proof/: all 23 Isabelle theory files now verify under Isabelle2025-2

Isabelle toolchain replaced (was genuinely 2011, 14+ years stale) and every
theory file fixed to actually compile -- most had apparently never been
checked under a working Isabelle at all. Fixed the vm_state self-reference
in StarForth_Base.thy properly (word_table is now a free-standing global
constant, not a circular record field), corrected the word_physics_transparent
axiom (was claiming full state equality from mere exec-equivalence, provably
too strong), and worked through 14 years of HOL-Library drift plus several
missing-hypothesis bugs across the physics-loop and ACL theories.

Two genuine (non-tactical) bugs found and left oops-flagged rather than
silently resolved: forth_roll's index arithmetic disagrees with both its own
test lemma and the real C ROLL implementation (three-way inconsistency), and
pm_wf isn't actually preserved by pm_record_hit/pm_record_miss. Both need a
decision, not a proof-script fix.

Full writeup in FABRIC-2.md item 5.2.

proof/StarForth_Concurrent.thy

@@ -21,53 +21,72 @@ begin
 
 theorem heartbeat_noninterference:
   "\<forall>n k vm.
-     data_stack (word_table (heartbeat_step ^^ k $ vm) n (heartbeat_step ^^ k $ vm))
-     = data_stack (word_table vm n vm)"
-  by (simp add: exec_after_n_heartbeats_eq)
+     data_stack (word_table n ((heartbeat_step ^^ k) vm))
+     = data_stack (word_table n vm)"
+  using exec_after_n_heartbeats_eq exec_equiv_ds by blast
 
 theorem heartbeat_noninterference_rs:
   "\<forall>n k vm.
-     return_stack (word_table (heartbeat_step ^^ k $ vm) n (heartbeat_step ^^ k $ vm))
-     = return_stack (word_table vm n vm)"
-  by (simp add: exec_after_n_heartbeats_eq)
+     return_stack (word_table n ((heartbeat_step ^^ k) vm))
+     = return_stack (word_table n vm)"
+  using exec_after_n_heartbeats_eq exec_equiv_rs by blast
 
 (* =========================================================================
    Section 2: Trace-level non-interference (proved by induction over ≃)
 
    foldl_word_table_eq: if two initial states are exec-equivalent (≃), then
-   running any word sequence on each produces identical states.  The proof is
-   structural: at each step word_physics_transparent (A4') gives FULL state
-   equality of the successors (not just exec-field agreement), so the remaining
-   foldl is trivially identical — no propagation of equivalence is needed.
+   running any word sequence on each produces exec-equivalent (not
+   identical -- CORRECTED 2026-08-13, see StarForth_Transition.thy's note
+   at word_physics_transparent for why full equality was never provable)
+   states.  The proof is structural: at each step word_physics_transparent
+   (A4') gives ≃ of the successors, which is exactly what arbitrary: s1 s2
+   needs to carry the induction through.
 
    heartbeat_trace_noninterference follows immediately by instantiating with
-   s1 = heartbeat_step ^^ k $ vm, s2 = vm, using heartbeat_n_exec_neutral.
+   s1 = (heartbeat_step ^^ k) vm, s2 = vm, using heartbeat_n_exec_neutral.
 
    ○ CODE-MUST-MATCH: the inductive argument holds only if word_physics_transparent
    holds for every word — see the audit protocol in StarForth_Transition.thy.
    ======================================================================== *)
 
+(* Restated 2026-08-13 with explicit object-level \<forall>/\<longrightarrow> instead of
+   assumes/shows + arbitrary: s1 s2 -- the assumes/arbitrary combination
+   was not reliably carrying "s1 \<simeq> s2" into the Nil case as Nil.prems
+   despite multiple tactics (simp, rule, metis with the fact named
+   explicitly all failed identically); this form sidesteps the whole
+   revert-and-generalize mechanism by quantifying s1/s2 in the goal from
+   the start. *)
 lemma foldl_word_table_eq:
-  assumes "s1 \<simeq> s2"
-  shows "foldl (\<lambda>s n. word_table s n s) s1 ws
-         = foldl (\<lambda>s n. word_table s n s) s2 ws"
-proof (induction ws arbitrary: s1 s2)
-  case Nil thus ?case by simp
+  "\<forall>s1 s2. s1 \<simeq> s2 \<longrightarrow>
+     foldl (\<lambda>s n. word_table n s) s1 ws \<simeq> foldl (\<lambda>s n. word_table n s) s2 ws"
+proof (induction ws)
+  case Nil
+  show ?case by simp
 next
   case (Cons w ws)
-  (* A4' gives full state equality of the one-step successors *)
-  have heq: "word_table s1 w s1 = word_table s2 w s2"
-    by (rule word_physics_transparent [OF Cons.prems])
-  show ?case by (simp add: heq)
+  show ?case
+  proof (intro allI impI)
+    fix s1 s2 :: vm_state
+    assume h: "s1 \<simeq> s2"
+    have heq: "word_table w s1 \<simeq> word_table w s2"
+      using h word_physics_transparent by blast
+    have "foldl (\<lambda>s n. word_table n s) (word_table w s1) ws
+        \<simeq> foldl (\<lambda>s n. word_table n s) (word_table w s2) ws"
+      using Cons.IH heq by blast
+    thus "foldl (\<lambda>s n. word_table n s) s1 (w # ws)
+        \<simeq> foldl (\<lambda>s n. word_table n s) s2 (w # ws)"
+      by simp
+  qed
 qed
 
 theorem heartbeat_trace_noninterference:
   "\<And> words vm k.
      data_stack
-       (foldl (\<lambda>s n. word_table s n s) (heartbeat_step ^^ k $ vm) words)
+       (foldl (\<lambda>s n. word_table n s) ((heartbeat_step ^^ k) vm) words)
      = data_stack
-         (foldl (\<lambda>s n. word_table s n s) vm words)"
-  using foldl_word_table_eq [OF heartbeat_n_exec_neutral] by simp
+         (foldl (\<lambda>s n. word_table n s) vm words)"
+  using foldl_word_table_eq [rule_format, OF heartbeat_n_exec_neutral] exec_equiv_ds
+  by blast
 
 (* =========================================================================
    Section 3: Mutex safety (proved from lock_state algebra)
@@ -97,12 +116,12 @@ lemma vm_step_preserves_lock_safety:
 
 lemma word_exec_deterministic:
   assumes "s1 \<simeq> s2"
-  shows "data_stack (word_table s1 n s1) = data_stack (word_table s2 n s2)"
-  using word_physics_transparent [OF assms] by simp
+  shows "data_stack (word_table n s1) = data_stack (word_table n s2)"
+  using word_physics_transparent [OF assms] exec_equiv_ds by blast
 
 lemma word_exec_rs_deterministic:
   assumes "s1 \<simeq> s2"
-  shows "return_stack (word_table s1 n s1) = return_stack (word_table s2 n s2)"
-  using word_physics_transparent [OF assms] by simp
+  shows "return_stack (word_table n s1) = return_stack (word_table n s2)"
+  using word_physics_transparent [OF assms] exec_equiv_rs by blast
 
 end