proof/: model IS and DEFER@ with the FIND-family gap sidestepped

Both words' real blockers are vm_find_word (name resolution, still
unmodelled everywhere in this suite) and a de->func != defer_runtime
identity check (unmodellable -- word_table exposes no per-entry function
identity). Sidestepped the same way physics_freeze_words.c's
FREEZE-WORD/UNFREEZE-WORD/etc. already do: parameterised over an
explicit target_wid_opt :: nat option (whatever vm_find_word would have
resolved) and is_defer_word :: bool (the identity check's result). Given
both, forth_is_full's DF write and forth_defer_fetch_full's DF read are
fully modelled via dict_write_df/de_df, including IS's own real
stack-underflow guard and both words' ds_full push guard.

defer_runtime itself remains unmodelled -- it's a structurally different
DF usage (the DF value is used as a dispatch target via word_table, gap
c, not just returned to the caller like the other DF-reading words).

Full suite (54 theories) verifies green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/COVERAGE.md

@@ -81,7 +81,7 @@ library itself is separately covered by `StarForth_Q48_16.thy`).
 | `framebuffer_words.c`, `keyboard_words.c` | `StarForth_Framebuffer_Words.thy`, `StarForth_Keyboard_Words.thy` | hosted-build fallback branches fully modelled |
 | `scroll_words.c`, `ttf_words.c` | `StarForth_Scroll_Words.thy`, `StarForth_TTF_Words.thy` | sentinel-only — words don't exist on hosted builds at all |
 | `lifecycle_words_hosted.c` | `StarForth_Lifecycle_Words_Hosted.thy` | 100% — zero deferred remainder |
-| `defer_words.c` | `StarForth_Defer_Words.thy` | live (see FINDINGS.md §3 correction); DEFER full up to the DF write (added 2026-08-14/15) |
+| `defer_words.c` | `StarForth_Defer_Words.thy` | live (see FINDINGS.md §3 correction); DEFER full up to the DF write, IS/DEFER@ full with FIND sidestepped, `defer_runtime` itself still gap (c) (added 2026-08-14/15) |
 | `log_words.c` | `StarForth_Log_Words.thy` | 100% |
 | `q48_words.c` | `StarForth_Q48_Words.thy` | 17/23 |
 | `inference_words.c` | `StarForth_Inference_Words.thy` | 5 accessors full; rest guard/shape |
@@ -133,13 +133,18 @@ effort on the scale of what's already here:
   create`/`_variable`/`_constant` — byte-identical C bodies) share one
   new definition, `forth_runtime_read_df`, which also required adding
   `current_executing_word_id` to `vm_state` (mirrors `vm->
-  current_executing_entry`). Still open: `:`'s `vm->compiling_word`
-  tracking (no vm_state field, so `:` stops just short of full closure);
-  DEFER's own runtime (dispatch reassignment via a stored pointer — a
-  fundamentally different DF usage, still gap (c)); IS/DEFER@ (need the
-  FIND-family name-resolution gap first); and the pin-shadow name-scan
-  guard everywhere (sidestepped via an explicit `pinned_conflict :: bool`
-  parameter, same technique as the XT-pop gap elsewhere in this suite).
+  current_executing_entry`). IS/DEFER@ (`StarForth_Defer_Words.thy`) are
+  also now modelled end to end, with the FIND-family name-resolution gap
+  sidestepped via an explicit `target_wid_opt :: nat option` +
+  `is_defer_word :: bool` pair, the same technique
+  `physics_freeze_words.c`'s FREEZE-WORD/etc. already established. Still
+  open: `:`'s `vm->compiling_word` tracking (no vm_state field, so `:`
+  stops just short of full closure); DEFER's own runtime (dispatch
+  reassignment via a stored pointer — a fundamentally different DF usage,
+  still gap (c), NOT the same shape as IS/DEFER@'s plain-value DF access);
+  the pin-shadow name-scan guard everywhere (sidestepped via an explicit
+  `pinned_conflict :: bool` parameter); and the FIND-family lookup itself,
+  which IS/DEFER@'s sidestep still doesn't model, only routes around.
 - **The vocabulary chain mechanics** (VOCABULARY/DEFINITIONS/CONTEXT/CURRENT/
   FORTH) — file-scope statics, see FINDINGS.md §1, instance #5.
 - **The hot-words cache** (`physics_benchmark_words.c`) and **the bucket/