proof/: all 23 Isabelle theory files now verify under Isabelle2025-2

Isabelle toolchain replaced (was genuinely 2011, 14+ years stale) and every
theory file fixed to actually compile -- most had apparently never been
checked under a working Isabelle at all. Fixed the vm_state self-reference
in StarForth_Base.thy properly (word_table is now a free-standing global
constant, not a circular record field), corrected the word_physics_transparent
axiom (was claiming full state equality from mere exec-equivalence, provably
too strong), and worked through 14 years of HOL-Library drift plus several
missing-hypothesis bugs across the physics-loop and ACL theories.

Two genuine (non-tactical) bugs found and left oops-flagged rather than
silently resolved: forth_roll's index arithmetic disagrees with both its own
test lemma and the real C ROLL implementation (three-way inconsistency), and
pm_wf isn't actually preserved by pm_record_hit/pm_record_miss. Both need a
decision, not a proof-script fix.

Full writeup in FABRIC-2.md item 5.2.

proof/StarForth_Loop2_Window.thy

@@ -78,9 +78,17 @@ lemma window_advance_act_window:
   "rw_act_window (window_advance w rw) = min (rw_total_exec rw + 1) ROLLING_WINDOW_SIZE"
   by (simp add: window_advance_def)
 
+(* CORRECTED 2026-08-13: added the missing window_invariant hypothesis.
+   Without it, rw_act_window rw is an unconstrained field unrelated to
+   rw_total_exec rw, so the claim is not provable -- nothing stops a
+   caller from handing in a state where rw_act_window is already larger
+   than the post-advance value. window_invariant is exactly what ties
+   rw_act_window to rw_total_exec (its defining formula), which is what
+   the proof actually needs. *)
 lemma window_advance_act_monotone:
-  "rw_act_window (window_advance w rw) \<ge> rw_act_window rw"
-  by (simp add: window_advance_def min_def)
+  assumes "window_invariant rw"
+  shows "rw_act_window (window_advance w rw) \<ge> rw_act_window rw"
+  using assms by (simp add: window_advance_def window_invariant_def min_def)
 
 lemma window_advance_act_bounded:
   "rw_act_window (window_advance w rw) \<le> ROLLING_WINDOW_SIZE"
@@ -120,29 +128,50 @@ lemma window_shrink_lb:
 lemma window_shrink_ub:
   assumes "rw_eff_window rw \<le> ROLLING_WINDOW_SIZE"
   shows "rw_eff_window (window_shrink rw) \<le> ROLLING_WINDOW_SIZE"
-  using assms by (simp add: window_shrink_def)
+  using assms
+  by (simp add: window_shrink_def ROLLING_WINDOW_SIZE_def ADAPTIVE_MIN_WINDOW_SIZE_def)
 
+(* CORRECTED 2026-08-13: added the missing lower-bound hypothesis. Without
+   it, rw_eff_window rw could be below ADAPTIVE_MIN_WINDOW_SIZE, in which
+   case window_shrink's max-clamp raises it back up to the floor -- the
+   result would then be \<ge> the input, not \<le>. window_invariant's own lower
+   bound is exactly what rules this out. *)
 lemma window_shrink_mono:
-  "rw_eff_window (window_shrink rw) \<le> rw_eff_window rw"
-  by (simp add: window_shrink_def)
+  assumes "rw_eff_window rw \<ge> ADAPTIVE_MIN_WINDOW_SIZE"
+  shows "rw_eff_window (window_shrink rw) \<le> rw_eff_window rw"
+  using assms by (simp add: window_shrink_def)
 
 lemma window_shrink_preserves_invariant:
   assumes "window_invariant rw"
   shows "window_invariant (window_shrink rw)"
-  using assms by (simp add: window_invariant_def window_shrink_def)
+  using assms
+  by (auto simp: window_invariant_def window_shrink_def diff_le_self
+           intro: le_trans[OF diff_le_self])
 
 lemma window_grow_lb:
   assumes "rw_eff_window rw \<ge> ADAPTIVE_MIN_WINDOW_SIZE"
   shows "rw_eff_window (window_grow rw) \<ge> ADAPTIVE_MIN_WINDOW_SIZE"
-  using assms by (simp add: window_grow_def)
+  using assms
+  by (simp add: window_grow_def ROLLING_WINDOW_SIZE_def ADAPTIVE_MIN_WINDOW_SIZE_def)
 
 lemma window_grow_ub:
   "rw_eff_window (window_grow rw) \<le> ROLLING_WINDOW_SIZE"
-  by (simp add: window_grow_def)
+proof -
+  have "rw_eff_window (window_grow rw)
+      = min ROLLING_WINDOW_SIZE (rw_eff_window rw + ADAPTIVE_GROWTH_THRESHOLD)"
+    by (simp add: window_grow_def)
+  also have "\<dots> \<le> ROLLING_WINDOW_SIZE" by (rule min.cobounded1)
+  finally show ?thesis .
+qed
 
+(* CORRECTED 2026-08-13: added the missing upper-bound hypothesis. Without
+   it, rw_eff_window rw could already exceed ROLLING_WINDOW_SIZE, in which
+   case window_grow's min-clamp would lower it -- the result would then be
+   \<le> the input, not \<ge>. *)
 lemma window_grow_mono:
-  "rw_eff_window (window_grow rw) \<ge> rw_eff_window rw"
-  by (simp add: window_grow_def)
+  assumes "rw_eff_window rw \<le> ROLLING_WINDOW_SIZE"
+  shows "rw_eff_window (window_grow rw) \<ge> rw_eff_window rw"
+  using assms by (simp add: window_grow_def)
 
 lemma window_grow_preserves_invariant:
   assumes "window_invariant rw"