proof/: all 23 Isabelle theory files now verify under Isabelle2025-2
Isabelle toolchain replaced (was genuinely 2011, 14+ years stale) and every theory file fixed to actually compile -- most had apparently never been checked under a working Isabelle at all. Fixed the vm_state self-reference in StarForth_Base.thy properly (word_table is now a free-standing global constant, not a circular record field), corrected the word_physics_transparent axiom (was claiming full state equality from mere exec-equivalence, provably too strong), and worked through 14 years of HOL-Library drift plus several missing-hypothesis bugs across the physics-loop and ACL theories. Two genuine (non-tactical) bugs found and left oops-flagged rather than silently resolved: forth_roll's index arithmetic disagrees with both its own test lemma and the real C ROLL implementation (three-way inconsistency), and pm_wf isn't actually preserved by pm_record_hit/pm_record_miss. Both need a decision, not a proof-script fix. Full writeup in FABRIC-2.md item 5.2.
This commit is contained in:
Robert Allan James
+42
-21
@@ -135,8 +135,9 @@ record dict_physics =
|
||||
(* ── Dictionary entry ────────────────────────────────────────────────────── *)
|
||||
(* ○ CODE-MUST-MATCH: struct DictEntry in include/vm.h
|
||||
⚠ HUMAN-REVIEW: The C DictEntry stores a function pointer (word_func_t func).
|
||||
This has been moved to word_table (a top-level vm_state field) to avoid the
|
||||
type circularity vm_state → vm_state inside dict_entry.
|
||||
This has been moved to word_table, a free-standing global constant declared
|
||||
after vm_state (see "Word semantics table" section below) -- not a
|
||||
vm_state field at all, which is what actually avoids the type circularity.
|
||||
Implementors: the C code must maintain a SEPARATE lookup table indexed by
|
||||
word_id that maps to word_func_t pointers — this is what word_table models.
|
||||
The dict_entry record here has no func field; look it up via word_table. *)
|
||||
@@ -301,7 +302,9 @@ record inference_outputs_state =
|
||||
□ dictionary / latest_id / here / dict_fence — dictionary state
|
||||
□ dict_lock / word_id_next — dict management
|
||||
□ vm_mode / vm_ip / state_var / vm_base / vm_error / vm_halted
|
||||
□ word_table — function pointer table (C: per-DictEntry func ptr)
|
||||
□ word_table — NOT a field of this record; see the
|
||||
free-standing "consts word_table" declaration after this record,
|
||||
function pointer table (C: per-DictEntry func ptr)
|
||||
□ heat_threshold_25th/50th/75th / last_bucket_reorg_ns / lookup_strategy
|
||||
□ rolling_window — all sub-fields including rw_act_window
|
||||
□ decay_slope_q48 / last_decay_check_ns / total_heat_at_check / ...
|
||||
@@ -358,20 +361,6 @@ record vm_state =
|
||||
vm_error :: bool
|
||||
vm_halted :: bool
|
||||
|
||||
(* ── Word semantics table ───────────────────────────────────────────── *)
|
||||
(* ⚠ CRITICAL DESIGN NOTE: The C DictEntry stores word_func_t func, a function
|
||||
pointer per word. Putting (vm_state ⇒ vm_state) inside dict_entry inside
|
||||
vm_state creates a circular type in HOL. SOLUTION: the word function table
|
||||
is a TOP-LEVEL field of vm_state, indexed by word_id.
|
||||
|
||||
○ CODE-MUST-MATCH: C implementors must maintain a PARALLEL array (or map)
|
||||
from word_id → word_func_t that is logically equivalent to this field.
|
||||
The dict_entry.func pointer in C can remain, but the proof framework
|
||||
treats word_table as the authoritative semantic specification.
|
||||
⚠ HUMAN-REVIEW: Verify that for every word_id i, word_table i matches
|
||||
exactly the behavior of the corresponding word_func_t function. *)
|
||||
word_table :: "nat \<Rightarrow> vm_state \<Rightarrow> vm_state"
|
||||
|
||||
(* ── Physics Loop #1: Execution heat tracking ───────────────────────── *)
|
||||
(* ○ CODE-MUST-MATCH: heat_threshold_{25th,50th,75th} in C VM struct.
|
||||
⚠ HUMAN-REVIEW: Thresholds are recomputed periodically by the heat bucket
|
||||
@@ -439,6 +428,32 @@ record vm_state =
|
||||
non-interference proof breaks. Verify in the SSM implementation. *)
|
||||
ssm_l8 :: ssm_l8_state
|
||||
|
||||
(* =========================================================================
|
||||
Word semantics table — deliberately NOT a vm_state field.
|
||||
|
||||
CORRECTED 2026-08-13: the original design put word_table inside vm_state
|
||||
with type "nat \<Rightarrow> vm_state \<Rightarrow> vm_state" -- self-referential (vm_state
|
||||
naming itself in its own field's type) and rejected by every Isabelle
|
||||
version, not just this one; HOL records have no fixed-point support. The
|
||||
file's own prior comment claimed hoisting it to a "top-level field of
|
||||
vm_state" solved the circularity -- it does not: the field's type still
|
||||
names vm_state before vm_state exists.
|
||||
|
||||
Fix: word_table is a free-standing, uninterpreted global constant,
|
||||
declared here AFTER vm_state so there is no forward reference. This is
|
||||
also more faithful to the C reality it models -- word_func_t dispatch is
|
||||
a fixed table built once at compile time, not per-VM-instance mutable
|
||||
state, so it never belonged inside vm_state's record in the first place.
|
||||
Individual word_id entries are characterised by axioms in the per-word
|
||||
theories (StarForth_Arithmetic_Words.thy etc.), not defined here.
|
||||
|
||||
○ CODE-MUST-MATCH: C implementors maintain the word_id \<rightarrow> word_func_t
|
||||
dispatch table this constant models. See StarForth_Transition.thy's
|
||||
word_physics_transparent axiom for the one property assumed of it: word
|
||||
execution depends only on the exec-visible fields (data_stack,
|
||||
return_stack, memory), never on physics state. *)
|
||||
consts word_table :: "nat \<Rightarrow> vm_state \<Rightarrow> vm_state"
|
||||
|
||||
(* =========================================================================
|
||||
Section 5: Well-formedness, error signalling, capacity predicates
|
||||
======================================================================== *)
|
||||
@@ -515,7 +530,10 @@ definition rs_full :: "vm_state \<Rightarrow> bool" where
|
||||
(* ⚠ CENTRAL CORRECTNESS MECHANISM:
|
||||
HOL record-update syntax vm⦇data_stack := xs⦈ proves that EVERY field
|
||||
not mentioned in the update (rolling_window, heartbeat, decay_slope_q48,
|
||||
pipeline_metrics, dictionary, word_table, etc.) is EXACTLY unchanged.
|
||||
pipeline_metrics, dictionary, etc.) is EXACTLY unchanged. word_table is
|
||||
not in this list since 2026-08-13 -- it is no longer a vm_state field at
|
||||
all (see above), so its independence from any vm_state update is true by
|
||||
construction, stronger than a per-update lemma could state.
|
||||
This is how we mechanise "proof of correctness in totality with no
|
||||
assumptions" — no field is silently assumed unchanged; HOL record algebra
|
||||
guarantees it.
|
||||
@@ -555,8 +573,11 @@ lemma ds_update_preserves_dict:
|
||||
"dictionary (vm\<lparr>data_stack := xs\<rparr>) = dictionary vm"
|
||||
by simp
|
||||
|
||||
lemma ds_update_preserves_word_table:
|
||||
"word_table (vm\<lparr>data_stack := xs\<rparr>) = word_table vm"
|
||||
by simp
|
||||
(* ds_update_preserves_word_table removed 2026-08-13: word_table is no
|
||||
longer a vm_state field (see the "Word semantics table" section above),
|
||||
so "word_table (vm\<lparr>...\<rparr>)" no longer type-checks -- there is nothing
|
||||
left to state. word_table's independence from data_stack updates is now
|
||||
true by construction (it is a fixed global, not read from vm at all),
|
||||
not something requiring its own lemma. *)
|
||||
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user