Body correctness: phase assembly #
The per-iteration proof of the body machine, assembled from the phase
lemmas. This file starts with the standing invariant SimInv (the tape
shape between loop iterations, relative to the interpreted machine's
configuration) and the halt-check phase: from the body's start state, a
halted interpreted machine makes the body a bounded-time no-op, and a
running one brings it to the peek phase with all tapes restored.
The body's standing tape shape between loop iterations, relative to a
configuration mc of the interpreted machine (decodeDesc α).toTM.
The state-tape clause is a disjunction: the running shape (the w-bit
encoding of the current state) or the post-default shape (the qhalt
field verbatim — the machine is then halted).
- wf_in : mc.input.StartInvariant
- wf_wk : (mc.work 0).StartInvariant
- wf_out : mc.output.StartInvariant
- state : ↑mc.state < 2 ^ (decodeDesc α).w ∧ (work stT).HoldsExact (bitsToSyms ((decodeDesc α).w.toBits ↑mc.state)) ∨ mc.state = (decodeDesc α).toTM.qhalt ∧ (work stT).HoldsExact (qhaltField (groupPairs α))
- desc : (work dsT).HoldsExact (groupPairs α)
- scratch : (work scT).HoldsExact []
Instances For
The state tape's contents (either disjunct) are blank-free.
Halt-check phase, halted case: when the interpreted machine sits at
its halt state, the body runs from its start state to bodyDone as a
pure no-op — every tape is exactly restored — within
5·|groupPairs α| + 7 steps.
Halt-check phase, running case: when the interpreted machine is not
at its halt state, the body's halt check falls through to the peek
phase with every tape exactly restored, within
5·|groupPairs α| + 7 steps.
Peek and seek phases: from peek1, capture the (honest) at-origin
flags and walk the desc head to the start of the entry region
(|F1| + |F2| + 3), all other tapes exactly restored, within
2·|groupPairs α| + 4 steps.
Cleanup phase (after a successful apply): blank-rewind the scratch
tape, then rewind the state and desc heads; ends at bodyDone with the
scratch cleared and every other tape's cells intact.
Default-phase tail (from dfScr, after the sanitized virtual moves
were applied on the segCheck step): clear the scratch, blank the state
tape, copy the qhalt field onto it, rewind everything; ends at
bodyDone with the state tape holding the qhalt field — the shape of
the invariant's post-default disjunct.
Apply phase (from appRewScr f, scratch holding the copied value
EL = new-state field (|SL| cells, the old state's width) followed by
the ten action cells): rewind scratch, overwrite the state tape, decode
and act on the virtual tapes, clean up. Ends at bodyDone with the
state tape holding the value's first |SL| cells and the virtual tapes
transformed by the sanitized action.