary-only, message-only and Both configurations preserve one current sequence and message. Changing configuration changes visibility and input routing, not logical ownership. Message scroll and summary scroll maintain separate positions and increments; the clean C303/G85 summary increment is 20 percent of the summary pane.

Delete, undelete, remove and expunge

Delete sets the message's deleted status and then applies the configured movement direction. Undelete removes that status. A profile may bind Delete And Up or choose a different post-delete direction; the exact command decides whether movement occurs before or after an error.

Remove is valid only for a temporary collection. It removes the reference from that collection, selects the next valid row and leaves the owning mail-file message/status unchanged unless the selected command separately modifies it.

Expunge is a persistence operation:

1. Determine affected disk-backed sequences.
2. Apply the selected confirmation policy before deleting membership or rewriting a file.
3. Lock each affected sequence in source order.
4. Remove deleted messages from the persistent representation and in-memory sequence according to the selected format's safe ordering.
5. Repair current/saved messages, indexes, reference caches and ticks.
6. Commit replacement/append state and release streams/locks.
7. Report each failed file distinctly and leave it dirty/retryable.

The clean C303 and G85 sources default to no expunge confirmation. A configured profile may change that. A multi-file failure MUST NOT be reported as an all-files success; completed files remain completed unless the source uses a replacement rollback for that format.

Filing, concatenation and buffer lifecycle

Move copies/appends the selected message to the destination buffer through that buffer's format adapter. Only after the destination accepts the message may the source apply its delete-after-move policy; the clean sources enable that policy. Failure before destination acceptance leaves the source undeleted. Failure after destination acceptance but before source deletion is a partial move and MUST be reported without deleting the accepted destination copy.

Concatenate combines message content with the selected destination message in the source-defined order. Append/Move relative to a referenced message first resolves a unique live reference; missing or ambiguous references fail before mutation.

Killing a temporary collection releases only collection state. Killing a dirty disk-backed buffer follows save/confirm policy and MUST NOT silently discard changes. Rename changes the sequence's user-facing identity; whether it renames a backing file is a separate explicit operation.

Get new mail and inboxes

The primary mail buffer and its inboxes are distinct objects. Get New Mail identifies configured and recovery inbox sources, establishes the selected status, reads complete messages through the inbox adapter, inserts them in the selected append/prepend/reverse order, marks new/unseen/recent state, invalidates caches, and publishes completion in the selected foreground/background order. Source-file rename, insertion, destination save, and source deletion are not one transaction and MUST follow the selected profile.

C303 may rename an inbox source before reading it. It retains pending inserted-source records through destination save, but after that save its delete loop prints a deletion error and clears the pending list even when deletion failed; a clone MUST reproduce that retry-loss edge in strict mode. G85 tracks renamed/inserted identities through its inbox-buffer :PARSING and :INSERTED states and deletes them during save finish; a non-file-not-found deletion error occurs after output close while :SAVED and the pending identities remain observable. The Genera option to complete inbox reading in the background is enabled by default, and automatic jump after retrieval is disabled by default. Both profiles may retain already inserted complete messages after a later failure, but they do not share one universal recovery invariant.

Search, filters and universes

This section gives the cross-profile application contract. The complete executable languages, exact option inventories and release-specific defects are incorporated from the System 303 and System 452.1 / Zmail 442.0 semantic companions.

Find String searches from the current message position. Occur searches a selected population and produces a report/selection without confusing text matches with message identities.

A filter evaluation MUST:

1. freeze the chosen universe and traversal order;
2. parse only the properties required by the predicate, exposing parse errors;
3. evaluate the predicate once per candidate unless the source explicitly retries;
4. preserve source order unless a selected sort follows; and
5. return a temporary collection or summary selection with stable message identity.

Map Over takes that result and applies the chosen command in order. Delete, Undelete, Type, Find String, Keywords, Unkeywords, Move, Forward, Redistribute, Reply, Concatenate and the profile-specific additions remain distinct command adapters. Commands which require one message versus a population MUST validate that distinction before mutation. Exact continue/stop behavior after an injected mid-map command error is TODO-RUNTIME-ZM-C303-MAP-FAILURE and TODO-RUNTIME-ZM-G85-MAP-FAILURE; a port MUST declare its interim policy rather than claiming L3 fidelity.

Named-command behavior is not inferred from labels. Every one of the 86 C303 and 152 G85 completion candidates follows the ordered validation, mutation, delegation, partial-failure and ownership record in the named-command effect closure. Rules, undo/redo, encryption, ECO restore, GMSGS and other multi-step commands deliberately expose nontransactional prefixes where that source does; a reconstruction MUST NOT silently roll them back or advertise a downstream subsystem as ZMail-owned.

Keywords, sorting and references

Keyword addition/removal updates message status, persistent-format capability, summary cache and modified ticks. A format unable to persist a property MUST expose that limitation before claiming a clean save. Keyword-list editing changes the available vocabulary separately from applying a keyword.

Sort computes keys from parsed fields and changes sequence order while preserving current message identity. Equal keys MUST use the selected release's stable/tie ordering; where not runtime-verified, exact tie order remains TODO-RUNTIME-ZM-SORT-TIES.

Reference operations build conversation membership from message identifiers and reply/reference headers. They MUST tolerate missing ancestors, detect duplicate identifiers and invalidate the reference index after relevant message/header changes. Select, append, move, delete, compare, survey and merge-keyword operations over a conversation use the same resolved ordered member set but retain their distinct mutation semantics.

Digests, duplicate detection, reformatting and rules

Undigestify is profile-specific. C303 first recognizes two separators, and when its clip option is enabled it deletes the original body tail before constructing and inserting children one at a time immediately after the original. Each child receives the inherited destination header and optional derived subject. Only after the loop finishes does the default delete option mark the original deleted. A mid-loop failure can therefore leave a clipped original plus partial children, but not the final delete mark from this invocation.

G85 first recognizes and constructs the complete child list, saves undo state, optionally selects a recycled collection containing the original, completes pending input on the owning buffer, and then inserts children in order into the buffer and any active collection. It updates character mappings and child To headers, adds the child message identifiers to the original's References header, and rearranges affected sequences. It retains the original; it has no C303 delete/clip step. A construction failure precedes insertion, while a later insertion/header failure can leave the source-visible partial prefix. Strict implementations MUST NOT average these orders.

Duplicate detection compares the selected source identifiers/content criteria. When deleting a duplicate, Genera inherits Answered, Filed, Forwarded, Sent, Keywords and Redirected state from the retained message as defined by source; it does not blindly copy deletion, file-format or display-cache properties.

Reformat/Unreformat changes derived header display and saved state according to the format's capabilities. A source Rule operation is an explicit profile overlay and MUST report each message/action result; it MUST NOT be treated as a hidden background filter.

System 46 request-file composer

ZM-C46-COMPOSE initializes this editable structure:

To: [optional initial recipient]
--Text follows this line--
[optional initial body]

The header scan is line-ordered and stops at the body boundary. For each requested prefix, MAIL-PARSE returns the first case-insensitive prefix match only when the line is strictly longer than the prefix; a bare To:, for example, is ignored. From: and the first line matching either Subject: or S: return the raw substring after the prefix, without generic whitespace trimming. Unknown header lines are ignored.

To collection starts at the first header line, resumes at the line after each match, and therefore emits all To lines in their header order. Cc collection then starts again at the first header line and emits all Cc lines in their header order. Within each matched line, split literally on commas, trim only space and tab from each piece, omit a piece empty at that point, and strip exactly one outer parenthesis pair when both ends match. Do not implement quoted-comma syntax. The nonempty test precedes parenthesis stripping, so () is still emitted as an empty parenthesized recipient and counts as a To result in the strict profile.

Transmission validates the separator before opening the request output. If the current default file host is not ITS-flavored, it changes the default to AI. It then opens DSK:.MAIL.;MAIL > and emits, in order:

FROM-JOB:LISP-MACHINE
SENT-BY:<current-user-id>
[CLAIMED-FROM:<From value>]
[SUBJECT:<Subject or S value>]
TO:"(<recipient>)"
[more TO records; Cc records include the R-OPTION CC marker]
TEXT;-1
<body lines>

At least one emitted To piece is required; Cc alone does not satisfy that check. Separator validation precedes output open, but the no-To check occurs only after the request file has been opened and the initial, optional From, and optional Subject records have been written. A no-recipient failure can therefore leave that prefix of the request file. The request file is the delivery handoff. Successful close then exits the special editor. Missing separator or recipient, open/write/close failure, or abort does not exit through the successful-send path. A failure after output begins MAY leave a partial request file; strict compatibility MUST expose the exact written prefix and MUST NOT label it delivered.

System 303 separate Mail mode

The System 303 editor uses the configured mail header delimiter and initializes Text mode plus Mail minor mode. It recognizes structured address navigation and its Control-X field commands. MAIL has two noninteractive cases:

• when text is supplied and editor use is false, submit the supplied string directly;
• otherwise enter Zmacs Mail composition, with T as the recipient meaning resume.

Send requires the delimiter bounded by line breaks. It passes header and body intervals to ZMail's SEND-MESSAGE; on successful return it exits the special buffer with update true. A missing delimiter fails before submission. A send failure retains the buffer and MUST NOT run successful exit.

Genera separate Mail mode

Genera first verifies that Zmail is loaded, then forces user login, selects/creates a Mail special buffer and initializes Text/Mail state when required. Failure of the loaded check occurs before login or buffer selection.

New buffers contain To, optional Subject/other headers, the exact editor separator alone on a line, and body. Filling treats the separator as a paragraph boundary. The Add File References command chooses a default from the recent buffer history but accepts an explicit pathname and inserts a typed File-References header.

On send:

1. locate the separator as a trimmed whole line;
2. if the buffer has prior recipient results, run the configured retransmission policy, optionally adding Supersedes and Comments;
3. call the shared Zmail sender with header and body intervals;
4. copy returned recipient state from the generated draft into the Mail buffer;
5. for a standalone mail frame, preserve the parseable draft in Zmacs; and
6. exit with update true.

The clean retransmission policy is Ask. If the user declines Supersedes, submission continues without it; if the user cancels the containing query, the selected abort semantics apply. A send error after adding headers leaves those edits visible and the draft resumable.

Integrated draft creation

Mail, Reply, Forward, Redistribute, Redirect, Continue, Local and Bug operations create or reuse a draft object and switch the reader frame to Send or a reply configuration. Header, body and original-message panes share the reader's editor closure. Recursive Mail pushes the enclosing draft/task state and restores it after the child finishes or aborts.

Reply construction has three independent dimensions in Genera:

• seven recipient policies: All, All-Cc, Cc-All, To, To-Cc, Cc-To, Sender;
• three original-message policies: Two Windows, One Window, Yank; and
• two header policies: Prune, Do Not Prune.

The resulting 42 combinations MUST be generated from the dimensions so profile defaults and button choices remain composable. System 303 retains its release's recipient/display/header dimensions, including its one/two/three-window controls.

Forward, redirect and redistribute are not aliases:

• Forward creates a new message body containing or referring to the original;
• Redistribute transmits the original with redistribution metadata; and
• Redirect changes the destination path while preserving the selected source-defined origin semantics.

The implementation MUST update Answered, Forwarded, Redistributed, Redirected or Sent status only at the source-defined success boundary.

In G85, composition unwind always swaps out/saves window state and removes no-fill mode. It discards only a truly unused draft whose node tick has not advanced beyond its creation tick and which has no transmission timestamp; edited or used drafts are retained. Split/merged header/body transitions find the blank separator or force a newline, and their pane points must round-trip. Abort Send has exact guards: a numeric argument beeps and does not abort; an active mark makes the command a no-op; keyboard-macro execution barfs; an unused draft is abandoned; an edited/used draft is retained before control returns to the reader. Blanket manual wording does not override these branches.

Draft field and body editing

Header-field commands create or select a correctly typed field and leave point at the source-defined edit position. Address movement respects parsed address boundaries, not word syntax. Add More Text restores body editing. Yank Current/Replied Messages inserts selected text and optionally prunes headers according to the effective profile.

Draft save, restore, write and Save As Message are separate operations:

• Save Draft File updates the associated default draft pathname;
• Write Draft File obtains a new pathname without silently changing unrelated mail files;
• Restore replaces or merges the selected saved draft per source behavior; and
• Save As Message stores a message object in the selected mail file/sequence.

Failure after a file write begins is reported with the draft still live. A port MUST NOT mark the draft clean unless the selected save operation completed its commit.

End, send and abort policy

Mail End is not an unconditional Send key. Its effective profile value selects Send, a two-choice send query, Add More Text, or a two-choice text query. The implementation MUST evaluate that policy at key time. Direct Control-Altmode bypasses Mail End and invokes Send Message.

Sending validates required headers and subject policy, normalizes addresses, derives reply/message identifiers, selects header-output style, constructs the envelope, applies file-copy requests, and calls the transport adapter. Prompts occur before the mutation they authorize. An adapter's partial recipient success MUST remain attached to the draft so retry/retransmission can avoid a false all-or-nothing account.

G85 canonicalizes file recipients, clears prior recipient/status/timestamp state, expands headers, and prompts on repeated expansion. A nonempty unhandled header or empty recipient set aborts before service selection. A per-expansion before-hook may suppress transmission; if it returns normally, it has taken ownership, and normal after methods may still mark source messages Answered/Forwarded and the draft Sent. Each recipient moves through Transmitting to its returned disposition. Earlier recipient success remains if a later service fails, but source/draft success marking occurs only after the whole primary operation returns normally. Programmatic SEND-MESSAGE parses a fresh Zmacs draft; make-draft-and-transmit sends before dummy message/undo registration, so failure leaves no dummy to imply persistence.

Format adapter protocol

Every selected format implements:

There is no release-independent “pathname, signature, override” pipeline. ZM-C303-ZMAIL and ZM-G85-ZMAIL MUST use these separate transactions.

For an existing C303 file:

1. merge/translate the pathname and open its input stream;
2. reuse the matching open buffer, or handle its changed-file conflict, before constructing another buffer;
3. when the caller supplied a buffer flavor, use it without detection; otherwise pass the already-open stream to the pathname host's format computer;
4. let that host method combine its content signature and host default, returning append state where defined, and restore the stream pointer after every probe; and
5. construct the chosen flavor and begin loading.

For a new C303 file, an existing default buffer supplies flavor/sticky options when selected; otherwise explicit flavor precedes the pathname host's no-stream default. The append/prepend profile is then applied, and the right-button options path may replace the selected flavor/options. These new-file decisions are not content recognition.

For an existing G85 pathname, buffer reuse and changed-file conflict resolution occur first. Only when a new buffer is needed does selection proceed:

1. explicit interactive Select Format and Options, when requested;
2. otherwise explicit FORMAT;
3. otherwise the pathname-derived default; and
4. otherwise the pathname host's default-default format.

The buffer is constructed before content/apparent-format checking. Automatic format error handling is enabled only when neither explicit Format nor interactive selection fixed the choice. On the first wrong-format condition, abort the current load; when the condition supplies an apparent format, change the buffer flavor and retry. A missing apparent format propagates to the ordinary retry UI. Subsequent attempts offer the user a different-format restart and the normal retry loop; they do not silently keep auto-changing forever.

For a new G85 file the distinct default chain is explicit Format, pathname-derived default, compatible current/default-buffer flavor, then host default-default. Caller options win over copied sticky options; the append policy is applied, then an explicit Select Format and Options request may replace the result. A forced format MUST remain recorded, and an apparent-format mismatch MUST follow the selected restart path rather than silently rewriting file content.

System 303 registered formats

The active source registers six selectable buffer flavors:

The active non-Symbolics local-filesystem integration defaults mail files to Babyl, with BABYL TEXT > as the possible main file and MAIL TEXT 0 as the new-mail pathname. ITS-path recognition distinguishes a leading Babyl options line from Rmail. TENEX- and Unix-family pathnames can also recognize Babyl. The comment-only lmfile and unselected lm.lisp do not define strict-profile behavior. The format's possible set is host-specific; the global registry is not a promise that every pathname offers all six.

Strict format behavior includes these release-specific rules:

• Rmail and Babyl are distinguished on ITS by whether the first line is exactly the Babyl options marker. An ITS message boundary is a line beginning with Control-Underscore and containing only space, tab or formfeed afterward.
• Babyl accepts versions 4 and 5. Another version signals a continuable error rather than being silently upgraded. Its original/status header and display header are divided by the *** EOOH *** sentinel; version-5 status and file options are parsed and serialized as distinct grammars.
• Tenex consumes the received-date line, decimal byte count and octal status bits. Its damaged-boundary/count recovery is observable and MUST be selected separately from strict rejection.
• Unix recognizes candidate From boundaries with the source's weekday/date heuristic. A line that merely begins with those bytes but fails that test is message content. The selected source has no general mboxrd unescaper or matching serializer escape pass: its adjacent From />From test is only part of the envelope-candidate heuristic. Strict compatibility MUST preserve that limitation; safe mboxrd escaping is a separately named extension.
• VMS recognizes formfeed boundaries and either fixed fields or a CHAOSMAIL header. The ZMail 50/System 94 manual calls VMS and Multics unimplemented; the selected maintained source implements VMS but has no Multics adapter. This is a release delta, not permission to add Multics to ZM-C303-ZMAIL.
• Text has serialization support but its mail-file-reparsable predicate is false. The supported arbitrary-format UI therefore excludes it. An adjacent source comment says a forced read should produce no messages, but executable control flow disagrees. Consecutive nonblank lines each set the common reader's start and become one-line messages. On an initial or intervening blank/space-tab-only line, the always-true callback reports an end while start remains null, and buffer-pointer construction faults before another message is published. Strict source semantics MUST reproduce both boundaries; the exact runtime condition/cleanup and whether an outer wrapper ever enforces the comment remain TODO-RUNTIME-ZM-C303-TEXT-FORCED. A port MAY reject or prominently label reopening as a separately selected safety extension, but MUST NOT call that extension strict source behavior or pretend the export round-trips.

Genera 8.5 registered formats

Genera registers Babyl, Rmail, KBin, Tenex, Unix, Directory and Text. The public Genera 8 manual names the first five; Directory and Text are 8.5 source-visible extensions. Directory stores one message per file. Text uses blank/configured separators on output, reads an input file as one large message, is explicitly non-reparsable, and is consequently filtered out of the arbitrary-format chooser. KBIN is a preparsed 16-bit binary representation supplied by the optional KBIN subsystem.

Recognition is host-family specific and every content probe MUST restore the stream position. The strict possible/default sets are:

KBIN magic/bounds/endian recognition and the Babyl first-line marker precede fallback. Source comments saying that some defaults “should” be KBIN are not active behavior.

Exact KBIN bytes remain licensed-oracle work. An implementation MAY mark KBIN unavailable at L1 and under the companion's FMT-L2-G85-TEXT claim, but MUST NOT expose an in-memory stub under the historical name. Only a selected STORAGE-G85-KBIN / FMT-L2-G85-KBIN claim requires the source's recognized bytes, upgrade/reparse command behavior and failure semantics under TODO-RUNTIME-ZM-G85-KBIN-BYTES.

Loading, saving and commit ordering

Load publishes only complete messages. A parse error attaches to the source position and buffer; previously loaded messages remain available unless the format explicitly requires whole-file rejection. The buffer does not enter idle/complete state until the foreground consumes the completion response.

Save chooses append versus rewrite from format capability, buffer options, mutation type, host/version semantics, and the selected profile's actual implementation. The adapter MUST expose whether it writes in place, creates a new host version, or uses a temporary/replacement identity; D08 imposes no universal rename transaction. Append records only the accepted suffix. Unknown options/headers are preserved, rejected or normalized according to the selected format—not silently discarded by a generic serializer.

An interrupted save records the selected source-visible stream, status, last accepted unit, file identity, pending inbox identities and any recovery pathname. Authority and dirty state change only at that adapter/profile's commit boundary. Close, versioning, deletion, or rename failures retain the exact partial state below; a clone MUST NOT invent a recovery artifact which the selected source never created.

System 303 persistence order and partial results

The maintained implementation does not provide one transaction around multi-file mail handling. Strict C303 mode MUST preserve these observable boundaries:

1. An inbox source MAY be renamed before its messages are read. A later parse or insertion failure therefore leaves the renamed source as recovery evidence.
2. Pending inbox files are deleted only after the destination mailbox save. A delete error is printed, but the pending list is then cleared; the same process does not automatically retry that deletion.
3. Merge first splices interval/node structures and then updates message arrays. An injected failure can expose a partially merged in-memory structure; no whole-merge rollback is promised.
4. Save All expunges every selected buffer before saving any of them. A later save failure therefore follows already completed in-memory expunging.
5. Expunge applies expiration deletion before its expunge confirmation. Declining the later prompt need not undo messages already marked deleted by expiration.
6. Foreground-save unwind calls the saving-aborted transition only while the buffer remains in the expected saving state. The foreground/background finish path can abort-close a :SAVING buffer and set it to NIL rather than restore :SAVING-REQUIRED; this source-visible edge remains a required fault test.

A safer clone MAY offer a transactional extension, but its strict profile must emit the historical intermediate results or reject that compatibility claim.

Genera load, new-mail, and save state machines

G85 load accepts :IDLE, or :LOADING only when pending inboxes justify it, and publishes :LOADING before open, identity verification, file header and background queue work. A background quantum adds at most 20 complete messages. Normal completion reaches transient :LOADED; foreground finish closes the stream, captures file identity, clears stream state, queues old parse work, restores options/selection and enters :READING-NEW-MAIL for pending inboxes or :IDLE otherwise. Default load abort kills the new sequence/mail file. Its survival path flushes load/parse work, destroys partial messages with nested aborts masked, repairs the active array and parse queue, abort-closes the stream, and reaches :IDLE or intentionally remains :LOADING for pending inbox work.

Read New Mail first completes transient loads/saves and aborts an active save because a fresh save follows. Under background, write and all-inbox locks, it flushes parse work, enters :READING-NEW-MAIL, loads and inserts inbox messages, then reparses and selects. Completion waits until every inbox has been inserted. Finish closes inbox buffers, runs hooks/sort, clears compaction state, enters :IDLE, and background saves unless inhibited. Abort flushes new-message parsing, aborts every inbox load, kills/compacts only additions from this attempt with aborts masked, and repairs selection, list and status. Ask, Auto and Stop policies for inbox-save queries and their restarts are distinct.

Save acquires the write lock and offers retry, fix and skip restarts. With no tick newer than the last save, it reaches transient :SAVED without writing, but finish still performs pending inbox cleanup and announcements. Otherwise it enters :SAVING before open/header work and processes at most ten messages per quantum. Finish closes output first, updates file identity, then deletes inserted inbox true names; only file-not-found is ignored; only afterward does it clear pending identities/tick and enter :IDLE. A different deletion error can therefore occur after output close while state still records :SAVED and pending inboxes. Abort flushes work, abort-closes, clears the stream and returns to :IDLE. Strict G85 MUST NOT invent a universal temporary-file/rename transaction. Genera 8.2's guarantee that saving to a Unix host creates a new version retaining prior contents is a release-specific compatibility rule, not a rule for every adapter.

Normalized submission interface

All non-C46 senders call a semantic adapter with:

• immutable normalized header/body content or a readable interval snapshot;
• envelope sender and ordered recipient groups with To/Cc/Bcc distinctions;
• first-hop host/site grouping and requested service constraints;
• file-copy destinations and blind-copy policy;
• message/reference/retransmission identity;
• interactive versus background permission; and
• a result sink for per-recipient attempt, acceptance, rejection, retry and diagnostic records.

The adapter MUST return a structured result. accepted-for-queue, delivered, temporarily failed, permanently rejected, and not attempted are distinct. Interactive ZMail/Zmail MUST NOT claim final delivery from queue acceptance.

System 303 transport profile

The maintained source exposes COMSAT/file-job, Chaos mail-server, direct Chaos, Ethernet and SMTP-related paths depending on site support. The UI/profile selects only modes whose dependencies are present. A recording adapter MAY emulate the handoff for conformance. Exact protocol bytes and remote retry policy remain D19/D21.

The selected tree is not self-contained for every advertised choice. No active ETHER-SEND-IT body is present, and SMTP delegates to a provider outside the selected ZMail closure. Selecting either without its provider MUST produce an unavailable-transport result before claiming acceptance; it MUST NOT fall through to an unrelated transport.

System 303 ordering is deliberately non-atomic:

1. Validate headers, optionally obtain and insert a subject, and generate the message identifier.
2. File requested FTo, FCC, and BFCC copies before network submission. When destinations overlap, FTo takes precedence over FCC, which takes precedence over BFCC.
3. Invoke the selected network/file transport.
4. Only after its success return mark the draft sent and mark source messages Answered or Forwarded.

Consequently a transport failure can leave committed local copies while the draft remains unsent, and a naive retry can duplicate those copies. Chaos submission uses separate visible-recipient and blind-recipient sessions, so visible success may precede Bcc failure. Direct Chaos sends per host before gateway retry, allowing earlier hosts to succeed before a later host fails. File submission is a no-op when both To and Cc are absent; an FTo-only draft can therefore complete as local filing. The programmatic Zmacs SEND-MESSAGE interface bypasses integrated-draft bookkeeping. All of these partial results MUST remain distinguishable in the result record.

Genera service discovery

Genera's active default is network submission rather than the older block-commented fixed transport option table. It groups recipients by first hop, asks the network service framework for candidate paths, prefers store-and-forward where available, may try a host-local mail-to-user path, can retry candidates, can offer a service believed unavailable, and may prompt before direct delivery fallback.

A conforming adapter MUST make candidate order, prompt decisions and per-recipient outcomes observable. It MUST distinguish an unavailable file host needed to prepare the draft from an unavailable mail transport after preparation. The preserved world failed at the former DIS-SYS-HOST boundary; no live delivery behavior was observed.

One G85 mail-access-path attempt has a five-minute timeout and the lifecycle start -> verify each recipient -> receive message -> finish -> close(normal), followed by an outer unwind close(abort). Close MUST therefore be idempotent and the trace MUST retain both calls. Attempt count increments before verify; success count increments only after verify returns. If zero recipients verify, receive still drains both message streams to a null sink so the peer is not left waiting. At least one accepted recipient triggers the message-sent callback, but acceptance is not evidence of final delivery. Abort/timeout at every phase retains verified and completed recipient dispositions.

Mailer separation

The separate Genera Mailer owns queues, logs, counters, persistent messages, mailboxes, hosts and delivery processes. D08 may submit to it and display a returned status. D08 MUST NOT create or inspect its internal queue as part of base Zmail conformance. The interactive Zmail background worker owns file parsing/saving and mail checks for its frame; naming similarity is not shared process identity.

Genera empty-reader witness

Runtime observation — Genera 8.5, session zmail-d08-genera-20260718, generation 1, verified 2026-07-18 after Select M and local LISP-MACHINE login. The reviewed 1200 by 900 image is 4,471 bytes; PNG SHA-256 a947dc4d80238ef0bea331d383603865a4eb653cd2903c2b23cd65217742aab7; normalized-pixel SHA-256 b4d8c37c43d839b0983d35c244950c1649668bd70ace82a2c2b5bd9ffab12d66; the 24-record action prefix has SHA-256 31f193b620c8d0cf62cbe9bbcc7744c6582f3d16db47aa4a93a84ec17ff0a150. It establishes the one-frame empty layout, visible pane relationships, menu labels and concise entry hints. It does not establish populated summary rows, message rendering, command effects, menu predicates, mail transport, site configuration, or source-to-world identity. Symbolics and other applicable rightsholders retain interests in the licensed screen; this minimum image is published under the page-specific fair-use review for historical criticism and reconstruction, and no endorsement is implied.

The visible relationship required by ZM-G85-ZMAIL at 1200 by 900 is a full-width summary region above a horizontal functional command pane, a large message region below, and the Zmail mode line at the bottom. The screenshot is an oracle for this relationship and short labels, not an exact pixel/font/color contract. At L2, a port MUST preserve pane identity, relative ordering, the four-by-five menu topology, current-selection indication and separate message/summary scroll state. Pixel identity remains outside the claim.

Genera separate Mail-mode witness

Runtime observation — Genera 8.5 in the same session and generation, verified 2026-07-18 after Select E and Control-X M. The reviewed 1200 by 900 image is 3,180 bytes; PNG SHA-256 6462902049b81435b2fb7cff480be055f660978bb12a4d5ea49dea091bb7c62c; normalized-pixel SHA-256 945ae06da781538b6def4937592b1bee5fbbd9d6f0ad0117b276f757ec846e67; the 38-record action prefix has SHA-256 b9f03911419f23c845e23fcc0739984c42e667daf7ec3176d89c399b486a7064. It establishes the left-hand blank editor's header/body template, separator and Text Mail mode line. The right-hand residual Zmail/dithered area is incidental prior state and is not a specified two-pane Mail layout. No address, body, delivery or resume behavior is shown. Symbolics and other applicable rightsholders retain interests in the licensed screen; this minimum image is published under the page-specific fair-use review for historical criticism and reconstruction, and no endorsement is implied.

The two images are deliberately not a sequence teaching operation. They compare two architecturally distinct surfaces and contain no user mail, address book, mailbox, substantial Help prose, source listing, font sheet, artwork or third-party media. Their exact-page reuse is recorded in the screenshot policy and curated asset catalog. No other capture from the session is approved by implication.

Genera runtime scope and shutdown

The selected world was an unconfigured isolated Genera 8.5 world, not a configured Symbolics site. The base and private Genera-8-5.vlod were each 54,804,480 bytes with SHA-256 a8ee5e86cc7e322f7385af3e0cd579d7650d4dcfc3ce328acbf8b25515dd0672 at start and stop. The selected client was Genera on DIS-LOCAL-HOST, XID 4194310, at (72,55), 1200 by 900. The complete run and action records, licensed archive, debugger, VLM, compatibility preload, responder, configuration, sandbox, Xvfb, input and shutdown identities remain in the ignored session and are summarized in the Zmail evidence dossier and curated catalog.

The run reached the shutdown prompt, sent and had yes accepted, then observed cleanup progress before the known current-VLM cold-load mutex stall required bounded host termination. It is forced-stopped, not orderly; state_may_be_incomplete=true. The private world remained byte-identical, but that does not prove whether an in-guest Save World or checkpoint occurred; both remain unknown. No source semantic claim is derived from the shutdown result.

CADR visual boundary and blockers

The System 303-0 session zmail-dossier-20260718, generation 1, showed a System Menu Mail entry, but the band lacked the ZWEI:ZMAIL-FRAME flavor. Loading the maintained source stopped at the unsited AMS-BRIDGE-1 file-host/login dependency. Its ignored menu and error captures therefore show absence, not the application, and their older provenance is intermediate evidence. Publishing them would not make the ZMail layout more reconstructable.

TODO-SCREENSHOT-ZM-C303-ZMAIL requires a fresh disposable run which loads the exact maintained closure, uses an inert local host and synthetic Babyl mailbox, reaches :BOTH, and records a current-schema provenance join before one minimal image receives a separate four-factor review. TODO-SCREENSHOT-ZM-C303-DRAFT similarly requires a blank integrated :SEND or :REPLY state. Neither may display real correspondence or substantial Help prose.

No runnable System 46 band is currently available. TODO-SCREENSHOT-ZM-C46-COMPOSE requires entering (MAIL) with synthetic text, capturing the blank/template state, exiting with Control-], and proving draft retention without opening the request file. Until then its geometry and exact mode-line pixels are source requirements, not runtime claims. These explicit blockers satisfy the repository rule against silently shipping a visible-behavior page without a screenshot.

Selectable differences

Defaults are compatibility data. C303 begins in Both, uses 45 percent for summary, scrolls summary by 20 percent, moves forward after delete, deletes after filing, does not confirm expunge, enables background checks/saves, replies to all by default, and generates Message-ID/In-Reply-To. G85 begins in Both, discovers transport through the network-service framework, uses Ask for retransmission handling, permits background inbox completion/checks by default, and evaluates profile-selected menu, movement, reply and End behavior at invocation time. A profile file may change them; the runner MUST report pristine versus effective values.

Source-visible defects and deliberate strictness

The following are not silently repaired in strict compatibility:

• C46 command prose names Control-G to quit while the local mode table binds Control-]; the table wins and the inherited Control-G result remains a runtime oracle.
• C46 opens the request stream before discovering that To is empty, so a rejected draft can leave partial output.
• C303's status-slot comment uses two state names not used by executable code.
• A C303 message-header parse waiter sleeps for state T; if the owning parser unwinds and restores NIL, the waiter may never wake. Strict testing uses a watchdog; a safe extension may wake with a parse-failed condition.
• C303 filing precedes transport and is not rolled back, while visible and blind Chaos sessions and per-host direct sends can succeed independently.
• C303 Save All/expunge, inbox rename/delete, merge and foreground/background completion have the nontransactional boundaries specified above.
• G85 ordinary background work is LIFO despite a nearby source comment calling it FIFO. Only preload requests are appended FIFO.
• G85's active summary dispatcher remains the older TV blip code even though a disabled source block proposes Dynamic Windows conversion.
• The preserved G85 site's integrated Mail failure at DIS-SYS-HOST is a site dependency, not a product defect and not a transport failure.

A conforming implementation MAY expose corrected modes such as safe-header-wait, transactional filing or FIFO ordinary work. It MUST label them extensions and MUST NOT report their traces as strict historical results.

Genera 8.0–8.3 documented deltas retained by the 8.5 target

The selected 442.0 source follows a history of user-visible corrections. These notes are cross-checks, not alternate code to layer over the selected source:

No separate local 8.4 or 8.5 Zmail release-note/design paper was found. The absence is an evidence gap, not permission to attribute later behavior to an invented note. Where a note describes older behavior that conflicts with selected 442.0 source, strict G85 follows 442.0 and exposes the older result only as an optional historical comparison profile.

Semantic closure required at L2

ZM-C46-COMPOSE requires the selected dired.55 Mail section plus the exact System 46 Standard ZWEI parent graph incorporated from D05. Its dired.qfasl corroborates a compiled module but is not a decoded body oracle. The public snapshot does not supply a reader, transport daemon, Zmacs overlay or matching runnable band; none may be inferred into this closure.

ZM-C303-ZMAIL requires the exact 18-path system declaration in the evidence ledger. The closure includes a comment-only lmfile, active file/zmail, and method/resource-only cometh; excludes the commented PARSE, unselected lm.lisp, and every advertised transport provider not present in the tree. The separate ZM-C303-COMPOSE additionally requires the selected zwei/dired and Zmacs parent graph. The ZMail 50/System 94 manual is a comparison profile, never a substitute module. Maintained check-in 4df393c... includes later restoration/history and MUST be labeled maintained LM-3, not pristine 1983 media.

The historical Zmail system declaration's exact build closure is the 47-file manifest in the ledger: the 37-file application-core subset plus RTC, Converse, and all eight KBIN implementation files. Behavioral/conformance overlays may let a host clone omit or separately claim KBIN byte behavior, Converse integration, live transports, or other optional capabilities, but those switches do not rewrite the declared historical build graph or turn the 37-file analytical subset into its exact closure. Calendar may be omitted only below the full ZM-G85-ZMAIL L2 claim; every such L2 claim includes the mandatory Calendar subset defined above. The separate zwei/mail module is additionally required for ZM-G85-COMPOSE; the separately declared Mailer system is not. Dynamic Windows, TV, ZWEI, filesystem, process, network-service and selected adapter dependencies are external interfaces, not evidence of CLIM.

The exact 37-file analytical application-core manifest denominator is:

zmail/multiple-choice-menus.lisp
zmail/button-panes.lisp
zmail/mail-access-paths.lisp
zmail/local-mail.lisp
zmail/chaos-mail.lisp
zmail/smtp.lisp
zmail/parser-generator.lisp
zmail/lexer-generator.lisp
zmail/rfc822-date-time-parser.lisp
zmail/headers-parser-rfc822.lisp
zmail/headers-lexer-rfc822.lisp
zmail/definitions.lisp
zmail/top.lisp
zmail/window.lisp
zmail/fat-strings.lisp
zmail/headers.lisp
zmail/collections.lisp
zmail/mail-files.lisp
zmail/mailbox-pathnames.lisp
zmail/foreign-mail-file-formats.lisp
zmail/commands.lisp
zmail/references.lisp
zmail/mail.lisp
zmail/template.lisp
zmail/message-encryption.lisp
zmail/filter.lisp
zmail/universe.lisp
zmail/profile.lisp
zmail/undo.lisp
zmail/eco-commands.lisp
zmail/date-expressions.lisp
zmail/directory-mail.lisp
zmail/calendar.lisp
zmail/rule.lisp
zmail/digest.lisp
zmail/compile-flavor-methods.lisp
zmail/template-library.lisp

The declared 47-file build denominator adds:

io/rtc.lisp
zmail/converse/converse.lisp
zmail/kbin/level-1-defs.lisp
zmail/kbin/defs.lisp
zmail/kbin/trace.lisp
zmail/kbin/load-defs.lisp
zmail/kbin/load.lisp
zmail/kbin/dump-defs.lisp
zmail/kbin/dump.lisp
zmail/kbin/buffer.lisp

A manifest checker MUST report every path, selected version, byte count and hash; a digest without its member list is not an exact closure claim.

At L2, host implementations may rename functions, objects and errors while preserving the semantic protocols and all selected observable effects. No D08 level claims historical source/package/API compatibility. L3 means the preservation fidelity defined in the conformance-level table: preserved-system comparison, exact selected format bytes where included, timing-visible behavior, source-selected partial failures, live registry enumeration and closure of the claimed runtime oracles. A separate source-API compatibility project would need package/symbol, signature, multiple-value, special-variable, flavor-method, condition/restart, representation and load/patch inventories; it is outside this specification rather than silently being redefined as L3.

Binary, byte and network exclusions

No level here provides QFASL ABI, world-image, pointer layout, compiled instruction, raw Chaos/SMTP/Ethernet, Mailer queue, KBIN byte or pixel compatibility unless an optional overlay and test explicitly names it. Semantic format tests for public C303 formats MAY compare exact generated bytes. Licensed G85 golden bytes remain local and evidence-only. A clone can be behaviorally conforming without reading a VLOD or hosting a historical network.

Artifact, profile, and entry tests

Effective input and transient-context tests

Composer and draft tests

Reader, collection, and parser tests

Calendar and reminder tests

Storage, inbox, and persistence tests

Submission and background tests

Visual, rights, and provenance tests

CADR and LM-3

1. Verify Git 8e978d7..., Fossil 4df393c..., the chosen band/disk, emulator and all copied-source revision/tree identities independently.
2. Create a fresh named private Xvfb session. For C46, use a matching band if one is lawfully available; for C303, load the exact selected closure into a disposable System 303 session with inert local host mappings and synthetic Babyl mail.
3. Record each input intent and outcome. Do not configure external mail delivery; use the recording adapter or an isolated fake service.
4. Export pristine and effective comtabs, prefixes, menus, TV blips, profile/template additions and Help descriptions from the running system. Enumerate every domain rather than sampling familiar keys.
5. Run one semantic fixture at a time, capturing ordered state and file/service traces. Keep injected fault files and correspondence synthetic.
6. Join screenshot sidecars with run.json for the execution-time usim hash; never claim that old sidecars contain it. Stop cleanly where possible and retain forced_stop and state_may_be_incomplete exactly.
7. Keep raw payloads ignored. Curate only a minimal application state after an image-and-page review.

Genera

1. Verify all licensed input and tracked harness/helper hashes, then make a private working-world copy. Never write to the purchased base.
2. Launch only through the documented isolated harness: separate namespaces, read-only store/helpers/X socket, private writable runtime, no external route, disabled/live-absent MIT-SHM, exact fail-closed X request substitutions and one supervised local RFC 868 response.
3. Require every running marker, select/record the exact client and record each input intent before XTEST plus its linked outcome after dispatch.
4. Use only synthetic addresses/messages/files. For binding tests, export semantic names, owners, priorities and applicability without copying source or Help prose.
5. Compare source profile and world result side by side. A site failure, patch, presentation registry addition or world-resident command changes the runtime profile; it does not rewrite the clean-source contract.
6. Record shutdown prompt, confirmation, cleanup, stall and forced cleanup independently. Neither confirmation nor world hash change proves Save World or a checkpoint.
7. Keep every raw payload ignored and review each proposed still for its exact use.

Recorded runtime witnesses