proof/: all 23 Isabelle theory files now verify under Isabelle2025-2

Isabelle toolchain replaced (was genuinely 2011, 14+ years stale) and every
theory file fixed to actually compile -- most had apparently never been
checked under a working Isabelle at all. Fixed the vm_state self-reference
in StarForth_Base.thy properly (word_table is now a free-standing global
constant, not a circular record field), corrected the word_physics_transparent
axiom (was claiming full state equality from mere exec-equivalence, provably
too strong), and worked through 14 years of HOL-Library drift plus several
missing-hypothesis bugs across the physics-loop and ACL theories.

Two genuine (non-tactical) bugs found and left oops-flagged rather than
silently resolved: forth_roll's index arithmetic disagrees with both its own
test lemma and the real C ROLL implementation (three-way inconsistency), and
pm_wf isn't actually preserved by pm_record_hit/pm_record_miss. Both need a
decision, not a proof-script fix.

Full writeup in FABRIC-2.md item 5.2.

proof/StarForth_Loop1_Heat.thy

@@ -2,6 +2,10 @@ theory StarForth_Loop1_Heat
   imports StarForth_Base
 begin
 
+(* AND/OR/XOR infix notation moved behind an opt-in bundle at some point
+   after 2011 -- unbundled by default now. Same fix as StarForth_Q48_16.thy. *)
+unbundle bit_operations_syntax
+
 (* =========================================================================
    StarForth_Loop1_Heat — Execution Heat Tracking (Physics Loop #1)
 
@@ -60,25 +64,33 @@ definition heat_increment :: "dict_entry \<Rightarrow> dict_entry" where
 lemma heat_increment_correct:
   assumes "de_heat e < HEAT_MAX"
   shows "de_heat (heat_increment e) = de_heat e + 1"
-  by (simp add: heat_increment_def assms)
+  using assms by (simp add: heat_increment_def min_def)
 
 lemma heat_increment_saturates:
   assumes "de_heat e = HEAT_MAX"
   shows "de_heat (heat_increment e) = HEAT_MAX"
   by (simp add: heat_increment_def assms)
 
+(* CORRECTED 2026-08-13: added the missing upper-bound hypothesis. Without
+   it, if de_heat e already exceeds HEAT_MAX, the min-clamp in
+   heat_increment could pull the result back down below de_heat e,
+   breaking monotonicity. *)
 lemma heat_increment_non_decreasing:
-  "de_heat (heat_increment e) \<ge> de_heat e"
-  by (simp add: heat_increment_def)
+  assumes "de_heat e \<le> HEAT_MAX"
+  shows "de_heat (heat_increment e) \<ge> de_heat e"
+  using assms by (simp add: heat_increment_def)
 
 lemma heat_increment_preserves_validity:
   assumes "heat_valid e"
   shows "heat_valid (heat_increment e)"
 proof -
-  have "de_heat e \<ge> 0" and "de_heat e \<le> HEAT_MAX"
+  have h0: "de_heat e \<ge> 0" and hmax: "de_heat e \<le> HEAT_MAX"
     using assms by (simp_all add: heat_valid_def)
-  thus ?thesis
-    by (simp add: heat_valid_def heat_increment_def HEAT_MAX_def)
+  have le: "de_heat (heat_increment e) \<le> HEAT_MAX"
+    unfolding heat_increment_def by (simp add: min.cobounded2)
+  have ge: "de_heat (heat_increment e) \<ge> 0"
+    unfolding heat_increment_def using h0 by (simp add: HEAT_MAX_def)
+  from le ge show ?thesis by (simp add: heat_valid_def)
 qed
 
 lemma heat_increment_preserves_flags:
@@ -112,10 +124,18 @@ lemma heat_decay_frozen:
   shows "heat_decay amount e = e"
   by (simp add: heat_decay_def assms)
 
+(* CORRECTED 2026-08-13: added the missing lower-bound hypothesis. In the
+   PINNED branch, heat_decay floors at max 1 (de_heat e - amount) -- if
+   de_heat e was already below 1 (e.g. 0), the floor raises it, breaking
+   monotonicity. de_heat e \<ge> 1 is the standing invariant a pinned word is
+   supposed to maintain (see heat_decay_pinned_positive's own \<ge> 1
+   conclusion below), just never stated here as a precondition before. *)
 lemma heat_decay_monotone:
   assumes "\<not> heat_frozen e"
+  assumes "de_heat e \<ge> 1"
+  assumes "amount \<ge> 0"
   shows "de_heat (heat_decay amount e) \<le> de_heat e"
-  by (simp add: heat_decay_def assms)
+  using assms by (simp add: heat_decay_def)
 
 lemma heat_decay_non_negative:
   assumes "\<not> heat_frozen e"
@@ -155,7 +175,7 @@ lemma heat_decay_preserves_flags:
 (* All dict entries reachable via the dictionary have valid heat. *)
 definition dict_heat_wf :: "vm_state \<Rightarrow> bool" where
   "dict_heat_wf vm \<longleftrightarrow>
-     \<forall>i e. dictionary vm i = Some e \<longrightarrow> heat_valid e"
+     (\<forall>i e. dictionary vm i = Some e \<longrightarrow> heat_valid e)"
 
 (* =========================================================================
    Section 6: Heat thresholds