ZMail named-command effect closure

Status and reconstruction claim

This companion closes the named-command surface of the ZMail and mail-composition reimplementation specification (D08): a conforming implementation of the selected source profiles MUST implement each of the 86 System 303 definitions and each of the 152 Genera 8.5 completion candidates exactly once, with the application-owned ordering and failure boundary listed below. This is a semantic and source-profile contract. It is not evidence that the commands were resident in the tested System 303-0 band, nor that the preserved Genera 8.5 world has no site, patch, profile, or user additions.

Compatibility boundary: source-profile semantic command compatibility, plus behavioral compatibility only for rows whose effect traces pass the conformance suite. Excluded and reserved claims: this page does not claim loaded-world identity, downstream service reimplementation, public or historical Lisp API compatibility, file or binary compatibility, timing, or visual identity.

The Genera descriptions are original analysis. They disclose names needed to identify the interface, source identities, concise behavior, and test obligations; they do not reproduce proprietary source bodies or documentation. Licensed inputs remain local.

Normative vocabulary and scope

MUST, MUST NOT, SHOULD, and MAY are normative. “Then” gives observable order; it does not imply atomicity. “Prompt” includes the source's minibuffer, menu, or query interaction. Unless a row says otherwise, abort while choosing an operand precedes the first application mutation, but an error after the first listed mutation retains completed effects. The command loop's preflight and recovery contract remains D08's foreground command transaction.

The tables cover the named top-level completion registries. Direct generic ZWEI bindings, integrated-draft-only commands, transient task buttons, TV blips, Dynamic Windows translators, and separate Zmacs Mail mode are closed by D08's complete effective input and gesture trees, not counted again here.

Visible layout and the two reviewed runtime images are incorporated from D08's visible-interface evidence. This command-effect companion adds no decorative or payload screenshot.

Compatibility profiles and closure levels

This companion inherits D08's C303 and G85 release profiles and its L1, L2 and L3 ladder. Matching the static denominator and tuples supports the L1 interface/data claim. The complete command-effect tests below are required for the source-profile behavioral L2 claim. The two preserved-runtime oracles are required only for the corresponding L3 preserved-system claim; leaving them open does not silently demote source-closed L2 behavior. This page does not claim public API, historical-source, file-format, binary, timing, or pixel compatibility.

Command architecture and ownership model

Every completion candidate is an application adapter around D08 state plus, where listed, a delegated editor, file, network, print, compiler, distribution, encryption, or submission service. Dispatch first applies wrapper preconditions, then the command-owned operand and button logic, then ordered model and adapter effects, and finally returns a redisplay/result indication. The tables specify that chain without turning downstream services into ZMail-owned implementations.

System 303: all 86 definitions

The order here is deterministic source-path and source-offset order. Humanized names are the exact completion names produced by the selected naming rule.

Genera 8.5: all 152 completion candidates

This denominator is the clean selected source closure, not merely a grep count. It includes the 147 ordinary ZMail macro forms, the three separately loaded ECO forms, the package-qualified KBIN reparse form, and the printer command adopted into ZMail. The source's internal Save and Expunge synonym functions copy existing command names and therefore do not add completion candidates.

High-risk command contracts

These rules expand rows where a command name or manual gloss hides ordering that a reimplementation can easily get wrong. They are normative for the stated source profile.

Denominator construction and generated validation

The denominator was produced by inert parsing; no historical form was evaluated. For C303, the parser walks top-level lists in the active unversioned source files, normalizes the macro head case-insensitively, and selects exactly the 86 definitions in comnds, filter, mail, mfiles, profil, and window. This catches the lowercase View Original Header form that an uppercase anchored grep misses. Patch files and old numbered siblings are excluded from the clean-source denominator.

For G85, the same parser walks the selected physical source versions from the exact declared build-source manifest. Its set equation is:

147 ordinary zmail DEFINE-ZMAIL-TOP-LEVEL-COMMAND forms
+ 3 eco-commands forms loaded as the ECO extension
+ 1 package-qualified kbin/buffer reparse form
+ 1 externally defined printer command explicitly adopted into ZMail
= 152 completion candidates

For an independent transcription check, encode each table row in profile/ID order as UTF-8 ID, tab, trimmed completion name, tab, trimmed literal Markdown source-owner cell, newline. The 238-record stream is 13,095 bytes and has SHA-256 f8583a50211bee3642c064ec12a53f8eee5da9732275277de0a7d299ab9a04df.

The font-change escape surrounding Set Key is removed only from its identifier; the source bytes are otherwise not normalized. The two compatibility synonym forms for Save and Expunge map to existing completion names and add zero. Humanization uses the profile's command-name constructor; the G85 constructor expands Msg/Msgs to Message/Messages, while the C303 table retains its selected names.

After each edit, a document-side checker MUST enforce all of the following:

1. IDs are exactly C303-001 through C303-086 and G85-001 through G85-152;
2. every ID and completion name is unique within its profile;
3. each source-produced tuple (profile, completion-name, physical-path, line) has one row and no row lacks such a tuple, except the explicitly two-owner adopted printer row;
4. the Set Key, ECO, KBIN, printer-adoption, lowercase-C303, and synonym cases produce the arithmetic above; and
5. each row has nonempty family, effect, applicability, failure, and normative-owner cells.

The following rights-safe check validates the finite document shape. Source-to-row comparison MUST additionally use the inert extractor and licensed inputs locally; the licensed source is not copied into a test fixture.

import re
from pathlib import Path

text = Path("docs/zmail-command-effect-closure.md").read_text()
for profile, expected in (("C303", 86), ("G85", 152)):
    rows = re.findall(
        rf"^\\| ({profile})-(\\d{{3}}) \\| ([^|]+) \\| ([^|]+) \\|"
        rf" ([^|]+) \\| ([^|]+) \\| ([^|]+) \\| ([^|]+) \\| ([^|]+) \\|$",
        text,
        re.MULTILINE,
    )
    assert [int(row[1]) for row in rows] == list(range(1, expected + 1))
    assert len({row[2].strip() for row in rows}) == expected
    assert all(all(cell.strip() for cell in row[2:]) for row in rows)

Command-effect conformance suite

Each test records profile, exact source identities, pristine versus mutated table state, fixture, input/button/numeric state, ordered trace, result, cleanup, and base artifact immutability. Real mail delivery, restoration, printing, and destructive filesystem actions are outside the safe preserved-system oracle; fakes are normative for effect order.

Known unknowns, runtime oracles, and nonclaims

TODO-RUNTIME-ZM-CMD-01: after a disposable CADR file host makes the selected System 303 ZMail sources loadable, enumerate the live completion alist, compare all 86 names, and exercise one harmless representative of every family in a synthetic temporary mailbox. The current 303-0 observation found the program advertised but not resident, so source closure is not mislabeled as loaded-band closure.

TODO-RUNTIME-ZM-CMD-02: in a disposable licensed Genera private world, enumerate the clean effective completion registry before and after profile/init processing and compare the 152-name baseline. Exercise read-only commands and reversible synthetic message mutations through the Genera harness. Do not invoke real ECO restore, external submission, printing, arbitrary compilation/loading, or real cryptographic material. This oracle distinguishes clean source, compiled-world, and user/site registry state; until it runs, every G85 row remains source-established.

This page does not claim exact callable Lisp signatures, binary identity, timing, pixels, downstream printer/compiler/distribution/network behavior, or security of historical encryption. A command delegated to another dossier is closed here only at the explicitly stated ZMail adapter boundary.

Sources

• LM-3 System 303 pinned public zmail/comnds.lisp, filter.lisp, mail.lisp, mfiles.lisp, profil.lisp, and window.lisp.
• Licensed local Genera System 452.1 / Zmail 442.0 sources named in every G85 row; exact sizes and hashes are retained in D08 and the Genera application study.
• Symbolics, Editing and Mail, Genera 8, used as intended-behavior cross-check, not as the command denominator.
• Richard Stallman, ZMail Manual, first edition, April 1983, used as a System 303 intended-behavior cross-check.

Last verified: 2026-07-19.