Church Machine · ISA review

Church Machine — Full ISA approval draft
Church Machine · ISA review

Full instruction-format draft · 12 October 2026 · Confidential · Proposals are not implementation certification

Church Machine — Full ISA approval draft

12 October 2026 · Confidential · Consolidated instruction specification

Introduction — Fail-Safe Computer Science

The Church Machine's objective is no machine error undetected: detect failure promptly, contain its effects, and fail fast through the defined HardFault restart path rather than permit silent corruption. Integrated IDE diagnostics, reproducible fault evidence, rapid corrections and regression testing support continuous improvement in mean time between failures (MTBF). Restart alone is not a correction; telemetry must never delay restart.

Within a CM-Network, tight containment of data and function and atomic modularity are intended to form the Hard Crust of molten cyberspace: explicit authority boundaries that prevent a failed or compromised component from propagating damage beyond its authorized reach. The ambition is to address malware, ransomware, AI jailbreaks and the consequences of quantum-driven breakdown of today's cryptography through enforceable containment, verifiable execution and evolving cryptographic protection. These are engineering objectives, not a claim that this ISA alone eliminates every attack, detects every physical failure, or replaces post-quantum cryptography.

The ultimate goal is Fail-Safe Computer Science as industrial-strength technology for all digital media in the endless Information Age—making failure detection, containment, correction and measurable reliability foundations of digital infrastructure rather than optional additions.

1. Status and reading rule

This is the replacement reading copy for approval, not an addendum that requires the reader to assemble an ISA from old tables. It includes every active instruction and every opcode allocation. It does not certify the current assembler, simulator or hardware.

DECIDED identifies the owner's explicit decisions. BASELINE identifies retained instruction behavior. PROPOSED identifies concrete resolutions requiring approval. An unresolved drafting question is not permission to retire an existing instruction or arbitrarily make it fault.

All field tables in this document are complete 32-bit formats. New allocations and canonical-zero rules are PROPOSED unless explicitly marked DECIDED. They form one new, incompatible encoding profile; they must not be mixed with old binaries. The short name RED-FULL-DRAFT is a document identifier, not an allocated on-wire profile number.

The complete instruction-format proposal is below. Whole-ISA operational acceptance still requires the specific decisions in §16, especially LAMBDA's protected continuation ABI. These are disclosed approval issues, not hidden omissions or withdrawals of opcode 4 or 7.

2. Architectural rules

DECIDED

  • Instruction words, data words and GTs are 32 bits.
  • Addresses, offsets, NIA and method-table entries use words, not bytes.
  • CALL requires E. E cannot be combined with L or S.
  • Opcodes 8 (ELOADCALL) and 9 (XLOADLAMBDA) are retired.
  • Indexed CALL and indexed LAMBDA are forms of their original instructions.
  • CALL and RETURN inherit M on all System CRs. M is not a GT permission.
  • B is automatically cleared on the first CALL or RETURN.
  • RETURN clears eligible CRs by default; a true keep bit retains the current value. CR5, CR6 and CR12–CR15 are outside that mask. CR15 cannot be cleared. Keep-mask bit 10 is reserved.
  • Watchdog timeout is a HardFault, not an IRQ.
  • HardFault is an automatic restart. The machine never enters a terminal stopped state. Persistent faults produce a nonoperational tight restart loop.
  • Telemetry capture/delivery must neither interrupt nor delay restart.
  • Portable compilation and saving require no Namespace slot. Unresolved declared pet names may be saved and assigned to a Namespace for later authorized linking. Consuming an unresolved capability HardFaults.

BASELINE

There are sixteen CRs and sixteen DRs, numbered 0–15. DR0 always reads zero. A write to DR0 discards the result but does not suppress defined flag effects. CR5 is Thread-bound heap authority; CR6 is abstraction C-list authority; CR12 is Thread authority; CR14 is executable-code authority; CR15 is Namespace authority. CR13 remains a protected System CR; this draft assigns it no automatic IRQ/recovery role.

The C-list count is an unsigned eight-bit number of entries, not the last index. Count 0 has no rows; count 1 has row 0; count 255 has rows 0–254. The validity test is row < count.

PROPOSED common safety contract

All operand validity, generation, integrity, type, permissions, bounds and transition capacity checks complete before effects are committed. Address arithmetic is checked, never wrapped. A failed instruction does not retire, publish a partial write or create authority. HardFault then restarts; “no retirement” does not mean the machine remains halted.

An ordinary capability destination is CR0–CR4 or CR7–CR11. Structural CR5/CR6 are reconstructed by protected transitions. CR12–CR15 require the explicit System-register paths below. Indexed C-list access requires L; no implicit CR6 permission bypass is retained. Entering an abstraction derives an L-only CR6 view and an X-only CR14 view without adding L/S to its E-GT.

3. Decode and conditions

Except CALL and the proposed INDEX prefix, the common envelope is:

31         27 26       23 22       19 18       15 14                 0
+------------+-----------+-----------+-----------+-------------------+
| opcode (5) | cond (4)  | A (4)     | B (4)     | literal (15)      |
+------------+-----------+-----------+-----------+-------------------+

Here B is just a field label, not the GT Bind bit. Tables below give the meaning of every bit. 0 means required zero, not “ignored.”

cond Name Test
0 EQ Z
1 NE not Z
2 CS / HS C
3 CC / LO not C
4 MI N
5 PL not N
6 VS V
7 VC not V
8 HI C and not Z
9 LS not C or Z
10 GE N equals V
11 LT N differs from V
12 GT not Z and N equals V
13 LE Z or N differs from V
14 AL Always; default
15 NV Never; retained baseline

PROPOSED: validate structural encoding before testing the condition. A valid false-condition instruction performs no operand access or flag updates and advances to the next instruction. A malformed encoding HardFaults even with NV. CALL has no condition field or conditional suffix.

4. Complete opcode allocation

Decimal Binary Instruction Status
0 00000 LOAD Active
1 00001 SAVE Active
2 00010 CALL Active; revised allocation DECIDED
3 00011 RETURN Active; mask allocation PROPOSED
4 00100 CHANGE Active; used by boot and Thread handoff
5 00101 SWITCH Active
6 00110 TPERM Active; revised predicate allocation PROPOSED
7 00111 LAMBDA Active; indexed allocation PROPOSED
8 01000 Former ELOADCALL Retired, HardFault
9 01001 Former XLOADLAMBDA Retired, HardFault
10 01010 INDEX prefix New proposal, not previously approved
11–15 01011–01111 Reserved No instruction assigned
16 10000 DREAD Active
17 10001 DWRITE Active
18 10010 BFEXT Active
19 10011 BFINS Active
20 10100 MCMP Active
21 10101 IADD Active
22 10110 ISUB Active
23 10111 BRANCH Active
24 11000 SHL Active
25 11001 SHR Active
26–29 11010–11101 Reserved No instruction assigned
30 11110 WORD/data marker Not executable
31 11111 LUMP header marker Not executable

Executing a retired, reserved or data/header opcode HardFaults. Declared data words can contain any 32-bit pattern; they become instructions only if fetched as executable code, which must remain within the executable region.

5. Capability memory: LOAD and SAVE

Instruction 31:27 26:23 22:19 18:15 14:8 7:0
LOAD 0 cond CRd CRs 0 row
SAVE 1 cond CRdest CRvalue 0 row

row is 0–254; 255 is invalid for these two instructions, not a direct marker. Both instructions necessarily address a C-list row.

LOAD CRd, CRs, #row: require valid L authority on CRs, validate the row and selected GT, then load the descriptor into an ordinary destination CR. It grants no permission absent from the selected GT and does not elevate M.

SAVE CRdest, CRvalue, #row: require S on the destination authority and B=1 on the source GT. Validate mutable destination storage, generation, type and bounds before storing. SAVE cannot write immutable portable artifact bytes, private Thread context or protected Namespace fields through ordinary C-list authority. It does not itself clear source B.

Both gain register-supplied rows through §13.

6. CALL

DECIDED format

Bits Width Meaning
31:27 5 Opcode 2
26:23 4 index[7:4]
22:19 4 CRs
18:15 4 index[3:0]
14:0 15 Unsigned method selector 
index = (word[26:23] << 4) | word[18:15]

Index 0–254 selects a C-list GT through CRs. Index 255 selects the GT directly in CRs. Explicit 255 and an omitted index are identical direct mode. Neither addresses row 255. CALL is unconditional regardless of the index.

CALL CR2, #0
CALL CR2[#255], #0       ; exactly the same encoding
CALL CR6[#0], #1         ; C-list row 0, method 1

The source C-list requires L when indexed; the selected target requires E and may not combine E with L/S. Resolve into internal state, not a visible scratch register. Validate the target abstraction, entry and full stack capacity before committing.

Method 0 enters word 1. Method n>0 reads the declared table's nth word, whose value is a LUMP-relative word offset. Validate the table index and executable destination. Zero/private entries, the header or a non-code offset HardFault. There is no byte multiplication in architectural addressing.

Push the canonical CHURCH continuation; derive CR6 and CR14; retain other live CR/DR values except defined B clearing. CR5 remains Thread-bound. System-CR M bits are inherited independently of descriptor reconstruction. The register-index proposal in §13 changes only target selection, not the 15-bit method selector or entry transition.

PROPOSED B scope: clear B in live ordinary CR GTs and the entered/restored E authority at successful CALL/RETURN commit, including normalized saved Enter GTs. Do not rewrite C-list storage or immutable artifacts. No clear of CR12–CR15 descriptors or M bits is implied. This scope needs approval; automatic first-CALL/RETURN B clearing is already DECIDED.

7. RETURN

Bits Width Meaning
31:27 5 Opcode 3
26:23 4 cond
22:12 11 0
11 1 Reserved 0
10 1 Reserved 0, DECIDED
9:5 5 Keep CR11, CR10, CR9, CR8, CR7
4:0 5 Keep CR4, CR3, CR2, CR1, CR0

Default mask is zero. A set bit retains the current descriptor, not a hidden caller snapshot. A clear bit clears that descriptor. Legal masks are 0–0x3FF. CR5, CR6 and CR12–CR15 are excluded.

Validate the entire protected frame and resume authority/NIA before popping or clearing. Restore saved indicators, reconstruct CR6/CR14 for a CHURCH return, retain DRs and Thread/System state, and inherit System-CR M. CR15 is never cleared. Apply B clearing at successful commit.

An empty, sentinel or corrupt return frame is a HardFault and thus an automatic restart—not a successful return-to-boot operation.

§13 proposes an indexed, DR-supplied keep mask. It does not permit selecting an arbitrary stack frame or bypassing protected return authority.

8. CHANGE and SWITCH

CHANGE is opcode 4 and remains active. The old draft's proposed withdrawal of CHANGE is removed. Boot already uses CHANGE CR12, CR15, #1.

Instruction 31:27 26:23 22:19 18:15 14:8 7:0
CHANGE 4 cond CRd CRs 0 index
SWITCH 5 cond CRd CRs 0 index

PROPOSED unified selection: 0–254 select a C-list row, requiring L on CRs. 255 uses CRs directly. Existing three-operand CHANGE/SWITCH syntax is retained; direct syntax omits the row or explicitly uses 255.

CHANGE — protected installation and Thread handoff

CRd must be CR12–CR15. L on the source is not sufficient to authorize an isolated-register change. PROPOSED: require destination M latched at acceptance and consume it on successful commit, consistently with SWITCH. Namespace/boot control must explicitly provide that authority; no hidden boot exemption. This is a security-policy proposal, not a claim about the current boot implementation.

CHANGE to CR12 validates and installs a Thread through the full handoff protocol in §14. CR13–CR15 retain protected installation semantics, not automatic IRQ dispatch. CR13 must receive a valid descriptor for its assigned system role; CR14 must receive valid X code authority; CR15 must receive a Namespace descriptor. Changing CR14 uses its valid first executable word as the new NIA. These target-type rules are PROPOSED.

A CR12 self-selection is a validated no-op on Thread state, but consumes the explicit M authorization. Non-self selection validates incoming and outgoing state before committing either. It never overwrites an unowned reset bank's nominally selected dormant Thread.

SWITCH — isolated descriptor replacement

CRd must be CR12–CR15, with M=1 latched at acceptance. Ordinary indexed sources are CR0–CR11; no CR6 L bypass. Validate selected descriptor and destination role, then replace the descriptor and clear destination M. No implicit Thread save/restore or fault recovery occurs.

PROPOSED distinction: SWITCH may replace CR12 only before live Thread ownership exists; use CHANGE for an owned Thread handoff. SWITCH CR14 must retain a valid current NIA under the replacement X authority; otherwise fault. Changing CR15 does not rewrite other capabilities or their generations. This closes unsafe raw descriptor replacement while preserving both opcodes.

§13 supplies a runtime index without using a new fused CHANGE/SWITCH opcode.

9. TPERM

PROPOSED read-only predicate format

Bits Width Meaning
31:27 5 Opcode 6
26:23 4 cond
22:19 4 Tested CR / indexed source C-list CR
18:15 4 Direct reference CR for EXACT; otherwise 0
14:7 8 index: 0–254 row; 255 direct
6:4 3 0
3:0 4 Predicate

Only the tested operand is indexed. EXACT's reference is a direct CR. No fifth predicate bit is needed: E and B are independent tests, and EB is not an instruction modifier.

Code Predicate Defined successful-query result
0 VALID Valid selected GT → true
1 R Permission set equals R
2 RW Permission set equals RW
3 X Permission set equals X
4 RX Permission set equals RX
5 RWX Permission set equals RWX
6 L Permission set equals L
7 S Permission set equals S
8 E Permission set equals E
9 LS Permission set equals LS
10 B Bind is set
11–12 Reserved HardFault
13 FRAME A genuine continuation exists
14 EXACT Both validated 32-bit GT words are equal
15 Reserved HardFault

Permission comparisons exclude B and M. Same-domain unequal valid operands give false; cross-domain permission requests HardFault. Invalid, NULL, unresolved or inaccessible operands HardFault, including under VALID. PROPOSED flags: Z=result, N=not result, C=V=0.

FRAME uses tested CR=0, reference CR=0, index=255; it reads protected stack state, not a GT. Empty/sentinel gives false; corrupt context HardFaults. This does not promise that RETURN's independent caller checks will pass.

TPERM does not mutate permissions, attenuate authority, or clear B. Historical CLEAR/EB/offset-check/attenuation spellings must not be silently reinterpreted. The removal of historical attenuation is an explicit approval item in §16.

10. LAMBDA

BASELINE: apply X-authorized code using the caller's capability scope; do not switch the caller's C-list as CALL does.

PROPOSED format

Bits Width Meaning
31:27 5 Opcode 7
26:23 4 cond
22:19 4 Target CR / indexed source C-list CR
18:15 4 0
14:8 7 0
7:0 8 index: 0–254 row; 255 direct 
LAMBDA CR2               ; index 255
LAMBDA CR6[#3]           ; fetch X-GT from row 3

Indexed selection requires L; selected code requires X and a valid executable entry. Preserve caller scope and System M. Enter the first executable word of the selected code region, never a LUMP header. Normal RETURN unwinds its protected continuation. Opcode 9 is not used.

Specific operational approval issue: an arbitrary cross-object LAMBDA must preserve both the caller's scope authority and return-code authority. The existing one-word saved indicator cannot alone represent both when code and scope differ. A host-only return-PC cache is not an architectural solution. Before whole-ISA acceptance, choose a versioned protected LAMBDA frame or explicitly approve a same-code-object restriction. Neither choice is silently made here; LAMBDA remains allocated and its established behavior is not declared invalid merely because this reconciliation is incomplete.

11. Data access and bit operations

DREAD / DWRITE — opcodes 16 / 17

Bits Meaning
31:27 16 for DREAD; 17 for DWRITE
26:23 cond
22:19 DR destination (read) / value (write)
18:15 CR data authority
14 Mode I
13:0 when I=1 Unsigned immediate word offset
13:4 when I=0 Unsigned ten-bit base
3:0 when I=0 DR index register

I=1: offset=literal[13:0], range 0–16383. I=0: offset=base+unsigned(DRx); checked addition, no truncation.

DREAD requires R and returns one 32-bit word. DWRITE requires W and writes one word. Require valid data-region or explicitly authorized word-I/O authority. Offsets must stay in its region; data access cannot bypass Thread-private or Namespace protection. Flags are unchanged.

BFEXT / BFINS — opcodes 18 / 19

Bits Meaning
31:27 18 for BFEXT; 19 for BFINS
26:23 cond
22:19 DRd
18:15 DRs (not a CR)
14:10 0
9:5 Least-significant bit position
4:0 Width

PROPOSED: widths 1–31; width 0 reserved. Require lsb+width <= 32. BFEXT zero-extends the selected DRs bits into DRd. BFINS copies the low width bits of DRs into DRd at lsb, preserving all other DRd bits. Read both operands before writeback, including when they name the same DR. Flags unchanged. §13 supplies a register-indexed bit position.

12. Arithmetic, comparison and branch

MCMP — opcode 20

31:27 26:23 22:19 18:15 14:0
20 cond DRleft DRright 0

Compute left-right for NZCV only; write no DR. §13 proposes runtime selection of the right DR from the DR bank, not an unauthorized memory read.

IADD / ISUB — opcodes 21 / 22

Bits Meaning
31:27 21 / 22
26:23 cond
22:19 DRd
18:15 DRleft
14 I: immediate selector
13:0 when I=1 Signed 14-bit literal (−8192…8191)
13:4 when I=0 0
3:0 when I=0 DRright

Add/subtract and write the low 32 bits. Set N from bit31, Z for zero, C for addition carry/subtraction no-borrow, V for signed overflow. Arithmetic wrap is defined; capability/address arithmetic must still be checked separately. Register form already provides runtime operand selection.

BRANCH — opcode 23

31:27 26:23 22:19 18:15 14:0
23 cond 0 0 Signed word displacement

Range −16384…16383. Target is current instruction NIA plus sign-extended displacement, not next NIA plus displacement. Validate under current CR14 X authority and executable-region boundaries. Flags unchanged. §13 proposes a full signed 32-bit register displacement.

SHL / SHR — opcodes 24 / 25

Instruction 31:27 26:23 22:19 18:15 14:6 5 4:0
SHL 24 cond DRd DRs 0 0 amount
SHR 25 cond DRd DRs 0 A amount

Amounts 0–31. SHL shifts left, truncating to 32 bits. SHR A=0 is logical zero-fill; A=1 is arithmetic sign-fill. Amount zero copies the source. Flags unchanged. §13 supplies a runtime bit-position index/shift amount.

13. ISA-wide register-index option — explicit new proposal

The approved direction is indexed options throughout the ISA. CALL's decided word has no remaining room for a mode bit plus a DR selector while retaining its full method field. PROPOSED resolution: reserve opcode 10 as a single INDEX prefix rather than steal CALL method bits, revive opcodes 8/9, or change every existing base format.

This proposal is not yet approved and is not claimed to be implemented. “Index” retains the natural operand meaning per instruction; it does not turn every arithmetic instruction into a C-list memory operation.

Prefix bits Meaning
31:27 Opcode 10
26:23 14 (fixed marker, not a separate condition)
22:19 DRx providing the runtime value
18:0 0

INDEX DRx followed by one active base instruction is one indivisible two-word instruction. Prefix+body fetch, validation and commit are atomic. No intervening retirement, Thread selection or transfer is permitted. Nested prefixes, a prefix without a body, or a non-active body opcode HardFault. Body condition governs the pair; CALL remains unconditional.

The instruction address is the prefix address. Fall-through and saved next NIA are prefix NIA+2; branch displacement is relative to the prefix. No control transfer may land on a body word. PROPOSED: the admitted code image supplies a verified instruction-boundary map, computed from code sections before execution; not guessed from preceding runtime data words. This map and profile admission are prerequisites for this extension.

DRx is sampled from the pre-instruction state. The body field being replaced must encode zero as specified below, preventing two conflicting indices.

Body Runtime value from DRx Canonical zero field in body Checks
LOAD C-list row row 0–254, then row<count
SAVE Destination C-list row row 0–254, then row<count
CALL Target selector Both split index nibbles 0–255; 255 direct; method unchanged
RETURN Keep mask mask 0–0x3FF; no stack-frame indexing
CHANGE Target selector index 0–255; 255 direct
SWITCH Target selector index 0–255; 255 direct
TPERM Tested-operand selector index 0–255; EXACT reference unchanged
LAMBDA Target selector index 0–255; 255 direct
DREAD Effective word offset Entire literal Unsigned 32-bit offset; bounds checked
DWRITE Effective word offset Entire literal Unsigned 32-bit offset; bounds checked
BFEXT Bit position lsb 0–31; position+encoded width<=32
BFINS Bit position lsb Same
MCMP Right-hand DR number DRright 0–15; read that pre-instruction DR
IADD Right arithmetic operand Entire literal Full 32-bit value
ISUB Right arithmetic operand Entire literal Full 32-bit value
BRANCH Signed displacement displacement Signed 32-bit; target bounds checked
SHL Shift amount amount 0–31
SHR Shift amount amount 0–31; retain encoded A

No high-bit truncation is allowed. TPERM FRAME with INDEX requires DRx=255, tested/reference CR fields zero and encoded selector zero; without INDEX its selector is 255. The same FRAME predicate is used.

This supplies a complete encoding proposal for runtime indexing of all active instructions, including RETURN's mask and MCMP's operand selection. It is not an implicit capability-indexing prefix for DREAD/DWRITE: obtain that data capability through an authorized LOAD first.

14. Continuations, Thread ownership and restart

Retained canonical CHURCH frame

Word Content
frame top − 1 Normalized caller E-GT, B cleared
frame top FLAGS[31:28], NIA[27:13], prior SZ[12], prior STO[11:0]

FLAGS order is NZCV. NIA is a caller-relative word offset of the next instruction (including a prefix pair's length). Validate all represented ranges before push. Store the prior indicators, then install the new SZ/STO. A CHURCH frame is two words; no hidden caller CR snapshot or host return-PC cache replaces it.

Thread private layout retains DR homes, protected indicator at +17, Heap starting at +18, size-derived private Stack and CR homes. The protected indicator has the same FLAGS/NIA/SZ/STO packing. It is not exposed through ordinary CR5 heap authority. Do not add a separate executable-identity word to a Thread body.

On CHANGE into a Thread:

  1. Validate the complete incoming object, geometry, authority and saved frame.
  2. If no Thread owns the live reset bank, do not save it into the dormant selected Thread. Selection is not ownership.
  3. If owned, validate space and suspend the outgoing Thread using the canonical CHURCH frame and its existing CR/DR homes.
  4. Restore incoming homes and protected context, rederive CR5, and reconstruct executable authority through RETURN-equivalent validation.
  5. Publish ownership only after the complete transition succeeds.

LAMBDA's cross-object continuation and suspension while code/scope differ must be resolved consistently with this ABI, as disclosed in §10/§16. The existing two-word CHURCH frame is not silently enlarged by this draft.

HardFault abandons the failed operation and starts the reset/boot path automatically. Fault telemetry is best-effort and never gates restart. Reboot initializes an unowned live bank and empty protected stack indicators; it does not misidentify retained RAM as a current suspended owner. There is no fault-injected IRQ, CALL, CHANGE, instruction skip, lazy-resolution wait or operation-level retry. A persistent cause loops through restart.

15. Assembly, portable artifacts and compatibility

Pet names are symbolic C-list references, not capability-register spellings or authority by themselves. Code labels are lexical instruction addresses, not capability names. Comments do not declare capabilities or labels.

An unresolved declared pet name does not block Compile, Save Lump or storage in a target Namespace. Compile does not save. Authorized linking supplies destination-local GTs in a destination copy; the portable artifact retains symbolic identity. Consumption before valid binding HardFaults.

Files serialize words big-endian. Transport bytes do not change ISA word units. Header/data words and method-table words are not executable regions.

PROPOSED pseudo-instructions: NOP is BRANCH #1 (AL), a true no-effect fall-through. Do not use all-zero LOAD as a purported universally safe NOP. HALT has no machine-stop encoding and should be rejected rather than imply the machine stops. WORD emits data, not an executable instruction.

Old CALL AL/zero encodes indexed row 224 in the new format, not direct CALL. Old TPERM, RETURN, LAMBDA and other changed canonical fields must also be reassembled. No automatic old-binary reinterpretation is permitted. Before release, allocate a real profile identifier and bind it to artifacts, loader admission, continuation ABI and instruction-boundary maps. Reject unsupported profiles before application execution; HardFault restarts.

16. Approval decisions and acceptance evidence

Already decided — do not reopen accidentally

Word units; E without L/S for CALL; opcode 8/9 retirement; unconditional split-index CALL; explicit/implicit 255 direct CALL; M inheritance; automatic B clearing; RETURN default-clear/exclusions and reserved bit10; CR15 retention; watchdog HardFault; automatic restart without telemetry gating; slotless portable saving. CHANGE remains allocated at opcode 4.

Concrete proposals awaiting approval

  1. Register indexing: opcode 10 INDEX and two-word instruction boundaries (§13), versus a different explicit extension allocation. No existing instruction is withdrawn while this is reviewed.
  2. CHANGE/SWITCH: unified direct marker, exact M authorization and consumption, Thread ownership distinction and destination-type checks (§8).
  3. TPERM: read-only semantics, B preset10, VALID fault boundary, EXACT reference field, flags, and removal of legacy attenuation (§9).
  4. RETURN/B: physical ten-bit keep mapping and precise B-clearing scope.
  5. Common details: L-only CR6/no L bypass, ordinary destination restrictions, NV retention, reserved-field validation order, bitfield width0, NOP/HALT spelling, indexed boundary map and profile admission.

Operational contract still requiring resolution

LAMBDA: select and fully specify a protected continuation ABI for distinct scope/code identities, including nested LAMBDA, CALL from LAMBDA, RETURN and Thread suspension. Alternatively, explicitly approve a same-code-object restriction. This draft supplies its full direct/indexed instruction format but does not falsely claim that the unresolved continuation contract is settled.

System boot contract: bind restart to the selected boot image/profile and document how boot obtains initial System M and validates CR13's assigned role. The proposed M rule must not make the existing boot CHANGE impossible.

Required conformance evidence after approval

  • Independent encoding/decoding vectors for all 18 active opcodes, every condition, field boundary and reserved-bit rejection.
  • CALL direct=explicit255 equality, rows0/254, method0/1/32767, runtime index overflow, flag independence and no old-AL compatibility guess.
  • RETURN every keep bit, reserved10/11 rejection, CR15 retention, M inheritance and B clearing across save/restore.
  • CHANGE unowned reset bank, first ownership, repeated handoffs, self-selection, failed incoming validation and full outgoing canonical frames.
  • TPERM independent E/B and EXACT direct/indexed operands; invalid operands fault rather than turn into unauthorized probes.
  • INDEX atomic fetch/retirement, body-entry rejection, false conditions, signed branch bounds and every per-instruction runtime range.
  • HardFault restart with unavailable telemetry, persistent-fault looping and no accidental ownership of retained Thread bytes.

Approval scope: approve the decided rules and each named proposal explicitly. A complete opcode/format inventory is not a claim of whole-ISA semantic approval, implementation alignment or physical-board verification.

Comments

Post a Comment