proof/: complete parse+insert composition for :, CREATE, VARIABLE, DEFER

Extends the CONSTANT worked example from the previous commit to all five
name-parsing/entry-creating words. Each now has a forth_*_full definition
composing the real C order end to end, up to but not including the
data-field write (gap b, still open):

- forth_create_full: parse -> dict_insert_entry -> forth_align (reused
  directly from StarForth_Dictionary_Words.thy's ALIGN model).
- forth_variable_full: parse -> forth_align -> forth_vm_allot_raw (new --
  models the raw vm_allot() C helper VARIABLE calls directly, bounds-
  checked against DICTIONARY_MEMORY_SIZE exactly like vm_align, distinct
  from the FORTH word ALLOT's own VM_MEMORY_SIZE-bounded forth_allot) ->
  dict_insert_entry.
- forth_colon_full: nested-':' guard (checked before the parse, matching
  real C order) -> parse -> forth_colon_entry_half (mode-set + WORD_SMUDGED
  insert). Added forth_parse_word_preserves_vm_mode/dictionary/
  word_id_next to StarForth_Base.thy to support this composition cleanly.
- forth_defer_full: parse -> dict_insert_entry, the simplest of the five.

dict_insert_entry's callers (the four forth_*_entry_half definitions)
still take the parsed name as a caller parameter for standalone use.

Full suite (54 theories) verifies green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Robert Allan James
2026-08-15 05:29:49 -04:00
co-authored by Claude Sonnet 5
parent 1aca77d55c
commit d3d66fb608
4 changed files with 256 additions and 25 deletions
+41 -1
View File
@@ -87,8 +87,48 @@ lemma defer_entry_half_pinned_conflict_errors:
shows "vm_error (forth_defer_entry_half name pinned_conflict vm)"
using assms by (simp add: forth_defer_entry_half_def dict_insert_entry_def set_error_def)
lemma defer_not_modelled: True \<comment> \<open>DEFER beyond the entry-creation half: name parse (TIB gap) + DF zero-init (gap b). See forth_defer_entry_half above for what IS now modelled.\<close>
lemma defer_not_modelled: True \<comment> \<open>DEFER beyond the entry-creation half: DF zero-init (gap b). See forth_defer_full below for the parse composition.\<close>
by simp
(* ── DEFER, full composition, gap (a)+parse CLOSED 2026-08-15 ────────────
`word_defer` (defer_words.c:73-101): parse name -> vm_create_word. No
align/allot, no stack guard -- the simplest full composition in this
suite. Same pattern as StarForth_Defining_Words.thy's forth_create_full/
forth_constant_full/forth_variable_full. *)
definition forth_defer_full :: "nat \<Rightarrow> bool \<Rightarrow> vm_state \<Rightarrow> vm_state" where
"forth_defer_full max_len pinned_conflict vm =
(let (nm, vm1) = forth_parse_word max_len vm
in if nm = ''''
then set_error vm1
else dict_insert_entry nm 0 pinned_conflict vm1)"
lemma defer_full_empty_parse_errors:
assumes "fst (forth_parse_word max_len vm) = ''''"
shows "vm_error (forth_defer_full max_len pinned_conflict vm)"
proof -
obtain nm vm1 where parse_eq: "forth_parse_word max_len vm = (nm, vm1)" by fastforce
hence "nm = ''''" using assms by simp
thus ?thesis using parse_eq by (simp add: forth_defer_full_def set_error_def)
qed
lemma defer_full_success_populates_dictionary:
assumes "dropWhile is_ws (drop (input_pos vm) (input_buffer vm)) \<noteq> []" (is "?s1 \<noteq> []")
assumes "max_len \<ge> 2"
assumes "\<not> pinned_conflict"
shows "\<exists>e wid. dictionary (forth_defer_full max_len pinned_conflict vm) wid = Some e
\<and> de_name e \<noteq> '''' \<and> de_flags e = 0"
proof -
obtain nm vm1 where parse_eq: "forth_parse_word max_len vm = (nm, vm1)" by fastforce
hence nm_nonempty: "nm \<noteq> ''''"
using forth_parse_word_success_nonempty[OF assms(1) assms(2)] by (metis fstI)
have "forth_defer_full max_len pinned_conflict vm = dict_insert_entry nm 0 pinned_conflict vm1"
using parse_eq nm_nonempty by (simp add: forth_defer_full_def)
moreover have "\<exists>e. dictionary (dict_insert_entry nm 0 pinned_conflict vm1) (word_id_next vm1) = Some e
\<and> de_name e = nm \<and> de_flags e = 0"
using assms(3) by (simp add: dict_insert_entry_def Let_def)
ultimately show ?thesis using nm_nonempty by auto
qed
lemma defer_runtime_not_modelled: True \<comment> \<open>defer_runtime: DF read (gap b) + call-through (gap c).\<close>
by simp
lemma defer_fetch_not_modelled: True \<comment> \<open>DEFER@: FIND (name-resolution gap) + DF read (gap b).\<close>