Robert Allan JamesandClaude Sonnet 5
45c381ca6c
Covers the runtime half of control_words.c fully: (BRANCH), (0BRANCH), (?DO), (DO), (LOOP), (+LOOP), (LEAVE), UNLOOP, I, J, EXIT. The "vm_ip as raw pointer" gap flagged at every earlier resume point turns out not to need a new model extension -- return_stack-held addresses dereference into vm->memory exactly like @/! addresses from the data stack, so the existing mem_read/unat machinery from StarForth_Memory_Words covers it directly. The compile-time half (IF/ELSE/THEN, BEGIN/WHILE/REPEAT/AGAIN/UNTIL, the compiling halves of ?DO/DO/LOOP/+LOOP/LEAVE, CASE/OF/ENDOF/ENDCASE) is left unmodelled, not from a model gap but a genuine architectural finding: Headline finding, not fixed: every compile-time control-flow word operates on FILE-SCOPE C statics (cf_stack/cf_sp, cf_last_mode, leave_addrs/leave_sp, endof_addrs/endof_sp, and their mark-stacks) -- none are struct VM fields, none are keyed by VM instance. In the Tripod multi-VM fleet, two VMs compiling control structures at overlapping times corrupt each other's IF/DO/CASE nesting through this shared global state, and a VM whose compilation aborts mid-structure leaves stale cf_sp/leave_sp/endof_sp state for whichever VM compiles next. cf_epoch_sync's mode-transition reset heuristic is itself keyed off a single global (cf_last_mode), not per-VM, so it can neither reliably detect nor reliably avoid false resets across VMs. Modelling these words against vm_state would require either inventing a field the real implementation doesn't have (silently fixing the bug in the proof) or modelling a bare global with no plumbing precedent in this suite -- both out of scope, left as documented gaps. 28 theory files verify with zero errors. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
32 lines
926 B
Plaintext
32 lines
926 B
Plaintext
session "StarForth" = "HOL-Library" +
|
|
description "Formal proofs of StarForth FORTH-79 primitive correctness and physics-loop invariants"
|
|
theories [document = false]
|
|
StarForth_Base
|
|
StarForth_Q48_16
|
|
StarForth_Stack_Words
|
|
StarForth_Double_Words
|
|
StarForth_Arithmetic_Words
|
|
StarForth_Mixed_Arithmetic_Words
|
|
StarForth_Logical_Words
|
|
StarForth_Return_Stack_Words
|
|
StarForth_Memory_Words
|
|
StarForth_Dictionary_Words
|
|
StarForth_Dictionary_Manipulation_Words
|
|
StarForth_Control_Words
|
|
StarForth_Mutex
|
|
StarForth_Transition
|
|
StarForth_Loop1_Heat
|
|
StarForth_Loop2_Window
|
|
StarForth_Loop3_Decay
|
|
StarForth_Loop4_Pipeline
|
|
StarForth_Loop5_WinInf
|
|
StarForth_Loop6_DecayInf
|
|
StarForth_Loop7_Heartrate
|
|
StarForth_Concurrent
|
|
StarForth_Correctness
|
|
ACL_Pin_Monotone
|
|
ACL_Inherit_Clears_Pin
|
|
ACL_TTL_Bounded
|
|
ACL_Emergency_Bypass
|
|
ACL_No_Escalation
|