October 2026 main drop: mirror from GitHub

.github/workflows/lean.yml

@@ -0,0 +1,32 @@
+name: lean
+on: [push, pull_request]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install elan
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh -o elan-init.sh
+          sh elan-init.sh -y --default-toolchain none
+          echo "$HOME/.elan/bin" >> "$GITHUB_PATH"
+      - name: Build
+        run: lake build
+      - name: Forbidden constructs
+        run: |
+          if grep -rnE '\bsorry\b|\badmit\b|native_decide|^\s*axiom ' formal word-ir forth bcpl wolfram backend --include='*.lean'; then exit 1; fi
+      - name: Axiom audit
+        run: lake env lean formal/Audit.lean
+      - name: Native x86-64 execution check
+        run: .lake/build/bin/wordc check 300
+      - name: Forth source files (x86-64)
+        run: for f in examples/forth/*.fs; do .lake/build/bin/wordc forth "$f" || exit 1; done
+      - name: Install wasmtime
+        run: |
+          curl -sSfL -o wasmtime.tar.xz https://github.com/bytecodealliance/wasmtime/releases/download/v30.0.2/wasmtime-v30.0.2-x86_64-linux.tar.xz
+          tar xf wasmtime.tar.xz
+          echo "$PWD/wasmtime-v30.0.2-x86_64-linux" >> "$GITHUB_PATH"
+      - name: WebAssembly execution check
+        run: .lake/build/bin/wasmw check 300
+      - name: Forth source files (WebAssembly)
+        run: for f in examples/forth/*.fs; do .lake/build/bin/wasmw forth "$f" || exit 1; done

.gitignore

@@ -0,0 +1 @@
+.lake/

License

@@ -0,0 +1,110 @@
+# Parr Source License — No AI Training, Version 1.0
+
+Copyright (c) 2026 Ahmad Ali Parr
+
+This is a custom source-available license inspired by the Functional Source
+License. It is not the standard FSL and does not include an automatic grant of
+an Apache, MIT, or other future license.
+
+## 1. Definitions
+
+"Licensor" means Ahmad Ali Parr.
+
+"Software" means the source code, documentation, examples, tests, and other
+materials that the Licensor makes available under this license. Separately
+licensed third-party materials remain governed by their respective licenses.
+
+"Competing Use" means making the Software available to others in a commercial
+product or service that substitutes for the Software, offers the same or
+substantially similar functionality as the Software, or substitutes for a
+product or service the Licensor offers using the Software as of the date the
+applicable version is made available.
+
+"AI Training" means using the Software, any portion of it, modifications or
+derivatives of it, or data derived from it as training material for an artificial
+intelligence or machine-learning model. This includes pretraining, fine-tuning,
+continued training, distillation, reinforcement learning, and constructing or
+supplying datasets for any of those purposes. Data derived from the Software
+includes synthetic training examples generated from its code or documentation.
+
+"Permitted Purpose" means any purpose that is neither a Competing Use nor AI
+Training.
+
+## 2. License grant
+
+Subject to compliance with this license, the Licensor grants you a worldwide,
+nonexclusive, royalty-free license to use, copy, modify, create derivative works
+of, publicly perform, publicly display, and redistribute the Software for
+Permitted Purposes.
+
+Permitted Purposes include internal business use, personal use, education,
+research, and professional services provided to users who comply with this
+license, provided those activities do not constitute Competing Use or AI
+Training. Commercial use that is not a Competing Use or AI Training is permitted.
+
+## 3. No AI training
+
+You may not use the Software for AI Training, or license, sell, distribute, or
+otherwise supply it or data derived from it for AI Training, without separate
+written permission from the Licensor. This restriction applies to commercial,
+noncommercial, educational, research, and internal activities alike.
+
+Using an existing AI model solely for inference, such as to review, explain, or
+modify the Software, is permitted if that activity is otherwise a Permitted
+Purpose and the Software and resulting derived data are not used for AI
+Training. This license does not prohibit training on unrelated material or on
+your own material that is independent of the Software.
+
+## 4. Redistribution and notices
+
+If you redistribute the Software or any modification or derivative of it, you
+must include a copy of this license and preserve the copyright notices provided
+with the Software. You must identify your modifications and must not imply that
+the Licensor endorses them.
+
+The portions of a redistributed work that consist of the Software or its
+modifications or derivatives remain subject to this license. You may not grant
+recipients rights to those portions that conflict with this license. Independent
+components may retain their own licenses.
+
+## 5. Patents
+
+To the extent a Permitted Purpose necessarily infringes patent claims controlled
+by the Licensor, the license grant includes a license under those claims. If you
+bring a patent claim alleging that the Software infringes or contributes to
+patent infringement, your patent license under this license terminates
+immediately.
+
+## 6. Trademarks
+
+This license grants no rights to the Licensor's trademarks, trade names, service
+marks, or product names, except for reasonable attribution and identification of
+the origin of the Software.
+
+## 7. Termination
+
+Your rights under this license terminate automatically if you violate its
+terms. Termination does not terminate the rights of recipients who obtained
+copies from you and remain in compliance. Reinstatement of your rights requires
+written permission from the Licensor.
+
+## 8. No automatic conversion
+
+The Competing Use and AI Training restrictions do not expire automatically.
+There is no conversion to another license after two years or any other period.
+Any additional license grant requires a separate grant from the relevant rights
+holder.
+
+## 9. Disclaimer of warranties
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE IS PROVIDED
+"AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
+TITLE, AND NONINFRINGEMENT.
+
+## 10. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE LICENSOR
+OR CONTRIBUTORS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

NEXT_STEPS.md

@@ -0,0 +1,36 @@
+# Next steps
+
+Suggested development order. Each item names the gap it closes in the current code.
+
+## 1. Forth: parser fuel and a grammar specification
+
+Colon definitions (lowered to IR `call`/`ret`), `RECURSE`, `EXIT`, `VARIABLE`,
+`CONSTANT`, `0=`, `MOD`, the return-data stack words `>R R> R@` and
+`DO … LOOP` with `I` and `J` are covered by `Forth.Program.compile_correct`.
+The return-data stack is the IR's auxiliary stack (`tor`/`fromr`/`rfetch`),
+which `call`/`ret` never touch, so loop parameters and `>R` values survive
+calls and recursion, and unbalanced use across `EXIT` or a call is defined
+behaviour. A text parser (`Forth.parse`) and a printer (`Forth.print`) exist,
+with the round trip `parse (print P) = .ok P` proved for well-formed programs
+(`Forth.parse_print`). The converse direction is proved in
+`Forth/ParseProps.lean`: every successful parse is well formed (`parse_wf`), so
+`print` is a canonical form (`parse_print_of_parse`), and the handling of case,
+comments, `CONSTANT` and `RECURSE` is characterised by lemmas. `wordc forth` /
+`wasmw forth` run a Forth source file on either backend. Remaining:
+
+- The parser lemmas have side conditions where the text-level statement would
+  otherwise be false (a `( … )` comment body without `)`, `\` or newline, after
+  text not ending inside a `(` comment; case-insensitivity up to the spelling in
+  error messages). Not proved: that the fuel bounds of `parseSeq`/`parseTop`
+  are never exhausted (the "too deeply nested" / "too long" errors are
+  unreachable), and a full specification of `parse` as a grammar.
+- Not implemented: `+LOOP`, `?DO`, `LEAVE` and `UNLOOP`. `LOOP` uses only the
+  equal case of ANS Forth's crossing rule (it ends when `index + 1 = limit`),
+  which is exact for a step of one; `+LOOP` would need the full rule.
+
+## Ongoing
+
+The formal results cover the Lean machine models. Their agreement with real
+assemblers and runtimes is checked by execution, not proved: keep running
+`wordc check` and `wasmw check` (CI uses Wasmtime v30.0.2) after every change to
+a model, lowering or emitter.

README.md

@@ -0,0 +1,492 @@
+---
+license: other
+license_name: parr-source-license-no-ai-training-1.0
+license_link: https://huggingface.co/Snapkitty/ai-free/blob/main/License
+tags:
+- snapkitty
+- october-2026-drop
+- lean4
+- forth
+- bcpl
+- wolfram
+- compiler
+- formal-verification
+---
+
+> Mirrored from [https://github.com/SNAPKITTYAGENT9NOVA/ai-free](https://github.com/SNAPKITTYAGENT9NOVA/ai-free) at commit `1891a9e`. Part of the **SnapKitty October 2026 main drop**.
+
+# UniversalWord: follow the word
+
+**Three source-language perspectives. One word machine. Two executable destinations. A Lean file for every stage of the journey.**
+
+UniversalWord, hosted here as `ai-free`, brings Forth, a BCPL subset, and Wolfram-style scalar and matrix computations into a shared intermediate language. Its central character is the machine word: a fixed-width value that can carry an integer, a truth flag, or a memory address. Around that value, the project builds reference semantics, translations, reusable proofs, target machine models, emitters, and executable comparison harnesses.
+
+Think of this repository as a railway atlas. The source frontends are departure stations. Universal Word IR is the interchange where their different expressions become a common instruction stream. The x86-64 and WebAssembly backends are two routes onward. The Lean modules describe the track, establish how each connection behaves, and carry the argument from a source computation to a target outcome.
+
+This README is your guided journey through that atlas. Every Lean file receives an individual stop, with a link, a description, and a reason to open it. You can follow the whole route or jump directly to the part that interests you: writing Forth, understanding compiler correctness, exploring matrix multiplication, inspecting native assembly, or studying WebAssembly dispatch.
+
+**Inventory note:** the surveyed `master` snapshot, commit [`93d6d84`](https://github.com/SNAPKITTYWEST/ai-free/tree/93d6d84fe80d3b7f333e31324b35ba27a964b9cc), contains **81 `.lean` files**. The numbered atlas below covers all 81, including library entry files, executable entry points, and the audit. The count follows the actual source tree so every link leads to an existing file.
+
+## Choose your route
+
+| Destination | Start here | What you will discover |
+| --- | --- | --- |
+| A first working example | [Forth.Example](forth/Forth/Example.lean) | How `5 DUP +` becomes a machine computation |
+| Forth source text | [Forth.Parse](forth/Forth/Parse.lean) | Definitions, variables, comments, recursion, and loops |
+| The common machine | [WordDialect.Machine](formal/WordDialect/Machine.lean) | Instructions, state, outcomes, and authoritative execution |
+| Reusable compiler proofs | [WordIR.Frag](word-ir/WordIR/Frag.lean) | How verified control-flow fragments compose |
+| Memory-oriented source programs | [BCPL.Semantics](bcpl/BCPL/Semantics.lean) | Word expressions, indirection, assignment, and statements |
+| Mathematical computations | [Wolfram.MatrixExample](wolfram/Wolfram/MatrixExample.lean) | A concrete matrix product and its formal ingredients |
+| Native execution | [X86.Lower](backend/x86_64/X86/Lower.lean) | Register conventions, assembly sequences, and guards |
+| WebAssembly execution | [Wasm.Lower](backend/wasm/Wasm/Lower.lean) | Instruction functions and the dispatch loop |
+| Proof dependency inspection | [Audit](formal/Audit.lean) | The project's namespace-wide axiom audit |
+
+The numbered entries are arranged by the computation's journey rather than alphabetical order. Within each region, the order moves from vocabulary and execution toward translation, correctness, examples, and public imports. This makes the map useful both as a reference and as a reading course.
+
+## Before departure: the machine's vocabulary
+
+A `Word n` is a Lean `BitVec n`. Addition, subtraction, and multiplication follow fixed-width modular arithmetic. A pointer interprets the same representation as a word address. Source-level arithmetic therefore has a precise destination: a bit-vector result, with signed and unsigned interpretations used where the operation calls for them.
+
+The IR uses word-addressed memory. Address `a` selects one word; a 64-bit backend places that cell at a corresponding byte address separated by eight bytes. Its data stack is a list with the top at the head. For a binary expression written as `a b op`, `b` is on top and the result is `a op b`. Keeping that convention in mind makes the instruction definitions and compiler output much easier to follow.
+
+Control addresses are instruction indices. The machine has virtual registers, a data stack, a return stack of code addresses, and a separate auxiliary stack of words. Calls and returns use the code-address stack. Forth's return-data operations use the auxiliary stack. That separation lets saved data and loop parameters survive calls and recursion, and it carries through both backends.
+
+Execution can continue, halt, or trap. The executable targets report the shared traps with a common vocabulary:
+
+| Exit code | Meaning |
+| --- | --- |
+| `0` | Successful halt |
+| `1` | Data-stack underflow |
+| `2` | Bad memory address |
+| `3` | Division by zero |
+| `4` | Bad program counter |
+| `5` | Return-stack or auxiliary-stack underflow |
+| `6` | Target stack capacity exceeded |
+
+The IR describes unbounded stacks. The targets provide finite regions and check capacity before growing them. Their correctness results incorporate that relationship: a target reaches the IR outcome or reports overflow; when the execution stays within capacity, it reaches exactly the IR outcome. These are useful, explicit contracts to keep beside the rest of the tour.
+
+## Station I: the common word machine — files 1–10
+
+Every route passes through this region. Its definitions give the shared instruction stream meaning, and its theorems provide the language used throughout the frontend and backend proofs.
+
+### 1. [Word.lean](formal/WordDialect/Word.lean) — the value carried everywhere
+
+Defines `Word n`, pointer interpretation, comparison conditions, truth conversion, shifts, and rotations. Its lemmas establish pointer round trips and numeric behavior.
+
+### 2. [Memory.lean](formal/WordDialect/Memory.lean) — the address book
+
+Defines word cells, address validity, and optional reads and writes. The accompanying theorems describe reading a written cell, preserving other cells, and commuting independent writes.
+
+### 3. [Machine.lean](formal/WordDialect/Machine.lean) — the interchange
+
+Defines the IR instructions, traps, machine state, outcomes, `exec`, and `step`. Arithmetic, stack manipulation, register access, memory, and control flow meet here. It also defines the separate auxiliary stack.
+
+### 4. [Stack.lean](formal/WordDialect/Stack.lean) — count the passengers
+
+Assigns each instruction its operand and result counts. The underflow theorems establish what happens when operands are missing and show that sufficient operands exclude a data-stack-underflow result.
+
+### 5. [Rules.lean](formal/WordDialect/Rules.lean) — the instruction handbook
+
+Presents explicit execution rules for literals, pointers, arithmetic, memory, stack operations, and registers. Numeric lemmas connect word operations to modular arithmetic and exact results under stated bounds.
+
+### 6. [Invariants.lean](formal/WordDialect/Invariants.lean) — what stays in place
+
+Proves frame conditions for a successful instruction: stack-depth change, stable address validity, memory and register effects, and return- and auxiliary-stack preservation. It also characterizes halting and trap causes.
+
+### 7. [Exec.lean](formal/WordDialect/Exec.lean) — from a step to a journey
+
+Defines finite continuing paths with `Steps`, terminating executions with `Exec`, and the fuel-bounded interpreter `run`. Soundness, completeness, and determinism connect executable interpretation to the relations.
+
+### 8. [Init.lean](formal/WordDialect/Init.lean) — the first platform
+
+Builds memory from an image, defines the initial state, and extracts a final data stack from an outcome. It includes the direct IR version of `5 DUP +` and proves its result.
+
+### 9. [WordDialect.lean](formal/WordDialect.lean) — the public doorway
+
+Collects the word-machine modules into one import. Its role is architectural: users and downstream libraries can open the semantic foundation through `import WordDialect`.
+
+### 10. [Audit.lean](formal/Audit.lean) — the proof ledger
+
+Imports the project libraries and implements `#audit_wd`. It traverses theorem declarations in the `WordDialect` namespace and collects their axiom dependencies. The command allows Lean's standard `propext`, `Quot.sound`, and `Classical.choice`, reporting other dependencies as errors.
+
+## Station II: the compiler's construction kit — files 11–17
+
+The frontends share more than an instruction set. This region packages recurring compiler arguments so expressions, branches, and loops can reuse an established foundation.
+
+### 11. [Straight.lean](word-ir/WordIR/Straight.lean) — an uninterrupted stretch
+
+Defines straight-line instructions, code placement with `At`, and sequence execution with `execSeq`. Its theorems turn sequence calculations into machine paths or trapping executions.
+
+### 12. [Frag.lean](word-ir/WordIR/Frag.lean) — track that fits its position
+
+Defines position-dependent fragments whose emitted addresses adapt to their placement while their size stays fixed. Sequencing, conditionals, until loops, while loops, and repeat loops come with placement and execution rules.
+
+### 13. [Flag.lean](word-ir/WordIR/Flag.lean) — a shared signal convention
+
+Defines source truth flags as all ones for true and zero for false. The IR comparison produces one or zero; `cmpFlagCode` converts that result to the Forth and BCPL convention.
+
+### 14. [RExpr.lean](word-ir/WordIR/RExpr.lean) — expressions with a destination
+
+Defines register-and-memory expressions built from constants, registers, arithmetic, and loads. Each expression has an evaluator and an instruction sequence that leaves its result on the data stack.
+
+### 15. [Loop.lean](word-ir/WordIR/Loop.lean) — repeat with an invariant
+
+Builds a counted loop using a virtual register, initialization, an unsigned bound test, and an increment. `countedLoop_run` carries a supplied invariant through every iteration to the endpoint.
+
+### 16. [Program.lean](word-ir/WordIR/Program.lean) — arrive at a final outcome
+
+Lifts straight-line code into a complete program by appending `halt`. Its theorems connect a successful `execSeq` calculation to a halted execution and a trapping calculation to the same trap.
+
+### 17. [WordIR.lean](word-ir/WordIR.lean) — the workshop entrance
+
+Exports the straight-line, fragment, flag, expression, loop, and whole-program tools through one import. This entry file shows the compiler layer's reusable vocabulary at a glance.
+
+## Station III: Forth, from text to execution — files 18–28
+
+Forth makes the common machine tangible. Its data-stack operations have direct IR counterparts, while definitions, recursion, variables, return-data operations, and structured loops reveal how the translation grows into a complete source pipeline.
+
+### 18. [Semantics.lean](forth/Forth/Semantics.lean) — Forth's own account
+
+Defines operations, blocks, programs, source state, and the `Run` relation. It specifies signed division, remainder, truth flags, memory access, calls, early exit, and `DO … LOOP`. The source return-data stack is separate from call frames.
+
+### 19. [Compile.lean](forth/Forth/Compile.lean) — words become instructions
+
+Lowers primitives and blocks into IR fragments. It places the main block before `halt`, then lays out definition bodies followed by `ret`. Definition addresses come from fixed code sizes.
+
+### 20. [OpCorrect.lean](forth/Forth/OpCorrect.lean) — each primitive keeps its meaning
+
+Proves that lowering a Forth operation produces straight-line code with the behavior specified by `Op.sem`. Success transfers the resulting source state to the machine; failure preserves the trap.
+
+### 21. [Correct.lean](forth/Forth/Correct.lean) — the complete translation argument
+
+Connects source `Run` derivations to compiled machine paths, early returns, and matching traps. `DefsAt` describes dictionary-body placement, including recursive calls. `Program.compile_correct` lifts the argument to an initialized whole program.
+
+### 22. [Eval.lean](forth/Forth/Eval.lean) — a reference you can evaluate
+
+Implements a fuel-bounded source interpreter and proves `eval_sound` against `Run`. Concrete evaluation can therefore supply a source-semantics derivation, including for recursive words.
+
+### 23. [Example.lean](forth/Forth/Example.lean) — five becomes ten
+
+Takes `5 DUP +` through source semantics, compilation, and machine execution. The tiny example makes the entire frontend argument visible without a large program.
+
+### 24. [Parse.lean](forth/Forth/Parse.lean) — the text ticket office
+
+Turns source text into a dictionary, main block, and variable count. It handles case-insensitive words, comments, literals, colon definitions, recursion, early exit, variables, constants, conditionals, and loops.
+
+### 25. [Print.lean](forth/Forth/Print.lean) — a return ticket to text
+
+Prints programs using canonical variable and definition names, then proves `parse_print` for well-formed programs. The argument covers both token generation and parsing.
+
+### 26. [ParseProps.lean](forth/Forth/ParseProps.lean) — the parser's promises
+
+Proves that successful parsing yields a well-formed program and that printing such a result gives canonical source. Further results cover case behavior, comments, constants, dictionary definitions, and `RECURSE`.
+
+### 27. [TextExample.lean](forth/Forth/TextExample.lean) — the journey in source spelling
+
+Provides concrete examples spanning parsing, reference evaluation, compilation, and machine results. Its subjects include recursive sums, variables, constants, remainder, early exits, nested loops, and return-data operations. It also records parser outcomes for selected malformed inputs.
+
+### 28. [Forth.lean](forth/Forth.lean) — the frontend entrance
+
+Exports the Forth library through one import, bringing its semantics, compiler, proofs, evaluator, text tools, and examples together. For an application, this is the convenient access point.
+
+## Station IV: BCPL and the memory-centered route — files 29–34
+
+BCPL reaches the same machine from a different source perspective. Variables are memory cells, values are words, and expression and statement semantics supply the reference for compilation.
+
+### 29. [Semantics.lean](bcpl/BCPL/Semantics.lean) — expressions and statements in words
+
+Defines the supported syntax, operator meanings, expression evaluation, assignment, and statement execution. It includes indirection, address-of, conditionals, and loops. Evaluation order and signed division are explicit, and comparisons use all-ones truth flags.
+
+### 30. [Compile.lean](bcpl/BCPL/Compile.lean) — memory programs enter the interchange
+
+Lowers expressions to stack-producing instruction sequences and statements to fragments. Variables use a supplied address mapping, and statements restore the data stack on completion. Arithmetic and assignments use straight-line code; structured control uses the common fragment toolkit.
+
+### 31. [ExprCorrect.lean](bcpl/BCPL/ExprCorrect.lean) — expression results travel intact
+
+Proves straight-line properties and correctness for operator and expression lowering, covering successful values and traps. These results establish the evaluator-to-instruction connection needed by statement compilation.
+
+### 32. [Correct.lean](bcpl/BCPL/Correct.lean) — statements reach their promised memory
+
+Proves assignment and statement translation correctness. Successful compiled execution reaches the statement endpoint with the source result's memory and an unchanged data stack; trapping source execution leads to the matching machine trap.
+
+### 33. [Example.lean](bcpl/BCPL/Example.lean) — put five in a cell
+
+Uses the assignment `x := 2 + 3` to demonstrate the complete BCPL route. Given an addressable variable cell, the reference statement produces the expected memory and the compiled machine program stores five there.
+
+### 34. [BCPL.lean](bcpl/BCPL.lean) — the BCPL doorway
+
+Collects the BCPL semantics, translation, correctness results, and example under one import. The entry file marks a clean frontend boundary: the source language has its own account of execution, then connects through compiler proofs to the shared machine.
+
+## Station V: mathematical expressions and matrix cargo — files 35–39
+
+The Wolfram-style route connects mathematical integer expressions to fixed-width computation. Matrix multiplication then turns that connection into nested loops over a concrete memory layout.
+
+### 35. [Scalar.lean](wolfram/Wolfram/Scalar.lean) — integers meet fixed-width words
+
+Defines scalar expressions for integer literals, symbols, addition, multiplication, subtraction, and negation. Integer evaluation connects to `RExpr` lowering modulo the word width. Compilation and assignment theorems cover successful results and errors.
+
+### 36. [MatrixLayout.lean](wolfram/Wolfram/MatrixLayout.lean) — pack the rows
+
+Defines partial dot sums, row-major matrix representation with `MatAt`, and destination-prefix updates with `CWritten`. Its lemmas describe extending the written output while preserving source cells outside that region.
+
+### 37. [MatrixDot.lean](wolfram/Wolfram/MatrixDot.lean) — three loops carry the product
+
+Lowers matrix multiplication into row, column, and accumulation loops using four virtual registers. Geometry conditions specify address bounds and separation. Proofs progress from index expressions and accumulation to cells, rows, the full fragment, and `dotProgram_correct`.
+
+### 38. [MatrixExample.lean](wolfram/Wolfram/MatrixExample.lean) — a product you can recognize
+
+Instantiates the matrix geometry and memory representation for `[[1,2],[3,4]]` multiplied by `[[5,6],[7,8]]`, whose product is `[[19,22],[43,50]]`. It stores the inputs at word addresses zero and four and the output at eight.
+
+### 39. [Wolfram.lean](wolfram/Wolfram.lean) — the mathematical entrance
+
+Exports the scalar and matrix modules, connecting expression lowering, layout vocabulary, multiplication proofs, and the worked example. Start through this import when constructing a mathematical sample.
+
+## Station VI: the shared observation platform — file 40
+
+### 40. [Harness.lean](backend/common/Harness.lean) — compare the arrivals
+
+Defines samples, expected Lean outcomes, target result decoding, the backend `Runner` interface, fixed examples, and generated programs. The harness compares trap codes or final data stack, memory, and virtual registers.
+
+## Station VII: the x86-64 express — files 41–62
+
+The native route implements the IR with concrete registers, guarded stack regions, and GNU assembly. Its proof structure proceeds from machine semantics through local simulation to whole-program and entry-point results.
+
+### 41. [Isa.lean](backend/x86_64/X86/Isa.lean) — the native vehicle
+
+Models the emitted x86-64 instruction subset, registers, condition flags, memory access, and target outcomes. Faults and runtime exits are explicit.
+
+### 42. [Lower.lean](backend/x86_64/X86/Lower.lean) — choose the native track
+
+Defines runtime register roles, operand and capacity guards, instruction sizes, offsets, and lowering. The data stack uses `r15`, virtual registers use `r14`, IR memory uses `r13`, entry stack position uses `r12`, and auxiliary data uses `rbp`.
+
+### 43. [Emit.lean](backend/x86_64/X86/Emit.lean) — print the assembly journey
+
+Prints lowered instructions in GNU assembler Intel syntax and supplies the runtime prologue and output/exit helpers. Runtime declarations establish memory and stack regions. Successful execution writes a binary state dump; traps and overflow use their exit codes.
+
+### 44. [Rel.lean](backend/x86_64/X86/Rel.lean) — match the two timetables
+
+Defines runtime geometry and the relation between IR and native states. It maps stacks, virtual registers, memory, and return addresses into disjoint target regions. Frame lemmas support updates.
+
+### 45. [Run.lean](backend/x86_64/X86/Run.lean) — locate and follow native code
+
+Defines native continuing and terminating execution relations, code placement, and theorems locating each lowered IR instruction. It connects offset calculations to the emitted instruction list, including the trailing bad-program-counter stub.
+
+### 46. [Seq.lean](backend/x86_64/X86/Seq.lean) — compose short native stretches
+
+Provides straight-line native execution and its connection to native step paths. It also proves the conditional-jump-and-trap guard pattern.
+
+### 47. [Flags.lean](backend/x86_64/X86/Flags.lean) — read the signals correctly
+
+Proves that native condition-code interpretation after subtraction matches all ten IR comparison predicates. The argument accounts for zero, sign, carry, and overflow flags.
+
+### 48. [Micro.lean](backend/x86_64/X86/Micro.lean) — the smallest useful moves
+
+Establishes local effects of target loads, stores, scratch-register updates, stack-pointer adjustment, and pushing a word. Each lemma works with the state relation.
+
+### 49. [Guard.lean](backend/x86_64/X86/Guard.lean) — check room and operands
+
+Proves operand-count guards and data- and return-stack capacity checks. With enough operands or room, the code continues; otherwise it produces the specified underflow or overflow outcome.
+
+### 50. [SimBin.lean](backend/x86_64/X86/SimBin.lean) — one pattern, many operators
+
+Defines `MidSpec` and proves a generic binary-operation simulation. The pattern loads two operands, computes in scratch state, stores the result, and removes one stack slot.
+
+### 51. [SimOps.lean](backend/x86_64/X86/SimOps.lean) — instantiate the arithmetic route
+
+Applies the generic binary pattern to arithmetic, bitwise operations, shifts, rotations, and comparisons. Its middle specifications show the target computation matches the IR operation.
+
+### 52. [SimStack.lean](backend/x86_64/X86/SimStack.lean) — rearrange the carried words
+
+Proves simulations for literals, pointers, complement, duplication, dropping, swapping, copying a lower stack item, and rotation. Local target-step lemmas support the stack updates.
+
+### 53. [SimMem.lean](backend/x86_64/X86/SimMem.lean) — preserve neighboring regions
+
+Develops address and frame lemmas for virtual-register and IR-memory access. It establishes the effects of reading and writing those cells while preserving stack and other-region relations.
+
+### 54. [SimMemOps.lean](backend/x86_64/X86/SimMemOps.lean) — perform the checked access
+
+Proves the address bounds guard and complete simulations for virtual-register push/pop and memory load/store. Both successful access and bad-address traps are covered, with overflow behavior for a growing data stack.
+
+### 55. [SimDiv.lean](backend/x86_64/X86/SimDiv.lean) — handle division's special junctions
+
+Covers unsigned division, signed division, and three-operand selection. The proofs include zero-divisor traps and the signed divisor-minus-one path that avoids native division overflow while preserving modular word semantics.
+
+### 56. [SimCtl.lean](backend/x86_64/X86/SimCtl.lean) — branch, call, and return
+
+Proves simulations for jumps, conditional branches, calls, returns, and halt. The native return stack stores lowered return-code indices corresponding to IR addresses. Return underflow and call overflow receive explicit results.
+
+### 57. [SimAux.lean](backend/x86_64/X86/SimAux.lean) — a separate place for saved data
+
+Proves auxiliary-stack access, push/pop effects, capacity and empty-stack guards, and the `tor`, `fromr`, and `rfetch` simulations. Its dedicated region and `rbp` pointer preserve saved words across native calls.
+
+### 58. [SimStep.lean](backend/x86_64/X86/SimStep.lean) — every instruction gets a connection
+
+Combines the instruction-family results into `sim_exec`, covering each IR instruction and continuing, halted, or trapped outcomes. `Fits` describes required stack headroom, and simulation includes overflow where capacity runs out.
+
+### 59. [Correct.lean](backend/x86_64/X86/Correct.lean) — preserve the complete journey
+
+Lifts instruction simulation to whole-program behavior. `lowerProg_correct_or_overflow` allows a matching IR outcome or overflow; `lowerProg_correct` gives the matching outcome when reachable states fit. Geometry, layout agreement, code-address bounds, and valid register indices make the program's target contract explicit.
+
+### 60. [Init.lean](backend/x86_64/X86/Init.lean) — begin at the binary entrance
+
+Models the prologue and proves its effect, then relates the resulting native state to `State.init`. `Loader.Holds` gathers the loader's memory, placement, and entry-stack facts.
+
+### 61. [X86.lean](backend/x86_64/X86.lean) — the native library entrance
+
+Exports the native model, lowering, emitter, relations, simulation modules, whole-program proofs, and initialization result. This import gives users the complete backend library.
+
+### 62. [Main.lean](backend/x86_64/Main.lean) — take the express for a run
+
+Implements `wordc`: emit assembly, assemble and link with `as` and `ld`, execute, and compare against Lean. It supports fixed/generated checks and Forth files, plus auxiliary-stack and overflow samples.
+
+## Station VIII: the WebAssembly line — files 63–81
+
+WebAssembly offers structured control, typed operands, and byte memory. This route represents each IR instruction as a function returning the next instruction index, then runs those functions through a dispatch loop.
+
+### 63. [Isa.lean](backend/wasm/Wasm/Isa.lean) — the WebAssembly vehicle
+
+Models typed values, globals, byte-addressed linear memory, the emitted instruction subset, function tables, and structured execution. Reads and writes use little-endian bytes; loops and branches obey label discipline. Division and host-exit behavior are explicit.
+
+### 64. [Lower.lean](backend/wasm/Wasm/Lower.lean) — turn jumps into dispatch
+
+Lowers each IR instruction to a function returning an `i32` next index. A dispatch loop calls through the function table. Globals track program counter and three stack pointers; memory regions hold registers, IR cells, and stacks.
+
+### 65. [Emit.lean](backend/wasm/Wasm/Emit.lean) — print the module
+
+Produces WebAssembly text from lowered instructions and supplies memory declarations, data bytes, globals, imports, and the halt helper. Runtime layout constants determine region placement and capacity.
+
+### 66. [Mem.lean](backend/wasm/Wasm/Mem.lean) — eight bytes make a word
+
+Proves that writing eight bytes reconstructs the same 64-bit value on a read at that address. Reads of disjoint cells stay unchanged, and writes preserve memory size.
+
+### 67. [Rel.lean](backend/wasm/Wasm/Rel.lean) — align the two state views
+
+Defines runtime geometry and the relation between IR values and WebAssembly globals and memory. Separate views cover the data stack, registers, IR memory, return addresses, and auxiliary words.
+
+### 68. [Seq.lean](backend/wasm/Wasm/Seq.lean) — join target computations
+
+Defines straight-line execution with `execL` and derives the target `Run` relation from successful calculations. Sequencing lemmas handle normal completion and abrupt outcomes, with useful conditional cases.
+
+### 69. [Frame.lean](backend/wasm/Wasm/Frame.lean) — update one region at a time
+
+Proves how eight-byte writes affect the five state views. Updates to a stack, register, or IR-memory cell preserve the other regions. Further lemmas handle stack-pointer adjustment and pushing or popping return and auxiliary entries.
+
+### 70. [Guard.lean](backend/wasm/Wasm/Guard.lean) — the checked platform edge
+
+Proves sequence append behavior, state-relation conveniences, operand guards, and capacity guards. Passing checks preserve the required relation; failing checks produce the appropriate exit.
+
+### 71. [SimAlu.lean](backend/wasm/Wasm/SimAlu.lean) — the arithmetic carriage
+
+Provides generic binary-operation simulation and instantiates it for arithmetic, bitwise operations, rotations, and comparisons. It connects two stack-cell loads, a target operation, a result store, and stack adjustment.
+
+### 72. [SimAlu2.lean](backend/wasm/Wasm/SimAlu2.lean) — arithmetic's special connections
+
+Handles shifts, division, signed division, and complement. Large shift counts yield zero as required by the IR, while division checks zero explicitly. The signed divisor-minus-one case preserves modular semantics while avoiding WebAssembly's signed-division overflow trap.
+
+### 73. [SimStack.lean](backend/wasm/Wasm/SimStack.lean) — move words through memory
+
+Proves stack manipulation, selection, literals, pointers, and virtual-register transfers. General push and core-sequence lemmas support multiple operations, with guards for operand availability and capacity.
+
+### 74. [SimMem.lean](backend/wasm/Wasm/SimMem.lean) — find the right eight bytes
+
+Proves IR-address checking, conversion to `mb + 8a`, and simulations of load and store. A valid word address reaches the corresponding bytes; an invalid address exits with bad-address code two.
+
+### 75. [SimCtl.lean](backend/wasm/Wasm/SimCtl.lean) — return the next station index
+
+Covers jumps, branches, calls, returns, halt, and the bad-program-counter stub. Continuing instruction functions leave the next IR index for dispatch. Calls and returns update the dedicated return region; empty returns and full call stacks receive defined exits.
+
+### 76. [SimAux.lean](backend/wasm/Wasm/SimAux.lean) — preserve the saved-word connection
+
+Proves `tor`, `fromr`, and `rfetch` over the auxiliary region tracked by `$ap`. It covers successful movement and copying, empty-stack code five, and capacity code six.
+
+### 77. [SimExec.lean](backend/wasm/Wasm/SimExec.lean) — one complete dispatch step
+
+Combines all instruction-family results into `sim_step`. It defines stack headroom, trap-code mapping, and the relation between one emitted function's execution and one IR outcome.
+
+### 78. [Correct.lean](backend/wasm/Wasm/Correct.lean) — carry the result through the loop
+
+Proves dispatch-loop preservation and lifts it to the module's start function. The two main results offer matching IR behavior with overflow allowed, or exact matching behavior under capacity conditions.
+
+### 79. [Init.lean](backend/wasm/Wasm/Init.lean) — start from an instantiated module
+
+Constructs initial globals and zeroed memory with the emitted data image, proves runtime geometry and the initial state relation, and establishes `module_correct`. Program-layout fit and register and instruction bounds remain explicit.
+
+### 80. [Wasm.lean](backend/wasm/Wasm.lean) — the WebAssembly library entrance
+
+Exports the target model, lowering, emitter, memory facts, relations, framing, guards, instruction simulations, whole-program correctness, and initialization. One import provides the full WebAssembly backend.
+
+### 81. [WasmMain.lean](backend/wasm/WasmMain.lean) — ride the line in Wasmtime
+
+Implements `wasmw`: emit WAT, run it through Wasmtime, and compare target output with Lean. It supports sample checks, generated programs, source Forth execution, and source emission.
+
+## Make your first journey
+
+Install Git and [elan](https://github.com/leanprover/elan), then make `lean` and `lake` available on your path. The repository pins `leanprover/lean4:v4.34.1`; elan selects that toolchain. The Lake package is named `UniversalWord`, and its manifest lists no external package dependencies.
+
+```sh
+git clone https://github.com/SNAPKITTYWEST/ai-free.git
+cd ai-free
+lake build
+```
+
+The default build includes the semantic and frontend libraries, shared harness, both backend libraries, and the `wordc` and `wasmw` executables. Native execution uses x86-64 Linux with GNU `as` and `ld`. WebAssembly execution uses [Wasmtime](https://github.com/bytecodealliance/wasmtime/releases); the workflow selects version `30.0.2`.
+
+Try a short source file containing `5 DUP +`, or use the repository's [Forth examples](examples/forth). The commands below exercise real source parsing and compilation before comparing target behavior with Lean:
+
+```sh
+.lake/build/bin/wordc forth examples/forth/fib.fs
+.lake/build/bin/wasmw forth examples/forth/memory.fs 16
+.lake/build/bin/wordc emit-forth examples/forth/sum.fs > /tmp/sum.s
+.lake/build/bin/wasmw emit-forth examples/forth/sum.fs > /tmp/sum.wat
+```
+
+The optional memory-word count defaults to sixteen. Variables occupy cells starting at zero; the executable frontend arranges memory for the parsed program. Forth definitions can call themselves, and `RECURSE` names the current definition. `DO … LOOP`, `I`, `J`, and return-data words provide especially interesting examples because their data survives calls through the auxiliary stack.
+
+For a broader trip, run the fixed samples and three hundred generated programs on each destination:
+
+```sh
+.lake/build/bin/wordc check 300
+.lake/build/bin/wasmw check 300
+```
+
+With no count, the generated-program count defaults to two hundred. `check 0` runs the fixed checks without generated programs. The shared reference interpreter uses bounded fuel; programs that exhaust it are reported as skipped. Generation uses a fixed seed, helping make comparisons reproducible. Backend checks additionally exercise auxiliary-stack behavior and intentional overflow.
+
+You can also inspect a built-in sample's output without running the target:
+
+```sh
+.lake/build/bin/wordc emit forth_five_dup_plus > /tmp/five.s
+.lake/build/bin/wasmw emit forth_five_dup_plus > /tmp/five.wat
+```
+
+Other named samples include `bcpl_sum_1_to_10`, `wolfram_dot_2x2`, and `raw_call_ret`. The shared harness contains the complete sample lists. Native execution artifacts are written under `/tmp/wordc`; WebAssembly artifacts use `/tmp/wasmw`. Successful target output is a binary state dump decoded by the harness, so these commands are most informative when used with the comparison tools or emitter output.
+
+## Read the proofs as a connected story
+
+A source correctness theorem begins with a source execution result. The compiler translates that program into the shared IR, and its theorem establishes the corresponding machine execution. A backend theorem then connects that machine execution to a target model. Initialization results establish the relation at the target's starting state. The examples make these connections concrete with values and memory images you can recognize.
+
+When exploring a theorem, start with its conclusion and then inspect its hypotheses. A matrix theorem's geometry explains where input and output cells live. A backend theorem's register condition explains which virtual-register indices the configured file supports. A capacity condition explains when a bounded target follows the IR outcome exactly. These hypotheses are part of the module's usable interface and often reveal the clearest path to constructing your own example.
+
+For a small complete reading route, follow Forth's example into its compiler and correctness file, then open the shared harness and one executable entry point. For a deeper route, begin with the machine, read straight-line and fragment composition, and follow BCPL statement correctness. For nested-loop reasoning, take the counted-loop module into matrix layout, matrix multiplication, and its concrete example.
+
+The two backend routes offer an illuminating comparison. Native lowering computes target offsets and uses native calls. WebAssembly lowering returns IR instruction indices through a table-driven dispatch loop. Both preserve the same source of meaning, use separate storage for call addresses and auxiliary words, and connect local instruction simulations to complete execution results. Their different implementations make the common semantic layer especially valuable to readers.
+
+A useful exercise is to trace one value across the map. In `5 DUP +`, parsing produces a literal and two operations; reference evaluation duplicates five and adds the pair; compilation emits the corresponding IR sequence; either backend carries that sequence to its target representation. The final stack contains ten. For BCPL, trace the same arithmetic into a variable cell instead. For matrix multiplication, trace one output entry through its accumulator register, the inner loop, and the destination write. These three examples give you stack, memory, and loop perspectives on the same architecture. Once those routes feel familiar, the larger theorem files become easier to navigate: identify the local semantic result, find its compiled fragment, locate the appropriate simulation, and follow the composition to the final outcome. Each step has a named home in this atlas for your next exploration.
+
+## The project's verification practice
+
+The repository includes a namespace-wide axiom audit and a [CI workflow](.github/workflows/lean.yml) that builds the libraries, checks prohibited proof constructs, runs the audit, exercises both executable backends, and runs the Forth example files. The audit command is:
+
+```sh
+lake env lean formal/Audit.lean
+```
+
+Formal results describe the machine models and their stated interfaces. Differential execution compares emitted artifacts through real assemblers and runtimes with the Lean reference. Together, these give readers a theorem route through the definitions and an execution route through concrete programs. The audit makes theorem dependencies inspectable across the imported libraries.
+
+When adding an operation, a useful path is to define its semantic behavior, connect its translation with an appropriate correctness result, and add a shared sample. An existing example provides a manageable starting point. For source-interface work, parser and printer properties show how text behavior can receive the same attention as machine behavior. For backend work, the instruction-family files indicate where a new local simulation joins the complete step theorem.
+
+After a code change, use the project's build, audit, and backend checks as the repository workflow prescribes. For navigation and documentation, this atlas lets you move directly to the relevant source file and follow its imports. Each numbered stop identifies a real module's contribution, from the first word representation to the two executable destinations.
+
+## License
+
+The project uses the [Parr Source License — No AI Training, Version 1.0](License), copyright © 2026 Ahmad Ali Parr. The license text defines permitted purposes and its conditions, including restrictions concerning competing use and AI training. Refer to that file for the governing terms when using, modifying, or distributing the project.
+

backend/common/Harness.lean

@@ -0,0 +1,307 @@
+import WordDialect
+import WordIR
+import Forth
+import BCPL
+import Wolfram
+
+/-!
+# Harness
+
+Shared differential-testing harness for every backend. A backend supplies a `Runner`: it takes a
+`Sample` (an IR program plus initial memory and register-file size), runs it on the real target,
+and reports either the dumped final state or the exit code of a trap. The harness runs the same IR
+program under the Lean semantics (`WordDialect.run`) and compares.
+
+Trap exit codes are common to all backends: 1 stackUnderflow, 2 badAddress, 3 divideByZero,
+4 badPc, 5 returnUnderflow; 6 is a target stack overflow, which has no IR counterpart. On halt a backend writes, as raw little-endian 64-bit words, the data
+stack depth, the data stack (top first), the IR memory and the virtual registers.
+-/
+
+open WordDialect
+
+structure Sample where
+  name : String
+  prog : Prog 64
+  mem : List Nat
+  nregs : Nat := 4
+  /-- Set when the sample could not be built (e.g. Forth source failed to parse); `check`
+  then reports an error instead of running anything. -/
+  buildError : Option String := none
+
+def mkMem (img : List Nat) : Memory 64 := Memory.ofImage img
+
+inductive Result where
+  | halted (stack mem regs : List Nat)
+  | trap (code : Nat)
+  | timeout
+  deriving BEq, Repr
+
+/-- Expected result under the Lean semantics. -/
+def trapCode : Trap → Nat
+  | .stackUnderflow => 1
+  | .badAddress => 2
+  | .divideByZero => 3
+  | .badPc => 4
+  | .returnUnderflow => 5
+
+def expected (s : Sample) : Result :=
+  match run s.prog 200000 (State.init (mkMem s.mem)) with
+  | none => .timeout
+  | some (.trapped t) => .trap (trapCode t)
+  | some (.next _) => .timeout
+  | some (.halted st) =>
+    .halted (st.dstack.map (·.toNat))
+      ((List.range s.mem.length).map fun a => (st.mem.cell (BitVec.ofNat 64 a)).toNat)
+      ((List.range s.nregs).map fun r => (st.regs r).toNat)
+
+def u64 (b : ByteArray) (off : Nat) : Nat :=
+  (List.range 8).foldl (fun acc i => acc + (b.get! (off + i)).toNat * 2 ^ (8 * i)) 0
+
+partial def readAll (h : IO.FS.Handle) (acc : ByteArray) : IO ByteArray := do
+  let chunk ← h.read 65536
+  if chunk.isEmpty then pure acc else readAll h (acc ++ chunk)
+
+def parseDump (s : Sample) (b : ByteArray) : Option Result :=
+  if b.size < 8 then none else
+  let depth := u64 b 0
+  let m := s.mem.length
+  if b.size != 8 + 8 * depth + 8 * m + 8 * s.nregs then none else
+  some (.halted ((List.range depth).map fun i => u64 b (8 + 8 * i))
+    ((List.range m).map fun i => u64 b (8 + 8 * depth + 8 * i))
+    ((List.range s.nregs).map fun i => u64 b (8 + 8 * depth + 8 * m + 8 * i)))
+
+/-- A backend: run a sample on the real target. -/
+abbrev Runner := Sample → IO (Except String Result)
+
+def check (run : Runner) (s : Sample) : IO Bool := do
+  if let some e := s.buildError then
+    IO.println s!"ERROR {s.name}: {e}"; return false
+  let exp := expected s
+  match exp with
+  | .timeout => IO.println s!"SKIP  {s.name} (IR did not terminate within fuel)"; return true
+  | _ =>
+    match ← run s with
+    | .error e => IO.println s!"ERROR {s.name}: {e}"; return false
+    | .ok got =>
+      if got == exp then
+        IO.println s!"PASS  {s.name}  {repr exp}"; return true
+      else
+        IO.println s!"FAIL  {s.name}\n  lean:   {repr exp}\n  target: {repr got}"; return false
+
+/-! ## Programs from the frontends -/
+
+def forthSample (name : String) (b : Forth.Block) (mem : List Nat := List.replicate 16 0) : Sample :=
+  { name, prog := Forth.compileProgram b, mem }
+
+/-- A sample written as Forth source text. A parse failure becomes a reported error. The memory
+image is extended with zero cells if the program's `VARIABLE`s (cells `0 … vars - 1`) need more. -/
+def forthTextSample (name : String) (src : String) (mem : List Nat := List.replicate 16 0) :
+    Sample :=
+  match Forth.parse src with
+  | .ok P => { name, prog := P.compile, mem := mem ++ List.replicate (P.vars - mem.length) 0 }
+  | .error e => { name, prog := [], mem, buildError := some s!"Forth parse error: {e}" }
+
+open Forth in
+def forthOps (ops : List Op) : Block := ops.foldr (fun o b => .op o b) .nil
+
+def bcplAddr : BCPL.Var → Word 64 := fun x => BitVec.ofNat 64 x
+
+def samplesFrontends : List Sample :=
+  open Forth in
+  [ forthSample "forth_five_dup_plus" Forth.fiveDupPlus
+  , forthSample "forth_countdown"
+      (.op (.lit 10) (.untilL (forthOps [.lit 1, .sub, .dup, .lit 0, .eq]) .nil))
+  , forthSample "forth_if_else" (.op (.lit 3) (.op (.lit 5) (.op .lt (.ite (.op (.lit 111) .nil) (.op (.lit 222) .nil) .nil))))
+  , forthSample "forth_store_fetch" (forthOps [.lit 42, .lit 7, .store, .lit 7, .fetch])
+  , forthSample "forth_sdiv_trunc" (forthOps [.lit (-7), .lit 2, .div])
+  , forthSample "forth_sdiv_intmin" (forthOps [.lit (-9223372036854775808), .lit (-1), .div])
+  , forthSample "forth_shifts" (forthOps [.lit 1, .lit 64, .lshift, .lit (-1), .lit 70, .rshift,
+      .lit 255, .lit 3, .rshift, .lit 1, .lit 63, .lshift])
+  , forthSample "forth_compare_signed" (forthOps [.lit (-1), .lit 1, .lt, .lit (-1), .lit 1, .ult,
+      .lit 5, .lit 5, .eq, .lit 5, .lit 6, .ne])
+  , forthSample "forth_stack_words" (forthOps [.lit 1, .lit 2, .lit 3, .rot, .over, .swap, .dup,
+      .drop])
+  , forthSample "forth_trap_div0" (forthOps [.lit 1, .lit 0, .div])
+  , forthSample "forth_trap_underflow" (forthOps [.add])
+  , forthSample "forth_trap_badaddr" (forthOps [.lit 1000, .fetch])
+  , forthTextSample "forth_text_sum_recursive" Forth.sumSrc
+  , forthTextSample "forth_text_fib_recursive"
+      ": FIB ( n -- fib[n] ) DUP 2 < IF ELSE DUP 1 - FIB SWAP 2 - FIB + THEN ;\n15 FIB"
+  , forthTextSample "forth_text_gcd_words"
+      ": MOD ( a b -- a mod b ) OVER OVER / * - ;\n\
+       : GCD ( a b -- g ) BEGIN SWAP OVER MOD DUP 0 = UNTIL DROP ;\n\
+       1071 462 GCD 3 !  3 @  \\ store the result at address 3, read it back"
+  , forthTextSample "forth_text_trap_in_word" ": INNER 1 0 / ; : OUTER 7 INNER 8 ; 5 OUTER"
+  , forthTextSample "forth_text_mod_zeq"
+      "-7 2 MOD  7 -2 MOD  -7 -2 MOD  9223372036854775807 10 MOD\n\
+       -9223372036854775808 -1 MOD  0 0=  5 0=  -1 0="
+  , forthTextSample "forth_text_trap_mod0" "5 1 0 MOD"
+  , forthTextSample "forth_text_variables"
+      "VARIABLE N  VARIABLE ACC  100 CONSTANT LIMIT\n\
+       : STEP ( -- ) ACC @ N @ + ACC !  N @ 1 + N ! ;\n\
+       0 N !  0 ACC !  BEGIN STEP N @ LIMIT > UNTIL  ACC @ N @"
+  , forthTextSample "forth_text_many_variables"
+      "VARIABLE A0 VARIABLE A1 VARIABLE A2 VARIABLE A3 VARIABLE A4 VARIABLE A5 VARIABLE A6\n\
+       VARIABLE A7 VARIABLE A8 VARIABLE A9 VARIABLE A10 VARIABLE A11 VARIABLE A12 VARIABLE A13\n\
+       VARIABLE A14 VARIABLE A15 VARIABLE A16 VARIABLE A17 VARIABLE A18 VARIABLE A19\n\
+       77 A19 !  -5 A0 !  A19 @ A0 @ +  A19"
+  , forthTextSample "forth_text_exit_recursive"
+      ": GCD ( a b -- g ) DUP 0= IF DROP EXIT THEN SWAP OVER MOD RECURSE ;\n\
+       : SUM ( n -- 0+...+n ) DUP 0= IF EXIT THEN DUP 1 - RECURSE + ;\n\
+       1071 462 GCD  20 SUM"
+  , forthTextSample "forth_text_exit_dead_code" ": F 1 EXIT 2 3 ; : G F F + EXIT F ; G"
+  , forthTextSample "forth_text_do_loop_sum" "0 10 0 DO I + LOOP  0 1 0 DO I 7 + + LOOP"
+  , forthTextSample "forth_text_nested_loops" "0 3 0 DO 4 0 DO I J * + LOOP LOOP"
+  , forthTextSample "forth_text_rstack_across_call"
+      ": BUMP ( R: x -- x+1 ) R> 1 + >R ; : PEEK R@ ; 5 >R BUMP BUMP PEEK R>"
+  , forthTextSample "forth_text_rstack_recursive"
+      ": SUMR ( n -- 0+...+n ) DUP 0= IF EXIT THEN DUP >R 1 - RECURSE R> + ;\n10 SUMR"
+  , forthTextSample "forth_text_trap_fromr_empty" "1 2 R>"
+  , forthTextSample "forth_text_trap_rfetch_empty" "1 >R R> R@"
+  , forthTextSample "forth_text_loop_calls_loop"
+      ": TRI ( n -- 0+...+n-1 ) 0 SWAP 0 DO I + LOOP ;\n0 6 1 DO I TRI + LOOP  4 TRI"
+  , forthTextSample "forth_text_loop_exit"
+      ": FIND3 10 0 DO I 3 = IF I EXIT THEN LOOP 99 ; FIND3 R> R>"
+  , forthTextSample "forth_text_loop_recursive"
+      ": F ( acc n -- acc' ) DUP IF DUP 0 DO SWAP I + SWAP LOOP 1 - RECURSE ELSE DROP THEN ;\n\
+       0 3 F"
+  , forthTextSample "forth_text_trap_do_underflow" "1 DO LOOP"
+  , forthTextSample "forth_text_trap_loop_rdrop" "3 0 DO R> DROP LOOP"
+  , forthTextSample "forth_text_trap_j_outside" "1 >R 2 >R J"
+  , { name := "bcpl_sum_1_to_10", mem := List.replicate 4 0,
+      prog := BCPL.compileProgram bcplAddr
+        (.seq (.assign (.var 1) (.num 10)) (.seq (.assign (.var 0) (.num 0))
+          (.while (.bin .ne (.var 1) (.num 0))
+            (.seq (.assign (.var 0) (.bin .add (.var 0) (.var 1)))
+                  (.assign (.var 1) (.bin .sub (.var 1) (.num 1))))))) }
+  , { name := "bcpl_indirect", mem := List.replicate 8 0,
+      prog := BCPL.compileProgram bcplAddr
+        (.seq (.assign (.var 0) (.addrOf 5))
+          (.seq (.assign (.rv (.var 0)) (.num 77))
+            (.assign (.var 1) (.bin .add (.rv (.var 0)) (.num 1))))) }
+  , { name := "wolfram_dot_2x2", nregs := 4,
+      mem := [1, 2, 3, 4, 5, 6, 7, 8, 0, 0, 0, 0],
+      prog := (Wolfram.dotFrag 2 2 2 0 4 8 : IR.Frag 64).emit 0 ++ [.halt] }
+  , { name := "wolfram_dot_3x2_2x4", nregs := 4,
+      mem := [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+      prog := (Wolfram.dotFrag 3 2 4 0 6 14 : IR.Frag 64).emit 0 ++ [.halt] }
+  ]
+
+/-! ## Hand-written IR covering control flow and calls -/
+
+def samplesRaw : List Sample :=
+  [ { name := "raw_call_ret", mem := [], nregs := 1,
+      prog := [.word 5, .call 4, .call 4, .halt, .dup, .add, .ret] }
+  , { name := "raw_trap_ret_empty", mem := [], nregs := 1, prog := [.ret] }
+  , { name := "raw_trap_badpc", mem := [], nregs := 1, prog := [.word 1, .jmp 100] }
+  , { name := "raw_rotates", mem := [], nregs := 1,
+      prog := [.word 0x8000000000000001, .word 1, .rotl, .word 0x8000000000000001, .word 1, .rotr,
+               .word 3, .word 130, .rotl, .halt] }
+  , { name := "raw_select_regs", mem := [], nregs := 3,
+      prog := [.word 9, .pop 2, .word 11, .word 22, .word 0, .select, .push 2, .word 11,
+               .word 22, .word 1, .select, .halt] }
+  ]
+
+/-! ## Randomised differential testing -/
+
+def edge : Array Nat :=
+  #[0, 1, 2, 3, 7, 63, 64, 65, 127, 128, 255, 2 ^ 63 - 1, 2 ^ 63, 2 ^ 63 + 1, 2 ^ 64 - 1,
+    2 ^ 64 - 2, 0xdeadbeef, 0x123456789abcdef0]
+
+def randWord : IO Nat := do
+  let k ← IO.rand 0 3
+  if k = 0 then
+    let hi ← IO.rand 0 (2 ^ 32 - 1)
+    let lo ← IO.rand 0 (2 ^ 32 - 1)
+    pure (hi * 2 ^ 32 + lo)
+  else
+    let i ← IO.rand 0 (edge.size - 1)
+    pure edge[i]!
+
+def conds : Array Cond := #[.eq, .ne, .ult, .ule, .ugt, .uge, .slt, .sle, .sgt, .sge]
+
+def genInstr (depth : Nat) : IO (List (Instr 64) × Int) := do
+  let r ← IO.rand 0 99
+  if depth < 2 && r >= 6 then
+    let k ← IO.rand 0 2
+    if k = 0 then do let w ← randWord; return ([.word (BitVec.ofNat 64 w)], 1)
+    else if k = 1 then do let q ← IO.rand 0 3; return ([.push q], 1)
+    else do let w ← randWord; return ([.word (BitVec.ofNat 64 w)], 1)
+  else
+    let k ← IO.rand 0 30
+    match k with
+    | 0 => do let w ← randWord; return ([.word (BitVec.ofNat 64 w)], 1)
+    | 1 => return ([.add], -1) | 2 => return ([.sub], -1) | 3 => return ([.mul], -1)
+    | 4 => return ([.and], -1) | 5 => return ([.or], -1) | 6 => return ([.xor], -1)
+    | 7 => return ([.not], 0)
+    | 8 => return ([.shl], -1) | 9 => return ([.shr], -1)
+    | 10 => return ([.rotl], -1) | 11 => return ([.rotr], -1)
+    | 12 => return ([.div], -1) | 13 => return ([.sdiv], -1)
+    | 14 => do let c ← IO.rand 0 9; return ([.cmp (conds[c]?.getD .eq)], -1)
+    | 15 => return ([.select], -2)
+    | 16 => return ([.dup], 1) | 17 => return ([.drop], -1) | 18 => return ([.swap], 0)
+    | 19 => return ([.over], 1) | 20 => return ([.rot], 0)
+    | 21 => do let q ← IO.rand 0 3; return ([.push q], 1)
+    | 22 => do let q ← IO.rand 0 3; return ([.pop q], -1)
+    | 23 => do let v ← randWord; let a ← IO.rand 0 17
+               return ([.word (BitVec.ofNat 64 v), .word (BitVec.ofNat 64 a), .store], 0)
+    | 24 => do let a ← IO.rand 0 17; return ([.word (BitVec.ofNat 64 a), .load], 1)
+    | 25 => do let v ← randWord; return ([.word (BitVec.ofNat 64 v), .word 0, .select], 0)
+    | 26 => return ([.tor], -1) | 27 => return ([.fromr], 1) | 28 => return ([.rfetch], 1)
+    | _ => do let w ← randWord; return ([.word (BitVec.ofNat 64 w)], 1)
+
+def genProg (len : Nat) : IO (List (Instr 64)) := do
+  let mut code : List (Instr 64) := []
+  let mut depth : Int := 0
+  for _ in List.range len do
+    let (is, d) ← genInstr depth.toNat
+    code := code ++ is
+    depth := max 0 (depth + d)
+  -- a few forward jumps / conditional branches
+  let n := code.length
+  for _ in List.range 2 do
+    let k ← IO.rand 0 (n - 1)
+    let skip ← IO.rand 1 4
+    let kind ← IO.rand 0 1
+    if kind = 0 then
+      code := code.set k (.jmp (min n (k + 1 + skip)))
+    else
+      code := code.set k (.branch (min n (k + 1 + skip)))
+  return code ++ [.halt]
+
+def fuzz (run : Runner) (count : Nat) : IO Bool := do
+  let mut ok := true
+  let mut skipped := 0
+  let mut halts := 0
+  let mut traps : Array Nat := #[0, 0, 0, 0, 0, 0]
+  let mut longest := 0
+  for i in List.range count do
+    let len ← IO.rand 4 40
+    let prog ← genProg len
+    let mem ← (List.range 16).mapM fun _ => randWord
+    let s : Sample := { name := s!"fuzz_{i}", prog, mem, nregs := 4 }
+    let exp := expected s
+    match exp with
+    | .halted st _ _ => halts := halts + 1; longest := max longest st.length
+    | .trap c => traps := traps.set! c (traps[c]! + 1)
+    | .timeout => pure ()
+    if exp == .timeout then skipped := skipped + 1 else
+    match ← run s with
+    | .error e => IO.println s!"ERROR fuzz_{i}: {e}"; ok := false
+    | .ok got =>
+      if got != exp then
+        IO.println s!"FAIL  fuzz_{i}\n  lean:   {repr exp}\n  target: {repr got}"
+        ok := false
+  IO.println s!"fuzz: {count} programs, {skipped} skipped; halted {halts}; traps by code (1 underflow, 2 badaddr, 3 div0, 4 badpc, 5 ret) {traps.toList.drop 1}; max final depth {longest}; {if ok then "all agree" else "MISMATCH"}"
+  return ok
+
+def allSamples : List Sample := samplesFrontends ++ samplesRaw
+
+/-- Run every sample and `count` random programs against a backend. -/
+def checkAll (run : Runner) (count : Nat) : IO Bool := do
+  IO.setRandSeed 20260610
+  let mut ok := true
+  for s in allSamples do
+    if !(← check run s) then ok := false
+  if !(← fuzz run count) then ok := false
+  return ok

backend/wasm/Wasm.lean

@@ -0,0 +1,17 @@
+import Wasm.Isa
+import Wasm.Lower
+import Wasm.Emit
+import Wasm.Mem
+import Wasm.Rel
+import Wasm.Seq
+import Wasm.Frame
+import Wasm.Guard
+import Wasm.SimAlu
+import Wasm.SimAlu2
+import Wasm.SimStack
+import Wasm.SimMem
+import Wasm.SimCtl
+import Wasm.SimAux
+import Wasm.SimExec
+import Wasm.Correct
+import Wasm.Init

backend/wasm/Wasm/Correct.lean

@@ -0,0 +1,292 @@
+import Wasm.SimExec
+
+/-!
+# Wasm.Correct
+
+Whole-program preservation for the WebAssembly backend. The module's start function is the
+dispatch loop `loop { pc := call_indirect table[pc] ; br 0 }` over the function table
+`funcsOf L p`. Running it from a state related to the IR state `s` reaches the outcome the IR
+semantics reaches from `s`:
+
+* IR `halted s'`  ⇒  the loop halts (`exitHalt`) in a state `w'` with `Rel0 c s' w'`, so the data
+  stack, virtual registers, IR memory and return stack agree with `s'`;
+* IR `trapped t`  ⇒  the loop exits with code `trapCode t`.
+
+Every instruction that grows a stack checks for room and exits with code 6 when the stack is
+full, so there are two forms of the theorem:
+
+* `lowerProg_correct_or_overflow` has no capacity hypothesis: the module reaches the IR outcome as
+  above, or it exits with code 6 (the run needed more stack than the target provides);
+* `lowerProg_correct` additionally assumes the IR run stays within the capacities (`Fits` at every
+  reachable state); then no guard fires and the module reaches exactly the IR outcome.
+
+Hypotheses of both (all explicit):
+* `Geom c`         the memory regions are disjoint and inside the 32-bit linear memory, and each
+                   stack can hold at least one word;
+* `hn`             the program has fewer than `2^32` instructions (function indices are `i32`);
+* `RegsOk`         every `push r`/`pop r` names a register inside the register file.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+/-- Every register index used by the program lies in the virtual register file. -/
+def RegsOk (c : Cfg) (p : Prog 64) : Prop :=
+  ∀ (k : Nat) (i : WordDialect.Instr 64), p[k]? = some i →
+    ∀ r : Nat, (i = .push r ∨ i = .pop r) → r < c.nregs
+
+def loopBody : List WI := [.globalGet pcG, .callIndirect, .globalSet pcG, .br 0]
+
+theorem mainBody_eq : mainBody = [.loop loopBody] := rfl
+
+/-- The relation at the top of the dispatch loop: operand stack empty, the `pc` global holding the
+IR `pc` clamped to `n` (a jump past the end is clamped at lowering time), and every return index
+within the program. -/
+def RelD (c : Cfg) (n : Nat) (s : State 64) (w : WState) : Prop :=
+  Rel0 c s w ∧ w.stack = [] ∧ w.globals pcG = .i32 (ofN (min s.pc n)) ∧ ∀ a ∈ s.rstack, a ≤ n
+
+/-- One IR step, seen from the top of the dispatch loop. -/
+def LoopSim (c : Cfg) (fs : Funcs) (n : Nat) (w : WState) : Outcome 64 → Prop
+  | .next s' => ∃ w', RelD c n s' w' ∧
+      ∀ r, RunI fs (.loop loopBody) w' r → RunI fs (.loop loopBody) w r
+  | .halted s' => ∃ w', RunI fs (.loop loopBody) w (.halted w') ∧ Rel0 c s' w'
+  | .trapped t => RunI fs (.loop loopBody) w (.exit (trapCode t))
+
+/-- The final-outcome form, for the loop. -/
+def Final (c : Cfg) (fs : Funcs) (w : WState) : Outcome 64 → Prop
+  | .next _ => False
+  | .halted s' => ∃ w', RunI fs (.loop loopBody) w (.halted w') ∧ Rel0 c s' w'
+  | .trapped t => RunI fs (.loop loopBody) w (.exit (trapCode t))
+
+/-- Exit code 6: a stack overflow guard fired. -/
+def overflowCode : Nat := 6
+
+/-- The final-outcome form, for the module's start function. -/
+def FinalMain (c : Cfg) (fs : Funcs) (w : WState) : Outcome 64 → Prop
+  | .next _ => False
+  | .halted s' => ∃ w', Run fs mainBody w (.halted w') ∧ Rel0 c s' w'
+  | .trapped t => Run fs mainBody w (.exit (trapCode t))
+
+section Loop
+
+variable {c : Cfg} {fs : Funcs} {w : WState}
+
+theorem funcs_at (L : Layout) (p : Prog 64) {j : Nat} (hj : j ≤ p.length) :
+    (funcsOf L p)[j]? = some (instrCode L p j) := by
+  simp [funcsOf, List.getElem?_range (show j < p.length + 1 by omega)]
+
+theorem rgetPc {m : Nat} (hpc : w.globals pcG = .i32 (ofN m)) :
+    RunI fs (.globalGet pcG) w (.normal { w with stack := .i32 (ofN m) :: w.stack }) :=
+  .simple rfl (by simp [stepI, hpc])
+
+/-- The dispatched function returned the next index `v`: one loop iteration, then the loop again
+from the updated state. -/
+theorem loop_next {m : Nat} {code : List WI} (hst : w.stack = [])
+    (hpc : w.globals pcG = .i32 (ofN m)) (hf : fs[(ofN m).toNat]? = some code) {w' : WState} {v : W32}
+    (hrun : Run fs code { w with stack := [] } (.normal w')) (hst' : w'.stack = [.i32 v]) {r : Res}
+    (hr : RunI fs (.loop loopBody)
+      { w' with stack := [], globals := setG w'.globals pcG (.i32 v) } r) :
+    RunI fs (.loop loopBody) w r := by
+  have h2 : RunI fs .callIndirect { w with stack := .i32 (ofN m) :: w.stack }
+      (.normal { w' with stack := [.i32 v] }) := by
+    have := RunI.callNormal (fs := fs) (s := { w with stack := .i32 (ofN m) :: w.stack }) (r := [])
+      (by simp [hst]) hf hrun hst'
+    exact this
+  have h3 : RunI fs (.globalSet pcG) { w' with stack := [.i32 v] }
+      (.normal { w' with stack := [], globals := setG w'.globals pcG (.i32 v) }) :=
+    .simple rfl rfl
+  have hb : Run fs loopBody w (.br 0 { w' with stack := [], globals := setG w'.globals pcG (.i32 v) }) :=
+    .consNormal (rgetPc hpc) (.consNormal h2 (.consNormal h3 (.consAbrupt .br trivial)))
+  refine .loopBr0 hb ?_
+  rw [hst]
+  exact hr
+
+/-- The dispatched function exited or halted: so does the loop. -/
+theorem loop_abrupt {m : Nat} {code : List WI} (hpc : w.globals pcG = .i32 (ofN m))
+    (hf : fs[(ofN m).toNat]? = some code) {res : Res}
+    (hrun : Run fs code { w with stack := [] } res) (hres : (∃ k, res = .exit k) ∨ (∃ w', res = .halted w')) :
+    RunI fs (.loop loopBody) w res := by
+  have h2 := RunI.callAbrupt (fs := fs) (s := { w with stack := .i32 (ofN m) :: w.stack })
+    (r := w.stack) rfl hf hrun (by rcases hres with ⟨k, rfl⟩ | ⟨w', rfl⟩ <;> trivial)
+  rcases hres with ⟨k, rfl⟩ | ⟨w', rfl⟩
+  · exact .loopExit (.consNormal (rgetPc hpc) (.consAbrupt h2 trivial))
+  · exact .loopHalted (.consNormal (rgetPc hpc) (.consAbrupt h2 trivial))
+
+theorem loop_step (hg : Geom c) {p : Prog 64} (hn : p.length < 2 ^ 32) (hreg : RegsOk c p)
+    {s : State 64} (hs : RelD c p.length s w) :
+    LoopSim c (funcsOf c.layout p) p.length w (step p s) ∨
+      (¬ Fits c s ∧ RunI (funcsOf c.layout p) (.loop loopBody) w (.exit overflowCode)) := by
+  obtain ⟨h0, hst, hpc, hrs⟩ := hs
+  have hm : min s.pc p.length ≤ p.length := Nat.min_le_right _ _
+  have hf : (funcsOf c.layout p)[(ofN (min s.pc p.length)).toNat]? =
+      some (instrCode c.layout p (min s.pc p.length)) := by
+    rw [ofN_toNat (show min s.pc p.length < 2 ^ 32 by omega)]
+    exact funcs_at c.layout p hm
+  by_cases hlt : s.pc < p.length
+  · have hi : p[s.pc]? = some p[s.pc] := List.getElem?_eq_getElem hlt
+    have hcode : instrCode c.layout p (min s.pc p.length) = lowerInstr c.layout p.length s.pc p[s.pc] := by
+      rw [Nat.min_eq_left (Nat.le_of_lt hlt)]
+      simp [instrCode, hi]
+    rw [hcode] at hf
+    have hss := sim_step (fs := funcsOf c.layout p) hg (h0.setStack []) rfl hn hrs hi
+      (hreg s.pc _ hi)
+    rw [step_of_fetch hi]
+    generalize exec p[s.pc] s = o at hss ⊢
+    rcases hss with hss | ⟨hnf, h6⟩
+    rotate_left
+    · exact .inr ⟨hnf, loop_abrupt hpc hf h6 (.inl ⟨6, rfl⟩)⟩
+    left
+    cases o with
+    | next s' =>
+      obtain ⟨hrs', w', hr, h0', hst'⟩ := hss
+      refine ⟨{ w' with stack := [], globals := setG w'.globals pcG (.i32 (ofN (min s'.pc p.length))) },
+        ⟨?_, rfl, by simp [setG], hrs'⟩, fun r hr' => loop_next hst hpc hf hr hst' hr'⟩
+      exact Rel0.congr (h0'.setStack []) rfl (by simp [setG, pcG, spG]) (by simp [setG, pcG, rpG])
+        (by simp [setG, pcG, apG])
+    | halted s' =>
+      obtain ⟨w', hr, h0'⟩ := hss
+      exact ⟨w', loop_abrupt hpc hf hr (.inr ⟨w', rfl⟩), h0'⟩
+    | trapped t =>
+      exact loop_abrupt hpc hf hss (.inl ⟨_, rfl⟩)
+  · rw [step_pc_oob (by omega)]
+    have hcode : instrCode c.layout p (min s.pc p.length) = [.exitTrap 4] := by
+      rw [Nat.min_eq_right (by omega)]
+      simp [instrCode]
+    rw [hcode] at hf
+    exact .inl (loop_abrupt hpc hf sim_stub (.inl ⟨4, rfl⟩))
+
+/-- Whole-program preservation, for the dispatch loop. -/
+theorem loop_correct (hg : Geom c) {p : Prog 64} (hn : p.length < 2 ^ 32) (hreg : RegsOk c p)
+    {s : State 64} {o : Outcome 64} (h : Exec p s o) :
+    ∀ {w : WState}, RelD c p.length s w → (∀ s', Steps p s s' → Fits c s') →
+      Final c (funcsOf c.layout p) w o := by
+  induction h with
+  | @halt s s' hst =>
+    intro w hs hb
+    have := loop_step hg hn hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨hnf, _⟩
+    · exact this
+    · exact absurd (hb s .refl) hnf
+  | @trap s t hst =>
+    intro w hs hb
+    have := loop_step hg hn hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨hnf, _⟩
+    · exact this
+    · exact absurd (hb s .refl) hnf
+  | @next s s' o hst _ ih =>
+    intro w hs hb
+    have := loop_step hg hn hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨hnf, _⟩
+    rotate_left
+    · exact absurd (hb s .refl) hnf
+    obtain ⟨w', hs', hlift⟩ := this
+    have hih := ih hs' (fun s'' hss => hb s'' (.cons hst hss))
+    cases o with
+    | next _ => exact hih.elim
+    | halted s2 =>
+      obtain ⟨w'', hr, h0⟩ := hih
+      exact ⟨w'', hlift _ hr, h0⟩
+    | trapped t => exact hlift _ hih
+
+/-- Whole-program preservation for the dispatch loop, with no capacity hypothesis: the IR outcome,
+or exit 6 when a stack overflow guard fires. -/
+theorem loop_correct_or_overflow (hg : Geom c) {p : Prog 64} (hn : p.length < 2 ^ 32)
+    (hreg : RegsOk c p) {s : State 64} {o : Outcome 64} (h : Exec p s o) :
+    ∀ {w : WState}, RelD c p.length s w →
+      Final c (funcsOf c.layout p) w o ∨ RunI (funcsOf c.layout p) (.loop loopBody) w (.exit overflowCode) := by
+  induction h with
+  | @halt s s' hst =>
+    intro w hs
+    have := loop_step hg hn hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨_, h6⟩
+    · exact .inl this
+    · exact .inr h6
+  | @trap s t hst =>
+    intro w hs
+    have := loop_step hg hn hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨_, h6⟩
+    · exact .inl this
+    · exact .inr h6
+  | @next s s' o hst _ ih =>
+    intro w hs
+    have := loop_step hg hn hreg hs
+    rw [hst] at this
+    rcases this with ⟨w', hs', hlift⟩ | ⟨_, h6⟩
+    · rcases ih hs' with hih | h6
+      · left
+        cases o with
+        | next _ => exact hih.elim
+        | halted s2 =>
+          obtain ⟨w'', hr, h0⟩ := hih
+          exact ⟨w'', hlift _ hr, h0⟩
+        | trapped t => exact hlift _ hih
+      · exact .inr (hlift _ h6)
+    · exact .inr h6
+
+theorem final_main {p : Prog 64} {o : Outcome 64} (hl : Final c fs w o) : FinalMain c fs w o := by
+  cases o with
+  | next _ => exact hl.elim
+  | halted s' =>
+    obtain ⟨w', hr, h0⟩ := hl
+    refine ⟨w', ?_, h0⟩
+    rw [mainBody_eq]
+    exact .consAbrupt hr trivial
+  | trapped t =>
+    show Run _ mainBody w _
+    rw [mainBody_eq]
+    exact .consAbrupt hl trivial
+
+/-- Whole-program preservation for the module's start function, with no capacity hypothesis: the
+module reaches the IR outcome, or exits with code 6 because a stack was full. -/
+theorem lowerProg_correct_or_overflow (hg : Geom c) {p : Prog 64} (hn : p.length < 2 ^ 32)
+    (hreg : RegsOk c p) {s : State 64} {o : Outcome 64} (h : Exec p s o) (hs : RelD c p.length s w) :
+    FinalMain c (funcsOf c.layout p) w o ∨ Run (funcsOf c.layout p) mainBody w (.exit overflowCode) := by
+  rcases loop_correct_or_overflow hg hn hreg h hs with hl | h6
+  · exact .inl (final_main (p := p) hl)
+  · right
+    rw [mainBody_eq]
+    exact .consAbrupt h6 trivial
+
+/-- Whole-program preservation, for the module's start function `mainBody`. When the IR run stays
+within the stack capacities, no overflow guard fires and the outcome is exactly the IR's. -/
+theorem lowerProg_correct (hg : Geom c) {p : Prog 64} (hn : p.length < 2 ^ 32) (hreg : RegsOk c p)
+    {s : State 64} {o : Outcome 64} (h : Exec p s o) (hs : RelD c p.length s w)
+    (hb : ∀ s', Steps p s s' → Fits c s') :
+    FinalMain c (funcsOf c.layout p) w o := by
+  exact final_main (p := p) (loop_correct hg hn hreg h hs hb)
+
+end Loop
+
+/-- The state the runtime establishes before the dispatch loop (`Wasm.Emit`): empty operand stack,
+`pc = 0`, `sp = dEnd`, `rp = rEnd`, `ap = aEnd` (empty auxiliary stack), and the register file and IR memory regions holding the IR
+state's initial contents. `RelD` then holds at entry, so `lowerProg_correct` applies. -/
+theorem init_rel {c : Cfg} (n : Nat) {s0 : State 64} {w0 : WState} (hg : Geom c)
+    (hpc0 : s0.pc = 0) (hd : s0.dstack = []) (hr : s0.rstack = [])
+    (hst : w0.stack = []) (hpc : w0.globals pcG = .i32 (ofN 0))
+    (hsp : w0.globals spG = .i32 (ofN c.dEnd)) (hrp : w0.globals rpG = .i32 (ofN c.rEnd))
+    (ha : s0.astack = []) (hap : w0.globals apG = .i32 (ofN c.aEnd))
+    (hregs : RegRel c w0.mem s0.regs) (hmem : MemRel c w0.mem s0.mem)
+    (hiv : ∀ a : Word 64, s0.mem.valid a = decide (a.toNat < c.M)) (hsize : w0.mem.size = c.msize) :
+    RelD c n s0 w0 :=
+  ⟨{ sp := by simpa [hd] using hsp
+     rp := by simpa [hr] using hrp
+     stack := by intro i v h; simp [hd] at h
+     regs := hregs
+     mem := hmem
+     rs := by intro i a h; simp [hr] at h
+     irvalid := hiv
+     size := hsize
+     capD := by simp [hd]; exact hg.dBase_le
+     capR := by simp [hr]; exact hg.rBase_le
+     ap := by simpa [ha] using hap
+     aux := by intro i v h; simp [ha] at h
+     capA := by simp [ha]; have := hg.aBase_8; omega },
+   hst, by simpa [hpc0] using hpc, by simp [hr]⟩
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/Emit.lean

@@ -0,0 +1,117 @@
+import Wasm.Lower
+
+/-!
+# Wasm.Emit
+
+WebAssembly text (WAT) for a lowered program, plus the small runtime. The instruction text is
+printed from exactly the `WI` list `lowerProg` builds, so the text and the verified model cannot
+diverge. Hand-written: the imports, the memory declaration with the IR memory image, and the `$halt`
+helper that dumps the final state (data-stack depth, data stack, IR memory, virtual registers as raw
+little-endian 64-bit words) through WASI `fd_write` and exits 0. Traps are `proc_exit(code)`.
+-/
+
+namespace WordDialect
+namespace Wasm
+namespace Emit
+
+/-- Placement of the runtime regions in linear memory. -/
+structure Runtime where
+  memImage : List Nat
+  nregs : Nat
+
+def Runtime.rf (_ : Runtime) : Nat := 0x1000
+def Runtime.mb (r : Runtime) : Nat := r.rf + 8 * r.nregs
+def Runtime.dBase (_ : Runtime) : Nat := 0x10000
+def Runtime.dEnd (r : Runtime) : Nat := r.dBase + 8 * 65536
+def Runtime.rBase (r : Runtime) : Nat := r.dEnd
+def Runtime.rEnd (r : Runtime) : Nat := r.rBase + 8 * 4096
+def Runtime.aBase (r : Runtime) : Nat := r.rEnd
+def Runtime.aEnd (r : Runtime) : Nat := r.aBase + 8 * 4096
+def Runtime.pages (r : Runtime) : Nat := (r.aEnd + 65535) / 65536
+def Runtime.msize (r : Runtime) : Nat := 65536 * r.pages
+
+def Runtime.layout (r : Runtime) : Layout :=
+  { dEnd := r.dEnd, rEnd := r.rEnd, rf := r.rf, mb := r.mb, M := r.memImage.length,
+    dBase := r.dBase, rBase := r.rBase, aEnd := r.aEnd, aBase := r.aBase }
+
+def ind (d : Nat) : String := String.ofList (List.replicate (2 * d) ' ')
+
+def line (d : Nat) (s : String) : String := ind d ++ s ++ "\n"
+
+partial def instr (d : Nat) : WI → String
+  | .i32const v => line d s!"i32.const {v.toNat}"
+  | .i64const v => line d s!"i64.const {v.toNat}"
+  | .globalGet i => line d s!"global.get {i}"
+  | .globalSet i => line d s!"global.set {i}"
+  | .i64load off => line d s!"i64.load offset={off}"
+  | .i64store off => line d s!"i64.store offset={off}"
+  | .i64add => line d "i64.add" | .i64sub => line d "i64.sub" | .i64mul => line d "i64.mul"
+  | .i64and => line d "i64.and" | .i64or => line d "i64.or" | .i64xor => line d "i64.xor"
+  | .i64shl => line d "i64.shl" | .i64shru => line d "i64.shr_u"
+  | .i64rotl => line d "i64.rotl" | .i64rotr => line d "i64.rotr"
+  | .i64divu => line d "i64.div_u" | .i64divs => line d "i64.div_s"
+  | .i64eq => line d "i64.eq" | .i64ne => line d "i64.ne"
+  | .i64ltu => line d "i64.lt_u" | .i64leu => line d "i64.le_u"
+  | .i64gtu => line d "i64.gt_u" | .i64geu => line d "i64.ge_u"
+  | .i64lts => line d "i64.lt_s" | .i64les => line d "i64.le_s"
+  | .i64gts => line d "i64.gt_s" | .i64ges => line d "i64.ge_s"
+  | .i64eqz => line d "i64.eqz"
+  | .i32add => line d "i32.add" | .i32sub => line d "i32.sub" | .i32shl => line d "i32.shl"
+  | .i32gtu => line d "i32.gt_u" | .i32eq => line d "i32.eq"
+  | .i32wrap => line d "i32.wrap_i64"
+  | .i64extu => line d "i64.extend_i32_u"
+  | .select => line d "select"
+  | .loop b => line d "loop" ++ String.join (b.map (instr (d + 1))) ++ line d "end"
+  | .ite t => line d "if" ++ String.join (t.map (instr (d + 1))) ++ line d "end"
+  | .br l => line d s!"br {l}"
+  | .exitTrap c => line d s!"i32.const {c}" ++ line d "call $proc_exit" ++ line d "unreachable"
+  | .exitHalt => line d "global.get 1" ++ line d "call $halt" ++ line d "unreachable"
+  | .callIndirect => line d "call_indirect (type $step)"
+
+def hexByte (n : Nat) : String :=
+  let s := String.ofList (Nat.toDigits 16 n)
+  "\\" ++ (if s.length < 2 then "0" ++ s else s)
+
+/-- Byte `i` (little-endian) of the word `w`, as placed in the data segment. -/
+def byteOf (w i : Nat) : Nat := (w / 256 ^ i) % 256
+
+def wordBytes (w : Nat) : String :=
+  String.join ((List.range 8).map fun i => hexByte (byteOf w i))
+
+def program (r : Runtime) (p : Prog 64) : String :=
+  let m := r.memImage.length
+  let L := r.layout
+  let fs := funcsOf L p
+  "(module\n" ++
+  "  (type $step (func (result i32)))\n" ++
+  "  (import \"wasi_snapshot_preview1\" \"fd_write\" (func $fd_write (param i32 i32 i32 i32) (result i32)))\n" ++
+  "  (import \"wasi_snapshot_preview1\" \"proc_exit\" (func $proc_exit (param i32)))\n" ++
+  s!"  (memory (export \"memory\") {r.pages})\n" ++
+  "  (global $pc (mut i32) (i32.const 0))\n" ++
+  s!"  (global $sp (mut i32) (i32.const {r.dEnd}))\n" ++
+  s!"  (global $rp (mut i32) (i32.const {r.rEnd}))\n" ++
+  s!"  (global $ap (mut i32) (i32.const {r.aEnd}))\n" ++
+  (if m = 0 then "" else
+    s!"  (data (i32.const {r.mb}) \"{String.join (r.memImage.map wordBytes)}\")\n") ++
+  "  (func $write (param $p i32) (param $n i32)\n" ++
+  "    (i32.store (i32.const 16) (local.get $p))\n" ++
+  "    (i32.store (i32.const 20) (local.get $n))\n" ++
+  "    (drop (call $fd_write (i32.const 1) (i32.const 16) (i32.const 1) (i32.const 24))))\n" ++
+  "  (func $halt (param $sp i32)\n" ++
+  s!"    (i64.store (i32.const 0) (i64.extend_i32_u (i32.shr_u (i32.sub (i32.const {r.dEnd}) (local.get $sp)) (i32.const 3))))\n" ++
+  "    (call $write (i32.const 0) (i32.const 8))\n" ++
+  s!"    (call $write (local.get $sp) (i32.sub (i32.const {r.dEnd}) (local.get $sp)))\n" ++
+  s!"    (call $write (i32.const {r.mb}) (i32.const {8 * m}))\n" ++
+  s!"    (call $write (i32.const {r.rf}) (i32.const {8 * r.nregs}))\n" ++
+  "    (call $proc_exit (i32.const 0)))\n" ++
+  String.join ((fs.zipIdx).map fun (b, k) =>
+    s!"  (func $f{k} (type $step)\n" ++ String.join (b.map (instr 2)) ++ "  )\n") ++
+  s!"  (table {fs.length} funcref)\n" ++
+  s!"  (elem (i32.const 0) {String.intercalate " " ((List.range fs.length).map fun k => s!"$f{k}")})\n" ++
+  "  (func $main (export \"_start\")\n" ++
+  String.join (mainBody.map (instr 2)) ++
+  "  )\n)\n"
+
+end Emit
+end Wasm
+end WordDialect

backend/wasm/Wasm/Frame.lean

@@ -0,0 +1,355 @@
+import Wasm.Seq
+
+/-!
+# Wasm.Frame
+
+How a write of one 8-byte cell into one region affects the five views
+`StackRel RegRel MemRel RsRel AuxRel`:
+the views of the other regions are unchanged, and the view of the written region changes in the
+expected way. All statements are about `Rel0` and the byte memory only.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+section Keep
+
+variable {c : Cfg} {s : State 64} {w : WState} {m' : WMem} {A : Nat} {v : W}
+
+theorem keep_stack (hs : Rel0 c s w) (hw : w.mem.write64 A v = some m')
+    (hA : A + 8 ≤ c.dBase ∨ c.dEnd ≤ A) : StackRel c m' s.dstack := by
+  have hcap := hs.capD
+  intro i x hi
+  have hik : i < s.dstack.length := by
+    by_cases hh : i < s.dstack.length
+    · exact hh
+    · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+  rw [read64_write64_other hw (by omega)]
+  exact hs.stack i x hi
+
+theorem keep_regs (hs : Rel0 c s w) (hw : w.mem.write64 A v = some m')
+    (hA : A + 8 ≤ c.rf ∨ c.rf + 8 * c.nregs ≤ A) : RegRel c m' s.regs := by
+  intro r hr
+  rw [read64_write64_other hw (by omega)]
+  exact hs.regs r hr
+
+theorem keep_mem (hs : Rel0 c s w) (hw : w.mem.write64 A v = some m')
+    (hA : A + 8 ≤ c.mb ∨ c.mb + 8 * c.M ≤ A) : MemRel c m' s.mem := by
+  intro a ha
+  rw [read64_write64_other hw (by omega)]
+  exact hs.mem a ha
+
+theorem keep_rs (hs : Rel0 c s w) (hw : w.mem.write64 A v = some m')
+    (hA : A + 8 ≤ c.rBase ∨ c.rEnd ≤ A) : RsRel c m' s.rstack := by
+  have hcap := hs.capR
+  intro i a hi
+  have hik : i < s.rstack.length := by
+    by_cases hh : i < s.rstack.length
+    · exact hh
+    · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+  rw [read64_write64_other hw (by omega)]
+  exact hs.rs i a hi
+
+theorem keep_aux (hs : Rel0 c s w) (hw : w.mem.write64 A v = some m')
+    (hA : A + 8 ≤ c.aBase ∨ c.aEnd ≤ A) : AuxRel c m' s.astack := by
+  have hcap := hs.capA
+  intro i x hi
+  have hik : i < s.astack.length := by
+    by_cases hh : i < s.astack.length
+    · exact hh
+    · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+  rw [read64_write64_other hw (by omega)]
+  exact hs.aux i x hi
+
+end Keep
+
+section Write
+
+variable {c : Cfg} {s : State 64} {w : WState} {m' : WMem} {v : W}
+
+/-- Write into data-stack slot `j`. -/
+theorem wr_stack_at (hg : Geom c) (hs : Rel0 c s w) {j : Nat} (hj : j < s.dstack.length) {A : Nat}
+    (hA : A = c.dEnd - 8 * s.dstack.length + 8 * j)
+    (hw : w.mem.write64 A v = some m') :
+    Rel0 c { s with dstack := s.dstack.set j v } { w with mem := m' } := by
+  subst hA
+  have hcap := hs.capD
+  have hdG := hg.dEnd_ge
+  obtain ⟨hsz, _⟩ := write64_size hw
+  refine { sp := ?_, rp := hs.rp, stack := ?_, regs := ?_, mem := ?_, rs := ?_, irvalid := hs.irvalid,
+           size := ?_, capD := ?_, capR := hs.capR, ap := hs.ap, aux := ?_, capA := hs.capA }
+  · simpa using hs.sp
+  · intro i x hi
+    simp only [List.length_set] at hi ⊢
+    by_cases hij : i = j
+    · subst hij
+      have : x = v := by simpa [List.getElem?_set_self hj] using hi.symm
+      subst this
+      exact read64_write64_same hw
+    · rw [List.getElem?_set_ne (by omega)] at hi
+      rw [read64_write64_other hw (by omega)]
+      exact hs.stack i x hi
+  · exact keep_regs (s := s) hs hw (by rcases hg.dS_F with h | h <;> omega)
+  · exact keep_mem (s := s) hs hw (by rcases hg.dS_M with h | h <;> omega)
+  · exact keep_rs (s := s) hs hw (by rcases hg.dS_K with h | h <;> omega)
+  · show m'.size = c.msize
+    rw [hsz]; exact hs.size
+  · simpa using hs.capD
+  · exact keep_aux (s := s) hs hw (by rcases hg.dS_A with h | h <;> omega)
+
+theorem wr_stack (hg : Geom c) (hs : Rel0 c s w) {j : Nat} (hj : j < s.dstack.length)
+    (hw : w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8 * j) v = some m') :
+    Rel0 c { s with dstack := s.dstack.set j v } { w with mem := m' } :=
+  wr_stack_at hg hs hj rfl hw
+
+/-- Update one global. -/
+def setG (g : Nat → Val) (i : Nat) (v : Val) : Nat → Val := fun j => if j = i then v else g j
+
+/-- Write virtual register `r`. -/
+theorem wr_regs (hg : Geom c) (hs : Rel0 c s w) {r : Nat} (hr : r < c.nregs)
+    (hw : w.mem.write64 (c.rf + 8 * r) v = some m') :
+    Rel0 c { s with regs := State.setReg s.regs r v } { w with mem := m' } := by
+  obtain ⟨hsz, _⟩ := write64_size hw
+  refine { sp := hs.sp, rp := hs.rp, stack := ?_, regs := ?_, mem := ?_, rs := ?_,
+           irvalid := hs.irvalid, size := ?_, capD := hs.capD, capR := hs.capR, ap := hs.ap,
+           aux := ?_, capA := hs.capA }
+  · exact keep_stack (s := s) hs hw (by rcases hg.dS_F with h | h <;> omega)
+  · intro r' hr'
+    by_cases h : r' = r
+    · subst h
+      simpa [State.setReg] using read64_write64_same hw
+    · rw [read64_write64_other hw (by omega)]
+      simpa [State.setReg, h] using hs.regs r' hr'
+  · exact keep_mem (s := s) hs hw (by rcases hg.dF_M with h | h <;> omega)
+  · exact keep_rs (s := s) hs hw (by rcases hg.dF_K with h | h <;> omega)
+  · show m'.size = c.msize
+    rw [hsz]; exact hs.size
+  · exact keep_aux (s := s) hs hw (by rcases hg.dF_A with h | h <;> omega)
+
+/-- Write IR memory word `a`, mirroring an IR store. -/
+theorem wr_mem (hg : Geom c) (hs : Rel0 c s w) {a : W} {im : WordDialect.Memory 64}
+    (hv : s.mem.write? a v = some im)
+    (hw : w.mem.write64 (c.mb + 8 * a.toNat) v = some m') :
+    Rel0 c { s with mem := im } { w with mem := m' } := by
+  obtain ⟨hsz, _⟩ := write64_size hw
+  have hvalid : s.mem.valid a = true := by
+    by_cases hh : s.mem.valid a = true
+    · exact hh
+    · have := (Memory.write?_none_iff s.mem a v).mpr (by simpa using hh); rw [hv] at this; simp at this
+  have hlt : a.toNat < c.M := by
+    have := hs.irvalid a
+    rw [hvalid] at this
+    simpa using this.symm
+  refine { sp := hs.sp, rp := hs.rp, stack := ?_, regs := ?_, mem := ?_, rs := ?_, irvalid := ?_,
+           size := ?_, capD := hs.capD, capR := hs.capR, ap := hs.ap, aux := ?_, capA := hs.capA }
+  · exact keep_stack (s := s) hs hw (by rcases hg.dS_M with h | h <;> omega)
+  · exact keep_regs (s := s) hs hw (by rcases hg.dF_M with h | h <;> omega)
+  · intro a' ha'
+    by_cases h : a' = a.toNat
+    · subst h
+      rw [read64_write64_same hw, BitVec.ofNat_toNat, BitVec.setWidth_eq]
+      have := (Memory.read?_some (Memory.read_write_same hv)).2
+      rw [this]
+    · rw [read64_write64_other hw (by omega)]
+      have hne : BitVec.ofNat 64 a' ≠ a := by
+        intro e
+        apply h
+        have h2 := congrArg BitVec.toNat e
+        have hM : a' < 2 ^ 64 := by have := hg.mb_le; have := hg.msize_lt; omega
+        simp [BitVec.toNat_ofNat, Nat.mod_eq_of_lt hM] at h2
+        exact h2
+      rw [Memory.cell_write_other hv hne]
+      exact hs.mem a' ha'
+  · exact keep_rs (s := s) hs hw (by rcases hg.dM_K with h | h <;> omega)
+  · intro a'; rw [Memory.write?_valid hv]; exact hs.irvalid a'
+  · show m'.size = c.msize
+    rw [hsz]; exact hs.size
+  · exact keep_aux (s := s) hs hw (by rcases hg.dM_A with h | h <;> omega)
+
+/-- Adjust the data-stack pointer upward by `n` words (popping `n` elements). -/
+theorem adj_sp (hg : Geom c) (hs : Rel0 c s w) {n : Nat} (hn : n ≤ s.dstack.length) :
+    Rel0 c { s with dstack := s.dstack.drop n }
+      { w with globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length - n)))) } := by
+  have hcap := hs.capD
+  refine { sp := ?_, rp := ?_, stack := ?_, regs := hs.regs, mem := hs.mem, rs := hs.rs,
+           irvalid := hs.irvalid, size := hs.size, capD := ?_, capR := hs.capR, ap := ?_,
+           aux := hs.aux, capA := hs.capA }
+  · simp [setG, spG]
+  · have : rpG ≠ spG := by decide
+    simpa [setG, this] using hs.rp
+  · intro i x hi
+    simp only [List.length_drop]
+    rw [List.getElem?_drop] at hi
+    have := hs.stack (n + i) x hi
+    have e : c.dEnd - 8 * (s.dstack.length - n) + 8 * i = c.dEnd - 8 * s.dstack.length + 8 * (n + i) := by
+      omega
+    rw [e]; exact this
+  · simp only [List.length_drop]; omega
+  · have : apG ≠ spG := by decide
+    simpa [setG, this] using hs.ap
+
+/-- Push: the stack pointer moved down one word and the new top written. -/
+theorem push_rel (hg : Geom c) (hs : Rel0 c s w)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd)
+    (hw : w.mem.write64 (c.dEnd - 8 * (s.dstack.length + 1)) v = some m') :
+    Rel0 c { s with dstack := v :: s.dstack }
+      { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) } := by
+  have hcap := hs.capD
+  obtain ⟨hsz, _⟩ := write64_size hw
+  refine { sp := ?_, rp := ?_, stack := ?_, regs := ?_, mem := ?_, rs := ?_, irvalid := hs.irvalid,
+           size := ?_, capD := ?_, capR := hs.capR, ap := ?_, aux := ?_, capA := hs.capA }
+  · simp [setG, spG]
+  · have : rpG ≠ spG := by decide
+    simpa [setG, this] using hs.rp
+  · intro i x hi
+    simp only [List.length_cons] at hi ⊢
+    cases i with
+    | zero =>
+      simp at hi; subst hi
+      simpa using read64_write64_same hw
+    | succ i =>
+      simp only [List.getElem?_cons_succ] at hi
+      have hik : i < s.dstack.length := by
+        have := (List.getElem?_eq_some_iff.mp hi).1; simpa using this
+      have e : c.dEnd - 8 * (s.dstack.length + 1) + 8 * (i + 1) = c.dEnd - 8 * s.dstack.length + 8 * i := by
+        omega
+      rw [e, read64_write64_other hw (by omega)]
+      exact hs.stack i x hi
+  · exact keep_regs (s := s) hs hw (by rcases hg.dS_F with h | h <;> omega)
+  · exact keep_mem (s := s) hs hw (by rcases hg.dS_M with h | h <;> omega)
+  · exact keep_rs (s := s) hs hw (by rcases hg.dS_K with h | h <;> omega)
+  · show m'.size = c.msize
+    rw [hsz]; exact hs.size
+  · simp only [List.length_cons]; omega
+  · have : apG ≠ spG := by decide
+    simpa [setG, this] using hs.ap
+  · exact keep_aux (s := s) hs hw (by rcases hg.dS_A with h | h <;> omega)
+
+/-- Call: the return-stack pointer moved down and the return index written. -/
+theorem push_rs (hg : Geom c) (hs : Rel0 c s w) {a : Nat}
+    (hfit : c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd)
+    (hw : w.mem.write64 (c.rEnd - 8 * (s.rstack.length + 1)) (BitVec.ofNat 64 a) = some m') :
+    Rel0 c { s with rstack := a :: s.rstack }
+      { w with mem := m', globals := setG w.globals rpG (.i32 (ofN (c.rEnd - 8 * (s.rstack.length + 1)))) } := by
+  have hcap := hs.capR
+  obtain ⟨hsz, _⟩ := write64_size hw
+  refine { sp := ?_, rp := ?_, stack := ?_, regs := ?_, mem := ?_, rs := ?_, irvalid := hs.irvalid,
+           size := ?_, capD := hs.capD, capR := ?_, ap := ?_, aux := ?_, capA := hs.capA }
+  · have : spG ≠ rpG := by decide
+    simpa [setG, this] using hs.sp
+  · simp [setG, rpG]
+  · exact keep_stack (s := s) hs hw (by rcases hg.dS_K with h | h <;> omega)
+  · exact keep_regs (s := s) hs hw (by rcases hg.dF_K with h | h <;> omega)
+  · exact keep_mem (s := s) hs hw (by rcases hg.dM_K with h | h <;> omega)
+  · intro i x hi
+    simp only [List.length_cons] at hi ⊢
+    cases i with
+    | zero =>
+      simp at hi; subst hi
+      simpa using read64_write64_same hw
+    | succ i =>
+      simp only [List.getElem?_cons_succ] at hi
+      have hik : i < s.rstack.length := by
+        have := (List.getElem?_eq_some_iff.mp hi).1; simpa using this
+      have e : c.rEnd - 8 * (s.rstack.length + 1) + 8 * (i + 1) = c.rEnd - 8 * s.rstack.length + 8 * i := by
+        omega
+      rw [e, read64_write64_other hw (by omega)]
+      exact hs.rs i x hi
+  · show m'.size = c.msize
+    rw [hsz]; exact hs.size
+  · simp only [List.length_cons]; omega
+  · have : apG ≠ rpG := by decide
+    simpa [setG, this] using hs.ap
+  · exact keep_aux (s := s) hs hw (by rcases hg.dK_A with h | h <;> omega)
+
+/-- Return: the return-stack pointer moved up one entry. -/
+theorem pop_rs (hs : Rel0 c s w) {a : Nat} {rs : List Nat} (hr : s.rstack = a :: rs) :
+    Rel0 c { s with rstack := rs }
+      { w with globals := setG w.globals rpG (.i32 (ofN (c.rEnd - 8 * rs.length))) } := by
+  have hcap := hs.capR
+  rw [hr] at hcap
+  simp only [List.length_cons] at hcap
+  refine { sp := ?_, rp := ?_, stack := hs.stack, regs := hs.regs, mem := hs.mem, rs := ?_,
+           irvalid := hs.irvalid, size := hs.size, capD := hs.capD, capR := ?_, ap := ?_,
+           aux := hs.aux, capA := hs.capA }
+  · have : spG ≠ rpG := by decide
+    simpa [setG, this] using hs.sp
+  · simp [setG, rpG]
+  · intro i x hi
+    have h := hs.rs (i + 1) x (by simpa [hr] using hi)
+    rw [hr] at h
+    simp only [List.length_cons] at h
+    have e : c.rEnd - 8 * (rs.length + 1) + 8 * (i + 1) = c.rEnd - 8 * rs.length + 8 * i := by omega
+    rw [e] at h
+    exact h
+  · show c.rBase + 8 * rs.length ≤ c.rEnd
+    omega
+  · have : apG ≠ rpG := by decide
+    simpa [setG, this] using hs.ap
+
+/-- `tor`: the auxiliary-stack pointer moved down one word and the new top written. -/
+theorem push_aux (hg : Geom c) (hs : Rel0 c s w) {a : W}
+    (hfit : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd)
+    (hw : w.mem.write64 (c.aEnd - 8 * (s.astack.length + 1)) a = some m') :
+    Rel0 c { s with astack := a :: s.astack }
+      { w with mem := m', globals := setG w.globals apG (.i32 (ofN (c.aEnd - 8 * (s.astack.length + 1)))) } := by
+  have hcap := hs.capA
+  obtain ⟨hsz, _⟩ := write64_size hw
+  refine { sp := ?_, rp := ?_, stack := ?_, regs := ?_, mem := ?_, rs := ?_, irvalid := hs.irvalid,
+           size := ?_, capD := hs.capD, capR := hs.capR, ap := ?_, aux := ?_, capA := ?_ }
+  · have : spG ≠ apG := by decide
+    simpa [setG, this] using hs.sp
+  · have : rpG ≠ apG := by decide
+    simpa [setG, this] using hs.rp
+  · exact keep_stack (s := s) hs hw (by rcases hg.dS_A with h | h <;> omega)
+  · exact keep_regs (s := s) hs hw (by rcases hg.dF_A with h | h <;> omega)
+  · exact keep_mem (s := s) hs hw (by rcases hg.dM_A with h | h <;> omega)
+  · exact keep_rs (s := s) hs hw (by rcases hg.dK_A with h | h <;> omega)
+  · show m'.size = c.msize
+    rw [hsz]; exact hs.size
+  · simp [setG, apG]
+  · intro i x hi
+    simp only [List.length_cons] at hi ⊢
+    cases i with
+    | zero =>
+      simp at hi; subst hi
+      simpa using read64_write64_same hw
+    | succ i =>
+      simp only [List.getElem?_cons_succ] at hi
+      have hik : i < s.astack.length := by
+        have := (List.getElem?_eq_some_iff.mp hi).1; simpa using this
+      have e : c.aEnd - 8 * (s.astack.length + 1) + 8 * (i + 1) = c.aEnd - 8 * s.astack.length + 8 * i := by
+        omega
+      rw [e, read64_write64_other hw (by omega)]
+      exact hs.aux i x hi
+  · simp only [List.length_cons]; omega
+
+/-- `fromr`: the auxiliary-stack pointer moved up one word. -/
+theorem pop_aux (hs : Rel0 c s w) {a : W} {as : List W} (hr : s.astack = a :: as) :
+    Rel0 c { s with astack := as }
+      { w with globals := setG w.globals apG (.i32 (ofN (c.aEnd - 8 * as.length))) } := by
+  have hcap := hs.capA
+  rw [hr] at hcap
+  simp only [List.length_cons] at hcap
+  refine { sp := ?_, rp := ?_, stack := hs.stack, regs := hs.regs, mem := hs.mem, rs := hs.rs,
+           irvalid := hs.irvalid, size := hs.size, capD := hs.capD, capR := hs.capR, ap := ?_,
+           aux := ?_, capA := ?_ }
+  · have : spG ≠ apG := by decide
+    simpa [setG, this] using hs.sp
+  · have : rpG ≠ apG := by decide
+    simpa [setG, this] using hs.rp
+  · simp [setG, apG]
+  · intro i x hi
+    have h := hs.aux (i + 1) x (by simpa [hr] using hi)
+    rw [hr] at h
+    simp only [List.length_cons] at h
+    have e : c.aEnd - 8 * (as.length + 1) + 8 * (i + 1) = c.aEnd - 8 * as.length + 8 * i := by omega
+    rw [e] at h
+    exact h
+  · show c.aBase + 8 * as.length ≤ c.aEnd
+    omega
+
+end Write
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/Guard.lean

@@ -0,0 +1,163 @@
+import Wasm.Frame
+
+/-!
+# Wasm.Guard
+
+`execL` over appended lists, the operand-count guard `uf`, and small conveniences used by every
+instruction proof.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+theorem execL_append (a b : List WI) (s : WState) :
+    execL (a ++ b) s = (execL a s).bind (execL b) := by
+  induction a generalizing s with
+  | nil => simp [execL]
+  | cons i is ih =>
+    simp only [List.cons_append, execL]
+    cases stepI i s <;> simp [ih]
+
+theorem Rel0.setStack {c : Cfg} {s : State 64} {w : WState} (h : Rel0 c s w) (x : List Val) :
+    Rel0 c s { w with stack := x } :=
+  { sp := h.sp, rp := h.rp, stack := h.stack, regs := h.regs, mem := h.mem, rs := h.rs,
+    irvalid := h.irvalid, size := h.size, capD := h.capD, capR := h.capR, ap := h.ap, aux := h.aux,
+    capA := h.capA }
+
+/-- `Rel0` only looks at the globals `sp`, `rp`, `ap` and the memory. -/
+theorem Rel0.congr {c : Cfg} {s : State 64} {w w' : WState} (h : Rel0 c s w)
+    (hm : w'.mem = w.mem) (hsp : w'.globals spG = w.globals spG)
+    (hrp : w'.globals rpG = w.globals rpG) (hap : w'.globals apG = w.globals apG) : Rel0 c s w' :=
+  { sp := by rw [hsp]; exact h.sp, rp := by rw [hrp]; exact h.rp,
+    stack := by rw [hm]; exact h.stack, regs := by rw [hm]; exact h.regs,
+    mem := by rw [hm]; exact h.mem, rs := by rw [hm]; exact h.rs, irvalid := h.irvalid,
+    size := by rw [hm]; exact h.size, capD := h.capD, capR := h.capR,
+    ap := by rw [hap]; exact h.ap, aux := by rw [hm]; exact h.aux, capA := h.capA }
+
+section Uf
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+theorem sp_lt (hg : Geom c) (hs : Rel0 c s w) : c.dEnd - 8 * s.dstack.length < 2 ^ 32 := by
+  have := hg.dEnd_le; have := hg.msize_lt; omega
+
+theorem spToNat (hg : Geom c) (hs : Rel0 c s w) {u : WState} (hu : u.globals = w.globals) :
+    u.globals spG = .i32 (ofN (c.dEnd - 8 * s.dstack.length)) := by
+  rw [hu]; exact hs.sp
+
+theorem ult_ofN {a b : Nat} (ha : a < 2 ^ 32) (hb : b < 2 ^ 32) :
+    (ofN a).ult (ofN b) = decide (a < b) := by
+  simp [BitVec.ult_eq_decide, ofN_toNat ha, ofN_toNat hb]
+
+/-- Enough operands: the guard falls through, changing nothing. -/
+theorem uf_pass (hg : Geom c) (hs : Rel0 c s w) {k : Nat} (hk0 : 0 < k) (hk : k ≤ s.dstack.length) :
+    Run fs (uf c.layout k) w (.normal w) := by
+  have hk0' : k ≠ 0 := by omega
+  have hX := sp_lt hg hs
+  have hlim : c.dEnd - 8 * k < 2 ^ 32 := by have := hg.dEnd_le; have := hg.msize_lt; omega
+  have hexec : execL [.globalGet spG, i32c (c.layout.dEnd - 8 * k), .i32gtu] w =
+      some { w with stack := .i32 (bool32 false) :: w.stack } := by
+    simp only [execL, stepI, hs.sp, i32c, Cfg.layout, Option.bind_some, bool32]
+    rw [show BitVec.ofNat 32 (c.dEnd - 8 * k) = ofN (c.dEnd - 8 * k) from rfl, ult_ofN hlim hX]
+    have hnum : ¬ (c.dEnd - 8 * k < c.dEnd - 8 * s.dstack.length) := by omega
+    simp [hnum]
+  have h3 : Run fs [.globalGet spG, i32c (c.layout.dEnd - 8 * k), .i32gtu] w
+      (.normal { w with stack := .i32 (bool32 false) :: w.stack }) :=
+    run_of_execL (by simp [WI.isCtl, i32c]) hexec
+  simp only [uf, hk0', if_false]
+  have h4 := run_ite_false (fs := fs) (thn := [.exitTrap 1])
+    (w := { w with stack := .i32 (bool32 false) :: w.stack }) (r := w.stack) (by simp [bool32])
+  exact run_append _ h3 h4
+
+theorem uf_trap (hg : Geom c) (hs : Rel0 c s w) {k : Nat} (hk0 : 0 < k) (hk3 : k ≤ 3)
+    (hk : s.dstack.length < k) :
+    Run fs (uf c.layout k) w (.exit 1) := by
+  have hk0' : k ≠ 0 := by omega
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hlim : c.dEnd - 8 * k < 2 ^ 32 := by have := hg.dEnd_le; have := hg.msize_lt; omega
+  have hdG := hg.dEnd_ge
+  have hexec : execL [.globalGet spG, i32c (c.layout.dEnd - 8 * k), .i32gtu] w =
+      some { w with stack := .i32 (bool32 true) :: w.stack } := by
+    simp only [execL, stepI, hs.sp, i32c, Cfg.layout, Option.bind_some, bool32]
+    rw [show BitVec.ofNat 32 (c.dEnd - 8 * k) = ofN (c.dEnd - 8 * k) from rfl, ult_ofN hlim hX]
+    have hnum : c.dEnd - 8 * k < c.dEnd - 8 * s.dstack.length := by omega
+    simp [hnum]
+  have h3 : Run fs [.globalGet spG, i32c (c.layout.dEnd - 8 * k), .i32gtu] w
+      (.normal { w with stack := .i32 (bool32 true) :: w.stack }) :=
+    run_of_execL (by simp [WI.isCtl, i32c]) hexec
+  simp only [uf, hk0', if_false]
+  have h4 := run_ite_exit (fs := fs) (w := { w with stack := .i32 (bool32 true) :: w.stack })
+    (r := w.stack) (c := bool32 true) (k := 1) rfl (by simp [bool32])
+  have := run_append _ h3 h4
+  simpa using this
+
+end Uf
+
+section Ovf
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+theorem ovf_cmp {u : WState} {g base p : Nat} (hp : u.globals g = .i32 (ofN p)) (hP : p < 2 ^ 32)
+    (hb : base + 8 < 2 ^ 32) :
+    execL [i32c (base + 8), .globalGet g, .i32gtu] u =
+      some { u with stack := .i32 (bool32 (decide (p < base + 8))) :: u.stack } := by
+  have hu := ult_ofN hP hb
+  simp only [ofN] at hp hu
+  simp [execL, stepI, i32c, hp, hu]
+
+theorem ovf_pass {u : WState} {g base p : Nat} (hp : u.globals g = .i32 (ofN p)) (hP : p < 2 ^ 32)
+    (hb : base + 8 < 2 ^ 32) (h : base + 8 ≤ p) : Run fs (ovf g base) u (.normal u) := by
+  have h1 := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c]) (ovf_cmp hp hP hb)
+  have hf : decide (p < base + 8) = false := by simp; omega
+  rw [hf] at h1
+  have h2 := run_ite_false (fs := fs) (thn := [.exitTrap 6])
+    (w := { u with stack := .i32 (bool32 false) :: u.stack }) (r := u.stack) (by simp [bool32])
+  have := run_append _ h1 h2
+  simpa [ovf] using this
+
+theorem ovf_trap {u : WState} {g base p : Nat} (hp : u.globals g = .i32 (ofN p)) (hP : p < 2 ^ 32)
+    (hb : base + 8 < 2 ^ 32) (h : p < base + 8) : Run fs (ovf g base) u (.exit 6) := by
+  have h1 := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c]) (ovf_cmp hp hP hb)
+  have ht : decide (p < base + 8) = true := by simp; omega
+  rw [ht] at h1
+  have h2 := run_ite_exit (fs := fs) (w := { u with stack := .i32 (bool32 true) :: u.stack })
+    (r := u.stack) (c := bool32 true) (k := 6) rfl (by simp [bool32])
+  have := run_append _ h1 h2
+  simpa [ovf] using this
+
+/-- Data stack has room for one more word: the guard falls through. -/
+theorem ovfD_pass (hg : Geom c) (hs : Rel0 c s w)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (ovf spG c.layout.dBase) w (.normal w) := by
+  have := hg.dEnd_le; have := hg.msize_lt; have := hg.dBase_8
+  exact ovf_pass hs.sp (sp_lt hg hs) (by simp [Cfg.layout]; omega) (by simp [Cfg.layout]; omega)
+
+/-- Data stack full: the guard exits 6. -/
+theorem ovfD_trap (hg : Geom c) (hs : Rel0 c s w)
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (ovf spG c.layout.dBase) w (.exit 6) := by
+  have := hg.dEnd_le; have := hg.msize_lt; have := hg.dBase_8; have := hs.capD
+  exact ovf_trap hs.sp (sp_lt hg hs) (by simp [Cfg.layout]; omega) (by simp [Cfg.layout]; omega)
+
+theorem rp_lt (hg : Geom c) (hs : Rel0 c s w) : c.rEnd - 8 * s.rstack.length < 2 ^ 32 := by
+  have := hg.rEnd_le; have := hg.msize_lt; omega
+
+/-- Return stack has room for one more entry: the guard falls through. -/
+theorem ovfR_pass (hg : Geom c) (hs : Rel0 c s w)
+    (hfit : c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd) :
+    Run fs (ovf rpG c.layout.rBase) w (.normal w) := by
+  have := hg.rEnd_le; have := hg.msize_lt; have := hg.rBase_8
+  exact ovf_pass hs.rp (rp_lt hg hs) (by simp [Cfg.layout]; omega) (by simp [Cfg.layout]; omega)
+
+/-- Return stack full: the guard exits 6. -/
+theorem ovfR_trap (hg : Geom c) (hs : Rel0 c s w)
+    (h : ¬ c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd) :
+    Run fs (ovf rpG c.layout.rBase) w (.exit 6) := by
+  have := hg.rEnd_le; have := hg.msize_lt; have := hg.rBase_8; have := hs.capR
+  exact ovf_trap hs.rp (rp_lt hg hs) (by simp [Cfg.layout]; omega) (by simp [Cfg.layout]; omega)
+
+end Ovf
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/Init.lean

@@ -0,0 +1,156 @@
+import Wasm.Correct
+import Wasm.Emit
+
+/-!
+# Wasm.Init
+
+The state a module emitted by `Wasm.Emit.program` starts in, and the end-to-end theorem from it.
+
+`initState r` is what WebAssembly instantiation produces for the module's declarations, built
+from the same constants and byte encoding the emitter prints:
+* globals `$pc $sp $rp $ap` (indices 0 1 2 3) initialised to `0`, `dEnd`, `rEnd`, `aEnd`;
+* linear memory of `pages` pages, all zero except the data segment at `mb`, which holds the IR
+  memory image word by word (`byteOf`, little-endian);
+* an empty operand stack.
+That an engine instantiates the module this way is the WebAssembly specification's instantiation
+rule; like the rest of the model, it is trusted and checked by `wasmw`.
+
+`module_correct`: for every program and memory image that fit the runtime's fixed layout, running
+the module's start function from `initState` reaches the IR outcome from `State.init`, or exits 6.
+The only remaining hypotheses are about the program itself.
+-/
+
+namespace WordDialect
+namespace Wasm
+namespace Emit
+
+/-- Byte `p` of linear memory at instantiation: the data segment, else zero. -/
+def imageByte (img : List Nat) (mb p : Nat) : Nat :=
+  if mb ≤ p ∧ p < mb + 8 * img.length then byteOf (img.getD ((p - mb) / 8) 0) ((p - mb) % 8) else 0
+
+/-- Globals at instantiation: `$pc = 0`, `$sp = dEnd`, `$rp = rEnd`, `$ap = aEnd`. -/
+def initGlobals (r : Runtime) : Nat → Val := fun j =>
+  if j = pcG then .i32 (ofN 0) else if j = spG then .i32 (ofN r.dEnd)
+  else if j = rpG then .i32 (ofN r.rEnd) else if j = apG then .i32 (ofN r.aEnd) else .i32 0#32
+
+/-- The machine state of the instantiated module, before its start function runs. -/
+def initState (r : Runtime) : WState :=
+  { stack := [], globals := initGlobals r, mem := { bytes := imageByte r.memImage r.mb, size := r.msize } }
+
+/-- The runtime's fixed placement, as a `Cfg`. -/
+def Runtime.cfg (r : Runtime) : Cfg :=
+  { dEnd := r.dEnd, dBase := r.dBase, rEnd := r.rEnd, rBase := r.rBase, rf := r.rf,
+    nregs := r.nregs, mb := r.mb, M := r.memImage.length, msize := r.msize, aEnd := r.aEnd,
+    aBase := r.aBase }
+
+theorem cfg_layout (r : Runtime) : r.cfg.layout = r.layout := rfl
+
+/-- The register file and IR memory fit below the data stack. -/
+def Runtime.Fits (r : Runtime) : Prop := 8 * (r.nregs + r.memImage.length) ≤ 0x10000 - 0x1000
+
+theorem msize_eq (r : Runtime) : r.msize = 655360 := by
+  simp [Runtime.msize, Runtime.pages, Runtime.aEnd, Runtime.aBase, Runtime.rEnd, Runtime.rBase,
+    Runtime.dEnd, Runtime.dBase]
+
+/-- The runtime's layout satisfies `Geom` whenever the register file and memory image fit. -/
+theorem geom (r : Runtime) (h : r.Fits) : Geom r.cfg := by
+  have hm := msize_eq r
+  simp only [Runtime.Fits] at h
+  constructor <;>
+    simp only [Runtime.cfg, hm, Runtime.dEnd, Runtime.dBase, Runtime.rEnd, Runtime.rBase, Runtime.rf,
+      Runtime.mb, Runtime.aEnd, Runtime.aBase] <;> omega
+
+theorem rdBytes_shift (b : Nat → Nat) (a : Nat) :
+    ∀ n, rdBytes b a n = rdBytes (fun q => b (a + q)) 0 n := by
+  intro n
+  induction n with
+  | zero => rfl
+  | succ n ih => simp only [rdBytes, ih, Nat.zero_add]
+
+theorem rdBytes_zero (a : Nat) : ∀ n, rdBytes (fun _ => 0) a n = 0 := by
+  intro n; induction n with
+  | zero => rfl
+  | succ n ih => simp [rdBytes, ih]
+
+/-- Reading word `a` of the data segment gives the image's word `a`. -/
+theorem read_image (r : Runtime) (h : r.Fits) {a : Nat} (ha : a < r.memImage.length) :
+    (initState r).mem.read64 (r.mb + 8 * a) = some (BitVec.ofNat 64 (r.memImage.getD a 0)) := by
+  have hm := msize_eq r
+  simp only [Runtime.Fits] at h
+  have hsz : r.mb + 8 * a + 8 ≤ (initState r).mem.size := by
+    simp only [initState, hm, Runtime.mb, Runtime.rf]; omega
+  simp only [WMem.read64, hsz, ↓reduceIte]
+  congr 1
+  rw [rdBytes_shift]
+  have hc : rdBytes (fun q => (initState r).mem.bytes (r.mb + 8 * a + q)) 0 8 =
+      rdBytes (fun q => (r.memImage.getD a 0 / 256 ^ q) % 256) 0 8 := by
+    apply rdBytes_congr
+    intro i hi
+    have h1 : r.mb ≤ r.mb + 8 * a + i ∧ r.mb + 8 * a + i < r.mb + 8 * r.memImage.length := by
+      omega
+    have h2 : (r.mb + 8 * a + i - r.mb) / 8 = a := by omega
+    have h3 : (r.mb + 8 * a + i - r.mb) % 8 = i := by omega
+    simp only [initState, imageByte, Nat.zero_add]
+    simp only [h1, and_self, ↓reduceIte, h2, h3]
+    rfl
+  rw [hc, rdBytes_pow]
+  apply BitVec.eq_of_toNat_eq
+  simp [BitVec.toNat_ofNat, Nat.mod_mod_of_dvd]
+
+/-- Outside the data segment, linear memory reads as zero. -/
+theorem read_zero (r : Runtime) (h : r.Fits) {A : Nat} (hA : A + 8 ≤ r.mb) :
+    (initState r).mem.read64 A = some 0#64 := by
+  have hm := msize_eq r
+  simp only [Runtime.Fits] at h
+  have hsz : A + 8 ≤ (initState r).mem.size := by
+    simp only [initState, hm, Runtime.mb, Runtime.rf] at hA ⊢; omega
+  simp only [WMem.read64, hsz, ↓reduceIte]
+  congr 1
+  have hc : rdBytes (initState r).mem.bytes A 8 = rdBytes (fun _ => 0) A 8 := by
+    apply rdBytes_congr
+    intro i hi
+    have : ¬ (r.mb ≤ A + i ∧ A + i < r.mb + 8 * r.memImage.length) := by omega
+    simp [initState, imageByte, this]
+  rw [hc, rdBytes_zero]
+
+/-- The instantiated module is related to the IR's initial state: `RelD` holds at the top of the
+dispatch loop, for any program length. -/
+theorem init_relD (r : Runtime) (h : r.Fits) (n : Nat) :
+    RelD r.cfg n (State.init (Memory.ofImage r.memImage)) (initState r) := by
+  have hg := geom r h
+  have hm := msize_eq r
+  have hF := h
+  simp only [Runtime.Fits] at hF
+  refine init_rel n hg rfl rfl rfl rfl ?_ ?_ ?_ ?_ ?_ ?_ ?_ ?_ ?_
+  · simp [initState, initGlobals]
+  · simp [initState, initGlobals, Runtime.cfg, spG, pcG]
+  · simp [initState, initGlobals, Runtime.cfg, spG, pcG, rpG]
+  · rfl
+  · simp [initState, initGlobals, Runtime.cfg, spG, pcG, rpG, apG]
+  · intro reg hr
+    have hr' : reg < r.nregs := hr
+    have := read_zero r h (A := r.rf + 8 * reg) (by simp only [Runtime.mb]; omega)
+    simpa [State.init, Runtime.cfg] using this
+  · intro a ha
+    have ha' : a < r.memImage.length := ha
+    have hlt : a < 2 ^ 64 := by omega
+    have := read_image r h ha'
+    simpa [State.init, Memory.ofImage, Runtime.cfg, BitVec.toNat_ofNat, Nat.mod_eq_of_lt hlt] using this
+  · intro a
+    rfl
+  · simp [initState, Runtime.cfg]
+
+/-- End to end: the module `Wasm.Emit.program r p` declares, instantiated, runs its start function
+to the outcome the IR reaches from `State.init` on the memory image, or exits 6 (stack
+overflow). Hypotheses are only about the program: it fits the layout, it has fewer than `2^32`
+instructions, and its register indices are in range. -/
+theorem module_correct (r : Runtime) (p : Prog 64) (h : r.Fits) (hn : p.length < 2 ^ 32)
+    (hreg : RegsOk r.cfg p) {o : Outcome 64} (hx : Exec p (State.init (Memory.ofImage r.memImage)) o) :
+    FinalMain r.cfg (funcsOf r.layout p) (initState r) o ∨
+      Run (funcsOf r.layout p) mainBody (initState r) (.exit overflowCode) := by
+  rw [← cfg_layout]
+  exact lowerProg_correct_or_overflow (geom r h) hn hreg hx (init_relD r h p.length)
+
+end Emit
+end Wasm
+end WordDialect

backend/wasm/Wasm/Isa.lean

@@ -0,0 +1,256 @@
+/-!
+# Wasm.Isa
+
+A model of the WebAssembly subset the backend emits, following the WebAssembly core
+specification:
+
+* typed operand stack (`i32` / `i64`), mutable globals, linear memory, a function table;
+* `i64.load`/`i64.store` on **bytes** (little-endian), taking an `i32` address plus a static offset
+  computed in unbounded arithmetic; an access with any byte outside the memory traps. There is no
+  aliasing assumption: overlapping accesses are modelled exactly;
+* `i64.div_s` traps on division by zero and on `INT64_MIN / -1`; `i64.div_u` traps on division by
+  zero; shifts and rotates take the count modulo 64 (the spec's definition);
+* `if` (without `else`) and `loop`/`br` with the spec's label discipline, including unwinding the
+  operand stack to the label height on a branch; `call_indirect` through the function table (a
+  callee runs on a fresh operand stack and returns the single value it leaves).
+
+Two host calls are terminal pseudo-instructions: `exitTrap c` (`i32.const c; call $proc_exit`) and
+`exitHalt` (`global.get sp; call $halt`, which dumps the machine state and exits 0).
+
+Semantics is a big-step relation, so loops need no fuel. That the model matches a real
+WebAssembly engine is an assumption, tested by differential execution (`wasmw`).
+-/
+
+namespace WordDialect
+namespace Wasm
+
+abbrev W := BitVec 64
+abbrev W32 := BitVec 32
+
+inductive Val where
+  | i32 (v : W32)
+  | i64 (v : W)
+  deriving DecidableEq
+
+/-- Little-endian read of `n` bytes starting at `a` (each byte taken modulo 256). -/
+def rdBytes (b : Nat → Nat) (a : Nat) : Nat → Nat
+  | 0 => 0
+  | n + 1 => rdBytes b a n + (b (a + n) % 256) * 256 ^ n
+
+structure WMem where
+  bytes : Nat → Nat
+  size : Nat
+
+def WMem.read64 (m : WMem) (a : Nat) : Option W :=
+  if a + 8 ≤ m.size then some (BitVec.ofNat 64 (rdBytes m.bytes a 8)) else none
+
+def WMem.write64 (m : WMem) (a : Nat) (v : W) : Option WMem :=
+  if a + 8 ≤ m.size then
+    some { m with bytes := fun p => if a ≤ p ∧ p < a + 8 then (v.toNat / 256 ^ (p - a)) % 256 else m.bytes p }
+  else none
+
+structure WState where
+  stack : List Val
+  globals : Nat → Val
+  mem : WMem
+
+inductive WI where
+  | i32const (v : W32)
+  | i64const (v : W)
+  | globalGet (i : Nat)
+  | globalSet (i : Nat)
+  | i64load (off : Nat)
+  | i64store (off : Nat)
+  | i64add | i64sub | i64mul | i64and | i64or | i64xor
+  | i64shl | i64shru | i64rotl | i64rotr | i64divu | i64divs
+  | i64eq | i64ne | i64ltu | i64leu | i64gtu | i64geu | i64lts | i64les | i64gts | i64ges
+  | i64eqz
+  | i32add | i32sub | i32shl | i32gtu | i32eq
+  | i32wrap
+  | i64extu
+  | select
+  | loop (body : List WI)
+  | ite (thn : List WI)
+  | br (l : Nat)
+  | callIndirect
+  | exitTrap (code : Nat)
+  | exitHalt
+
+/-- Control constructs, calls and terminal pseudo-instructions (handled by `RunI`, not `stepI`). -/
+def WI.isCtl : WI → Bool
+  | .loop _ | .ite _ | .br _ | .callIndirect | .exitTrap _ | .exitHalt => true
+  | _ => false
+
+def bool32 (b : Bool) : W32 := if b then 1#32 else 0#32
+
+def bin64 (f : W → W → W) (s : WState) : Option WState :=
+  match s.stack with
+  | .i64 b :: .i64 a :: r => some { s with stack := .i64 (f a b) :: r }
+  | _ => none
+
+def cmp64 (f : W → W → Bool) (s : WState) : Option WState :=
+  match s.stack with
+  | .i64 b :: .i64 a :: r => some { s with stack := .i32 (bool32 (f a b)) :: r }
+  | _ => none
+
+def bin32 (f : W32 → W32 → W32) (s : WState) : Option WState :=
+  match s.stack with
+  | .i32 b :: .i32 a :: r => some { s with stack := .i32 (f a b) :: r }
+  | _ => none
+
+/-- One non-control instruction; `none` is a trap. -/
+def stepI : WI → WState → Option WState
+  | .i32const v, s => some { s with stack := .i32 v :: s.stack }
+  | .i64const v, s => some { s with stack := .i64 v :: s.stack }
+  | .globalGet i, s => some { s with stack := s.globals i :: s.stack }
+  | .globalSet i, s =>
+    match s.stack with
+    | v :: r => some { s with stack := r, globals := fun j => if j = i then v else s.globals j }
+    | _ => none
+  | .i64load off, s =>
+    match s.stack with
+    | .i32 a :: r =>
+      match s.mem.read64 (a.toNat + off) with
+      | some v => some { s with stack := .i64 v :: r }
+      | none => none
+    | _ => none
+  | .i64store off, s =>
+    match s.stack with
+    | .i64 v :: .i32 a :: r =>
+      match s.mem.write64 (a.toNat + off) v with
+      | some m => some { s with stack := r, mem := m }
+      | none => none
+    | _ => none
+  | .i64add, s => bin64 (· + ·) s
+  | .i64sub, s => bin64 (· - ·) s
+  | .i64mul, s => bin64 (· * ·) s
+  | .i64and, s => bin64 (· &&& ·) s
+  | .i64or, s => bin64 (· ||| ·) s
+  | .i64xor, s => bin64 (· ^^^ ·) s
+  | .i64shl, s => bin64 (fun a b => a <<< (b.toNat % 64)) s
+  | .i64shru, s => bin64 (fun a b => a >>> (b.toNat % 64)) s
+  | .i64rotl, s => bin64 (fun a b => a.rotateLeft (b.toNat % 64)) s
+  | .i64rotr, s => bin64 (fun a b => a.rotateRight (b.toNat % 64)) s
+  | .i64divu, s =>
+    match s.stack with
+    | .i64 b :: .i64 a :: r =>
+      if b = 0#64 then none
+      else some { s with stack := .i64 (BitVec.ofNat 64 (a.toNat / b.toNat)) :: r }
+    | _ => none
+  | .i64divs, s =>
+    match s.stack with
+    | .i64 b :: .i64 a :: r =>
+      if b = 0#64 ∨ (a = BitVec.intMin 64 ∧ b = BitVec.allOnes 64) then none
+      else some { s with stack := .i64 (BitVec.ofInt 64 (Int.tdiv a.toInt b.toInt)) :: r }
+    | _ => none
+  | .i64eq, s => cmp64 (fun a b => a == b) s
+  | .i64ne, s => cmp64 (fun a b => a != b) s
+  | .i64ltu, s => cmp64 (fun a b => a.ult b) s
+  | .i64leu, s => cmp64 (fun a b => a.ule b) s
+  | .i64gtu, s => cmp64 (fun a b => b.ult a) s
+  | .i64geu, s => cmp64 (fun a b => b.ule a) s
+  | .i64lts, s => cmp64 (fun a b => a.slt b) s
+  | .i64les, s => cmp64 (fun a b => a.sle b) s
+  | .i64gts, s => cmp64 (fun a b => b.slt a) s
+  | .i64ges, s => cmp64 (fun a b => b.sle a) s
+  | .i64eqz, s =>
+    match s.stack with
+    | .i64 a :: r => some { s with stack := .i32 (bool32 (a == 0#64)) :: r }
+    | _ => none
+  | .i32add, s => bin32 (· + ·) s
+  | .i32sub, s => bin32 (· - ·) s
+  | .i32shl, s => bin32 (fun a b => a <<< (b.toNat % 32)) s
+  | .i32gtu, s =>
+    match s.stack with
+    | .i32 b :: .i32 a :: r => some { s with stack := .i32 (bool32 (b.ult a)) :: r }
+    | _ => none
+  | .i32eq, s =>
+    match s.stack with
+    | .i32 b :: .i32 a :: r => some { s with stack := .i32 (bool32 (a == b)) :: r }
+    | _ => none
+  | .i32wrap, s =>
+    match s.stack with
+    | .i64 a :: r => some { s with stack := .i32 (BitVec.ofNat 32 a.toNat) :: r }
+    | _ => none
+  | .i64extu, s =>
+    match s.stack with
+    | .i32 a :: r => some { s with stack := .i64 (BitVec.ofNat 64 a.toNat) :: r }
+    | _ => none
+  | .select, s =>
+    match s.stack with
+    | .i32 c :: v2 :: v1 :: r => some { s with stack := (if c ≠ 0#32 then v1 else v2) :: r }
+    | _ => none
+  | _, _ => none
+
+/-- Outcomes of running a list of instructions. -/
+inductive Res where
+  | normal (s : WState)
+  | br (n : Nat) (s : WState)
+  | exit (code : Nat)
+  | halted (s : WState)
+  | fault
+
+/-- Leaving a labelled construct entered with operand stack `entry`: a branch to label 0 is
+consumed (for `if`; `loop` re-enters) and the operand stack is unwound to its height at entry;
+other branches propagate outward. -/
+inductive BlockOut (entry : List Val) : Res → Res → Prop where
+  | norm {s} : BlockOut entry (.normal s) (.normal s)
+  | br0 {s} : BlockOut entry (.br 0 s) (.normal { s with stack := entry })
+  | brS {n s} : BlockOut entry (.br (n + 1) s) (.br n s)
+  | exit {c} : BlockOut entry (.exit c) (.exit c)
+  | halted {s} : BlockOut entry (.halted s) (.halted s)
+  | fault : BlockOut entry .fault .fault
+
+/-- Results that abandon the rest of an instruction sequence. -/
+def Res.abrupt : Res → Prop
+  | .normal _ => False
+  | _ => True
+
+/-- A function table: entry `i` is the body of function `i`. -/
+abbrev Funcs := List (List WI)
+
+mutual
+inductive RunI (fs : Funcs) : WI → WState → Res → Prop where
+  | simple {i s s'} : i.isCtl = false → stepI i s = some s' → RunI fs i s (.normal s')
+  | simpleFault {i s} : i.isCtl = false → stepI i s = none → RunI fs i s .fault
+  | loopNormal {body s s'} : Run fs body s (.normal s') → RunI fs (.loop body) s (.normal s')
+  | loopBr0 {body s s' r} :
+      Run fs body s (.br 0 s') → RunI fs (.loop body) { s' with stack := s.stack } r →
+      RunI fs (.loop body) s r
+  | loopBrS {body s n s'} : Run fs body s (.br (n + 1) s') → RunI fs (.loop body) s (.br n s')
+  | loopExit {body s c} : Run fs body s (.exit c) → RunI fs (.loop body) s (.exit c)
+  | loopHalted {body s s'} : Run fs body s (.halted s') → RunI fs (.loop body) s (.halted s')
+  | loopFault {body s} : Run fs body s .fault → RunI fs (.loop body) s .fault
+  | iteThen {thn s r c res res'} :
+      s.stack = .i32 c :: r → c ≠ 0#32 → Run fs thn { s with stack := r } res →
+      BlockOut r res res' → RunI fs (.ite thn) s res'
+  | iteElse {thn s r c} :
+      s.stack = .i32 c :: r → c = 0#32 → RunI fs (.ite thn) s (.normal { s with stack := r })
+  | iteFault {thn s} : (∀ c r, s.stack ≠ .i32 c :: r) → RunI fs (.ite thn) s .fault
+  | br {l s} : RunI fs (.br l) s (.br l s)
+  | callNormal {s r i body s' v} :
+      s.stack = .i32 i :: r → fs[i.toNat]? = some body →
+      Run fs body { s with stack := [] } (.normal s') → s'.stack = [.i32 v] →
+      RunI fs .callIndirect s (.normal { s' with stack := .i32 v :: r })
+  | callBad {s r i body s'} :
+      s.stack = .i32 i :: r → fs[i.toNat]? = some body →
+      Run fs body { s with stack := [] } (.normal s') → (∀ v, s'.stack ≠ [.i32 v]) →
+      RunI fs .callIndirect s .fault
+  | callAbrupt {s r i body res} :
+      s.stack = .i32 i :: r → fs[i.toNat]? = some body →
+      Run fs body { s with stack := [] } res → res.abrupt →
+      RunI fs .callIndirect s (match res with | .br _ _ => .fault | other => other)
+  | callMissing {s r i} :
+      s.stack = .i32 i :: r → fs[i.toNat]? = none → RunI fs .callIndirect s .fault
+  | callBadStack {s} : (∀ i r, s.stack ≠ .i32 i :: r) → RunI fs .callIndirect s .fault
+  | exitTrap {c s} : RunI fs (.exitTrap c) s (.exit c)
+  | exitHalt {s} : RunI fs .exitHalt s (.halted s)
+
+inductive Run (fs : Funcs) : List WI → WState → Res → Prop where
+  | nil {s} : Run fs [] s (.normal s)
+  | consNormal {i is s s' r} : RunI fs i s (.normal s') → Run fs is s' r → Run fs (i :: is) s r
+  | consAbrupt {i is s r} : RunI fs i s r → r.abrupt → Run fs (i :: is) s r
+end
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/Lower.lean

@@ -0,0 +1,185 @@
+import WordDialect
+import Wasm.Isa
+
+/-!
+# Wasm.Lower
+
+Lowering of Universal Word IR (64-bit words) to WebAssembly.
+
+The IR has arbitrary jumps, calls and returns; WebAssembly has structured control. Solution: every
+IR instruction `k` becomes its own function `f_k : () → i32` that performs the instruction and
+returns the index of the next IR instruction; the module is a dispatch loop
+
+    loop { pc := call_indirect (table[pc]) ; br 0 }
+
+Function `n` (past the last instruction) is the bad-pc stub. Every jump target is clamped to `n` at
+lowering time, so a jump past the end traps `badPc` exactly as in the IR semantics.
+
+Globals: `0 = pc` (i32), `1 = sp` data-stack pointer (i32, grows down, empty = `dEnd`), `2 = rp`
+return-stack pointer (i32, grows down, empty = `rEnd`), `3 = ap` auxiliary-stack pointer (i32, grows
+down, empty = `aEnd`). The register file, IR memory and the three stacks live in linear memory at the
+static addresses of `Layout`; the operand stack is used only for temporaries. `call` pushes the IR
+index of the return instruction onto the return stack; `ret` pops it. `tor`/`fromr`/`rfetch` move or
+copy words between the data stack and the auxiliary stack; taking from an empty auxiliary stack
+exits 5 (`returnUnderflow`), as `ret` does on an empty return stack.
+
+Every `load`/`store` is bounds-checked against the IR memory size, and every popping instruction
+checks the operand count against `dEnd`, so traps match the IR semantics. Every instruction that
+grows the data stack checks for room above `dBase`, `call` checks for room above `rBase`, and `tor`
+checks for room above `aBase`; on
+overflow the module exits with code 6. The IR has unbounded stacks, so this exit has no IR
+counterpart: it reports that the run exceeded the target's stack capacity.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+structure Layout where
+  dEnd : Nat      -- data stack: empty at `dEnd`
+  rEnd : Nat      -- return stack: empty at `rEnd`
+  rf : Nat        -- virtual register file, cell `r` at `rf + 8r`
+  mb : Nat        -- IR memory, word `a` at `mb + 8a`
+  M : Nat         -- IR memory size in words
+  dBase : Nat     -- data stack: full at `dBase`
+  rBase : Nat     -- return stack: full at `rBase`
+  aEnd : Nat      -- auxiliary stack: empty at `aEnd`
+  aBase : Nat     -- auxiliary stack: full at `aBase`
+
+def pcG : Nat := 0
+def spG : Nat := 1
+def rpG : Nat := 2
+def apG : Nat := 3
+
+def i32c (n : Nat) : WI := .i32const (BitVec.ofNat 32 n)
+def i64c (n : Nat) : WI := .i64const (BitVec.ofNat 64 n)
+
+def spAdd (d : Nat) : List WI := [.globalGet spG, i32c d, .i32add, .globalSet spG]
+def spSub (d : Nat) : List WI := [.globalGet spG, i32c d, .i32sub, .globalSet spG]
+
+/-- Operand-count guard for `k` operands: trap `stackUnderflow` unless `sp ≤ dEnd - 8k`. -/
+def uf (L : Layout) (k : Nat) : List WI :=
+  if k = 0 then [] else [.globalGet spG, i32c (L.dEnd - 8 * k), .i32gtu, .ite [.exitTrap 1]]
+
+/-- Overflow guard on the stack whose pointer is global `g`: exit 6 unless one more word fits,
+i.e. unless `base + 8 ≤ ptr`. -/
+def ovf (g base : Nat) : List WI := [i32c (base + 8), .globalGet g, .i32gtu, .ite [.exitTrap 6]]
+
+/-- Push the word computed by `val`. -/
+def pushWith (val : List WI) : List WI :=
+  spSub 8 ++ [.globalGet spG] ++ val ++ [.i64store 0]
+
+/-- `[sp + off]` as an `i64` on the operand stack. -/
+def ldS (off : Nat) : List WI := [.globalGet spG, .i64load off]
+
+/-- Address of IR memory word `[sp+0]`, bounds-checked first. -/
+def memAddr (L : Layout) : List WI :=
+  ldS 0 ++ [.i64const (BitVec.ofNat 64 L.M), .i64geu, .ite [.exitTrap 2]] ++
+    ldS 0 ++ [.i32wrap, i32c 3, .i32shl, i32c L.mb, .i32add]
+
+/-- Binary operation on `[sp+8] (op) [sp+0]`, result in `[sp+8]`, then pop one. -/
+def binBody (op : List WI) : List WI :=
+  [.globalGet spG] ++ ldS 8 ++ ldS 0 ++ op ++ [.i64store 8] ++ spAdd 8
+
+def binOp (L : Layout) (op : List WI) : List WI := uf L 2 ++ binBody op
+
+/-- Shifts: a count of 64 or more yields 0. -/
+def shiftBody (op : WI) : List WI :=
+  [.globalGet spG, .i64const 0#64] ++ ldS 8 ++ ldS 0 ++ [op] ++
+    ldS 0 ++ [.i64const 64#64, .i64geu, .select, .i64store 8] ++ spAdd 8
+
+def shiftOp (L : Layout) (op : WI) : List WI := uf L 2 ++ shiftBody op
+
+/-- Trap `divideByZero` when the divisor `[sp+0]` is zero. -/
+def zeroGuard : List WI := ldS 0 ++ [.i64eqz, .ite [.exitTrap 3]]
+
+/-- Signed division of `[sp+8]` by `[sp+0]` (non-zero), result in `[sp+8]`, pop one. A divisor of -1
+yields `0 - a` and the divisor passed to `i64.div_s` is then 1, so the spec's `INT64_MIN / -1` trap
+cannot occur. -/
+def sdivBody : List WI :=
+  [.globalGet spG, .i64const 0#64] ++ ldS 8 ++ [.i64sub] ++
+    ldS 8 ++ [.i64const 1#64] ++ ldS 0 ++ ldS 0 ++ [.i64const (BitVec.allOnes 64), .i64eq, .select,
+      .i64divs] ++ ldS 0 ++ [.i64const (BitVec.allOnes 64), .i64eq, .select, .i64store 8] ++
+    spAdd 8
+
+def cmpOp : WordDialect.Cond → WI
+  | .eq => .i64eq | .ne => .i64ne | .ult => .i64ltu | .ule => .i64leu | .ugt => .i64gtu
+  | .uge => .i64geu | .slt => .i64lts | .sle => .i64les | .sgt => .i64gts | .sge => .i64ges
+
+/-- Code for IR instruction number `k` of a program of `n` instructions: performs it and leaves
+the next instruction index on the operand stack. -/
+def lowerInstr (L : Layout) (n k : Nat) : WordDialect.Instr 64 → List WI
+  | .word w => ovf spG L.dBase ++ pushWith [.i64const w] ++ [i32c (k + 1)]
+  | .ptr p => ovf spG L.dBase ++ pushWith [.i64const p.toWord] ++ [i32c (k + 1)]
+  | .load =>
+    uf L 1 ++ [.globalGet spG] ++ memAddr L ++ [.i64load 0, .i64store 0] ++ [i32c (k + 1)]
+  | .store =>
+    uf L 2 ++ memAddr L ++ ldS 8 ++ [.i64store 0] ++ spAdd 16 ++ [i32c (k + 1)]
+  | .add => binOp L [.i64add] ++ [i32c (k + 1)]
+  | .sub => binOp L [.i64sub] ++ [i32c (k + 1)]
+  | .mul => binOp L [.i64mul] ++ [i32c (k + 1)]
+  | .and => binOp L [.i64and] ++ [i32c (k + 1)]
+  | .or => binOp L [.i64or] ++ [i32c (k + 1)]
+  | .xor => binOp L [.i64xor] ++ [i32c (k + 1)]
+  | .div => uf L 2 ++ zeroGuard ++ binBody [.i64divu] ++ [i32c (k + 1)]
+  | .sdiv => uf L 2 ++ zeroGuard ++ sdivBody ++ [i32c (k + 1)]
+  | .not =>
+    uf L 1 ++ [.globalGet spG] ++ ldS 0 ++ [.i64const (BitVec.allOnes 64), .i64xor, .i64store 0] ++
+      [i32c (k + 1)]
+  | .shl => shiftOp L .i64shl ++ [i32c (k + 1)]
+  | .shr => shiftOp L .i64shru ++ [i32c (k + 1)]
+  | .rotl => binOp L [.i64rotl] ++ [i32c (k + 1)]
+  | .rotr => binOp L [.i64rotr] ++ [i32c (k + 1)]
+  | .cmp c => binOp L [cmpOp c, .i64extu] ++ [i32c (k + 1)]
+  | .select =>
+    uf L 3 ++ [.globalGet spG] ++ ldS 16 ++ ldS 8 ++ ldS 0 ++ [.i64const 0#64, .i64ne, .select,
+      .i64store 16] ++ spAdd 16 ++ [i32c (k + 1)]
+  | .jmp t => [i32c (min t n)]
+  | .branch t =>
+    uf L 1 ++ [i32c (min t n), i32c (k + 1)] ++ ldS 0 ++ [.i64const 0#64, .i64ne, .select] ++ spAdd 8
+  | .call t =>
+    ovf rpG L.rBase ++ [.globalGet rpG, i32c 8, .i32sub, .globalSet rpG, .globalGet rpG, i64c (k + 1), .i64store 0,
+      i32c (min t n)]
+  | .ret =>
+    [.globalGet rpG, i32c L.rEnd, .i32eq, .ite [.exitTrap 5], .globalGet rpG, .i64load 0, .i32wrap,
+      .globalGet rpG, i32c 8, .i32add, .globalSet rpG]
+  | .push r => ovf spG L.dBase ++ pushWith [i32c (L.rf + 8 * r), .i64load 0] ++ [i32c (k + 1)]
+  | .pop r =>
+    uf L 1 ++ [i32c (L.rf + 8 * r)] ++ ldS 0 ++ [.i64store 0] ++ spAdd 8 ++ [i32c (k + 1)]
+  | .dup => uf L 1 ++ ovf spG L.dBase ++ spSub 8 ++ [.globalGet spG] ++ ldS 8 ++ [.i64store 0] ++ [i32c (k + 1)]
+  | .drop => uf L 1 ++ spAdd 8 ++ [i32c (k + 1)]
+  | .swap =>
+    uf L 2 ++ [.globalGet spG] ++ ldS 8 ++ [.globalGet spG] ++ ldS 0 ++ [.i64store 8, .i64store 0] ++
+      [i32c (k + 1)]
+  | .over =>
+    uf L 2 ++ ovf spG L.dBase ++ spSub 8 ++ [.globalGet spG, .globalGet spG, .i64load 16, .i64store 0] ++ [i32c (k + 1)]
+  | .rot =>
+    uf L 3 ++ [.globalGet spG] ++ ldS 16 ++ [.globalGet spG] ++ ldS 0 ++ [.globalGet spG] ++ ldS 8 ++
+      [.i64store 16, .i64store 8, .i64store 0] ++ [i32c (k + 1)]
+  | .tor =>
+    uf L 1 ++ ovf apG L.aBase ++ [.globalGet apG, i32c 8, .i32sub, .globalSet apG, .globalGet apG] ++
+      ldS 0 ++ [.i64store 0] ++ spAdd 8 ++ [i32c (k + 1)]
+  | .fromr =>
+    [.globalGet apG, i32c L.aEnd, .i32eq, .ite [.exitTrap 5]] ++ ovf spG L.dBase ++
+      pushWith [.globalGet apG, .i64load 0] ++ [.globalGet apG, i32c 8, .i32add, .globalSet apG] ++
+      [i32c (k + 1)]
+  | .rfetch =>
+    [.globalGet apG, i32c L.aEnd, .i32eq, .ite [.exitTrap 5]] ++ ovf spG L.dBase ++
+      pushWith [.globalGet apG, .i64load 0] ++ [i32c (k + 1)]
+  | .halt => [.exitHalt]
+
+/-- Function `k`: the code of IR instruction `k`, or the bad-pc stub past the end. -/
+def instrCode (L : Layout) (p : Prog 64) (k : Nat) : List WI :=
+  match p[k]? with
+  | some i => lowerInstr L p.length k i
+  | none => [.exitTrap 4]
+
+/-- The function table: one function per IR instruction, then the bad-pc stub. -/
+def funcsOf (L : Layout) (p : Prog 64) : Funcs :=
+  (List.range (p.length + 1)).map (instrCode L p)
+
+/-- The module's start function: the dispatch loop. -/
+def mainBody : List WI :=
+  [.loop [.globalGet pcG, .callIndirect, .globalSet pcG, .br 0]]
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/Mem.lean

@@ -0,0 +1,89 @@
+import Wasm.Isa
+
+/-!
+# Wasm.Mem
+
+Byte-level memory facts: a write of eight bytes is read back by a read at the same address, and
+leaves every read at a disjoint address unchanged. These replace any "word cell" memory assumption.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+theorem rdBytes_congr {b b' : Nat → Nat} {a : Nat} :
+    ∀ {n : Nat}, (∀ i, i < n → b (a + i) = b' (a + i)) → rdBytes b a n = rdBytes b' a n := by
+  intro n
+  induction n with
+  | zero => intro _; rfl
+  | succ n ih =>
+    intro h
+    simp only [rdBytes]
+    rw [ih (fun i hi => h i (by omega)), h n (by omega)]
+
+theorem rdBytes_pow (v : Nat) : ∀ n : Nat,
+    rdBytes (fun p => (v / 256 ^ p) % 256) 0 n = v % 256 ^ n := by
+  intro n
+  induction n with
+  | zero => simp [rdBytes, Nat.mod_one]
+  | succ n ih =>
+    simp only [rdBytes, Nat.zero_add]
+    rw [ih, Nat.pow_succ, Nat.mod_mul]
+    simp [Nat.mod_mod, Nat.mul_comm]
+
+theorem write64_size {m m' : WMem} {a : Nat} {v : W} (h : m.write64 a v = some m') :
+    m'.size = m.size ∧ a + 8 ≤ m.size := by
+  unfold WMem.write64 at h
+  split at h
+  · rename_i hlt; simp at h; subst h; exact ⟨rfl, hlt⟩
+  · simp at h
+
+theorem write64_some {m : WMem} {a : Nat} {v : W} (h : a + 8 ≤ m.size) :
+    ∃ m', m.write64 a v = some m' := by
+  simp [WMem.write64, h]
+
+theorem read64_write64_same {m m' : WMem} {a : Nat} {v : W} (h : m.write64 a v = some m') :
+    m'.read64 a = some v := by
+  obtain ⟨hs, hlt⟩ := write64_size h
+  unfold WMem.write64 at h
+  rw [if_pos hlt] at h
+  simp at h
+  subst h
+  unfold WMem.read64
+  rw [if_pos (by simpa using hlt)]
+  congr 1
+  have hc : rdBytes (fun p => if a ≤ p ∧ p < a + 8 then (v.toNat / 256 ^ (p - a)) % 256 else m.bytes p) a 8
+      = rdBytes (fun p => (v.toNat / 256 ^ p) % 256) 0 8 := by
+    rw [show rdBytes (fun p => (v.toNat / 256 ^ p) % 256) 0 8 =
+        rdBytes (fun p => (v.toNat / 256 ^ (p - a)) % 256) a 8 from ?_]
+    · apply rdBytes_congr
+      intro i hi
+      have h1 : a ≤ a + i := by omega
+      have h2 : a + i < a + 8 := by omega
+      simp [h1, h2]
+    · simp only [rdBytes]
+      simp [Nat.add_sub_cancel_left]
+  rw [hc, rdBytes_pow]
+  have : v.toNat < 256 ^ 8 := by have := v.isLt; simpa using this
+  rw [Nat.mod_eq_of_lt this]
+  simp
+
+theorem read64_write64_other {m m' : WMem} {a b : Nat} {v : W} (h : m.write64 a v = some m')
+    (hd : b + 8 ≤ a ∨ a + 8 ≤ b) : m'.read64 b = m.read64 b := by
+  obtain ⟨hs, hlt⟩ := write64_size h
+  unfold WMem.write64 at h
+  rw [if_pos hlt] at h
+  simp at h
+  subst h
+  unfold WMem.read64
+  simp only []
+  by_cases hb : b + 8 ≤ m.size
+  · rw [if_pos hb, if_pos hb]
+    congr 2
+    apply rdBytes_congr
+    intro i hi
+    have : ¬ (a ≤ b + i ∧ b + i < a + 8) := by omega
+    simp [this]
+  · rw [if_neg hb, if_neg hb]
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/Rel.lean

@@ -0,0 +1,116 @@
+import WordDialect
+import Wasm.Lower
+import Wasm.Mem
+
+/-!
+# Wasm.Rel
+
+The relation between an IR state and a WebAssembly machine state.
+
+Linear-memory regions (byte intervals, all within the memory and within the 32-bit address space,
+pairwise disjoint):
+* data stack   `[dBase, dEnd)`, with `k` words on it the top is at `dEnd - 8k`;
+* register file `[rf, rf + 8 nregs)`;
+* IR memory     `[mb, mb + 8 M)`, word `a` at `mb + 8a`;
+* return stack  `[rBase, rEnd)`, with `k` entries the top is at `rEnd - 8k`; an entry is the IR index
+  of the return instruction;
+* auxiliary stack `[aBase, aEnd)`, with `k` words on it the top is at `aEnd - 8k`.
+Everything is stated at natural-number byte addresses and `read64` on the byte memory.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+structure Cfg where
+  dEnd : Nat
+  dBase : Nat
+  rEnd : Nat
+  rBase : Nat
+  rf : Nat
+  nregs : Nat
+  mb : Nat
+  M : Nat
+  msize : Nat
+  aEnd : Nat
+  aBase : Nat
+
+def Cfg.layout (c : Cfg) : Layout :=
+  { dEnd := c.dEnd, rEnd := c.rEnd, rf := c.rf, mb := c.mb, M := c.M, dBase := c.dBase,
+    rBase := c.rBase, aEnd := c.aEnd, aBase := c.aBase }
+
+structure Geom (c : Cfg) : Prop where
+  msize_lt : c.msize < 2 ^ 32
+  dEnd_le : c.dEnd ≤ c.msize
+  rEnd_le : c.rEnd ≤ c.msize
+  rf_le : c.rf + 8 * c.nregs ≤ c.msize
+  mb_le : c.mb + 8 * c.M ≤ c.msize
+  dBase_le : c.dBase ≤ c.dEnd
+  rBase_le : c.rBase ≤ c.rEnd
+  dBase_8 : c.dBase + 8 ≤ c.dEnd
+  rBase_8 : c.rBase + 8 ≤ c.rEnd
+  dEnd_ge : 24 ≤ c.dEnd
+  dS_F : c.dEnd ≤ c.rf ∨ c.rf + 8 * c.nregs ≤ c.dBase
+  dS_M : c.dEnd ≤ c.mb ∨ c.mb + 8 * c.M ≤ c.dBase
+  dS_K : c.dEnd ≤ c.rBase ∨ c.rEnd ≤ c.dBase
+  dF_M : c.rf + 8 * c.nregs ≤ c.mb ∨ c.mb + 8 * c.M ≤ c.rf
+  dF_K : c.rf + 8 * c.nregs ≤ c.rBase ∨ c.rEnd ≤ c.rf
+  dM_K : c.mb + 8 * c.M ≤ c.rBase ∨ c.rEnd ≤ c.mb
+  aEnd_le : c.aEnd ≤ c.msize
+  aBase_8 : c.aBase + 8 ≤ c.aEnd
+  dS_A : c.dEnd ≤ c.aBase ∨ c.aEnd ≤ c.dBase
+  dF_A : c.rf + 8 * c.nregs ≤ c.aBase ∨ c.aEnd ≤ c.rf
+  dM_A : c.mb + 8 * c.M ≤ c.aBase ∨ c.aEnd ≤ c.mb
+  dK_A : c.rEnd ≤ c.aBase ∨ c.aEnd ≤ c.rBase
+
+/-- A natural number as an `i32`. -/
+def ofN (a : Nat) : W32 := BitVec.ofNat 32 a
+
+theorem ofN_toNat {a : Nat} (h : a < 2 ^ 32) : (ofN a).toNat = a := by
+  simp [ofN, BitVec.toNat_ofNat, Nat.mod_eq_of_lt h]
+
+theorem ofN_inj {a b : Nat} (ha : a < 2 ^ 32) (hb : b < 2 ^ 32) (h : ofN a = ofN b) : a = b := by
+  have := congrArg BitVec.toNat h
+  simpa [ofN, BitVec.toNat_ofNat, Nat.mod_eq_of_lt ha, Nat.mod_eq_of_lt hb] using this
+
+theorem ofN_add (a b : Nat) : ofN a + ofN b = ofN (a + b) := (BitVec.ofNat_add a b).symm
+
+theorem ofN_sub {a b : Nat} (h : b ≤ a) : ofN a - ofN b = ofN (a - b) := by
+  apply BitVec.eq_of_toNat_eq
+  simp only [ofN, BitVec.toNat_sub, BitVec.toNat_ofNat]
+  have h1 : (a - b) % 2 ^ 32 = ((2 ^ 32 - b % 2 ^ 32) + a % 2 ^ 32) % 2 ^ 32 := by omega
+  exact h1.symm
+
+def StackRel (c : Cfg) (m : WMem) (d : List W) : Prop :=
+  ∀ i v, d[i]? = some v → m.read64 (c.dEnd - 8 * d.length + 8 * i) = some v
+
+def RegRel (c : Cfg) (m : WMem) (regs : Nat → W) : Prop :=
+  ∀ r, r < c.nregs → m.read64 (c.rf + 8 * r) = some (regs r)
+
+def MemRel (c : Cfg) (m : WMem) (im : WordDialect.Memory 64) : Prop :=
+  ∀ a, a < c.M → m.read64 (c.mb + 8 * a) = some (im.cell (BitVec.ofNat 64 a))
+
+def RsRel (c : Cfg) (m : WMem) (rs : List Nat) : Prop :=
+  ∀ i a, rs[i]? = some a → m.read64 (c.rEnd - 8 * rs.length + 8 * i) = some (BitVec.ofNat 64 a)
+
+def AuxRel (c : Cfg) (m : WMem) (as : List W) : Prop :=
+  ∀ i v, as[i]? = some v → m.read64 (c.aEnd - 8 * as.length + 8 * i) = some v
+
+/-- The relation, except for the operand stack and the `pc` global (those are added at the top of
+the dispatch loop by `RelD` in `Wasm.Correct`). -/
+structure Rel0 (c : Cfg) (s : State 64) (w : WState) : Prop where
+  sp : w.globals spG = .i32 (ofN (c.dEnd - 8 * s.dstack.length))
+  rp : w.globals rpG = .i32 (ofN (c.rEnd - 8 * s.rstack.length))
+  stack : StackRel c w.mem s.dstack
+  regs : RegRel c w.mem s.regs
+  mem : MemRel c w.mem s.mem
+  rs : RsRel c w.mem s.rstack
+  irvalid : ∀ a : Word 64, s.mem.valid a = decide (a.toNat < c.M)
+  size : w.mem.size = c.msize
+  capD : c.dBase + 8 * s.dstack.length ≤ c.dEnd
+  capR : c.rBase + 8 * s.rstack.length ≤ c.rEnd
+  ap : w.globals apG = .i32 (ofN (c.aEnd - 8 * s.astack.length))
+  aux : AuxRel c w.mem s.astack
+  capA : c.aBase + 8 * s.astack.length ≤ c.aEnd
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/Seq.lean

@@ -0,0 +1,65 @@
+import Wasm.Rel
+
+/-!
+# Wasm.Seq
+
+Straight-line execution (`execL`) with its `Run` derivation, sequencing, and the operand-count
+guard `uf`.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+/-- Straight-line evaluation of non-control instructions. -/
+def execL : List WI → WState → Option WState
+  | [], s => some s
+  | i :: is, s => (stepI i s).bind (execL is)
+
+theorem run_of_execL {fs : Funcs} : ∀ {is : List WI} {s s' : WState},
+    (∀ i ∈ is, i.isCtl = false) → execL is s = some s' → Run fs is s (.normal s')
+  | [], s, s', _, h => by simp [execL] at h; subst h; exact .nil
+  | i :: is, s, s', hc, h => by
+    simp only [execL] at h
+    cases hs : stepI i s with
+    | none => simp [hs] at h
+    | some s1 =>
+      rw [hs] at h
+      exact .consNormal (.simple (hc i (by simp)) hs)
+        (run_of_execL (fun j hj => hc j (by simp [hj])) h)
+
+theorem run_append {fs : Funcs} : ∀ (a : List WI) {b : List WI} {s s' : WState} {r : Res},
+    Run fs a s (.normal s') → Run fs b s' r → Run fs (a ++ b) s r
+  | [], b, s, s', r, h1, h2 => by cases h1; simpa using h2
+  | i :: a, b, s, s', r, h1, h2 => by
+    cases h1 with
+    | consNormal hi hs => exact .consNormal hi (run_append a hs h2)
+    | consAbrupt hi hab => exact absurd hab (by simp [Res.abrupt])
+
+theorem run_append_abrupt {fs : Funcs} : ∀ (a : List WI) {b : List WI} {s : WState} {r : Res},
+    Run fs a s r → r.abrupt → Run fs (a ++ b) s r
+  | [], b, s, r, h1, hr => by cases h1; exact absurd hr (by simp [Res.abrupt])
+  | i :: a, b, s, r, h1, hr => by
+    cases h1 with
+    | consNormal hi hs => exact .consNormal hi (run_append_abrupt a hs hr)
+    | consAbrupt hi hab => exact .consAbrupt hi hab
+
+/-- `if` whose condition is false: continue with the condition popped. -/
+theorem run_ite_false {fs : Funcs} {thn : List WI} {w : WState} {r : List Val} (hs : w.stack = .i32 0#32 :: r) :
+    Run fs [.ite thn] w (.normal { w with stack := r }) :=
+  .consNormal (.iteElse hs rfl) .nil
+
+/-- `if (cond ≠ 0) { exit code }`. -/
+theorem run_ite_exit {fs : Funcs} {w : WState} {r : List Val} {c : W32} {k : Nat}
+    (hs : w.stack = .i32 c :: r) (hc : c ≠ 0#32) : Run fs [.ite [.exitTrap k]] w (.exit k) :=
+  .consAbrupt (.iteThen hs hc (.consAbrupt .exitTrap trivial) .exit) trivial
+
+/-- All instructions are non-control. -/
+def allSimple (l : List WI) : Bool := l.all fun i => !i.isCtl
+
+theorem allSimple_spec {l : List WI} (h : allSimple l = true) : ∀ i ∈ l, i.isCtl = false := by
+  intro i hi
+  have := List.all_eq_true.mp h i hi
+  simpa using this
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/SimAlu.lean

@@ -0,0 +1,159 @@
+import Wasm.Guard
+
+/-!
+# Wasm.SimAlu
+
+Simulation of the binary operations: the generic `sim_binop` (operand guard, two loads, the
+operation, a store into the second slot, pop one) and its instantiations.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+section Sim
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+theorem run_finish {u : WState} (nxt : Nat) :
+    Run fs [i32c nxt] u (.normal { u with stack := .i32 (ofN nxt) :: u.stack }) :=
+  run_of_execL (by simp [WI.isCtl, i32c]) (by simp [execL, stepI, i32c, ofN])
+
+theorem ctl_binBody {op : List WI} (hctl : ∀ i ∈ op, i.isCtl = false) :
+    ∀ i ∈ binBody op, i.isCtl = false := by
+  intro i hi
+  simp only [binBody, ldS, spAdd, List.mem_append, List.mem_cons, List.mem_nil_iff, or_false] at hi
+  rcases hi with ((((hi | hi | hi) | hi | hi) | hi) | hi) | hi | hi | hi | hi
+  all_goals first | exact hctl i ‹_› | (subst_vars; rfl)
+
+/-- Core of every instruction shaped `uf 2; <body>; next`: the body (given as an execution fact)
+overwrites the second slot with `y` and pops one. -/
+theorem sim_bin_core (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W} {pre : List WI}
+    (hpre : Run fs pre w (.normal w))
+    (hd : s.dstack = b :: a :: d) {B : List WI} {y : W} (hctlB : ∀ i ∈ B, i.isCtl = false)
+    (hB : ∀ m', w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8) y = some m' →
+      execL B w = some { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) })
+    (nxt : Nat) :
+    ∃ w', Run fs (pre ++ (B ++ [i32c nxt])) w (.normal w') ∧
+      Rel0 c { s with dstack := y :: d } w' ∧ w'.stack = [.i32 (ofN nxt)] := by
+  have hlen : s.dstack.length = d.length + 2 := by simp [hd]
+  have hk : 2 ≤ s.dstack.length := by omega
+  have hcap := hs.capD
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8) y = some m' :=
+    write64_some (by rw [hs.size]; have := hg.dEnd_le; omega)
+  have hbR := run_of_execL (fs := fs) hctlB (hB m' hm')
+  have hrel1 := wr_stack hg hs (j := 1) (by omega) (v := y) (m' := m') (by simpa using hm')
+  have hrel2 := adj_sp hg hrel1 (n := 1) (by simp [hd])
+  have e3 : ({ { s with dstack := s.dstack.set 1 y } with dstack := ({ s with dstack := s.dstack.set 1 y } : State 64).dstack.drop 1 } : State 64) = { s with dstack := y :: d } := by
+    simp [hd]
+  rw [e3] at hrel2
+  have e2 : c.dEnd - 8 * s.dstack.length + 8 = c.dEnd - 8 * (s.dstack.length - 1) := by omega
+  rw [e2] at hbR
+  refine ⟨_, run_append _ hpre (run_append _ hbR (run_finish nxt)), ?_, ?_⟩
+  · refine Rel0.congr (hrel2.setStack []) rfl ?_ ?_ ?_
+    · simp [setG, spG, List.length_set]
+    · simp [setG, spG, rpG]
+    · simp [setG, spG, apG]
+  · simp [hst]
+
+theorem sim_binop (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W} {pre : List WI}
+    (hpre : Run fs pre w (.normal w))
+    (hd : s.dstack = b :: a :: d) {op : List WI} (hctl : ∀ i ∈ op, i.isCtl = false) {y : W}
+    (hop : ∀ (u : WState) (r : List Val), u.stack = .i64 b :: .i64 a :: r →
+      execL op u = some { u with stack := .i64 y :: r }) (nxt : Nat) :
+    ∃ w', Run fs (pre ++ (binBody op ++ [i32c nxt])) w (.normal w') ∧
+      Rel0 c { s with dstack := y :: d } w' ∧ w'.stack = [.i32 (ofN nxt)] := by
+  have hlen : s.dstack.length = d.length + 2 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some a := by
+    have := hs.stack 1 a (by simp [hd]); simpa using this
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some b := by
+    have := hs.stack 0 b (by simp [hd]); simpa using this
+  refine sim_bin_core hg hs hst hpre hd (ctl_binBody hctl) ?_ nxt
+  intro m' hm'
+  have hsp8 : ofN (c.dEnd - 8 * s.dstack.length) + ofN 8 = ofN (c.dEnd - 8 * s.dstack.length + 8) :=
+    ofN_add _ _
+  have hpre : execL ([.globalGet spG] ++ ldS 8 ++ ldS 0) w = some { w with stack := .i64 b :: .i64 a :: .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } := by
+    simp [ldS, execL, stepI, hs.sp, ofN_toNat hX, hr0, hr1]
+  have hop' := hop { w with stack := .i64 b :: .i64 a :: .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } (.i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack) rfl
+  have hstore : execL [.i64store 8] { w with stack := .i64 y :: .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } = some { w with mem := m' } := by
+    simp [execL, stepI, ofN_toNat hX, hm']
+  have hadd : execL (spAdd 8) { w with mem := m' } = some { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) } := by
+    have hsp8' : ofN (c.dEnd - 8 * s.dstack.length) + 8#32 = ofN (c.dEnd - 8 * s.dstack.length + 8) := hsp8
+    simp [spAdd, execL, stepI, bin32, hs.sp, i32c]
+    unfold setG
+    rw [hsp8']
+  simp only [binBody, execL_append, hpre, Option.bind_some, hop', hstore, hadd]
+
+theorem uf2_pass (hg : Geom c) (hs : Rel0 c s w) {b a : W} {d : List W} (hd : s.dstack = b :: a :: d) :
+    Run fs (uf c.layout 2) w (.normal w) :=
+  uf_pass hg hs (k := 2) (by omega) (by simp [hd])
+
+/-- Conclusion shared by every instruction simulation. -/
+abbrev Sim1 (c : Cfg) (fs : Funcs) (body : List WI) (s' : State 64) (w : WState) (nxt : Nat) : Prop :=
+  ∃ w', Run fs body w (.normal w') ∧ Rel0 c s' w' ∧ w'.stack = [.i32 (ofN nxt)]
+
+macro "hop_tac" : tactic =>
+  `(tactic| (intro u r h; simp [execL, stepI, bin64, cmp64, bool32, Word.rotl, Word.rotr, Word.ofBool, WordDialect.Cond.eval, cmpOp, h]))
+
+theorem sim_add (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .add) { s with dstack := (a + b) :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64add]) (by simp [WI.isCtl]) (y := a + b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem sim_sub (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .sub) { s with dstack := (a - b) :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64sub]) (by simp [WI.isCtl]) (y := a - b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem sim_mul (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .mul) { s with dstack := (a * b) :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64mul]) (by simp [WI.isCtl]) (y := a * b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem sim_and (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .and) { s with dstack := (a &&& b) :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64and]) (by simp [WI.isCtl]) (y := a &&& b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem sim_or (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .or) { s with dstack := (a ||| b) :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64or]) (by simp [WI.isCtl]) (y := a ||| b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem sim_xor (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .xor) { s with dstack := (a ^^^ b) :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64xor]) (by simp [WI.isCtl]) (y := a ^^^ b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem sim_rotl (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .rotl) { s with dstack := Word.rotl a b :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64rotl]) (by simp [WI.isCtl]) (y := Word.rotl a b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem sim_rotr (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .rotr) { s with dstack := Word.rotr a b :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [.i64rotr]) (by simp [WI.isCtl]) (y := Word.rotr a b) (by hop_tac) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+theorem ext_bool (v : Bool) : BitVec.setWidth 64 (bool32 v) = Word.ofBool v := by
+  cases v <;> simp [bool32, Word.ofBool]
+
+theorem sim_cmp (n k : Nat) (cd : WordDialect.Cond) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = [])
+    {a b : W} {d : List W} (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k (.cmp cd)) { s with dstack := Word.ofBool (cd.eval a b) :: d } w (k + 1) := by
+  have := sim_binop (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := [cmpOp cd, .i64extu]) (by cases cd <;> simp [cmpOp, WI.isCtl])
+    (y := Word.ofBool (cd.eval a b)) (by intro u r h; cases cd <;> simp [execL, stepI, bin64, cmp64, ext_bool, WordDialect.Cond.eval, cmpOp, h]) (k + 1)
+  simpa [lowerInstr, binOp, List.append_assoc] using this
+
+end Sim
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/SimAlu2.lean

@@ -0,0 +1,189 @@
+import Wasm.SimAlu
+
+/-!
+# Wasm.SimAlu2
+
+Shifts (a count of 64 or more yields 0), `div` and `sdiv` (zero guard; `sdiv` by -1 avoids the
+`INT64_MIN / -1` trap of `i64.div_s`), and `not`.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+section Sim
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+theorem ctl_shiftBody (op : WI) (hop : op.isCtl = false) : ∀ i ∈ shiftBody op, i.isCtl = false :=
+  allSimple_spec (by simp only [allSimple, shiftBody, ldS, spAdd, List.all_append, List.all_cons, List.all_nil, hop, Bool.not_false, Bool.and_true, Bool.true_and]; decide)
+
+theorem shiftBody_split (op : WI) : shiftBody op =
+    ([.globalGet spG, .i64const 0#64] ++ ldS 8 ++ ldS 0) ++ [op] ++
+      (ldS 0 ++ [.i64const 64#64, .i64geu, .select, .i64store 8] ++ spAdd 8) := by
+  simp [shiftBody, List.append_assoc]
+
+theorem sim_shift_gen (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    {pre : List WI} (hpre : Run fs pre w (.normal w)) (hd : s.dstack = b :: a :: d)
+    {op : WI} (hctl : op.isCtl = false) {z y : W}
+    (hop : ∀ (u : WState) (r : List Val), u.stack = .i64 b :: .i64 a :: r →
+      execL [op] u = some { u with stack := .i64 z :: r })
+    (hy : y = if (64#64).ule b then 0#64 else z) (nxt : Nat) :
+    ∃ w', Run fs (pre ++ (shiftBody op ++ [i32c nxt])) w (.normal w') ∧
+      Rel0 c { s with dstack := y :: d } w' ∧ w'.stack = [.i32 (ofN nxt)] := by
+  have hlen : s.dstack.length = d.length + 2 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some a := by
+    have := hs.stack 1 a (by simp [hd]); simpa using this
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some b := by
+    have := hs.stack 0 b (by simp [hd]); simpa using this
+  refine sim_bin_core hg hs hst hpre hd (ctl_shiftBody op hctl) ?_ nxt
+  intro m' hm'
+  have hsp8 : ofN (c.dEnd - 8 * s.dstack.length) + 8#32 = ofN (c.dEnd - 8 * s.dstack.length + 8) :=
+    ofN_add _ _
+  have h1 : execL ([.globalGet spG, .i64const 0#64] ++ ldS 8 ++ ldS 0) w = some { w with stack := .i64 b :: .i64 a :: .i64 0#64 :: .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } := by
+    simp [ldS, execL, stepI, hs.sp, ofN_toNat hX, hr0, hr1]
+  have hop' := hop { w with stack := .i64 b :: .i64 a :: .i64 0#64 :: .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } (.i64 0#64 :: .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack) rfl
+  have h3 : execL (ldS 0 ++ [.i64const 64#64, .i64geu, .select, .i64store 8] ++ spAdd 8) { w with stack := .i64 z :: .i64 0#64 :: .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } = some { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) } := by
+    subst hy
+    by_cases hc : (64#64).ule b = true
+    · have hm2 : w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8) 0#64 = some m' := by simpa [hc] using hm'
+      simp [ldS, spAdd, execL, stepI, bin32, cmp64, hs.sp, ofN_toNat hX, hr0, bool32, hc, hm2, i32c, hsp8]
+      rfl
+    · have hc' : (64#64).ule b = false := by simpa using hc
+      have hm2 : w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8) z = some m' := by simpa [hc'] using hm'
+      simp [ldS, spAdd, execL, stepI, bin32, cmp64, hs.sp, ofN_toNat hX, hr0, bool32, hc', hm2, i32c, hsp8]
+      rfl
+  rw [shiftBody_split, execL_append, execL_append, h1]
+  simp only [Option.bind_some]
+  rw [hop']
+  simp only [Option.bind_some]
+  exact h3
+
+theorem ule64_iff (b : W) : ((64#64).ule b = true) ↔ 64 ≤ b.toNat := by
+  simp [BitVec.ule_eq_decide]
+
+theorem sim_shl (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .shl) { s with dstack := Word.shl a b :: d } w (k + 1) := by
+  have := sim_shift_gen (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := .i64shl) rfl
+    (z := a <<< (b.toNat % 64)) (y := Word.shl a b)
+    (by intro u r h; simp [execL, stepI, bin64, h])
+    (by
+      by_cases hc : 64 ≤ b.toNat
+      · simp [(ule64_iff b).mpr hc, Word.shl, show ¬ b.toNat < 64 by omega]
+      · have : ¬ ((64#64).ule b = true) := fun h => hc ((ule64_iff b).mp h)
+        simp [this, Word.shl, show b.toNat < 64 by omega, Nat.mod_eq_of_lt (show b.toNat < 64 by omega)]) (k + 1)
+  simpa [lowerInstr, shiftOp, List.append_assoc] using this
+
+theorem ushiftRight_ge {a : W} {m : Nat} (h : 64 ≤ m) : a >>> m = 0#64 := by
+  apply BitVec.eq_of_toNat_eq
+  simp only [BitVec.toNat_ushiftRight, Nat.shiftRight_eq_div_pow]
+  have : a.toNat < 2 ^ m := Nat.lt_of_lt_of_le a.isLt (Nat.pow_le_pow_right (by omega) h)
+  simp [Nat.div_eq_of_lt this]
+
+theorem sim_shr (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .shr) { s with dstack := Word.shr a b :: d } w (k + 1) := by
+  have := sim_shift_gen (fs := fs) hg hs hst (uf2_pass hg hs hd) hd (op := .i64shru) rfl
+    (z := a >>> (b.toNat % 64)) (y := Word.shr a b)
+    (by intro u r h; simp [execL, stepI, bin64, h])
+    (by
+      by_cases hc : 64 ≤ b.toNat
+      · simp [(ule64_iff b).mpr hc, Word.shr, ushiftRight_ge hc]
+      · have : ¬ ((64#64).ule b = true) := fun h => hc ((ule64_iff b).mp h)
+        simp [this, Word.shr, Nat.mod_eq_of_lt (show b.toNat < 64 by omega)]) (k + 1)
+  simpa [lowerInstr, shiftOp, List.append_assoc] using this
+
+/-- The zero guard, passing case. -/
+theorem zg_pass (hg : Geom c) (hs : Rel0 c s w) {b : W} {d : List W} (hd : s.dstack = b :: d) (hne : b ≠ 0#64) :
+    Run fs zeroGuard w (.normal w) := by
+  have hX := sp_lt hg hs
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some b := by
+    have := hs.stack 0 b (by simp [hd]); simpa using this
+  have h1 : execL (ldS 0 ++ [.i64eqz]) w = some { w with stack := .i32 (bool32 false) :: w.stack } := by
+    simp [ldS, execL, stepI, hs.sp, ofN_toNat hX, hr0, bool32, hne]
+  have h2 : Run fs (ldS 0 ++ [.i64eqz]) w (.normal { w with stack := .i32 (bool32 false) :: w.stack }) :=
+    run_of_execL (by simp [ldS, WI.isCtl]) h1
+  have h3 := run_ite_false (fs := fs) (thn := [.exitTrap 3]) (w := { w with stack := .i32 (bool32 false) :: w.stack }) (r := w.stack) (by simp [bool32])
+  simpa [zeroGuard, List.append_assoc] using run_append _ h2 h3
+
+/-- The zero guard, trapping case. -/
+theorem zg_trap (hg : Geom c) (hs : Rel0 c s w) {d : List W} (hd : s.dstack = 0#64 :: d) :
+    Run fs zeroGuard w (.exit 3) := by
+  have hX := sp_lt hg hs
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some 0#64 := by
+    have := hs.stack 0 0#64 (by simp [hd]); simpa using this
+  have h1 : execL (ldS 0 ++ [.i64eqz]) w = some { w with stack := .i32 (bool32 true) :: w.stack } := by
+    simp [ldS, execL, stepI, hs.sp, ofN_toNat hX, hr0, bool32]
+  have h2 : Run fs (ldS 0 ++ [.i64eqz]) w (.normal { w with stack := .i32 (bool32 true) :: w.stack }) :=
+    run_of_execL (by simp [ldS, WI.isCtl]) h1
+  have h3 := run_ite_exit (fs := fs) (w := { w with stack := .i32 (bool32 true) :: w.stack }) (r := w.stack) (c := bool32 true) (k := 3) rfl (by simp [bool32])
+  simpa [zeroGuard, List.append_assoc] using run_append _ h2 h3
+
+theorem sim_div (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) (hb : b ≠ 0#64) :
+    Sim1 c fs (lowerInstr c.layout n k .div) { s with dstack := a.udiv b :: d } w (k + 1) := by
+  have hpre : Run fs (uf c.layout 2 ++ zeroGuard) w (.normal w) :=
+    run_append _ (uf2_pass hg hs hd) (zg_pass hg hs (d := a :: d) hd hb)
+  have := sim_binop (fs := fs) hg hs hst hpre hd (op := [.i64divu]) (by simp [WI.isCtl])
+    (y := a.udiv b) (by intro u r h; simp [execL, stepI, h, hb, BitVec.udiv_def]) (k + 1)
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_div_trap (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a : W} {d : List W}
+    (hd : s.dstack = 0#64 :: a :: d) :
+    Run fs (lowerInstr c.layout n k .div) w (.exit 3) := by
+  have h := run_append (fs := fs) _ (uf2_pass hg hs hd)
+    (run_append_abrupt _ (zg_trap hg hs (d := a :: d) hd) (b := binBody [.i64divu] ++ [i32c (k + 1)]) trivial)
+  simpa [lowerInstr, List.append_assoc] using h
+
+theorem ctl_sdivBody : ∀ i ∈ sdivBody, i.isCtl = false :=
+  allSimple_spec (by decide)
+
+theorem sdiv_allOnes (a : W) : a.sdiv (BitVec.allOnes 64) = 0#64 - a := by
+  rw [← BitVec.neg_one_eq_allOnes, show (-1#64 : W) = -(1#64) from rfl, BitVec.sdiv_neg (by decide), BitVec.sdiv_one]
+  simp
+
+theorem sdiv_ne (a b : W) (hm : b ≠ BitVec.allOnes 64) :
+    BitVec.ofInt 64 (Int.tdiv a.toInt b.toInt) = a.sdiv b := by
+  have hq : (a.sdiv b).toInt = Int.tdiv a.toInt b.toInt :=
+    BitVec.toInt_sdiv_of_ne_or_ne a b (Or.inr (by rwa [BitVec.neg_one_eq_allOnes]))
+  rw [← hq]; simp
+
+theorem sim_sdiv (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) (hb : b ≠ 0#64) :
+    Sim1 c fs (lowerInstr c.layout n k .sdiv) { s with dstack := a.sdiv b :: d } w (k + 1) := by
+  have hpre : Run fs (uf c.layout 2 ++ zeroGuard) w (.normal w) :=
+    run_append _ (uf2_pass hg hs hd) (zg_pass hg hs (d := a :: d) hd hb)
+  have hlen : s.dstack.length = d.length + 2 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some a := by
+    have := hs.stack 1 a (by simp [hd]); simpa using this
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some b := by
+    have := hs.stack 0 b (by simp [hd]); simpa using this
+  have hsp8 : ofN (c.dEnd - 8 * s.dstack.length) + 8#32 = ofN (c.dEnd - 8 * s.dstack.length + 8) :=
+    ofN_add _ _
+  have := sim_bin_core (fs := fs) hg hs hst hpre hd ctl_sdivBody (y := a.sdiv b) ?_ (k + 1)
+  · simpa [lowerInstr, List.append_assoc] using this
+  intro m' hm'
+  by_cases hbm : b = BitVec.allOnes 64
+  · subst hbm
+    rw [sdiv_allOnes] at hm'
+    have hm2 : w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8) (-a) = some m' := by simpa using hm'
+    simp [sdivBody, ldS, spAdd, execL_append, execL, stepI, bin64, cmp64, bin32, hs.sp, ofN_toNat hX, hr0, hr1, bool32, hm2, i32c, hsp8]
+    rfl
+  · have hbm' : ¬ b = 18446744073709551615#64 := by simpa using hbm
+    rw [← sdiv_ne a b hbm] at hm'
+    simp [sdivBody, ldS, spAdd, execL_append, execL, stepI, bin64, cmp64, bin32, hs.sp, ofN_toNat hX, hr0, hr1, bool32, hm', i32c, hsp8, hbm', hb]
+    rfl
+
+theorem sim_sdiv_trap (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a : W} {d : List W}
+    (hd : s.dstack = 0#64 :: a :: d) :
+    Run fs (lowerInstr c.layout n k .sdiv) w (.exit 3) := by
+  have h := run_append (fs := fs) _ (uf2_pass hg hs hd)
+    (run_append_abrupt _ (zg_trap hg hs (d := a :: d) hd) (b := sdivBody ++ [i32c (k + 1)]) trivial)
+  simpa [lowerInstr, List.append_assoc] using h
+
+end Sim
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/SimAux.lean

@@ -0,0 +1,229 @@
+import Wasm.SimCtl
+
+/-!
+# Wasm.SimAux
+
+The auxiliary data stack: `tor` (operand guard, aux overflow guard, move `[sp]` to the new aux top),
+`fromr` and `rfetch` (empty-aux check exiting 5, data overflow guard, push `[ap]`; `fromr` also pops
+the aux stack). Every outcome is covered: next, `returnUnderflow` (exit 5), and overflow (exit 6).
+`tor` on an empty data stack is the generic operand-guard case of `sim_step`.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+section Sim
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+theorem ap_lt (hg : Geom c) (hs : Rel0 c s w) : c.aEnd - 8 * s.astack.length < 2 ^ 32 := by
+  have := hg.aEnd_le; have := hg.msize_lt; omega
+
+/-- Auxiliary stack has room for one more word: the guard falls through. -/
+theorem ovfA_pass (hg : Geom c) (hs : Rel0 c s w)
+    (hfit : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) :
+    Run fs (ovf apG c.layout.aBase) w (.normal w) := by
+  have := hg.aEnd_le; have := hg.msize_lt; have := hg.aBase_8
+  exact ovf_pass hs.ap (ap_lt hg hs) (by simp [Cfg.layout]; omega) (by simp [Cfg.layout]; omega)
+
+/-- Auxiliary stack full: the guard exits 6. -/
+theorem ovfA_trap (hg : Geom c) (hs : Rel0 c s w)
+    (h : ¬ c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) :
+    Run fs (ovf apG c.layout.aBase) w (.exit 6) := by
+  have := hg.aEnd_le; have := hg.msize_lt; have := hg.aBase_8; have := hs.capA
+  exact ovf_trap hs.ap (ap_lt hg hs) (by simp [Cfg.layout]; omega) (by simp [Cfg.layout]; omega)
+
+/-- The empty-auxiliary-stack check of `fromr`/`rfetch`. -/
+def auxE (L : Layout) : List WI := [.globalGet apG, i32c L.aEnd, .i32eq, .ite [.exitTrap 5]]
+
+/-- Non-empty auxiliary stack: the check falls through. -/
+theorem auxE_pass (hg : Geom c) (hs : Rel0 c s w) {a : W} {as : List W} (ha : s.astack = a :: as) :
+    Run fs (auxE c.layout) w (.normal w) := by
+  have hcap := hs.capA
+  rw [ha] at hcap
+  simp only [List.length_cons] at hcap
+  have hX : c.aEnd - 8 * (as.length + 1) < 2 ^ 32 := by have := ap_lt hg hs; rw [ha] at this; simpa using this
+  have hE : c.aEnd < 2 ^ 32 := by have := hg.aEnd_le; have := hg.msize_lt; omega
+  have hap : w.globals apG = .i32 (ofN (c.aEnd - 8 * (as.length + 1))) := by
+    have := hs.ap; rw [ha] at this; simpa using this
+  have hne : ofN (c.aEnd - 8 * (as.length + 1)) ≠ ofN c.aEnd := by
+    intro h; have := ofN_inj hX hE h; omega
+  have e1 : execL [.globalGet apG, i32c c.layout.aEnd, .i32eq] w =
+      some { w with stack := .i32 0#32 :: w.stack } := by
+    simp [execL, stepI, hap, i32c, Cfg.layout, bool32]
+    exact hne
+  have r1 := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c]) e1
+  have r2 := run_ite_false (fs := fs) (thn := [.exitTrap 5])
+    (w := { w with stack := .i32 0#32 :: w.stack }) (r := w.stack) rfl
+  have := run_append _ r1 r2
+  simpa [auxE] using this
+
+/-- Empty auxiliary stack: the check exits 5 (`returnUnderflow`). -/
+theorem auxE_trap (hs : Rel0 c s w) (ha : s.astack = []) :
+    Run fs (auxE c.layout) w (.exit 5) := by
+  have hap : w.globals apG = .i32 (ofN c.aEnd) := by
+    have := hs.ap; rw [ha] at this; simpa using this
+  have e1 : execL [.globalGet apG, i32c c.layout.aEnd, .i32eq] w =
+      some { w with stack := .i32 1#32 :: w.stack } := by
+    simp [execL, stepI, hap, i32c, Cfg.layout, bool32, ofN]
+  have r1 := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c]) e1
+  have r2 := run_ite_exit (fs := fs) (w := { w with stack := .i32 1#32 :: w.stack }) (r := w.stack)
+    (c := 1#32) (k := 5) rfl (by decide)
+  have := run_append _ r1 r2
+  simpa [auxE] using this
+
+theorem tor_split (L : Layout) (n k : Nat) : lowerInstr L n k .tor =
+    uf L 1 ++ ovf apG L.aBase ++
+      (([.globalGet apG, i32c 8, .i32sub, .globalSet apG, .globalGet apG] ++ ldS 0 ++ [.i64store 0] ++
+        spAdd 8) ++ [i32c (k + 1)]) := by
+  simp [lowerInstr, List.append_assoc]
+
+theorem sim_tor (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) (hfit : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) :
+    Sim1 c fs (lowerInstr c.layout n k .tor) { s with dstack := d, astack := a :: s.astack } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 1 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hA := ap_lt hg hs
+  have hcapA := hs.capA
+  have hcapD := hs.capD
+  have haE := hg.aEnd_le
+  have hsz := hg.msize_lt
+  have hlt : c.aEnd - 8 * (s.astack.length + 1) < 2 ^ 32 := by omega
+  have hsub : ofN (c.aEnd - 8 * s.astack.length) - 8#32 = ofN (c.aEnd - 8 * (s.astack.length + 1)) := by
+    have : (8#32 : W32) = ofN 8 := rfl
+    rw [this, ofN_sub (by omega)]
+    congr 1
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.aEnd - 8 * (s.astack.length + 1)) a = some m' :=
+    write64_some (by rw [hs.size]; omega)
+  have hsp8 : ofN (c.dEnd - 8 * s.dstack.length) + 8#32 = ofN (c.dEnd - 8 * s.dstack.length + 8) :=
+    ofN_add _ _
+  have hspa : w.globals 1 = .i32 (ofN (c.dEnd - 8 * s.dstack.length)) := hs.sp
+  have hapa : w.globals 3 = .i32 (ofN (c.aEnd - 8 * s.astack.length)) := hs.ap
+  have hexec : execL ([.globalGet apG, i32c 8, .i32sub, .globalSet apG, .globalGet apG] ++ ldS 0 ++
+      [.i64store 0] ++ spAdd 8) w =
+      some { w with mem := m', globals := setG (setG w.globals apG (.i32 (ofN (c.aEnd - 8 * (s.astack.length + 1))))) spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) } := by
+    simp [ldS, spAdd, execL, stepI, bin32, hapa, hspa, i32c, hsub, apG, spG, hst,
+      ofN_toNat hX, ofN_toNat hlt, hr0, hm', hsp8]
+    unfold setG; rfl
+  have hrel1 := push_aux hg hs hfit hm'
+  have hrel2 := adj_sp hg hrel1 (n := 1) (by simp [hd])
+  have e3 : ({ { s with astack := a :: s.astack } with
+      dstack := ({ s with astack := a :: s.astack } : State 64).dstack.drop 1 } : State 64) =
+      { s with dstack := d, astack := a :: s.astack } := by
+    simp [hd]
+  rw [e3] at hrel2
+  have hrel3 : Rel0 c { s with dstack := d, astack := a :: s.astack }
+      { w with mem := m', globals := setG (setG w.globals apG (.i32 (ofN (c.aEnd - 8 * (s.astack.length + 1))))) spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) } := by
+    refine Rel0.congr (hrel2.setStack []) rfl ?_ ?_ ?_
+    · have e2 : c.dEnd - 8 * s.dstack.length + 8 = c.dEnd - 8 * (s.dstack.length - 1) := by omega
+      simp [setG, spG, e2]
+    · simp [setG, spG, rpG]
+    · simp [setG, spG, apG]
+  have := core_gen (fs := fs) (pre := uf c.layout 1 ++ ovf apG c.layout.aBase)
+    (run_append _ (uf1_pass hg hs hd) (ovfA_pass hg hs hfit))
+    (B := [.globalGet apG, i32c 8, .i32sub, .globalSet apG, .globalGet apG] ++ ldS 0 ++ [.i64store 0] ++
+      spAdd 8)
+    (allSimple_spec (by simp [allSimple, ldS, spAdd, WI.isCtl, i32c])) ⟨_, hexec, hrel3, hst⟩ (k + 1)
+  rw [tor_split]
+  exact this
+
+theorem sim_tor_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) (h : ¬ c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) :
+    Run fs (lowerInstr c.layout n k .tor) w (.exit 6) := by
+  rw [tor_split, List.append_assoc]
+  exact run_append _ (uf1_pass hg hs hd) (run_append_abrupt _ (ovfA_trap hg hs h) trivial)
+
+theorem fromr_split (L : Layout) (n k : Nat) : lowerInstr L n k .fromr =
+    auxE L ++ ovf spG L.dBase ++
+      ((pushWith [.globalGet apG, .i64load 0] ++ [.globalGet apG, i32c 8, .i32add, .globalSet apG]) ++
+        [i32c (k + 1)]) := by
+  simp [lowerInstr, auxE, List.append_assoc]
+
+theorem rfetch_split (L : Layout) (n k : Nat) : lowerInstr L n k .rfetch =
+    auxE L ++ ovf spG L.dBase ++ (pushWith [.globalGet apG, .i64load 0] ++ [i32c (k + 1)]) := by
+  simp [lowerInstr, auxE, List.append_assoc]
+
+/-- Pushing the auxiliary top `[ap]` onto the data stack. -/
+theorem push_atop (hg : Geom c) (hs : Rel0 c s w) {a : W} {as : List W} (ha : s.astack = a :: as)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ w1, execL (pushWith [.globalGet apG, .i64load 0]) w = some w1 ∧
+      Rel0 c { s with dstack := a :: s.dstack } w1 ∧ w1.stack = w.stack := by
+  have hA := ap_lt hg hs
+  have hr0 : w.mem.read64 (c.aEnd - 8 * s.astack.length) = some a := by
+    have := hs.aux 0 a (by simp [ha]); simpa using this
+  exact push_gen hg hs hfit (val := [.globalGet apG, .i64load 0]) (v := a) (by simp [WI.isCtl])
+    (by
+      intro u _ hm hap
+      simp [execL, stepI, hap, hs.ap, ofN_toNat hA, hm, hr0])
+
+theorem sim_rfetch (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : W}
+    {as : List W} (ha : s.astack = a :: as) (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Sim1 c fs (lowerInstr c.layout n k .rfetch) { s with dstack := a :: s.dstack } w (k + 1) := by
+  obtain ⟨w1, he, hr, hst1⟩ := push_atop hg hs ha hfit
+  have := core_gen (fs := fs) (pre := auxE c.layout ++ ovf spG c.layout.dBase)
+    (run_append _ (auxE_pass hg hs ha) (ovfD_pass hg hs hfit))
+    (B := pushWith [.globalGet apG, .i64load 0])
+    (allSimple_spec (by simp [allSimple, pushWith, spSub, WI.isCtl, i32c])) ⟨w1, he, hr, by rw [hst1, hst]⟩
+    (k + 1)
+  rw [rfetch_split]
+  exact this
+
+theorem sim_fromr (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : W}
+    {as : List W} (ha : s.astack = a :: as) (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Sim1 c fs (lowerInstr c.layout n k .fromr) { s with dstack := a :: s.dstack, astack := as } w
+      (k + 1) := by
+  obtain ⟨w1, he, hr, hst1⟩ := push_atop hg hs ha hfit
+  have hcap := hs.capA
+  rw [ha] at hcap
+  simp only [List.length_cons] at hcap
+  have hX : c.aEnd - 8 * (as.length + 1) < 2 ^ 32 := by have := ap_lt hg hs; rw [ha] at this; simpa using this
+  have hap1 : w1.globals apG = .i32 (ofN (c.aEnd - 8 * (as.length + 1))) := by
+    have := hr.ap; simp only [ha, List.length_cons] at this; exact this
+  have hsp8 : ofN (c.aEnd - 8 * (as.length + 1)) + 8#32 = ofN (c.aEnd - 8 * as.length) := by
+    rw [show (8#32 : W32) = ofN 8 from rfl, ofN_add]; congr 1; omega
+  have e2 : execL [.globalGet apG, i32c 8, .i32add, .globalSet apG] w1 =
+      some { w1 with globals := setG w1.globals apG (.i32 (ofN (c.aEnd - 8 * as.length))) } := by
+    simp [execL, stepI, bin32, hap1, i32c, hsp8]
+    unfold setG; rfl
+  have hra : ({ s with dstack := a :: s.dstack } : State 64).astack = a :: as := ha
+  have hrel := pop_aux hr hra
+  have hB : execL (pushWith [.globalGet apG, .i64load 0] ++ [.globalGet apG, i32c 8, .i32add, .globalSet apG]) w =
+      some { w1 with globals := setG w1.globals apG (.i32 (ofN (c.aEnd - 8 * as.length))) } := by
+    rw [execL_append, he]
+    exact e2
+  have := core_gen (fs := fs) (pre := auxE c.layout ++ ovf spG c.layout.dBase)
+    (run_append _ (auxE_pass hg hs ha) (ovfD_pass hg hs hfit))
+    (B := pushWith [.globalGet apG, .i64load 0] ++ [.globalGet apG, i32c 8, .i32add, .globalSet apG])
+    (allSimple_spec (by simp [allSimple, pushWith, spSub, WI.isCtl, i32c])) ⟨_, hB, hrel, by simp [hst1, hst]⟩
+    (k + 1)
+  rw [fromr_split]
+  exact this
+
+theorem sim_fromr_trap (n k : Nat) (hs : Rel0 c s w) (ha : s.astack = []) :
+    Run fs (lowerInstr c.layout n k .fromr) w (.exit 5) := by
+  rw [fromr_split, List.append_assoc]
+  exact run_append_abrupt _ (auxE_trap hs ha) trivial
+
+theorem sim_rfetch_trap (n k : Nat) (hs : Rel0 c s w) (ha : s.astack = []) :
+    Run fs (lowerInstr c.layout n k .rfetch) w (.exit 5) := by
+  rw [rfetch_split, List.append_assoc]
+  exact run_append_abrupt _ (auxE_trap hs ha) trivial
+
+theorem sim_fromr_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a : W} {as : List W}
+    (ha : s.astack = a :: as) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (lowerInstr c.layout n k .fromr) w (.exit 6) := by
+  rw [fromr_split, List.append_assoc]
+  exact run_append _ (auxE_pass hg hs ha) (run_append_abrupt _ (ovfD_trap hg hs h) trivial)
+
+theorem sim_rfetch_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a : W} {as : List W}
+    (ha : s.astack = a :: as) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (lowerInstr c.layout n k .rfetch) w (.exit 6) := by
+  rw [rfetch_split, List.append_assoc]
+  exact run_append _ (auxE_pass hg hs ha) (run_append_abrupt _ (ovfD_trap hg hs h) trivial)
+
+end Sim
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/SimCtl.lean

@@ -0,0 +1,146 @@
+import Wasm.SimMem
+
+/-!
+# Wasm.SimCtl
+
+Control flow: `jmp`, `branch`, `call`, `ret` (and its `returnUnderflow` exit 5), `halt`, and the
+bad-pc stub (exit 4). Each leaves the next IR index on the operand stack, which the dispatch loop
+stores into the `pc` global.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+section Sim
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+theorem sim_jmp (n k t : Nat) (hs : Rel0 c s w) (hst : w.stack = []) :
+    Sim1 c fs (lowerInstr c.layout n k (.jmp t)) s w (min t n) :=
+  ⟨_, run_finish (min t n), hs.setStack _, by simp [hst]⟩
+
+theorem sim_branch (n k t : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {cv : W}
+    {d : List W} (hd : s.dstack = cv :: d) :
+    Sim1 c fs (lowerInstr c.layout n k (.branch t)) { s with dstack := d } w
+      (if Word.isTrue cv then min t n else k + 1) := by
+  have hlen : s.dstack.length = d.length + 1 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some cv := by
+    have := hs.stack 0 cv (by simp [hd]); simpa using this
+  have hsp8 : ofN (c.dEnd - 8 * s.dstack.length) + 8#32 = ofN (c.dEnd - 8 * s.dstack.length + 8) :=
+    ofN_add _ _
+  have e2 : c.dEnd - 8 * s.dstack.length + 8 = c.dEnd - 8 * (s.dstack.length - 1) := by omega
+  have el : execL ([i32c (min t n), i32c (k + 1)] ++ ldS 0 ++ [.i64const 0#64, .i64ne, .select] ++ spAdd 8) w =
+      some { w with stack := [.i32 (ofN (if Word.isTrue cv then min t n else k + 1))],
+                    globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length - 1)))) } := by
+    rw [← e2]
+    by_cases hc : cv = 0#64
+    · simp [ldS, spAdd, execL, stepI, cmp64, bin32, hs.sp, ofN_toNat hX, hr0, bool32, hc, i32c, hsp8,
+        Word.isTrue, hst]
+      exact ⟨rfl, rfl⟩
+    · simp [ldS, spAdd, execL, stepI, cmp64, bin32, hs.sp, ofN_toNat hX, hr0, bool32, hc, i32c, hsp8,
+        Word.isTrue, hst]
+      exact ⟨rfl, rfl⟩
+  have rl := run_of_execL (fs := fs) (by simp [ldS, spAdd, WI.isCtl, i32c]) el
+  have hrel := adj_sp hg hs (n := 1) (by simp [hd])
+  have e3 : ({ s with dstack := s.dstack.drop 1 } : State 64) = { s with dstack := d } := by simp [hd]
+  rw [e3] at hrel
+  refine ⟨_, ?_, hrel.setStack _, rfl⟩
+  have := run_append _ (uf1_pass (fs := fs) hg hs hd) rl
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_call (n k t : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = [])
+    (hfit : c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd) :
+    Sim1 c fs (lowerInstr c.layout n k (.call t)) { s with rstack := (k + 1) :: s.rstack } w (min t n) := by
+  have hcap := hs.capR
+  have hrE := hg.rEnd_le
+  have hsz := hg.msize_lt
+  have hlt : c.rEnd - 8 * (s.rstack.length + 1) < 2 ^ 32 := by omega
+  have hsub : ofN (c.rEnd - 8 * s.rstack.length) - 8#32 = ofN (c.rEnd - 8 * (s.rstack.length + 1)) := by
+    have : (8#32 : W32) = ofN 8 := rfl
+    rw [this, ofN_sub (by omega)]
+    congr 1
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.rEnd - 8 * (s.rstack.length + 1)) (BitVec.ofNat 64 (k + 1)) = some m' :=
+    write64_some (by rw [hs.size]; omega)
+  have el : execL [.globalGet rpG, i32c 8, .i32sub, .globalSet rpG, .globalGet rpG, i64c (k + 1), .i64store 0,
+      i32c (min t n)] w =
+      some { w with mem := m', stack := [.i32 (ofN (min t n))],
+                    globals := setG w.globals rpG (.i32 (ofN (c.rEnd - 8 * (s.rstack.length + 1)))) } := by
+    simp [execL, stepI, bin32, hs.rp, i32c, i64c, hsub, setG, ofN_toNat hlt, hm', hst]
+    exact ⟨rfl, rfl⟩
+  have rl := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c, i64c]) el
+  refine ⟨_, ?_, (push_rs hg hs hfit hm').setStack _, rfl⟩
+  simpa [lowerInstr] using run_append _ (ovfR_pass (fs := fs) hg hs hfit) rl
+
+theorem sim_call_ovf (n k t : Nat) (hg : Geom c) (hs : Rel0 c s w)
+    (h : ¬ c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd) :
+    Run fs (lowerInstr c.layout n k (.call t)) w (.exit 6) := by
+  have := run_append_abrupt (fs := fs) _ (ovfR_trap hg hs h)
+    (b := [.globalGet rpG, i32c 8, .i32sub, .globalSet rpG, .globalGet rpG, i64c (k + 1), .i64store 0,
+      i32c (min t n)]) trivial
+  simpa [lowerInstr] using this
+
+theorem ret_split (L : Layout) : lowerInstr L n k .ret =
+    [.globalGet rpG, i32c L.rEnd, .i32eq] ++ [.ite [.exitTrap 5]] ++
+      [.globalGet rpG, .i64load 0, .i32wrap, .globalGet rpG, i32c 8, .i32add, .globalSet rpG] := rfl
+
+theorem sim_ret (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : Nat}
+    {rs : List Nat} (hr : s.rstack = a :: rs) (ha : a < 2 ^ 32) :
+    Sim1 c fs (lowerInstr c.layout n k .ret) { s with rstack := rs } w a := by
+  have hcap := hs.capR
+  rw [hr] at hcap
+  simp only [List.length_cons] at hcap
+  have hrE := hg.rEnd_le
+  have hsz := hg.msize_lt
+  have hX : c.rEnd - 8 * (rs.length + 1) < 2 ^ 32 := by omega
+  have hE : c.rEnd < 2 ^ 32 := by omega
+  have hrp : w.globals rpG = .i32 (ofN (c.rEnd - 8 * (rs.length + 1))) := by
+    have := hs.rp; rw [hr] at this; simpa using this
+  have hne : ofN (c.rEnd - 8 * (rs.length + 1)) ≠ ofN c.rEnd := by
+    intro h; have := ofN_inj hX hE h; omega
+  have hr0 : w.mem.read64 (c.rEnd - 8 * (rs.length + 1)) = some (BitVec.ofNat 64 a) := by
+    have := hs.rs 0 a (by simp [hr]); rw [hr] at this; simpa using this
+  have e1 : execL [.globalGet rpG, i32c c.layout.rEnd, .i32eq] w = some { w with stack := [.i32 0#32] } := by
+    simp [execL, stepI, hrp, i32c, Cfg.layout, bool32, hst]
+    exact hne
+  have r1 := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c]) e1
+  have r2 := run_ite_false (fs := fs) (thn := [.exitTrap 5]) (w := { w with stack := [.i32 0#32] }) (r := []) rfl
+  have hsp8 : ofN (c.rEnd - 8 * (rs.length + 1)) + 8#32 = ofN (c.rEnd - 8 * rs.length) := by
+    rw [show (8#32 : W32) = ofN 8 from rfl, ofN_add]; congr 1; omega
+  have hwrap : BitVec.setWidth 32 (BitVec.ofNat 64 a) = ofN a := by
+    apply BitVec.eq_of_toNat_eq
+    have : a < 2 ^ 64 := by omega
+    simp [ofN, BitVec.toNat_setWidth, Nat.mod_eq_of_lt this]
+  have e3 : execL [.globalGet rpG, .i64load 0, .i32wrap, .globalGet rpG, i32c 8, .i32add, .globalSet rpG]
+      { { w with stack := [.i32 0#32] } with stack := [] } =
+      some { w with stack := [.i32 (ofN a)], globals := setG w.globals rpG (.i32 (ofN (c.rEnd - 8 * rs.length))) } := by
+    simp [execL, stepI, bin32, hrp, ofN_toNat hX, hr0, i32c, hsp8, hwrap]
+    unfold setG; rfl
+  have r3 := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c]) e3
+  refine ⟨_, ?_, (pop_rs hs hr).setStack _, rfl⟩
+  rw [ret_split]
+  exact run_append _ (run_append _ r1 r2) r3
+
+theorem sim_ret_trap (n k : Nat) (hs : Rel0 c s w) (hst : w.stack = []) (hr : s.rstack = []) :
+    Run fs (lowerInstr c.layout n k .ret) w (.exit 5) := by
+  have hrp : w.globals rpG = .i32 (ofN c.rEnd) := by
+    have := hs.rp; rw [hr] at this; simpa using this
+  have e1 : execL [.globalGet rpG, i32c c.layout.rEnd, .i32eq] w = some { w with stack := [.i32 1#32] } := by
+    simp [execL, stepI, hrp, i32c, Cfg.layout, bool32, hst, ofN]
+  have r1 := run_of_execL (fs := fs) (by simp [WI.isCtl, i32c]) e1
+  have r2 := run_ite_exit (fs := fs) (w := { w with stack := [.i32 1#32] }) (r := []) (c := 1#32) (k := 5)
+    rfl (by decide)
+  rw [ret_split]
+  exact run_append_abrupt _ (run_append _ r1 r2) trivial
+
+theorem sim_halt (n k : Nat) : Run fs (lowerInstr c.layout n k .halt) w (.halted w) :=
+  .consAbrupt .exitHalt trivial
+
+theorem sim_stub : Run fs [.exitTrap 4] w (.exit 4) :=
+  .consAbrupt .exitTrap trivial
+
+end Sim
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/SimExec.lean

@@ -0,0 +1,329 @@
+import Wasm.SimAux
+
+/-!
+# Wasm.SimExec
+
+One IR step is simulated by the function the lowering emits for the instruction, for every
+instruction and every outcome (`next`, `halted`, `trapped`). This is the case analysis over the
+whole instruction set that the dispatch-loop theorem (`Wasm.Correct`) iterates.
+
+Trap codes (the argument of `proc_exit`): 1 `stackUnderflow`, 2 `badAddress`, 3 `divideByZero`,
+4 `badPc`, 5 `returnUnderflow` (an empty return stack on `ret`, or an empty auxiliary stack on
+`fromr`/`rfetch`).
+
+Every instruction that grows a stack first checks for room, and exits with code 6 when the stack
+is full. So `sim_step` has no capacity hypothesis: the code either simulates the IR step, or the
+stack lacks the headroom `Fits` describes and the code exits 6. Code 6 has no IR counterpart (IR
+stacks are unbounded); it reports that the run exceeded the target's capacity.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+def trapCode : Trap → Nat
+  | .stackUnderflow => 1
+  | .badAddress => 2
+  | .divideByZero => 3
+  | .badPc => 4
+  | .returnUnderflow => 5
+
+/-- Headroom for one step: room to push one data word, one return index and one auxiliary word.
+With this headroom no overflow guard fires. -/
+def Fits (c : Cfg) (s : State 64) : Prop :=
+  c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd ∧ c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd ∧
+    c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd
+
+/-- What simulating one IR outcome means for the body of one dispatched function. On `next`, the
+function returns the (clamped) next IR index, and every return index stays within the program. -/
+def StepSim (c : Cfg) (fs : Funcs) (n : Nat) (body : List WI) (w : WState) : Outcome 64 → Prop
+  | .next s' => (∀ a ∈ s'.rstack, a ≤ n) ∧
+      ∃ w', Run fs body w (.normal w') ∧ Rel0 c s' w' ∧ w'.stack = [.i32 (ofN (min s'.pc n))]
+  | .halted s' => ∃ w', Run fs body w (.halted w') ∧ Rel0 c s' w'
+  | .trapped t => Run fs body w (.exit (trapCode t))
+
+section Step
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs} {n : Nat}
+
+theorem Rel0.setPc (h : Rel0 c s w) (q : Nat) : Rel0 c { s with pc := q } w :=
+  { sp := h.sp, rp := h.rp, stack := h.stack, regs := h.regs, mem := h.mem, rs := h.rs,
+    irvalid := h.irvalid, size := h.size, capD := h.capD, capR := h.capR, ap := h.ap, aux := h.aux,
+    capA := h.capA }
+
+theorem next_sim {body : List WI} {s1 : State 64} {q : Nat} (hrs : ∀ a ∈ s1.rstack, a ≤ n)
+    (h : Sim1 c fs body s1 w (min q n)) : StepSim c fs n body w (.next { s1 with pc := q }) := by
+  obtain ⟨w', hr, h0, hst⟩ := h
+  exact ⟨hrs, w', hr, h0.setPc q, hst⟩
+
+theorem fall_sim {body : List WI} {d : List W} (hlt : s.pc < n) (hrs : ∀ a ∈ s.rstack, a ≤ n)
+    (h : Sim1 c fs body { s with dstack := d } w (s.pc + 1)) : StepSim c fs n body w (s.fall d) := by
+  rw [← Nat.min_eq_left (show s.pc + 1 ≤ n by omega)] at h
+  exact next_sim (s1 := { s with dstack := d }) hrs h
+
+theorem shape1 {l : List W} (h : 1 ≤ l.length) : ∃ a d, l = a :: d := by
+  cases l with
+  | nil => simp at h
+  | cons a d => exact ⟨a, d, rfl⟩
+
+theorem shape2 {l : List W} (h : 2 ≤ l.length) : ∃ b a d, l = b :: a :: d := by
+  rcases l with _ | ⟨b, _ | ⟨a, d⟩⟩
+  · simp at h
+  · simp at h
+  · exact ⟨b, a, d, rfl⟩
+
+theorem shape3 {l : List W} (h : 3 ≤ l.length) : ∃ x y z d, l = x :: y :: z :: d := by
+  rcases l with _ | ⟨x, _ | ⟨y, _ | ⟨z, d⟩⟩⟩
+  · simp at h
+  · simp at h
+  · simp at h
+  · exact ⟨x, y, z, d, rfl⟩
+
+/-- Every instruction that pops operands starts with the operand-count guard. -/
+theorem lowerInstr_uf (L : Layout) (n k : Nat) (i : WordDialect.Instr 64) (h : 0 < i.pops) :
+    ∃ rest, lowerInstr L n k i = uf L i.pops ++ rest ∧ i.pops ≤ 3 := by
+  cases i <;> simp only [Instr.pops] at h ⊢ <;>
+    first
+    | exact absurd h (by decide)
+    | exact ⟨_, by simp only [lowerInstr, binOp, shiftOp, List.append_assoc]; rfl, by decide⟩
+
+theorem sim_step (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = [])
+    {p : Prog 64} (hn : p.length < 2 ^ 32) (hrs : ∀ a ∈ s.rstack, a ≤ p.length)
+    {i : WordDialect.Instr 64} (hi : p[s.pc]? = some i)
+    (hreg : ∀ r, (i = .push r ∨ i = .pop r) → r < c.nregs) :
+    StepSim c fs p.length (lowerInstr c.layout p.length s.pc i) w (exec i s) ∨
+      (¬ Fits c s ∧ Run fs (lowerInstr c.layout p.length s.pc i) w (.exit 6)) := by
+  have nfD : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd → ¬ Fits c s := fun h hf => h hf.1
+  have nfR : ¬ c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd → ¬ Fits c s := fun h hf => h hf.2.1
+  have nfA : ¬ c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd → ¬ Fits c s := fun h hf => h hf.2.2
+  have hlt : s.pc < p.length := by
+    by_cases h : s.pc < p.length
+    · exact h
+    · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+  by_cases hk : s.dstack.length < i.pops
+  · rw [exec_underflow i s hk]
+    obtain ⟨rest, hlow, h3⟩ := lowerInstr_uf c.layout p.length s.pc i (by omega)
+    rw [hlow]
+    exact .inl <| run_append_abrupt _ (uf_trap hg hs (by omega) h3 hk) trivial
+  have hk' : i.pops ≤ s.dstack.length := by omega
+  cases i with
+  | word v =>
+    by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+    · exact .inl <| fall_sim hlt hrs (sim_word _ _ hg hs hst v hf)
+    · exact .inr ⟨nfD hf, sim_word_ovf _ _ hg hs v hf⟩
+  | ptr q =>
+    by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+    · exact .inl <| fall_sim hlt hrs (sim_ptr _ _ hg hs hst q hf)
+    · exact .inr ⟨nfD hf, sim_ptr_ovf _ _ hg hs q hf⟩
+  | load =>
+    obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+    by_cases ha : a.toNat < c.M
+    · have hv : s.mem.valid a = true := (valid_iff hs a).mpr ha
+      have hex : exec .load s = s.fall (s.mem.cell a :: d) := by
+        simp [exec, hd, Memory.read?, hv]
+      rw [hex]
+      exact .inl <| fall_sim hlt hrs (sim_load _ _ hg hs hst hd ha)
+    · have hv : s.mem.valid a = false := by
+        cases h : s.mem.valid a
+        · rfl
+        · exact absurd ((valid_iff hs a).mp h) ha
+      have hex : exec .load s = .trapped .badAddress := by
+        simp [exec, hd, Memory.read?, hv]
+      rw [hex]
+      exact .inl <| sim_load_trap _ _ hg hs hd (by omega)
+  | store =>
+    obtain ⟨a, v, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    cases hw : s.mem.write? a v with
+    | none =>
+      have hv : s.mem.valid a = false := (Memory.write?_none_iff s.mem a v).mp hw
+      have ha : ¬ a.toNat < c.M := fun h => by rw [(valid_iff hs a).mpr h] at hv; simp at hv
+      have hex : exec .store s = .trapped .badAddress := by simp [exec, hd, hw]
+      rw [hex]
+      exact .inl <| sim_store_trap _ _ hg hs hd (by omega)
+    | some im =>
+      have hex : exec .store s = .next { { s with dstack := d, mem := im } with pc := s.pc + 1 } := by
+        simp [exec, hd, hw]
+      rw [hex]
+      have h := sim_store (fs := fs) p.length s.pc hg hs hst hd hw
+      rw [← Nat.min_eq_left (show s.pc + 1 ≤ p.length by omega)] at h
+      exact .inl <| next_sim hrs h
+  | add =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .add s = s.fall ((a + b) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_add _ _ hg hs hst hd)
+  | sub =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .sub s = s.fall ((a - b) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_sub _ _ hg hs hst hd)
+  | mul =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .mul s = s.fall ((a * b) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_mul _ _ hg hs hst hd)
+  | div =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    by_cases hb : b = 0#64
+    · subst hb
+      rw [show exec .div s = .trapped .divideByZero by simp [exec, hd]]
+      exact .inl <| sim_div_trap _ _ hg hs hd
+    · rw [show exec .div s = s.fall (a.udiv b :: d) by simp [exec, hd, hb]]
+      exact .inl <| fall_sim hlt hrs (sim_div _ _ hg hs hst hd hb)
+  | sdiv =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    by_cases hb : b = 0#64
+    · subst hb
+      rw [show exec .sdiv s = .trapped .divideByZero by simp [exec, hd]]
+      exact .inl <| sim_sdiv_trap _ _ hg hs hd
+    · rw [show exec .sdiv s = s.fall (a.sdiv b :: d) by simp [exec, hd, hb]]
+      exact .inl <| fall_sim hlt hrs (sim_sdiv _ _ hg hs hst hd hb)
+  | and =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .and s = s.fall ((a &&& b) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_and _ _ hg hs hst hd)
+  | or =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .or s = s.fall ((a ||| b) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_or _ _ hg hs hst hd)
+  | xor =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .xor s = s.fall ((a ^^^ b) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_xor _ _ hg hs hst hd)
+  | not =>
+    obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+    rw [show exec .not s = s.fall ((~~~a) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_not _ _ hg hs hst hd)
+  | shl =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .shl s = s.fall (Word.shl a b :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_shl _ _ hg hs hst hd)
+  | shr =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .shr s = s.fall (Word.shr a b :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_shr _ _ hg hs hst hd)
+  | rotl =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .rotl s = s.fall (Word.rotl a b :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_rotl _ _ hg hs hst hd)
+  | rotr =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .rotr s = s.fall (Word.rotr a b :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_rotr _ _ hg hs hst hd)
+  | cmp cd =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec (.cmp cd) s = s.fall (Word.ofBool (cd.eval a b) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_cmp _ _ cd hg hs hst hd)
+  | select =>
+    obtain ⟨cc, y, x, d, hd⟩ := shape3 (by simpa [Instr.pops] using hk')
+    rw [show exec .select s = s.fall ((if Word.isTrue cc then x else y) :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_select _ _ hg hs hst hd)
+  | jmp t =>
+    rw [show exec (.jmp t) s = .next { s with pc := t } by simp [exec]]
+    exact .inl <| next_sim hrs (sim_jmp _ _ t hs hst)
+  | branch t =>
+    obtain ⟨cv, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+    have h := sim_branch (fs := fs) p.length s.pc t hg hs hst hd
+    by_cases hc : Word.isTrue cv = true
+    · rw [show exec (.branch t) s = .next { { s with dstack := d } with pc := t } by simp [exec, hd, hc]]
+      simp only [hc, ↓reduceIte] at h
+      exact .inl <| next_sim hrs h
+    · rw [show exec (.branch t) s = s.fall d by simp [exec, hd, hc]]
+      have hc' : Word.isTrue cv = false := by simpa using hc
+      simp only [hc', Bool.false_eq_true, ↓reduceIte] at h
+      exact .inl <| fall_sim hlt hrs h
+  | call t =>
+    rw [show exec (.call t) s = .next { { s with rstack := (s.pc + 1) :: s.rstack } with pc := t } by simp [exec]]
+    by_cases hf : c.rBase + 8 * (s.rstack.length + 1) ≤ c.rEnd
+    · refine .inl (next_sim ?_ (sim_call _ _ t hg hs hst hf))
+      intro a ha
+      simp only [List.mem_cons] at ha
+      rcases ha with ha | ha
+      · omega
+      · exact hrs a ha
+    · exact .inr ⟨nfR hf, sim_call_ovf _ _ t hg hs hf⟩
+  | ret =>
+    cases hr : s.rstack with
+    | nil =>
+      rw [show exec .ret s = .trapped .returnUnderflow by simp [exec, hr]]
+      exact .inl <| sim_ret_trap _ _ hs hst hr
+    | cons a rs =>
+      rw [show exec .ret s = .next { { s with rstack := rs } with pc := a } by simp [exec, hr]]
+      have ha : a ≤ p.length := hrs a (by simp [hr])
+      have h := sim_ret (fs := fs) p.length s.pc hg hs hst hr (by omega)
+      rw [← Nat.min_eq_left ha] at h
+      exact .inl <| next_sim (fun b hb => hrs b (by simp [hr, hb])) h
+  | push r =>
+    rw [show exec (.push r) s = s.fall (s.regs r :: s.dstack) by simp [exec]]
+    by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+    · exact .inl <| fall_sim hlt hrs (sim_push _ _ hg hs hst (hreg r (.inl rfl)) hf)
+    · exact .inr ⟨nfD hf, sim_push_ovf _ _ hg hs r hf⟩
+  | pop r =>
+    obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+    rw [show exec (.pop r) s =
+        .next { { s with dstack := d, regs := State.setReg s.regs r a } with pc := s.pc + 1 } by
+      simp [exec, hd]]
+    have h := sim_pop (fs := fs) p.length s.pc hg hs hst (hreg r (.inr rfl)) hd
+    rw [← Nat.min_eq_left (show s.pc + 1 ≤ p.length by omega)] at h
+    exact .inl <| next_sim hrs h
+  | dup =>
+    obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+    rw [show exec .dup s = s.fall (a :: a :: d) by simp [exec, hd]]
+    by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+    · exact .inl <| fall_sim hlt hrs (sim_dup _ _ hg hs hst hd hf)
+    · exact .inr ⟨nfD hf, sim_dup_ovf _ _ hg hs hd hf⟩
+  | drop =>
+    obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+    rw [show exec .drop s = s.fall d by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_drop _ _ hg hs hst hd)
+  | swap =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .swap s = s.fall (a :: b :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_swap _ _ hg hs hst hd)
+  | over =>
+    obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+    rw [show exec .over s = s.fall (a :: b :: a :: d) by simp [exec, hd]]
+    by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+    · exact .inl <| fall_sim hlt hrs (sim_over _ _ hg hs hst hd hf)
+    · exact .inr ⟨nfD hf, sim_over_ovf _ _ hg hs hd hf⟩
+  | rot =>
+    obtain ⟨x, y, z, d, hd⟩ := shape3 (by simpa [Instr.pops] using hk')
+    rw [show exec .rot s = s.fall (z :: x :: y :: d) by simp [exec, hd]]
+    exact .inl <| fall_sim hlt hrs (sim_rot _ _ hg hs hst hd)
+  | tor =>
+    obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+    rw [show exec .tor s = .next { { s with dstack := d, astack := a :: s.astack } with pc := s.pc + 1 } by
+      simp [exec, hd]]
+    by_cases hf : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd
+    · have h := sim_tor (fs := fs) p.length s.pc hg hs hst hd hf
+      rw [← Nat.min_eq_left (show s.pc + 1 ≤ p.length by omega)] at h
+      exact .inl <| next_sim hrs h
+    · exact .inr ⟨nfA hf, sim_tor_ovf _ _ hg hs hd hf⟩
+  | fromr =>
+    cases ha : s.astack with
+    | nil =>
+      rw [show exec .fromr s = .trapped .returnUnderflow by simp [exec, ha]]
+      exact .inl <| sim_fromr_trap _ _ hs ha
+    | cons a as =>
+      rw [show exec .fromr s =
+          .next { { s with dstack := a :: s.dstack, astack := as } with pc := s.pc + 1 } by
+        simp [exec, ha]]
+      by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+      · have h := sim_fromr (fs := fs) p.length s.pc hg hs hst ha hf
+        rw [← Nat.min_eq_left (show s.pc + 1 ≤ p.length by omega)] at h
+        exact .inl <| next_sim hrs h
+      · exact .inr ⟨nfD hf, sim_fromr_ovf _ _ hg hs ha hf⟩
+  | rfetch =>
+    cases ha : s.astack with
+    | nil =>
+      rw [show exec .rfetch s = .trapped .returnUnderflow by simp [exec, ha]]
+      exact .inl <| sim_rfetch_trap _ _ hs ha
+    | cons a as =>
+      rw [show exec .rfetch s = s.fall (a :: s.dstack) by simp [exec, ha]]
+      by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+      · exact .inl <| fall_sim hlt hrs (sim_rfetch _ _ hg hs hst ha hf)
+      · exact .inr ⟨nfD hf, sim_rfetch_ovf _ _ hg hs ha hf⟩
+  | halt =>
+    rw [show exec .halt s = .halted s by simp [exec]]
+    exact .inl <| ⟨w, sim_halt _ _, hs⟩
+
+end Step
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/SimMem.lean

@@ -0,0 +1,188 @@
+import Wasm.SimStack
+
+/-!
+# Wasm.SimMem
+
+`load` and `store`: the bounds check `memAddr` (address below `M`, else exit 2 = `badAddress`),
+the byte address `mb + 8a`, and the simulation of both instructions and of their traps.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+section Sim
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+theorem memAddr_split (L : Layout) : memAddr L =
+    (ldS 0 ++ [.i64const (BitVec.ofNat 64 L.M), .i64geu]) ++ [.ite [.exitTrap 2]] ++
+      (ldS 0 ++ [.i32wrap, i32c 3, .i32shl, i32c L.mb, .i32add]) := by
+  simp [memAddr, List.append_assoc]
+
+theorem M_lt (hg : Geom c) : c.M < 2 ^ 32 := by
+  have := hg.mb_le; have := hg.msize_lt; omega
+
+theorem geu_M (hg : Geom c) (a : W) :
+    (BitVec.ofNat 64 c.M).ule a = decide (c.M ≤ a.toNat) := by
+  have hM := M_lt hg
+  have : c.M % 2 ^ 64 = c.M := Nat.mod_eq_of_lt (by omega)
+  simp [BitVec.ule_eq_decide, BitVec.toNat_ofNat, this]
+
+theorem addr_eq (hg : Geom c) {a : W} (ha : a.toNat < c.M) :
+    BitVec.setWidth 32 a <<< 3 + BitVec.ofNat 32 c.mb = ofN (c.mb + 8 * a.toNat) := by
+  have hmb := hg.mb_le; have hsz := hg.msize_lt
+  apply BitVec.eq_of_toNat_eq
+  have h1 : a.toNat < 2 ^ 32 := by omega
+  have h2 : a.toNat * 8 < 2 ^ 32 := by omega
+  have h3 : c.mb < 2 ^ 32 := by omega
+  have h4 : c.mb + 8 * a.toNat < 2 ^ 32 := by omega
+  simp [ofN, BitVec.toNat_add, BitVec.toNat_shiftLeft, BitVec.toNat_setWidth, Nat.shiftLeft_eq,
+    Nat.mod_eq_of_lt h1, Nat.mod_eq_of_lt h2, Nat.mod_eq_of_lt h3, Nat.mod_eq_of_lt h4]
+  omega
+
+/-- In-bounds address: `memAddr` leaves the byte address `mb + 8a` on the operand stack. -/
+theorem memAddr_ok (hg : Geom c) {u : WState} {sp : Nat} (hsp : u.globals spG = .i32 (ofN sp))
+    (hX : sp < 2 ^ 32) {a : W} (hr : u.mem.read64 sp = some a) (ha : a.toNat < c.M) :
+    Run fs (memAddr c.layout) u (.normal { u with stack := .i32 (ofN (c.mb + 8 * a.toNat)) :: u.stack }) := by
+  have hlt : ¬ c.M ≤ a.toNat := by omega
+  have e1 : execL (ldS 0 ++ [.i64const (BitVec.ofNat 64 c.layout.M), .i64geu]) u =
+      some { u with stack := .i32 0#32 :: u.stack } := by
+    simp [ldS, execL, stepI, cmp64, hsp, ofN_toNat hX, hr, Cfg.layout, geu_M hg, hlt, bool32]
+  have r1 := run_of_execL (fs := fs) (by simp [ldS, WI.isCtl]) e1
+  have r2 := run_ite_false (fs := fs) (thn := [.exitTrap 2]) (w := { u with stack := .i32 0#32 :: u.stack })
+    (r := u.stack) rfl
+  have e3 : execL (ldS 0 ++ [.i32wrap, i32c 3, .i32shl, i32c c.layout.mb, .i32add]) { u with stack := u.stack } =
+      some { u with stack := .i32 (ofN (c.mb + 8 * a.toNat)) :: u.stack } := by
+    simp [ldS, execL, stepI, bin32, hsp, ofN_toNat hX, hr, i32c, Cfg.layout, addr_eq hg ha]
+  have r3 := run_of_execL (fs := fs) (by simp [ldS, WI.isCtl, i32c]) e3
+  rw [memAddr_split]
+  exact run_append _ (run_append _ r1 r2) r3
+
+/-- Out-of-bounds address: `memAddr` exits with code 2 (`badAddress`). -/
+theorem memAddr_trap (hg : Geom c) {u : WState} {sp : Nat} (hsp : u.globals spG = .i32 (ofN sp))
+    (hX : sp < 2 ^ 32) {a : W} (hr : u.mem.read64 sp = some a) (ha : c.M ≤ a.toNat) :
+    Run fs (memAddr c.layout) u (.exit 2) := by
+  have e1 : execL (ldS 0 ++ [.i64const (BitVec.ofNat 64 c.layout.M), .i64geu]) u =
+      some { u with stack := .i32 1#32 :: u.stack } := by
+    simp [ldS, execL, stepI, cmp64, hsp, ofN_toNat hX, hr, Cfg.layout, geu_M hg, ha, bool32]
+  have r1 := run_of_execL (fs := fs) (by simp [ldS, WI.isCtl]) e1
+  have r2 := run_ite_exit (fs := fs) (w := { u with stack := .i32 1#32 :: u.stack }) (r := u.stack)
+    (c := 1#32) (k := 2) rfl (by decide)
+  rw [memAddr_split]
+  exact run_append_abrupt _ (run_append _ r1 r2) trivial
+
+/-- `valid a` is exactly `a < M`. -/
+theorem valid_iff (hs : Rel0 c s w) (a : W) : s.mem.valid a = true ↔ a.toNat < c.M := by
+  rw [hs.irvalid a]; simp
+
+theorem mem_cell (hs : Rel0 c s w) {a : W} (ha : a.toNat < c.M) :
+    w.mem.read64 (c.mb + 8 * a.toNat) = some (s.mem.cell a) := by
+  have := hs.mem a.toNat ha
+  rwa [BitVec.ofNat_toNat, BitVec.setWidth_eq] at this
+
+theorem addr_lt (hg : Geom c) {a : W} (ha : a.toNat < c.M) : c.mb + 8 * a.toNat < 2 ^ 32 := by
+  have := hg.mb_le; have := hg.msize_lt; omega
+
+theorem sim_load (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) (ha : a.toNat < c.M) :
+    Sim1 c fs (lowerInstr c.layout n k .load) { s with dstack := s.mem.cell a :: d } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 1 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.dEnd - 8 * s.dstack.length) (s.mem.cell a) = some m' :=
+    write64_some (by rw [hs.size]; have := hg.dEnd_le; omega)
+  have hA := addr_lt hg ha
+  have rg : Run fs [.globalGet spG] w
+      (.normal { w with stack := .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack }) :=
+    run_of_execL (by simp [WI.isCtl]) (by simp [execL, stepI, hs.sp])
+  have rm := memAddr_ok (fs := fs) hg (u := { w with stack := .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack })
+    hs.sp hX hr0 ha
+  have el : execL [.i64load 0, .i64store 0]
+      { { w with stack := .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } with
+        stack := .i32 (ofN (c.mb + 8 * a.toNat)) ::
+          ({ w with stack := .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack } : WState).stack } =
+      some { w with mem := m' } := by
+    simp [execL, stepI, ofN_toNat hA, ofN_toNat hX, mem_cell hs ha, hm']
+  have rl := run_of_execL (fs := fs) (by simp [WI.isCtl]) el
+  have hrel := wr_stack hg hs (j := 0) (by omega) (v := s.mem.cell a) (m' := m') (by simpa using hm')
+  have e : s.dstack.set 0 (s.mem.cell a) = s.mem.cell a :: d := by simp [hd]
+  rw [e] at hrel
+  refine ⟨{ w with mem := m', stack := [.i32 (ofN (k + 1))] }, ?_, hrel.setStack _, rfl⟩
+  have := run_append _ (uf1_pass (fs := fs) hg hs hd)
+    (run_append _ rg (run_append _ rm (run_append _ rl (run_finish (fs := fs) (k + 1)))))
+  simpa [lowerInstr, List.append_assoc, hst] using this
+
+theorem sim_load_trap (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) (ha : c.M ≤ a.toNat) :
+    Run fs (lowerInstr c.layout n k .load) w (.exit 2) := by
+  have hX := sp_lt hg hs
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  have rg : Run fs [.globalGet spG] w
+      (.normal { w with stack := .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack }) :=
+    run_of_execL (by simp [WI.isCtl]) (by simp [execL, stepI, hs.sp])
+  have rm := memAddr_trap (fs := fs) hg (u := { w with stack := .i32 (ofN (c.dEnd - 8 * s.dstack.length)) :: w.stack })
+    hs.sp hX hr0 ha
+  have := run_append _ (uf1_pass (fs := fs) hg hs hd)
+    (run_append _ rg (run_append_abrupt _ rm (b := [.i64load 0, .i64store 0] ++ [i32c (k + 1)]) trivial))
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_store (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a v : W}
+    {d : List W} (hd : s.dstack = a :: v :: d) {im : WordDialect.Memory 64}
+    (hv : s.mem.write? a v = some im) :
+    Sim1 c fs (lowerInstr c.layout n k .store) { s with dstack := d, mem := im } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 2 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hvalid : s.mem.valid a = true := by
+    by_cases hh : s.mem.valid a = true
+    · exact hh
+    · have := (Memory.write?_none_iff s.mem a v).mpr (by simpa using hh); rw [hv] at this; simp at this
+  have ha : a.toNat < c.M := (valid_iff hs a).mp hvalid
+  have hA := addr_lt hg ha
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some v := by
+    have := hs.stack 1 v (by simp [hd]); simpa using this
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.mb + 8 * a.toNat) v = some m' :=
+    write64_some (by rw [hs.size]; have := hg.mb_le; omega)
+  have rm := memAddr_ok (fs := fs) hg (u := w) hs.sp hX hr0 ha
+  have hsp16 : ofN (c.dEnd - 8 * s.dstack.length) + 16#32 = ofN (c.dEnd - 8 * s.dstack.length + 16) :=
+    ofN_add _ _
+  have el : execL (ldS 8 ++ [.i64store 0] ++ spAdd 16)
+      { w with stack := .i32 (ofN (c.mb + 8 * a.toNat)) :: w.stack } =
+      some { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 16))) } := by
+    simp [ldS, spAdd, execL, stepI, bin32, hs.sp, ofN_toNat hX, ofN_toNat hA, hr1, hm', i32c, hst, hsp16]
+    unfold setG
+    rfl
+  have rl := run_of_execL (fs := fs) (by simp [ldS, spAdd, WI.isCtl, i32c]) el
+  have hrel1 := wr_mem hg hs hv hm'
+  have hrel2 := adj_sp hg hrel1 (n := 2) (by simp [hd])
+  have e3 : ({ { s with mem := im } with dstack := ({ s with mem := im } : State 64).dstack.drop 2 } : State 64) =
+      { s with dstack := d, mem := im } := by
+    simp [hd]
+  rw [e3] at hrel2
+  have e2 : c.dEnd - 8 * s.dstack.length + 16 = c.dEnd - 8 * (s.dstack.length - 2) := by omega
+  rw [e2] at rl
+  refine ⟨_, ?_, hrel2.setStack [.i32 (ofN (k + 1))], rfl⟩
+  have := run_append _ (uf2_pass (fs := fs) hg hs hd)
+    (run_append _ rm (run_append _ rl (run_finish (fs := fs) (k + 1))))
+  simpa [lowerInstr, List.append_assoc, hst] using this
+
+theorem sim_store_trap (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a v : W} {d : List W}
+    (hd : s.dstack = a :: v :: d) (ha : c.M ≤ a.toNat) :
+    Run fs (lowerInstr c.layout n k .store) w (.exit 2) := by
+  have hX := sp_lt hg hs
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  have rm := memAddr_trap (fs := fs) hg (u := w) hs.sp hX hr0 ha
+  have := run_append _ (uf2_pass (fs := fs) hg hs hd)
+    (run_append_abrupt _ rm (b := ldS 8 ++ [.i64store 0] ++ spAdd 16 ++ [i32c (k + 1)]) trivial)
+  simpa [lowerInstr, List.append_assoc] using this
+
+end Sim
+
+end Wasm
+end WordDialect

backend/wasm/Wasm/SimStack.lean

@@ -0,0 +1,398 @@
+import Wasm.SimAlu2
+
+/-!
+# Wasm.SimStack
+
+`not`, `drop`, `dup`, `over`, `swap`, `rot`, `select`, `word`, `ptr`, `push`, `pop`.
+-/
+
+namespace WordDialect
+namespace Wasm
+
+section Sim
+
+variable {c : Cfg} {s : State 64} {w : WState} {fs : Funcs}
+
+/-- Finish an instruction: given the execution of its body, append the next-pc push. -/
+theorem core_gen {pre B : List WI} {s' : State 64} (hpre : Run fs pre w (.normal w))
+    (hctl : ∀ i ∈ B, i.isCtl = false)
+    (hB : ∃ w1, execL B w = some w1 ∧ Rel0 c s' w1 ∧ w1.stack = []) (nxt : Nat) :
+    ∃ w', Run fs (pre ++ (B ++ [i32c nxt])) w (.normal w') ∧ Rel0 c s' w' ∧
+      w'.stack = [.i32 (ofN nxt)] := by
+  obtain ⟨w1, he, hr, hs1⟩ := hB
+  exact ⟨{ w1 with stack := .i32 (ofN nxt) :: w1.stack },
+    run_append _ hpre (run_append _ (run_of_execL hctl he) (run_finish nxt)), hr.setStack _, by simp [hs1]⟩
+
+theorem uf1_pass (hg : Geom c) (hs : Rel0 c s w) {a : W} {d : List W} (hd : s.dstack = a :: d) :
+    Run fs (uf c.layout 1) w (.normal w) :=
+  uf_pass hg hs (k := 1) (by omega) (by simp [hd])
+
+theorem uf3_pass (hg : Geom c) (hs : Rel0 c s w) {x y z : W} {d : List W} (hd : s.dstack = x :: y :: z :: d) :
+    Run fs (uf c.layout 3) w (.normal w) :=
+  uf_pass hg hs (k := 3) (by omega) (by simp [hd])
+
+theorem ld_slot (hs : Rel0 c s w) {j : Nat} {v : W} (hj : s.dstack[j]? = some v) :
+    w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8 * j) = some v := hs.stack j v hj
+
+theorem xor_lit (a : W) : a ^^^ 18446744073709551615#64 = ~~~a := by
+  have := BitVec.xor_allOnes (x := a)
+  simpa using this
+
+theorem sim_not (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .not) { s with dstack := (~~~a) :: d } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 1 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.dEnd - 8 * s.dstack.length) (~~~a) = some m' :=
+    write64_some (by rw [hs.size]; have := hg.dEnd_le; have := hs.capD; omega)
+  have hexec : execL ([.globalGet spG] ++ ldS 0 ++ [.i64const (BitVec.allOnes 64), .i64xor, .i64store 0]) w = some { w with mem := m' } := by
+    simp [ldS, execL, stepI, bin64, hs.sp, ofN_toNat hX, hr0, hm', xor_lit]
+  have hrel := wr_stack hg hs (j := 0) (by omega) (v := ~~~a) (m' := m') (by simpa using hm')
+  have e : s.dstack.set 0 (~~~a) = (~~~a) :: d := by simp [hd]
+  rw [e] at hrel
+  have := core_gen (fs := fs) (pre := uf c.layout 1) (uf1_pass hg hs hd)
+    (B := [.globalGet spG] ++ ldS 0 ++ [.i64const (BitVec.allOnes 64), .i64xor, .i64store 0])
+    (by simp only [ldS, List.append_assoc]; exact allSimple_spec (by decide)) ⟨_, hexec, hrel, hst⟩ (k + 1)
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_drop (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .drop) { s with dstack := d } w (k + 1) := by
+  have hX := sp_lt hg hs
+  have hsp8 : ofN (c.dEnd - 8 * s.dstack.length) + 8#32 = ofN (c.dEnd - 8 * s.dstack.length + 8) :=
+    ofN_add _ _
+  have hexec : execL (spAdd 8) w = some { w with globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) } := by
+    simp [spAdd, execL, stepI, bin32, hs.sp, i32c]
+    unfold setG
+    rw [hsp8]
+  have hrel := adj_sp hg hs (n := 1) (by simp [hd])
+  have e : s.dstack.drop 1 = d := by simp [hd]
+  have e2 : c.dEnd - 8 * s.dstack.length + 8 = c.dEnd - 8 * (s.dstack.length - 1) := by
+    have := hs.capD; have : s.dstack.length = d.length + 1 := by simp [hd]
+    omega
+  rw [e2] at hexec
+  have hrel' : Rel0 c { s with dstack := d } { w with globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length - 1)))) } := by
+    have e3 : ({ s with dstack := s.dstack.drop 1 } : State 64) = { s with dstack := d } := by rw [e]
+    rw [e3] at hrel; exact hrel
+  have := core_gen (fs := fs) (pre := uf c.layout 1) (uf1_pass hg hs hd) (B := spAdd 8)
+    (allSimple_spec (by decide)) ⟨_, hexec, hrel', hst⟩ (k + 1)
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem push_gen (hg : Geom c) (hs : Rel0 c s w)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) {val : List WI} {v : W}
+    (hctl : ∀ i ∈ val, i.isCtl = false)
+    (hval : ∀ u : WState, u.globals spG = .i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1))) →
+      u.mem = w.mem → u.globals apG = w.globals apG →
+      execL val u = some { u with stack := .i64 v :: u.stack }) :
+    ∃ w1, execL (pushWith val) w = some w1 ∧ Rel0 c { s with dstack := v :: s.dstack } w1 ∧
+      w1.stack = w.stack := by
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hdE := hg.dEnd_le
+  have hsz := hg.msize_lt
+  have hlt : c.dEnd - 8 * (s.dstack.length + 1) < 2 ^ 32 := by omega
+  have hsub : ofN (c.dEnd - 8 * s.dstack.length) - 8#32 = ofN (c.dEnd - 8 * (s.dstack.length + 1)) := by
+    have : (8#32 : W32) = ofN 8 := rfl
+    rw [this, ofN_sub (by omega)]
+    congr 1
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.dEnd - 8 * (s.dstack.length + 1)) v = some m' :=
+    write64_some (by rw [hs.size]; omega)
+  have h1 : execL (spSub 8) w = some { w with globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) } := by
+    simp [spSub, execL, stepI, bin32, hs.sp, i32c, hsub]
+    rfl
+  have hg1 : execL [.globalGet spG] { w with globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) } = some { w with stack := .i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1))) :: w.stack, globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) } := by
+    simp [execL, stepI, setG, spG]
+  have h2 := hval { w with stack := .i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1))) :: w.stack, globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) } (by simp [setG, spG]) rfl
+    (by simp [setG, spG, apG])
+  have h3 : execL [.i64store 0] { w with stack := .i64 v :: .i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1))) :: w.stack, globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) } = some { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) } := by
+    simp [execL, stepI, ofN_toNat hlt, hm']
+  refine ⟨{ w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) }, ?_, push_rel hg hs hfit hm', rfl⟩
+  have e1 : pushWith val = spSub 8 ++ ([.globalGet spG] ++ (val ++ [.i64store 0])) := by
+    simp [pushWith, List.append_assoc]
+  rw [e1, execL_append, h1]
+  simp only [Option.bind_some]
+  rw [execL_append, hg1]
+  simp only [Option.bind_some]
+  rw [execL_append, h2]
+  simp only [Option.bind_some]
+  exact h3
+
+theorem sim_word (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) (v : W)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Sim1 c fs (lowerInstr c.layout n k (.word v)) { s with dstack := v :: s.dstack } w (k + 1) := by
+  have hB := push_gen hg hs hfit (val := [.i64const v]) (v := v) (by simp [WI.isCtl])
+    (by intro u _ _ _; simp [execL, stepI])
+  obtain ⟨w1, he, hr, hst1⟩ := hB
+  have := core_gen (fs := fs) (pre := ovf spG c.layout.dBase) (ovfD_pass hg hs hfit) (B := pushWith [.i64const v])
+    (allSimple_spec (by simp [allSimple, pushWith, spSub, WI.isCtl, i32c])) ⟨w1, he, hr, by rw [hst1, hst]⟩ (k + 1)
+  simpa [lowerInstr, pushWith, List.append_assoc] using this
+
+theorem sim_ptr (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) (q : WordDialect.Ptr 64)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Sim1 c fs (lowerInstr c.layout n k (.ptr q)) { s with dstack := q.toWord :: s.dstack } w (k + 1) :=
+  sim_word n k hg hs hst q.toWord hfit
+
+theorem sim_push (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {r : Nat}
+    (hr : r < c.nregs) (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Sim1 c fs (lowerInstr c.layout n k (.push r)) { s with dstack := s.regs r :: s.dstack } w (k + 1) := by
+  have hrf := hg.rf_le
+  have hsz := hg.msize_lt
+  have hB := push_gen hg hs hfit (val := [i32c (c.layout.rf + 8 * r), .i64load 0]) (v := s.regs r)
+    (by simp [WI.isCtl, i32c])
+    (by
+      intro u _ hm _
+      have h1 := hs.regs r hr
+      have h2 : c.rf + 8 * r < 2 ^ 32 := by omega
+      simp [execL, stepI, i32c, Cfg.layout, hm, BitVec.toNat_ofNat, Nat.mod_eq_of_lt h2, h1])
+  obtain ⟨w1, he, hr1, hst1⟩ := hB
+  have := core_gen (fs := fs) (pre := ovf spG c.layout.dBase) (ovfD_pass hg hs hfit)
+    (B := pushWith [i32c (c.layout.rf + 8 * r), .i64load 0])
+    (allSimple_spec (by simp [allSimple, pushWith, spSub, WI.isCtl, i32c])) ⟨w1, he, hr1, by rw [hst1, hst]⟩ (k + 1)
+  simpa [lowerInstr, pushWith, List.append_assoc] using this
+
+theorem sim_dup (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Sim1 c fs (lowerInstr c.layout n k .dup) { s with dstack := a :: a :: d } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 1 := by simp [hd]
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  have hsz := hg.msize_lt
+  have hdE := hg.dEnd_le
+  have hlt : c.dEnd - 8 * (s.dstack.length + 1) < 2 ^ 32 := by omega
+  have hB := push_gen hg hs hfit (val := ldS 8) (v := a)
+    (by simp [ldS, WI.isCtl])
+    (by
+      intro u hu hm _
+      have e : c.dEnd - 8 * (s.dstack.length + 1) + 8 = c.dEnd - 8 * s.dstack.length := by omega
+      simp [ldS, execL, stepI, hu, ofN_toNat hlt, e, hm, hr0])
+  obtain ⟨w1, he, hr, hst1⟩ := hB
+  have e : a :: s.dstack = a :: a :: d := by rw [hd]
+  rw [e] at hr
+  have := core_gen (fs := fs) (pre := uf c.layout 1 ++ ovf spG c.layout.dBase)
+    (run_append _ (uf1_pass hg hs hd) (ovfD_pass hg hs hfit)) (B := pushWith (ldS 8))
+    (allSimple_spec (by simp [allSimple, pushWith, spSub, ldS, WI.isCtl, i32c])) ⟨w1, he, hr, by rw [hst1, hst]⟩ (k + 1)
+  simpa [lowerInstr, pushWith, List.append_assoc] using this
+
+theorem sim_over (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Sim1 c fs (lowerInstr c.layout n k .over) { s with dstack := a :: b :: a :: d } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 2 := by simp [hd]
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some a := by
+    have := hs.stack 1 a (by simp [hd]); simpa using this
+  have hsz := hg.msize_lt
+  have hdE := hg.dEnd_le
+  have hlt : c.dEnd - 8 * (s.dstack.length + 1) < 2 ^ 32 := by omega
+  have hB := push_gen hg hs hfit (val := [.globalGet spG, .i64load 16]) (v := a)
+    (by simp [WI.isCtl])
+    (by
+      intro u hu hm _
+      have e : c.dEnd - 8 * (s.dstack.length + 1) + 16 = c.dEnd - 8 * s.dstack.length + 8 := by omega
+      simp [execL, stepI, hu, ofN_toNat hlt, e, hm, hr1])
+  obtain ⟨w1, he, hr, hst1⟩ := hB
+  have e : a :: s.dstack = a :: b :: a :: d := by rw [hd]
+  rw [e] at hr
+  have := core_gen (fs := fs) (pre := uf c.layout 2 ++ ovf spG c.layout.dBase)
+    (run_append _ (uf2_pass hg hs hd) (ovfD_pass hg hs hfit))
+    (B := pushWith [.globalGet spG, .i64load 16])
+    (allSimple_spec (by simp [allSimple, pushWith, spSub, WI.isCtl, i32c])) ⟨w1, he, hr, by rw [hst1, hst]⟩ (k + 1)
+  simpa [lowerInstr, pushWith, List.append_assoc] using this
+
+theorem sim_swap (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .swap) { s with dstack := a :: b :: d } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 2 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hdE := hg.dEnd_le
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some a := by
+    have := hs.stack 1 a (by simp [hd]); simpa using this
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some b := by
+    have := hs.stack 0 b (by simp [hd]); simpa using this
+  obtain ⟨m1, hm1⟩ : ∃ m1, w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8) b = some m1 :=
+    write64_some (by rw [hs.size]; omega)
+  obtain ⟨hsz1, _⟩ := write64_size hm1
+  obtain ⟨m2, hm2⟩ : ∃ m2, m1.write64 (c.dEnd - 8 * s.dstack.length) a = some m2 :=
+    write64_some (by rw [hsz1, hs.size]; omega)
+  have hexec : execL ([.globalGet spG] ++ ldS 8 ++ [.globalGet spG] ++ ldS 0 ++ [.i64store 8, .i64store 0]) w = some { w with mem := m2 } := by
+    simp [ldS, execL, stepI, hs.sp, ofN_toNat hX, hr0, hr1, hm1, hm2]
+  have hrel1 := wr_stack hg hs (j := 1) (by omega) (v := b) (m' := m1) (by simpa using hm1)
+  have hrel2 := wr_stack_at hg hrel1 (j := 0) (by simp; omega) (v := a) (m' := m2) (A := c.dEnd - 8 * s.dstack.length)
+    (by simp) (by simpa using hm2)
+  have e : (({ s with dstack := s.dstack.set 1 b } : State 64).dstack.set 0 a) = a :: b :: d := by simp [hd]
+  have e3 : ({ { s with dstack := s.dstack.set 1 b } with dstack := (({ s with dstack := s.dstack.set 1 b } : State 64).dstack.set 0 a) } : State 64) = { s with dstack := a :: b :: d } := by
+    simp [hd]
+  rw [e3] at hrel2
+  have := core_gen (fs := fs) (pre := uf c.layout 2) (uf2_pass hg hs hd)
+    (B := [.globalGet spG] ++ ldS 8 ++ [.globalGet spG] ++ ldS 0 ++ [.i64store 8, .i64store 0])
+    (allSimple_spec (by simp [allSimple, ldS, WI.isCtl])) ⟨_, hexec, hrel2, hst⟩ (k + 1)
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_rot (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {cc b a : W} {d : List W}
+    (hd : s.dstack = cc :: b :: a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .rot) { s with dstack := a :: cc :: b :: d } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 3 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hdE := hg.dEnd_le
+  have hr2 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 16) = some a := by
+    have := hs.stack 2 a (by simp [hd]); simpa using this
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some b := by
+    have := hs.stack 1 b (by simp [hd]); simpa using this
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some cc := by
+    have := hs.stack 0 cc (by simp [hd]); simpa using this
+  obtain ⟨m1, hm1⟩ : ∃ m1, w.mem.write64 (c.dEnd - 8 * s.dstack.length + 16) b = some m1 :=
+    write64_some (by rw [hs.size]; omega)
+  obtain ⟨hsz1, _⟩ := write64_size hm1
+  obtain ⟨m2, hm2⟩ : ∃ m2, m1.write64 (c.dEnd - 8 * s.dstack.length + 8) cc = some m2 :=
+    write64_some (by rw [hsz1, hs.size]; omega)
+  obtain ⟨hsz2, _⟩ := write64_size hm2
+  obtain ⟨m3, hm3⟩ : ∃ m3, m2.write64 (c.dEnd - 8 * s.dstack.length) a = some m3 :=
+    write64_some (by rw [hsz2, hsz1, hs.size]; omega)
+  have hexec : execL ([.globalGet spG] ++ ldS 16 ++ [.globalGet spG] ++ ldS 0 ++ [.globalGet spG] ++ ldS 8 ++ [.i64store 16, .i64store 8, .i64store 0]) w = some { w with mem := m3 } := by
+    simp [ldS, execL, stepI, hs.sp, ofN_toNat hX, hr0, hr1, hr2, hm1, hm2, hm3]
+  have hrel1 := wr_stack_at hg hs (j := 2) (by omega) (v := b) (m' := m1) (A := c.dEnd - 8 * s.dstack.length + 16) (by simp) hm1
+  have hrel2 := wr_stack_at hg hrel1 (j := 1) (by simp; omega) (v := cc) (m' := m2) (A := c.dEnd - 8 * s.dstack.length + 8)
+    (by simp) (by simpa using hm2)
+  have hrel3 := wr_stack_at hg hrel2 (j := 0) (by simp; omega) (v := a) (m' := m3) (A := c.dEnd - 8 * s.dstack.length)
+    (by simp) (by simpa using hm3)
+  have e3 : ({ { { s with dstack := s.dstack.set 2 b } with dstack := (({ s with dstack := s.dstack.set 2 b } : State 64).dstack.set 1 cc) } with dstack := ((({ s with dstack := s.dstack.set 2 b } : State 64).dstack.set 1 cc).set 0 a) } : State 64) = { s with dstack := a :: cc :: b :: d } := by
+    simp [hd]
+  rw [e3] at hrel3
+  have := core_gen (fs := fs) (pre := uf c.layout 3) (uf3_pass hg hs hd)
+    (B := [.globalGet spG] ++ ldS 16 ++ [.globalGet spG] ++ ldS 0 ++ [.globalGet spG] ++ ldS 8 ++ [.i64store 16, .i64store 8, .i64store 0])
+    (allSimple_spec (by simp [allSimple, ldS, WI.isCtl])) ⟨_, hexec, hrel3, hst⟩ (k + 1)
+  simpa [lowerInstr, List.append_assoc] using this
+
+/-- Core of instructions that overwrite slot `j` with `y` and then pop `n` words. -/
+theorem sim_wa_core (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {pre : List WI}
+    (hpre : Run fs pre w (.normal w)) {j n : Nat} {y : W} {L' : List W}
+    (hj : j < s.dstack.length) (hn : n ≤ s.dstack.length) (hL' : (s.dstack.set j y).drop n = L')
+    {B : List WI} (hctlB : ∀ i ∈ B, i.isCtl = false)
+    (hB : ∀ m', w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8 * j) y = some m' →
+      execL B w = some { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8 * n))) })
+    (nxt : Nat) :
+    ∃ w', Run fs (pre ++ (B ++ [i32c nxt])) w (.normal w') ∧
+      Rel0 c { s with dstack := L' } w' ∧ w'.stack = [.i32 (ofN nxt)] := by
+  have hcap := hs.capD
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.dEnd - 8 * s.dstack.length + 8 * j) y = some m' :=
+    write64_some (by rw [hs.size]; have := hg.dEnd_le; omega)
+  have hbR := run_of_execL (fs := fs) hctlB (hB m' hm')
+  have hrel1 := wr_stack hg hs (j := j) hj (v := y) (m' := m') hm'
+  have hrel2 := adj_sp hg hrel1 (n := n) (by simpa using hn)
+  have e3 : ({ { s with dstack := s.dstack.set j y } with dstack := ({ s with dstack := s.dstack.set j y } : State 64).dstack.drop n } : State 64) = { s with dstack := L' } := by
+    rw [← hL']
+  rw [e3] at hrel2
+  have e2 : c.dEnd - 8 * s.dstack.length + 8 * n = c.dEnd - 8 * (s.dstack.length - n) := by omega
+  rw [e2] at hbR
+  refine ⟨_, run_append _ hpre (run_append _ hbR (run_finish nxt)), ?_, ?_⟩
+  · refine Rel0.congr (hrel2.setStack []) rfl ?_ ?_ ?_
+    · simp [setG, spG, List.length_set]
+    · simp [setG, spG, rpG]
+    · simp [setG, spG, apG]
+  · simp [hst]
+
+theorem sim_select (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {cc y x : W} {d : List W}
+    (hd : s.dstack = cc :: y :: x :: d) :
+    Sim1 c fs (lowerInstr c.layout n k .select) { s with dstack := (if Word.isTrue cc then x else y) :: d } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 3 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hr2 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 16) = some x := by
+    have := hs.stack 2 x (by simp [hd]); simpa using this
+  have hr1 : w.mem.read64 (c.dEnd - 8 * s.dstack.length + 8) = some y := by
+    have := hs.stack 1 y (by simp [hd]); simpa using this
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some cc := by
+    have := hs.stack 0 cc (by simp [hd]); simpa using this
+  have hsp16 : ofN (c.dEnd - 8 * s.dstack.length) + 16#32 = ofN (c.dEnd - 8 * s.dstack.length + 16) :=
+    ofN_add (c.dEnd - 8 * s.dstack.length) 16
+  have := sim_wa_core (fs := fs) hg hs hst (uf3_pass hg hs hd) (j := 2) (n := 2)
+    (y := if Word.isTrue cc then x else y) (L' := (if Word.isTrue cc then x else y) :: d)
+    (by omega) (by omega) (by simp [hd]) (B := [.globalGet spG] ++ ldS 16 ++ ldS 8 ++ ldS 0 ++ [.i64const 0#64, .i64ne, .select, .i64store 16] ++ spAdd 16)
+    (allSimple_spec (by simp [allSimple, ldS, spAdd, WI.isCtl, i32c])) ?_ (k + 1)
+  · simpa [lowerInstr, List.append_assoc] using this
+  intro m' hm'
+  by_cases hc : cc = 0#64
+  · have hm2 : w.mem.write64 (c.dEnd - 8 * s.dstack.length + 16) y = some m' := by simpa [hc, Word.isTrue] using hm'
+    simp [ldS, spAdd, execL_append, execL, stepI, cmp64, bin32, hs.sp, ofN_toNat hX, hr0, hr1, hr2, bool32, hc, hm2, i32c, hsp16]
+    rfl
+  · have hm2 : w.mem.write64 (c.dEnd - 8 * s.dstack.length + 16) x = some m' := by simpa [hc, Word.isTrue] using hm'
+    simp [ldS, spAdd, execL_append, execL, stepI, cmp64, bin32, hs.sp, ofN_toNat hX, hr0, hr1, hr2, bool32, hc, hm2, i32c, hsp16]
+    rfl
+
+theorem sim_pop (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (hst : w.stack = []) {r : Nat}
+    (hr : r < c.nregs) {a : W} {d : List W} (hd : s.dstack = a :: d) :
+    Sim1 c fs (lowerInstr c.layout n k (.pop r)) { s with dstack := d, regs := State.setReg s.regs r a } w (k + 1) := by
+  have hlen : s.dstack.length = d.length + 1 := by simp [hd]
+  have hX := sp_lt hg hs
+  have hcap := hs.capD
+  have hrf := hg.rf_le
+  have hsz := hg.msize_lt
+  have hr0 : w.mem.read64 (c.dEnd - 8 * s.dstack.length) = some a := by
+    have := hs.stack 0 a (by simp [hd]); simpa using this
+  have hrfl : c.rf + 8 * r < 2 ^ 32 := by omega
+  obtain ⟨m', hm'⟩ : ∃ m', w.mem.write64 (c.rf + 8 * r) a = some m' :=
+    write64_some (by rw [hs.size]; omega)
+  have hsp8 : ofN (c.dEnd - 8 * s.dstack.length) + 8#32 = ofN (c.dEnd - 8 * s.dstack.length + 8) :=
+    ofN_add _ _
+  have hexec : execL ([i32c (c.layout.rf + 8 * r)] ++ ldS 0 ++ [.i64store 0] ++ spAdd 8) w = some { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) } := by
+    simp [ldS, spAdd, execL_append, execL, stepI, bin32, hs.sp, ofN_toNat hX, hr0, i32c, Cfg.layout, BitVec.toNat_ofNat, Nat.mod_eq_of_lt hrfl, hm', hsp8]
+    unfold setG
+    rfl
+  have hrel1 := wr_regs hg hs hr hm'
+  have hrel2 := adj_sp hg hrel1 (n := 1) (by simp [hd])
+  have e3 : ({ { s with regs := State.setReg s.regs r a } with dstack := ({ s with regs := State.setReg s.regs r a } : State 64).dstack.drop 1 } : State 64) = { s with dstack := d, regs := State.setReg s.regs r a } := by
+    simp [hd]
+  rw [e3] at hrel2
+  have hrel3 : Rel0 c { s with dstack := d, regs := State.setReg s.regs r a } { w with mem := m', globals := setG w.globals spG (.i32 (ofN (c.dEnd - 8 * s.dstack.length + 8))) } := by
+    refine Rel0.congr (hrel2.setStack []) rfl ?_ ?_ ?_
+    · have e2 : c.dEnd - 8 * s.dstack.length + 8 = c.dEnd - 8 * (s.dstack.length - 1) := by omega
+      simp [setG, spG, e2]
+    · simp [setG, spG, rpG]
+    · simp [setG, spG, apG]
+  have := core_gen (fs := fs) (pre := uf c.layout 1) (uf1_pass hg hs hd)
+    (B := [i32c (c.layout.rf + 8 * r)] ++ ldS 0 ++ [.i64store 0] ++ spAdd 8)
+    (allSimple_spec (by simp [allSimple, ldS, spAdd, WI.isCtl, i32c])) ⟨_, hexec, hrel3, hst⟩ (k + 1)
+  simpa [lowerInstr, List.append_assoc] using this
+
+/-! Data-stack overflow: every instruction that grows the data stack exits 6 when it is full. -/
+
+theorem sim_word_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (v : W)
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (lowerInstr c.layout n k (.word v)) w (.exit 6) := by
+  have := run_append_abrupt (fs := fs) _ (ovfD_trap hg hs h)
+    (b := pushWith [.i64const v] ++ [i32c (k + 1)]) trivial
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_ptr_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (q : WordDialect.Ptr 64)
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (lowerInstr c.layout n k (.ptr q)) w (.exit 6) := by
+  have := run_append_abrupt (fs := fs) _ (ovfD_trap hg hs h)
+    (b := pushWith [.i64const q.toWord] ++ [i32c (k + 1)]) trivial
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_push_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) (r : Nat)
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (lowerInstr c.layout n k (.push r)) w (.exit 6) := by
+  have := run_append_abrupt (fs := fs) _ (ovfD_trap hg hs h)
+    (b := pushWith [i32c (c.layout.rf + 8 * r), .i64load 0] ++ [i32c (k + 1)]) trivial
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_dup_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (lowerInstr c.layout n k .dup) w (.exit 6) := by
+  have := run_append (fs := fs) _ (uf1_pass hg hs hd) (run_append_abrupt _ (ovfD_trap hg hs h)
+    (b := spSub 8 ++ [.globalGet spG] ++ ldS 8 ++ [.i64store 0] ++ [i32c (k + 1)]) trivial)
+  simpa [lowerInstr, List.append_assoc] using this
+
+theorem sim_over_ovf (n k : Nat) (hg : Geom c) (hs : Rel0 c s w) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    Run fs (lowerInstr c.layout n k .over) w (.exit 6) := by
+  have := run_append (fs := fs) _ (uf2_pass hg hs hd) (run_append_abrupt _ (ovfD_trap hg hs h)
+    (b := spSub 8 ++ [.globalGet spG, .globalGet spG, .i64load 16, .i64store 0] ++ [i32c (k + 1)]) trivial)
+  simpa [lowerInstr, List.append_assoc] using this
+
+end Sim
+
+end Wasm
+end WordDialect

backend/wasm/WasmMain.lean

@@ -0,0 +1,135 @@
+import Harness
+import Wasm
+
+/-!
+# wasmw
+
+Execution harness for the WebAssembly backend. For each program it lowers the IR to WebAssembly,
+emits WAT (`Wasm.Emit`), runs it under `wasmtime` (WASI), runs the same IR program under the Lean
+semantics, and compares the exit status and the dumped data stack, IR memory and virtual registers
+(the shared `Harness`).
+
+`wasmtime` is found through the `WASMTIME` environment variable, else on `PATH`.
+
+`check` also runs `auxSamples`, raw IR programs for the auxiliary stack (`tor`/`fromr`/`rfetch`),
+against the Lean semantics, and the overflow programs, which must exit 6.
+
+Usage: `wasmw check [fuzzCount]`, `wasmw emit <sample>`, `wasmw forth <file.fs> [memWords]` (run a
+Forth source file under wasmtime and compare with the Lean semantics), `wasmw emit-forth <file.fs>`.
+-/
+
+open WordDialect
+
+def runtimeFor (s : Sample) : Wasm.Emit.Runtime := { memImage := s.mem, nregs := s.nregs }
+
+def watFor (s : Sample) : String :=
+  let r := runtimeFor s
+  Wasm.Emit.program r s.prog
+
+def workDir : String := "/tmp/wasmw"
+
+def runWasm (s : Sample) : IO (Except String Result) := do
+  IO.FS.createDirAll workDir
+  let path := s!"{workDir}/{s.name}.wat"
+  IO.FS.writeFile path (watFor s)
+  let cmd := (← IO.getEnv "WASMTIME").getD "wasmtime"
+  let child ← IO.Process.spawn { cmd, args := #["run", path], stdout := .piped, stderr := .piped, stdin := .null }
+  let bytes ← readAll child.stdout ByteArray.empty
+  let err ← child.stderr.readToEnd
+  let code ← child.wait
+  if code == 0 then
+    match parseDump s bytes with
+    | some r => return .ok r
+    | none => return .error s!"malformed dump ({bytes.size} bytes): {err}"
+  else if code.toNat ≥ 1 && code.toNat ≤ 6 then
+    return .ok (.trap code.toNat)
+  else
+    return .error s!"wasmtime exit {code}: {err}"
+
+/-- Raw IR programs exercising the auxiliary stack: values parked across `call`/`ret` and
+recursion, `R@` copies, a counted loop, and the traps (empty auxiliary stack → 5, `tor` on an empty
+data stack → 1). Each is checked against the Lean semantics. -/
+def auxSamples : List Sample :=
+  [ { name := "aux_basic",
+      prog := [.word 5#64, .tor, .word 7#64, .rfetch, .add, .fromr, .mul, .halt], mem := [] },
+    { name := "aux_across_call",
+      prog := [.word 3#64, .tor, .call 6, .fromr, .add, .halt,
+               .word 10#64, .rfetch, .add, .ret], mem := [] },
+    { name := "aux_recursion_fact",
+      prog := [.word 5#64, .call 3, .halt,
+               .dup, .word 0#64, .cmp .eq, .branch 15,
+               .dup, .tor, .word 1#64, .sub, .call 3, .fromr, .mul, .ret,
+               .drop, .word 1#64, .ret], mem := [] },
+    { name := "aux_counted_loop",
+      prog := [.word 0#64, .word 10#64, .tor,
+               .rfetch, .add, .fromr, .word 1#64, .sub, .dup, .tor, .word 0#64, .cmp .ne, .branch 3,
+               .fromr, .drop, .halt], mem := [] },
+    { name := "aux_fromr_empty", prog := [.word 1#64, .fromr, .halt], mem := [] },
+    { name := "aux_rfetch_empty", prog := [.rfetch, .halt], mem := [] },
+    { name := "aux_unbalanced", prog := [.word 1#64, .tor, .fromr, .fromr, .halt], mem := [] },
+    { name := "aux_tor_underflow", prog := [.tor, .halt], mem := [] },
+    { name := "aux_ret_keeps_aux",
+      prog := [.call 3, .fromr, .halt, .word 42#64, .tor, .ret], mem := [] } ]
+
+def checkAux : IO Bool := do
+  let mut ok := true
+  for s in auxSamples do
+    if !(← check runWasm s) then ok := false
+  return ok
+
+/-- Programs whose IR run never terminates and grows a stack without bound: the target must stop
+them with the overflow exit (code 6) instead of corrupting memory. -/
+def overflowSamples : List Sample :=
+  [ { name := "ovf_word_loop", prog := [.word 1#64, .jmp 0], mem := [] },
+    { name := "ovf_dup_loop", prog := [.word 1#64, .dup, .jmp 1], mem := [] },
+    { name := "ovf_call_loop", prog := [.call 0], mem := [] },
+    { name := "ovf_tor_loop", prog := [.word 1#64, .tor, .jmp 0], mem := [] } ]
+
+def checkOverflow : IO Bool := do
+  let mut ok := true
+  for s in overflowSamples do
+    match ← runWasm s with
+    | .ok (.trap 6) => IO.println s!"PASS  {s.name}  overflow exit 6"
+    | .ok got => IO.println s!"FAIL  {s.name}  expected overflow exit 6, got {repr got}"; ok := false
+    | .error e => IO.println s!"ERROR {s.name}: {e}"; ok := false
+  return ok
+
+/-- A Forth source file as a sample: named after the file, `memWords` zero words of IR memory. -/
+def forthFileSample (path : String) (memWords : Nat) : IO Sample := do
+  let src ← IO.FS.readFile path
+  let name := (System.FilePath.mk path).fileStem.getD "forth"
+  return forthTextSample name src (List.replicate memWords 0)
+
+def parseMem (rest : List String) : Option Nat :=
+  match rest with
+  | [] => some 16
+  | [m] => m.toNat?
+  | _ => none
+
+def main (args : List String) : IO UInt32 := do
+  match args with
+  | ["emit", name] =>
+    match (allSamples ++ auxSamples).find? (·.name == name) with
+    | some s => IO.println (watFor s); return 0
+    | none => IO.eprintln "unknown sample"; return 1
+  | "forth" :: path :: rest =>
+    match parseMem rest with
+    | none => IO.eprintln "usage: wasmw forth <file.fs> [memWords]"; return 2
+    | some m =>
+      let s ← forthFileSample path m
+      return (if ← check runWasm s then 0 else 1)
+  | "emit-forth" :: path :: rest =>
+    match parseMem rest with
+    | none => IO.eprintln "usage: wasmw emit-forth <file.fs> [memWords]"; return 2
+    | some m =>
+      let s ← forthFileSample path m
+      match s.buildError with
+      | some e => IO.eprintln e; return 1
+      | none => IO.println (watFor s); return 0
+  | "check" :: rest =>
+    let count := match rest with | [n] => n.toNat! | _ => 200
+    let agree ← checkAll runWasm count
+    let aux ← checkAux
+    let ovf ← checkOverflow
+    return (if agree && aux && ovf then 0 else 1)
+  | _ => IO.eprintln "usage: wasmw check [fuzzCount] | wasmw emit <sample> | wasmw forth <file.fs> [memWords] | wasmw emit-forth <file.fs> [memWords]"; return 2

backend/x86_64/Main.lean

@@ -0,0 +1,149 @@
+import Harness
+import X86
+
+/-!
+# wordc
+
+Native execution harness for the x86-64 backend. For each program it
+1. lowers the IR to x86-64 and emits GNU assembly (`X86.Emit`),
+2. assembles and links it with `as` / `ld`,
+3. runs the binary on this machine,
+4. runs the same IR program under the Lean semantics (`WordDialect.run`), and
+5. compares exit status and the dumped data stack, IR memory and virtual registers
+   (the shared `Harness`).
+
+`check` also runs the auxiliary-stack programs (`tor`/`fromr`/`rfetch`) in `auxSamples`.
+
+Usage: `wordc check [fuzzCount]`, `wordc emit <sample>`, `wordc forth <file.fs> [memWords]` (run a
+Forth source file natively and compare with the Lean semantics), `wordc emit-forth <file.fs>`.
+-/
+
+open WordDialect
+
+def dBase : Nat := 0x10000000
+def capacity : Nat := 65536
+def dEnd : Nat := dBase + 8 * capacity
+/-- Return-stack capacity in entries: 512 KiB of the native stack below the entry `rsp`. -/
+def rcap : Nat := 65536
+/-- Auxiliary-stack placement: `acap` words in `.astack`, linked at `aBase` (disjoint from
+`.dstack`, which ends at `dEnd = 0x10080000`). -/
+def aBase : Nat := 0x10100000
+def acap : Nat := 65536
+def aEnd : Nat := aBase + 8 * acap
+
+def runtimeFor (s : Sample) : X86.Emit.Runtime :=
+  { dEnd := dEnd, capacity := capacity, rcap := rcap, memImage := s.mem, nregs := s.nregs,
+    aEnd := aEnd, acap := acap }
+
+def layoutFor (s : Sample) : X86.Layout := (runtimeFor s).layout
+
+def asmFor (s : Sample) : String :=
+  X86.Emit.program (runtimeFor s) (X86.lowerProg (layoutFor s) s.prog)
+
+def workDir : String := "/tmp/wordc"
+
+def runNative (s : Sample) : IO (Except String Result) := do
+  IO.FS.createDirAll workDir
+  let base := s!"{workDir}/{s.name}"
+  IO.FS.writeFile (base ++ ".s") (asmFor s)
+  let a ← IO.Process.output { cmd := "as", args := #["-o", base ++ ".o", base ++ ".s"] }
+  if a.exitCode != 0 then return .error s!"as failed: {a.stderr}"
+  let l ← IO.Process.output { cmd := "ld", args := #[s!"--section-start=.dstack={X86.Emit.hex dBase}",
+    s!"--section-start=.astack={X86.Emit.hex aBase}", "-o", base, base ++ ".o"] }
+  if l.exitCode != 0 then return .error s!"ld failed: {l.stderr}"
+  let child ← IO.Process.spawn { cmd := base, stdout := .piped, stderr := .null, stdin := .null }
+  let bytes ← readAll child.stdout ByteArray.empty
+  let code ← child.wait
+  if code == 0 then
+    match parseDump s bytes with
+    | some r => return .ok r
+    | none => return .error s!"malformed dump ({bytes.size} bytes)"
+  else
+    return .ok (.trap code.toNat)
+
+
+/-- Programs whose IR run never terminates and grows a stack without bound: the native code must
+stop them with the overflow exit (code 6) instead of running off the end of a stack. -/
+def overflowSamples : List Sample :=
+  [ { name := "ovf_word_loop", prog := [.word 1#64, .jmp 0], mem := [] },
+    { name := "ovf_dup_loop", prog := [.word 1#64, .dup, .jmp 1], mem := [] },
+    { name := "ovf_call_loop", prog := [.call 0], mem := [] },
+    { name := "ovf_tor_loop", prog := [.word 1#64, .tor, .jmp 0], mem := [] } ]
+
+/-- Raw IR programs for the auxiliary stack, checked against the Lean semantics. -/
+def auxSamples : List Sample :=
+  [ -- park 7, copy it (R@), add, take it back, multiply: (3 + 7) * 7 = 70
+    { name := "aux_basic", mem := [], nregs := 1,
+      prog := [.word 7, .tor, .word 3, .rfetch, .add, .fromr, .mul, .halt] }
+    -- a value parked across a `call` whose body uses the aux stack itself: 5*5 + 100 = 125
+  , { name := "aux_across_call", mem := [], nregs := 1,
+      prog := [.word 100, .tor, .word 5, .call 7, .fromr, .add, .halt,
+               .tor, .rfetch, .fromr, .mul, .ret] }
+    -- recursive factorial keeping `n` on the aux stack across the recursive call: 5! = 120
+  , { name := "aux_fact_rec", mem := [], nregs := 1,
+      prog := [.word 5, .call 3, .halt,
+               .dup, .branch 8, .drop, .word 1, .ret,
+               .dup, .tor, .word 1, .sub, .call 3, .fromr, .mul, .ret] }
+    -- `fromr` / `rfetch` on an empty aux stack trap returnUnderflow (5)
+  , { name := "aux_fromr_empty", mem := [], nregs := 1, prog := [.word 1, .fromr, .halt] }
+  , { name := "aux_rfetch_empty", mem := [], nregs := 1, prog := [.rfetch, .halt] }
+    -- `ret` does not see aux-stack values: still returnUnderflow (5)
+  , { name := "aux_ret_not_aux", mem := [], nregs := 1, prog := [.word 1, .tor, .ret] }
+    -- `tor` on an empty data stack traps stackUnderflow (1)
+  , { name := "aux_tor_underflow", mem := [], nregs := 1, prog := [.tor, .halt] }
+  ]
+
+def checkAux : IO Bool := do
+  let mut ok := true
+  for s in auxSamples do
+    if !(← check runNative s) then ok := false
+  return ok
+
+def checkOverflow : IO Bool := do
+  let mut ok := true
+  for s in overflowSamples do
+    match ← runNative s with
+    | .ok (.trap 6) => IO.println s!"PASS  {s.name}  overflow exit 6"
+    | .ok got => IO.println s!"FAIL  {s.name}  expected overflow exit 6, got {repr got}"; ok := false
+    | .error e => IO.println s!"ERROR {s.name}: {e}"; ok := false
+  return ok
+
+/-- A Forth source file as a sample: named after the file, `memWords` zero words of IR memory. -/
+def forthFileSample (path : String) (memWords : Nat) : IO Sample := do
+  let src ← IO.FS.readFile path
+  let name := (System.FilePath.mk path).fileStem.getD "forth"
+  return forthTextSample name src (List.replicate memWords 0)
+
+def parseMem (rest : List String) : Option Nat :=
+  match rest with
+  | [] => some 16
+  | [m] => m.toNat?
+  | _ => none
+
+def main (args : List String) : IO UInt32 := do
+  match args with
+  | ["emit", name] =>
+    match (allSamples ++ auxSamples).find? (·.name == name) with
+    | some s => IO.println (asmFor s); return 0
+    | none => IO.eprintln "unknown sample"; return 1
+  | "forth" :: path :: rest =>
+    match parseMem rest with
+    | none => IO.eprintln "usage: wordc forth <file.fs> [memWords]"; return 2
+    | some m =>
+      let s ← forthFileSample path m
+      return (if ← check runNative s then 0 else 1)
+  | "emit-forth" :: path :: rest =>
+    match parseMem rest with
+    | none => IO.eprintln "usage: wordc emit-forth <file.fs> [memWords]"; return 2
+    | some m =>
+      let s ← forthFileSample path m
+      match s.buildError with
+      | some e => IO.eprintln e; return 1
+      | none => IO.println (asmFor s); return 0
+  | "check" :: rest =>
+    let count := match rest with | [n] => n.toNat! | _ => 200
+    let agree ← checkAll runNative count
+    let aux ← checkAux
+    let ovf ← checkOverflow
+    return (if agree && aux && ovf then 0 else 1)
+  | _ => IO.eprintln "usage: wordc check [fuzzCount] | wordc emit <sample> | wordc forth <file.fs> [memWords] | wordc emit-forth <file.fs> [memWords]"; return 2

backend/x86_64/X86.lean

@@ -0,0 +1,20 @@
+import X86.Isa
+import X86.Lower
+import X86.Emit
+import X86.Flags
+import X86.Run
+import X86.Rel
+import X86.Seq
+import X86.Micro
+import X86.Guard
+import X86.SimBin
+import X86.SimOps
+import X86.SimStack
+import X86.SimMem
+import X86.SimMemOps
+import X86.SimDiv
+import X86.SimCtl
+import X86.SimAux
+import X86.SimStep
+import X86.Correct
+import X86.Init

backend/x86_64/X86/Correct.lean

@@ -0,0 +1,181 @@
+import X86.SimStep
+
+/-!
+# X86.Correct
+
+Whole-program preservation: running the lowered x86 code from a state related to the IR state
+`s` reaches the same final outcome the IR semantics reaches from `s`.
+
+* IR `halted s'`  ⇒  the x86 code halts in a state `x'` with `Rel0 c p s' x'` (so the data
+  stack, virtual registers, IR memory and return stack agree with `s'`);
+* IR `trapped t`  ⇒  the x86 code exits with the same trap `t`.
+
+Every instruction that grows the data stack or the auxiliary stack, and every `call`, checks for
+room first and exits with `overflow` (exit code 6) when the stack is full, so there are two forms:
+
+* `lowerProg_correct_or_overflow` has no capacity hypothesis: the x86 code reaches the IR outcome
+  as above, or exits with `overflow` (the run needed more stack than the target provides);
+* `lowerProg_correct` additionally assumes the IR run stays within the capacities (`Fits` at every
+  reachable state); then no guard fires and the outcome is exactly the IR's.
+
+Hypotheses of both (all explicit):
+* `Geom c`            the memory regions (data stack, register file, IR memory, native stack,
+                      auxiliary stack) are disjoint and within the 64-bit address space, the
+                      data and auxiliary stacks hold at least one word each and the return stack
+                      at least two;
+* `L` matches `c`     data-stack end and limit, return-stack gap, auxiliary-stack end and limit,
+                      and IR memory size;
+* `hsz`               code indices fit in 64 bits;
+* `RegsOk`            every `push r`/`pop r` names a register inside the register file.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+/-- Every register index used by the program lies in the virtual register file. -/
+def RegsOk (c : Cfg) (p : Prog 64) : Prop :=
+  ∀ (k : Nat) (i : WordDialect.Instr 64), p[k]? = some i → ∀ r : Nat, (i = WordDialect.Instr.push r ∨ i = WordDialect.Instr.pop r) → r < c.nregs
+
+/-- The final-outcome form of `Sim`. -/
+def Final (c : Cfg) (p : Prog 64) (code : List (Instr Nat)) (x : M) : Outcome 64 → Prop
+  | .next _ => False
+  | .halted s' => ∃ x', XExec code x (.halted x') ∧ Rel0 c p s' x'
+  | .trapped t => XExec code x (.trapped t)
+
+theorem offs_ge {p : Prog 64} {k : Nat} (h : p.length ≤ k) : offs p k = offs p p.length := by
+  simp [offs, List.take_of_length_le h, List.take_length]
+
+/-- One IR step from a related state: the bad-pc stub, or the dispatched instruction. -/
+theorem step_sim {c : Cfg} {p : Prog 64} {L : Layout} (hg : Geom c)
+    (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hLr : L.rGap = ofN (8 * c.rcap - 16)) (hLa : L.aEnd = ofN c.aEnd)
+    (hLal : L.aLim = ofN (c.aBase + 8)) (hsz : ∀ k, offs p k < 2 ^ 64) (hreg : RegsOk c p)
+    {s : State 64} {x : M} (hs : Rel c p s x) :
+    Sim c p (lowerProg L p) x (WordDialect.step p s) ∨
+      (¬ Fits c s ∧ XExec (lowerProg L p) x .overflow) := by
+  cases hi : p[s.pc]? with
+  | none =>
+    left
+    have hst : WordDialect.step p s = .trapped .badPc := by simp [WordDialect.step, hi]
+    rw [hst]
+    have hge : p.length ≤ s.pc := by
+      by_cases hh : s.pc < p.length
+      · rw [List.getElem?_eq_getElem hh] at hi; simp at hi
+      · omega
+    obtain ⟨f0, _⟩ := lowerProg_stub L p
+    have hpc : x.pc = offs p p.length := by rw [hs.2, offs_ge hge]
+    exact XExec.trap (by rw [xstep_of_fetch (by rw [hpc]; exact f0)]; rfl)
+  | some i =>
+    have hst : WordDialect.step p s = WordDialect.exec i s := by simp [WordDialect.step, hi]
+    rw [hst]
+    exact sim_exec hg hL hMs hLd hLr hLa hLal hsz hs hi (fun r hr => hreg s.pc i hi r hr)
+
+/-- Whole-program preservation, with no capacity hypothesis: the x86 code reaches the IR
+outcome, or exits with `overflow` because a stack was full. -/
+theorem lowerProg_correct_or_overflow {c : Cfg} {p : Prog 64} {L : Layout} (hg : Geom c)
+    (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hLr : L.rGap = ofN (8 * c.rcap - 16)) (hLa : L.aEnd = ofN c.aEnd)
+    (hLal : L.aLim = ofN (c.aBase + 8)) (hsz : ∀ k, offs p k < 2 ^ 64) (hreg : RegsOk c p)
+    {s : State 64} {o : Outcome 64} (h : Exec p s o) :
+    ∀ {x : M}, Rel c p s x →
+      Final c p (lowerProg L p) x o ∨ XExec (lowerProg L p) x .overflow := by
+  induction h with
+  | @halt s s' hst =>
+    intro x hs
+    have := step_sim hg hL hMs hLd hLr hLa hLal hsz hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨_, h6⟩
+    · exact .inl this
+    · exact .inr h6
+  | @trap s t hst =>
+    intro x hs
+    have := step_sim hg hL hMs hLd hLr hLa hLal hsz hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨_, h6⟩
+    · exact .inl this
+    · exact .inr h6
+  | @next s s' o hst _ ih =>
+    intro x hs
+    have := step_sim hg hL hMs hLd hLr hLa hLal hsz hreg hs
+    rw [hst] at this
+    rcases this with ⟨x1, hsteps, hrel⟩ | ⟨_, h6⟩
+    · rcases ih hrel with hih | h6
+      · left
+        cases o with
+        | next _ => exact hih.elim
+        | halted s2 =>
+          obtain ⟨x', hx, hr⟩ := hih
+          exact ⟨x', XExec.of_steps hsteps hx, hr⟩
+        | trapped t => exact XExec.of_steps hsteps hih
+      · exact .inr (XExec.of_steps hsteps h6)
+    · exact .inr h6
+
+/-- Whole-program preservation. When the IR run stays within the stack capacities (`Fits` at
+every reachable state), no overflow guard fires and the outcome is exactly the IR's. -/
+theorem lowerProg_correct {c : Cfg} {p : Prog 64} {L : Layout} (hg : Geom c)
+    (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hLr : L.rGap = ofN (8 * c.rcap - 16)) (hLa : L.aEnd = ofN c.aEnd)
+    (hLal : L.aLim = ofN (c.aBase + 8)) (hsz : ∀ k, offs p k < 2 ^ 64) (hreg : RegsOk c p)
+    {s : State 64} {o : Outcome 64} (h : Exec p s o) :
+    ∀ {x : M}, Rel c p s x → (∀ s', Steps p s s' → Fits c s') →
+      Final c p (lowerProg L p) x o := by
+  induction h with
+  | @halt s s' hst =>
+    intro x hs hb
+    have := step_sim hg hL hMs hLd hLr hLa hLal hsz hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨hnf, _⟩
+    · exact this
+    · exact absurd (hb s .refl) hnf
+  | @trap s t hst =>
+    intro x hs hb
+    have := step_sim hg hL hMs hLd hLr hLa hLal hsz hreg hs
+    rw [hst] at this
+    rcases this with this | ⟨hnf, _⟩
+    · exact this
+    · exact absurd (hb s .refl) hnf
+  | @next s s' o hst _ ih =>
+    intro x hs hb
+    have := step_sim hg hL hMs hLd hLr hLa hLal hsz hreg hs
+    rw [hst] at this
+    rcases this with ⟨x1, hsteps, hrel⟩ | ⟨hnf, _⟩
+    · have hih := ih hrel (fun s'' hss => hb s'' (Steps.cons hst hss))
+      cases o with
+      | next _ => exact hih.elim
+      | halted s2 =>
+        obtain ⟨x', hx, hr⟩ := hih
+        exact ⟨x', XExec.of_steps hsteps hx, hr⟩
+      | trapped t => exact XExec.of_steps hsteps hih
+    · exact absurd (hb s .refl) hnf
+
+/-- The state the runtime prologue establishes (`X86.Emit`): empty stacks, `r12 = rsp = sp0`,
+`r13 r14 r15 rbp` at the conventions, and the register file and IR memory regions holding the IR
+state's initial contents. `Rel` then holds at the entry point, so `lowerProg_correct` applies. -/
+theorem init_rel {c : Cfg} {p : Prog 64} {s0 : State 64} {x0 : M} (hg : Geom c)
+    (hd : s0.dstack = []) (hr : s0.rstack = []) (ha : s0.astack = []) (hrc : 1 ≤ c.rcap)
+    (h15 : x0.regs Reg.r15 = ofN c.dEnd) (h14 : x0.regs Reg.r14 = ofN c.rf)
+    (h13 : x0.regs Reg.r13 = ofN c.mb) (h12 : x0.regs Reg.r12 = ofN c.sp0)
+    (hsp : x0.regs Reg.rsp = ofN c.sp0) (hbp : x0.regs Reg.rbp = ofN c.aEnd) (hregs : RegRel c x0.mem s0.regs)
+    (hmem : MemRel c x0.mem s0.mem) (hiv : ∀ a : Word 64, s0.mem.valid a = decide (a.toNat < c.M))
+    (hxv : RegionsValid c x0.mem.valid) (hpc : x0.pc = offs p s0.pc) : Rel c p s0 x0 :=
+  ⟨{ r15 := by simpa [hd] using h15
+     r14 := h14
+     r13 := h13
+     r12 := h12
+     rsp := by simpa [hr] using hsp
+     rbp := by simpa [ha] using hbp
+     aux := by intro i v h; simp [ha] at h
+     stack := by intro i v h; simp [hd] at h
+     regs := hregs
+     mem := hmem
+     rs := by intro i a h; simp [hr] at h
+     irvalid := hiv
+     xvalid := hxv
+     capD := by simp [hd]; exact hg.dBase_le
+     capR := by simp [hr]; exact hrc
+     capA := by have := hg.aBase_8; simp [ha]; omega }, hpc⟩
+
+end X86
+end WordDialect

backend/x86_64/X86/Emit.lean

@@ -0,0 +1,143 @@
+import X86.Lower
+
+/-!
+# X86.Emit
+
+GNU `as` (Intel syntax) text for a lowered program, plus the small runtime.
+
+The program text is produced from exactly the instruction list `lowerProg` builds, one
+`.L<index>:` label per x86 instruction, so the text and the verified model cannot diverge.
+
+The runtime (`prologue`, `epilogue`) is the only hand-written assembly. It
+* sets `r12 r13 r14 r15 rbp` to the conventions in `X86.Lower`,
+* implements `exitHalt` as: write `depth`, the data stack, IR memory and the virtual register
+  file to stdout (raw little-endian 64-bit words), then `exit(0)`,
+* implements `exitTrap t` as `exit(code t)` and `exitOvf` (stack overflow) as `exit(6)`.
+-/
+
+namespace WordDialect
+namespace X86
+namespace Emit
+
+open Reg
+
+def trapCode : Trap → Nat
+  | .stackUnderflow => 1
+  | .badAddress => 2
+  | .divideByZero => 3
+  | .badPc => 4
+  | .returnUnderflow => 5
+
+def regName : Reg → String
+  | .rax => "rax" | .rcx => "rcx" | .rdx => "rdx" | .rbx => "rbx" | .rsp => "rsp" | .rbp => "rbp"
+  | .r12 => "r12" | .r13 => "r13" | .r14 => "r14" | .r15 => "r15"
+
+def ccName : Cc → String
+  | .e => "e" | .ne => "ne" | .b => "b" | .be => "be" | .a => "a" | .ae => "ae"
+  | .l => "l" | .le => "le" | .g => "g" | .ge => "ge"
+
+def hex (n : Nat) : String := "0x" ++ String.ofList (Nat.toDigits 16 n)
+
+def lbl (t : Nat) : String := s!".L{t}"
+
+def mem (b : Reg) (disp : Int) : String :=
+  if disp = 0 then s!"qword ptr [{regName b}]"
+  else if disp > 0 then s!"qword ptr [{regName b} + {disp}]"
+  else s!"qword ptr [{regName b} - {-disp}]"
+
+def instr : Instr Nat → String
+  | .movImm d v => s!"movabs {regName d}, {hex v.toNat}"
+  | .movRR d s => s!"mov {regName d}, {regName s}"
+  | .load d b disp => s!"mov {regName d}, {mem b disp}"
+  | .store b disp s => s!"mov {mem b disp}, {regName s}"
+  | .loadIdx d b i => s!"mov {regName d}, qword ptr [{regName b} + {regName i}*8]"
+  | .storeIdx b i s => s!"mov qword ptr [{regName b} + {regName i}*8], {regName s}"
+  | .add d s => s!"add {regName d}, {regName s}"
+  | .sub d s => s!"sub {regName d}, {regName s}"
+  | .imul d s => s!"imul {regName d}, {regName s}"
+  | .and d s => s!"and {regName d}, {regName s}"
+  | .or d s => s!"or {regName d}, {regName s}"
+  | .xor d s => s!"xor {regName d}, {regName s}"
+  | .addImm d v => s!"add {regName d}, {v}"
+  | .not d => s!"not {regName d}"
+  | .neg d => s!"neg {regName d}"
+  | .cmp a b => s!"cmp {regName a}, {regName b}"
+  | .cmpImm a v => s!"cmp {regName a}, {v}"
+  | .test a b => s!"test {regName a}, {regName b}"
+  | .shlCl d => s!"shl {regName d}, cl"
+  | .shrCl d => s!"shr {regName d}, cl"
+  | .rolCl d => s!"rol {regName d}, cl"
+  | .rorCl d => s!"ror {regName d}, cl"
+  | .cmov c d s => s!"cmov{ccName c} {regName d}, {regName s}"
+  | .div s => s!"div {regName s}"
+  | .idiv s => s!"idiv {regName s}"
+  | .cqo => "cqo"
+  | .jmp t => s!"jmp {lbl t}"
+  | .jcc c t => s!"j{ccName c} {lbl t}"
+  | .call t => s!"call {lbl t}"
+  | .ret => "ret"
+  | .exitHalt => "jmp .Lhalt"
+  | .exitTrap t => s!"jmp .Ltrap{trapCode t}"
+  | .exitOvf => "jmp .Ltrap6"
+
+def body (code : List (Instr Nat)) : String :=
+  String.intercalate "\n" (code.zipIdx.map fun (i, k) => s!"{lbl k}:\n\t{instr i}") ++ "\n"
+
+/-- Data-stack placement (`capacity` words ending at `dEnd`), return-stack capacity in entries,
+IR memory image, register-file size, and auxiliary-stack placement (`acap` words ending at
+`aEnd`). -/
+structure Runtime where
+  dEnd : Nat
+  capacity : Nat
+  rcap : Nat
+  memImage : List Nat
+  nregs : Nat
+  aEnd : Nat
+  acap : Nat
+
+def Runtime.dBase (r : Runtime) : Nat := r.dEnd - 8 * r.capacity
+
+def Runtime.aBase (r : Runtime) : Nat := r.aEnd - 8 * r.acap
+
+/-- The lowering's view of the runtime: the constants the guards and bounds checks use. -/
+def Runtime.layout (r : Runtime) : Layout :=
+  { dEnd := BitVec.ofNat 64 r.dEnd, memSize := r.memImage.length,
+    dLim := BitVec.ofNat 64 (r.dBase + 8), rGap := BitVec.ofNat 64 (8 * r.rcap - 16),
+    aEnd := BitVec.ofNat 64 r.aEnd, aLim := BitVec.ofNat 64 (r.aBase + 8) }
+
+/-- The runtime prologue. Its model is `X86.Emit.prologueCode` (`X86/Init.lean`), where each `lea`
+is the `movImm` of the address the linker resolves the symbol to; keep the two in step. -/
+def prologue (r : Runtime) : String :=
+  "\t.intel_syntax noprefix\n\t.text\n\t.globl _start\n_start:\n" ++
+  "\tmov r12, rsp\n\tlea r13, [rip + irmem]\n\tlea r14, [rip + regfile]\n" ++
+  s!"\tmovabs r15, {hex r.dEnd}\n\tmovabs rbp, {hex r.aEnd}\n"
+
+def sysWrite (bufSetup : String) (len : String) : String :=
+  s!"\t{bufSetup}\n\tmov rdx, {len}\n\tmov rax, 1\n\tmov rdi, 1\n\tsyscall\n"
+
+def epilogue (r : Runtime) : String :=
+  let m := r.memImage.length
+  ".Lhalt:\n" ++
+  s!"\tmovabs rax, {hex r.dEnd}\n\tsub rax, r15\n\tshr rax, 3\n\tlea rbx, [rip + hdr]\n\tmov qword ptr [rbx], rax\n" ++
+  sysWrite "mov rsi, rbx" "8" ++
+  "\tlea rbx, [rip + hdr]\n\tmov rdx, qword ptr [rbx]\n\tshl rdx, 3\n\tmov rsi, r15\n\tmov rax, 1\n\tmov rdi, 1\n\tsyscall\n" ++
+  sysWrite "lea rsi, [rip + irmem]" (toString (8 * m)) ++
+  sysWrite "lea rsi, [rip + regfile]" (toString (8 * r.nregs)) ++
+  "\txor rdi, rdi\n\tjmp .Lexit\n" ++
+  String.join ((List.range 6).map fun k => s!".Ltrap{k + 1}:\n\tmov rdi, {k + 1}\n\tjmp .Lexit\n") ++
+  ".Lexit:\n\tmov rax, 60\n\tsyscall\n" ++
+  "\t.data\n\t.balign 8\nirmem:\n" ++
+  String.join (r.memImage.map fun v => s!"\t.quad {v}\n") ++
+  "\t.section .dstack, \"aw\", @nobits\n\t.balign 8\n" ++
+  s!"\t.skip {8 * r.capacity}\n" ++
+  "\t.section .astack, \"aw\", @nobits\n\t.balign 8\n" ++
+  s!"\t.skip {8 * r.acap}\n" ++
+  "\t.bss\n\t.balign 8\nhdr:\n\t.skip 8\nregfile:\n" ++ s!"\t.skip {8 * (r.nregs + 1)}\n"
+
+/-- Full assembly text for a lowered program. -/
+def program (r : Runtime) (code : List (Instr Nat)) : String :=
+  prologue r ++ body code ++ epilogue r
+
+end Emit
+end X86
+end WordDialect

backend/x86_64/X86/Flags.lean

@@ -0,0 +1,128 @@
+import X86.Lower
+
+/-!
+# X86.Flags
+
+The condition-code semantics (`Cc.holds` on `subFlags`) coincides with the IR comparison
+predicates (`Cond.eval`). This is the fact that makes `cmp; cmovcc` a correct lowering of IR
+`CMP`, for all ten conditions, in all four of `ZF SF CF OF`.
+-/
+
+namespace WordDialect
+namespace X86
+
+theorem sub_zero_iff (a b : W) : (a - b == 0#64) = (a == b) := by
+  have h : (a - b = 0#64) ↔ (a = b) := by
+    constructor
+    · intro h
+      apply BitVec.eq_of_toNat_eq
+      have := congrArg BitVec.toNat h
+      simp [BitVec.toNat_sub] at this
+      have := a.isLt; have := b.isLt
+      omega
+    · intro h; subst h; simp
+  by_cases h' : a = b
+  · simp [h']
+  · have hne : ¬ (a - b = 0#64) := fun hh => h' (h.mp hh)
+    rw [beq_eq_false_iff_ne.mpr hne, beq_eq_false_iff_ne.mpr h']
+
+theorem holds_e (a b : W) : Cc.e.holds (subFlags a b) = (a == b) := by
+  unfold Cc.holds subFlags; exact sub_zero_iff a b
+
+theorem holds_ne (a b : W) : Cc.ne.holds (subFlags a b) = (a != b) := by
+  unfold Cc.holds subFlags
+  simp only [sub_zero_iff]
+  rfl
+
+theorem holds_b (a b : W) : Cc.b.holds (subFlags a b) = a.ult b := by
+  unfold Cc.holds subFlags; rfl
+
+theorem holds_ae (a b : W) : Cc.ae.holds (subFlags a b) = b.ule a := by
+  unfold Cc.holds subFlags
+  simp only [BitVec.ult_eq_decide, BitVec.ule_eq_decide]
+  by_cases h : a.toNat < b.toNat <;> simp [h] <;> omega
+
+theorem holds_be (a b : W) : Cc.be.holds (subFlags a b) = a.ule b := by
+  unfold Cc.holds subFlags
+  simp only [sub_zero_iff, BitVec.ult_eq_decide, BitVec.ule_eq_decide]
+  by_cases h2 : a = b
+  · subst h2; simp
+  · have h3 : a.toNat ≠ b.toNat := fun h => h2 (BitVec.eq_of_toNat_eq h)
+    have h4 : (a == b) = false := beq_eq_false_iff_ne.mpr h2
+    by_cases h1 : a.toNat < b.toNat
+    · simp [h1, h4]; omega
+    · simp [h1, h4]
+      omega
+
+theorem holds_a (a b : W) : Cc.a.holds (subFlags a b) = b.ult a := by
+  unfold Cc.holds subFlags
+  simp only [sub_zero_iff, BitVec.ult_eq_decide]
+  by_cases h2 : a = b
+  · subst h2; simp
+  · have h3 : a.toNat ≠ b.toNat := fun h => h2 (BitVec.eq_of_toNat_eq h)
+    have h4 : (a == b) = false := beq_eq_false_iff_ne.mpr h2
+    by_cases h1 : a.toNat < b.toNat
+    · simp [h1, h4]; omega
+    · simp [h1, h4]
+      omega
+
+theorem holds_signed_core (a b : W) :
+    ((a - b).msb != (a.msb != b.msb && a.msb != (a - b).msb)) = a.slt b := by
+  have ha := a.isLt; have hb := b.isLt
+  simp only [BitVec.msb_eq_decide, BitVec.slt_eq_decide, BitVec.toInt_eq_toNat_cond,
+    BitVec.toNat_sub]
+  by_cases c1 : 2 ^ (64 - 1) ≤ a.toNat <;> by_cases c2 : 2 ^ (64 - 1) ≤ b.toNat <;>
+  by_cases c3 : 2 ^ (64 - 1) ≤ (2 ^ 64 - b.toNat + a.toNat) % 2 ^ 64 <;>
+  simp [c1, c2, c3] <;> omega
+
+theorem holds_l (a b : W) : Cc.l.holds (subFlags a b) = a.slt b := by
+  unfold Cc.holds subFlags; simp only []; exact holds_signed_core a b
+theorem beq_eq_not_bne (x y : Bool) : (x == y) = !(x != y) := by
+  cases x <;> cases y <;> rfl
+
+theorem holds_ge (a b : W) : Cc.ge.holds (subFlags a b) = b.sle a := by
+  unfold Cc.holds subFlags
+  simp only []
+  have hc := holds_signed_core a b
+  rw [beq_eq_not_bne, hc, BitVec.slt_eq_decide, BitVec.sle_eq_decide]
+  by_cases h : a.toInt < b.toInt <;> simp [h] <;> omega
+
+
+theorem holds_le (a b : W) : Cc.le.holds (subFlags a b) = a.sle b := by
+  unfold Cc.holds subFlags
+  simp only [sub_zero_iff]
+  rw [holds_signed_core a b, BitVec.slt_eq_decide, BitVec.sle_eq_decide]
+  by_cases h2 : a = b
+  · subst h2; simp
+  · have h3 : a.toInt ≠ b.toInt := fun h => h2 (BitVec.toInt_inj.mp h)
+    have h4 : (a == b) = false := beq_eq_false_iff_ne.mpr h2
+    by_cases h1 : a.toInt < b.toInt <;> simp [h1, h4] <;> omega
+
+theorem holds_g (a b : W) : Cc.g.holds (subFlags a b) = b.slt a := by
+  unfold Cc.holds subFlags
+  simp only [sub_zero_iff]
+  have hc := holds_signed_core a b
+  rw [beq_eq_not_bne, hc, BitVec.slt_eq_decide, BitVec.slt_eq_decide]
+  by_cases h2 : a = b
+  · subst h2; simp
+  · have h3 : a.toInt ≠ b.toInt := fun h => h2 (BitVec.toInt_inj.mp h)
+    have h4 : (a == b) = false := beq_eq_false_iff_ne.mpr h2
+    by_cases h1 : a.toInt < b.toInt <;> simp [h1, h4] <;> omega
+
+/-- `cmp a, b; jcc/cmovcc` evaluates exactly the IR comparison predicate. -/
+theorem holds_ccOf (c : WordDialect.Cond) (a b : W) :
+    (ccOf c).holds (subFlags a b) = c.eval a b := by
+  cases c <;> simp only [ccOf, WordDialect.Cond.eval]
+  · exact holds_e a b
+  · exact holds_ne a b
+  · exact holds_b a b
+  · exact holds_be a b
+  · exact holds_a a b
+  · exact holds_ae a b
+  · exact holds_l a b
+  · exact holds_le a b
+  · exact holds_g a b
+  · exact holds_ge a b
+
+end X86
+end WordDialect

backend/x86_64/X86/Guard.lean

@@ -0,0 +1,230 @@
+import X86.Micro
+
+/-!
+# X86.Guard
+
+The operand-count guard `uf`: with enough operands it falls through; otherwise it exits with
+`stackUnderflow`, which is exactly the IR trap.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+theorem ufSize_pos {n : Nat} (hn : 0 < n) : ufSize n = 4 := by simp [ufSize]; omega
+
+theorem uf_eq (L : Layout) {n : Nat} (hn : 0 < n) (base : Nat) :
+    uf L n base = [.movImm rax (L.dEnd - BitVec.ofNat 64 (8 * n)), .cmp r15 rax, .jcc .be (base + 4),
+      .exitTrap .stackUnderflow] := by
+  simp [uf]; omega
+
+theorem ule_ofN {a b : Nat} (ha : a < 2 ^ 64) (hb : b < 2 ^ 64) :
+    (ofN a).ule (ofN b) = decide (a ≤ b) := by
+  simp [BitVec.ule_eq_decide, ofN, BitVec.toNat_ofNat, Nat.mod_eq_of_lt ha, Nat.mod_eq_of_lt hb]
+
+/-- The comparison inside the guard, in terms of stack depth. -/
+theorem uf_flags {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hg : Geom c) (hs : Rel0 c p s x)
+    {L : Layout} (hL : L.dEnd = ofN c.dEnd) {n : Nat} (hn : 0 < n) (hn3 : n ≤ 3) :
+    ((subFlags (x.regs Reg.r15) (L.dEnd - BitVec.ofNat 64 (8 * n))) |> Cc.be.holds) =
+      decide (n ≤ s.dstack.length) := by
+  have hcap := hs.capD
+  have hdE := hg.dEnd_lt
+  have hge := hg.dEnd_ge
+  rw [holds_be, hs.r15, hL, show BitVec.ofNat 64 (8 * n) = ofN (8 * n) from rfl,
+    ofN_sub (by omega), ule_ofN (by omega) (by omega)]
+  by_cases h : n ≤ s.dstack.length
+  · simp [h]; omega
+  · simp [h]; omega
+
+/-- Enough operands: the guard falls through to `base + 4`, changing only scratch state. -/
+theorem uf_pass {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+    {L : Layout} {base n : Nat} (hg : Geom c) (hs : Rel0 c p s x) (hL : L.dEnd = ofN c.dEnd)
+    (hn : 0 < n) (hn3 : n ≤ 3) (hk : n ≤ s.dstack.length) (hpc : x.pc = base)
+    (hat : XAt code base (uf L n base)) :
+    ∃ x1, XSteps code x x1 ∧ Rel0 c p s x1 ∧ x1.pc = base + 4 ∧ x1.mem = x.mem ∧
+      (∀ r, r ≠ rax → x1.regs r = x.regs r) := by
+  rw [uf_eq L hn] at hat
+  obtain ⟨h1, h2, h3, h4, _⟩ := hat
+  let xa := x.mov rax (L.dEnd - BitVec.ofNat 64 (8 * n))
+  have hst1 : step code x = .next xa := by rw [xstep_of_fetch (by rw [hpc]; exact h1)]; rfl
+  have hxa_pc : xa.pc = base + 1 := by simp [xa, M.mov, M.setReg, M.adv, hpc]
+  let xb : M := { xa.adv with flags := some (subFlags (xa.regs r15) (xa.regs rax)) }
+  have hst2 : step code xa = .next xb := by
+    rw [xstep_of_fetch (m := xa) (by rw [hxa_pc]; exact h2)]; rfl
+  have hxb_pc : xb.pc = base + 2 := by simp [xb, M.adv, hxa_pc]
+  have hr15 : xa.regs r15 = x.regs r15 := by simp [xa, M.mov, M.setReg, M.adv]
+  have hflags : xb.flags = some (subFlags (x.regs r15) (L.dEnd - BitVec.ofNat 64 (8 * n))) := by
+    simp [xb, hr15, xa, M.mov, M.setReg, M.adv]
+  have hholds : Cc.be.holds (subFlags (x.regs r15) (L.dEnd - BitVec.ofNat 64 (8 * n))) = true := by
+    have := uf_flags hg hs hL hn hn3
+    simpa [hk] using this
+  have hsteps := guard_pass (code := code) (pc := base + 2) (m := xb) (c := .be) (t := .stackUnderflow)
+    (f := subFlags (x.regs r15) (L.dEnd - BitVec.ofNat 64 (8 * n)))
+    (by simpa [XAt] using And.intro h3 h4) hxb_pc hflags hholds
+  refine ⟨{ xb with pc := base + 2 + 2 }, ((XSteps.single hst1).trans (XSteps.single hst2)).trans
+    (by simpa using hsteps), ?_, by simp, by simp [xb, xa, M.adv, M.mov, M.setReg], ?_⟩
+  · refine hs.congr (by simp [xb, xa, M.adv, M.mov, M.setReg]) ?_ ?_ ?_ ?_ ?_ ?_ <;>
+      simp [xb, xa, M.adv, M.mov, M.setReg]
+  · intro r hr; simp [xb, xa, M.adv, M.mov, M.setReg, hr]
+
+/-- Too few operands: the guard exits with `stackUnderflow`. -/
+theorem uf_trap {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+    {L : Layout} {base n : Nat} (hg : Geom c) (hs : Rel0 c p s x) (hL : L.dEnd = ofN c.dEnd)
+    (hn : 0 < n) (hn3 : n ≤ 3) (hk : s.dstack.length < n) (hpc : x.pc = base)
+    (hat : XAt code base (uf L n base)) : XExec code x (.trapped .stackUnderflow) := by
+  rw [uf_eq L hn] at hat
+  obtain ⟨h1, h2, h3, h4, _⟩ := hat
+  let xa := x.mov rax (L.dEnd - BitVec.ofNat 64 (8 * n))
+  have hst1 : step code x = .next xa := by rw [xstep_of_fetch (by rw [hpc]; exact h1)]; rfl
+  have hxa_pc : xa.pc = base + 1 := by simp [xa, M.mov, M.setReg, M.adv, hpc]
+  let xb : M := { xa.adv with flags := some (subFlags (xa.regs r15) (xa.regs rax)) }
+  have hst2 : step code xa = .next xb := by
+    rw [xstep_of_fetch (m := xa) (by rw [hxa_pc]; exact h2)]; rfl
+  have hxb_pc : xb.pc = base + 2 := by simp [xb, M.adv, hxa_pc]
+  have hr15 : xa.regs r15 = x.regs r15 := by simp [xa, M.mov, M.setReg, M.adv]
+  have hflags : xb.flags = some (subFlags (x.regs r15) (L.dEnd - BitVec.ofNat 64 (8 * n))) := by
+    simp [xb, hr15, xa, M.mov, M.setReg, M.adv]
+  have hholds : Cc.be.holds (subFlags (x.regs r15) (L.dEnd - BitVec.ofNat 64 (8 * n))) = false := by
+    have := uf_flags hg hs hL hn hn3
+    have h : ¬ n ≤ s.dstack.length := by omega
+    simpa [h] using this
+  exact (XExec.of_steps ((XSteps.single hst1).trans (XSteps.single hst2))
+    (guard_trap (code := code) (pc := base + 2) (m := xb) (c := .be) (t := .stackUnderflow)
+      (f := subFlags (x.regs r15) (L.dEnd - BitVec.ofNat 64 (8 * n)))
+      (by simpa [XAt] using And.intro h3 h4) hxb_pc hflags hholds))
+
+section Ovf
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)} {L : Layout}
+  {base : Nat}
+
+theorem ovf_jcc_pass {pc : Nat} {m : M} {f : Flags} (h1 : code[pc]? = some (.jcc .ae (pc + 2)))
+    (hpc : m.pc = pc) (hf : m.flags = some f) (hc : Cc.ae.holds f = true) :
+    XSteps code m { m with pc := pc + 2 } := by
+  apply XSteps.single
+  rw [xstep_of_fetch (by rw [hpc]; exact h1)]
+  simp [exec, hf, hc]
+
+theorem ovf_jcc_trap {pc : Nat} {m : M} {f : Flags} (h1 : code[pc]? = some (.jcc .ae (pc + 2)))
+    (h2 : code[pc + 1]? = some .exitOvf) (hpc : m.pc = pc) (hf : m.flags = some f)
+    (hc : Cc.ae.holds f = false) : XExec code m .overflow := by
+  refine .next (m1 := { m with pc := pc + 1 }) ?_ (.ovf ?_)
+  · rw [xstep_of_fetch (by rw [hpc]; exact h1)]
+    simp [exec, hf, hc, hpc, M.adv]
+  · rw [xstep_of_fetch (m := { m with pc := pc + 1 }) h2]
+    simp [exec]
+
+/-- The data-stack guard's comparison, in terms of stack depth. -/
+theorem ovfD_flags (hg : Geom c) (hs : Rel0 c p s x) (hLd : L.dLim = ofN (c.dBase + 8)) :
+    Cc.ae.holds (subFlags (x.regs Reg.r15) L.dLim) =
+      decide (c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) := by
+  have hcap := hs.capD
+  have hdE := hg.dEnd_lt
+  have h8 := hg.dBase_8
+  rw [holds_ae, hs.r15, hLd, ule_ofN (by omega) (by omega)]
+  by_cases h : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+  · simp [h]; omega
+  · simp [h]; omega
+
+theorem ovfD_run (hpc : x.pc = base) (hat : XAt code base (ovfD L base)) :
+    ∃ xb : M, XSteps code x xb ∧ xb.pc = base + 2 ∧
+      xb.flags = some (subFlags (x.regs Reg.r15) L.dLim) ∧ xb.mem = x.mem ∧
+      (∀ r, r ≠ rax → xb.regs r = x.regs r) ∧
+      code[base + 2]? = some (.jcc .ae (base + 2 + 2)) ∧ code[base + 2 + 1]? = some .exitOvf := by
+  obtain ⟨h1, h2, h3, h4, _⟩ := hat
+  let xa := x.mov rax L.dLim
+  have hst1 : step code x = .next xa := by rw [xstep_of_fetch (by rw [hpc]; exact h1)]; rfl
+  have hxa_pc : xa.pc = base + 1 := by simp [xa, M.mov, M.setReg, M.adv, hpc]
+  let xb : M := { xa.adv with flags := some (subFlags (xa.regs r15) (xa.regs rax)) }
+  have hst2 : step code xa = .next xb := by
+    rw [xstep_of_fetch (m := xa) (by rw [hxa_pc]; exact h2)]; rfl
+  refine ⟨xb, (XSteps.single hst1).trans (XSteps.single hst2), by simp [xb, M.adv, hxa_pc],
+    by simp [xb, xa, M.mov, M.setReg, M.adv], by simp [xb, xa, M.adv, M.mov, M.setReg], ?_,
+    fetch_cast h3 (by omega), fetch_cast h4 (by omega)⟩
+  intro r hr; simp [xb, xa, M.adv, M.mov, M.setReg, hr]
+
+/-- Room for one more data word: the guard falls through to `base + 4`. -/
+theorem ovfD_pass (hg : Geom c) (hs : Rel0 c p s x) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) (hpc : x.pc = base)
+    (hat : XAt code base (ovfD L base)) :
+    ∃ x1, XSteps code x x1 ∧ Rel0 c p s x1 ∧ x1.pc = base + 4 ∧ x1.mem = x.mem ∧
+      (∀ r, r ≠ rax → x1.regs r = x.regs r) := by
+  obtain ⟨xb, hsb, hpcb, hfb, hmb, hrb, hj, _⟩ := ovfD_run hpc hat
+  have hholds : Cc.ae.holds (subFlags (x.regs Reg.r15) L.dLim) = true := by
+    rw [ovfD_flags hg hs hLd]; simpa using hfit
+  refine ⟨{ xb with pc := base + 2 + 2 }, hsb.trans (ovf_jcc_pass hj hpcb hfb hholds), ?_, rfl, hmb, hrb⟩
+  refine hs.congr hmb ?_ ?_ ?_ ?_ ?_ ?_ <;> exact hrb _ (by decide)
+
+/-- Data stack full: the guard exits with `overflow`. -/
+theorem ovfD_trap (hg : Geom c) (hs : Rel0 c p s x) (hLd : L.dLim = ofN (c.dBase + 8))
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) (hpc : x.pc = base)
+    (hat : XAt code base (ovfD L base)) : XExec code x .overflow := by
+  obtain ⟨xb, hsb, hpcb, hfb, _, _, hj, he⟩ := ovfD_run hpc hat
+  have hholds : Cc.ae.holds (subFlags (x.regs Reg.r15) L.dLim) = false := by
+    rw [ovfD_flags hg hs hLd]; simpa using h
+  exact XExec.of_steps hsb (ovf_jcc_trap hj he hpcb hfb hholds)
+
+/-- The return-stack guard's comparison, in terms of return-stack depth. -/
+theorem ovfR_flags (hg : Geom c) (hs : Rel0 c p s x) (hLr : L.rGap = ofN (8 * c.rcap - 16)) :
+    Cc.ae.holds (subFlags (x.regs Reg.rsp) (x.regs Reg.r12 - L.rGap)) =
+      decide (s.rstack.length + 2 ≤ c.rcap) := by
+  have hcapR := hs.capR
+  have hrc := hg.rcap_le
+  have hsp := hg.sp0_lt
+  have hge := hg.rcap_ge
+  rw [holds_ae, hs.rsp, hs.r12, hLr, ofN_sub (by omega), ule_ofN (by omega) (by omega)]
+  by_cases h : s.rstack.length + 2 ≤ c.rcap
+  · simp [h]; omega
+  · simp [h]; omega
+
+theorem ovfR_run (hpc : x.pc = base) (hat : XAt code base (ovfR L base)) :
+    ∃ xd : M, XSteps code x xd ∧ xd.pc = base + 4 ∧
+      xd.flags = some (subFlags (x.regs Reg.rsp) (x.regs Reg.r12 - L.rGap)) ∧ xd.mem = x.mem ∧
+      (∀ r, r ≠ rax → r ≠ rcx → xd.regs r = x.regs r) ∧
+      code[base + 4]? = some (.jcc .ae (base + 4 + 2)) ∧ code[base + 4 + 1]? = some .exitOvf := by
+  obtain ⟨h1, h2, h3, h4, h5, h6, _⟩ := hat
+  let xa := x.mov rax (x.regs r12)
+  have hst1 : step code x = .next xa := by rw [xstep_of_fetch (by rw [hpc]; exact h1)]; rfl
+  have hxa_pc : xa.pc = base + 1 := by simp [xa, M.mov, M.setReg, M.adv, hpc]
+  let xb := xa.mov rcx L.rGap
+  have hst2 : step code xa = .next xb := by
+    rw [xstep_of_fetch (m := xa) (by rw [hxa_pc]; exact h2)]; rfl
+  have hxb_pc : xb.pc = base + 2 := by simp [xb, M.mov, M.setReg, M.adv, hxa_pc]
+  let xc := xb.arith rax (xb.regs rax - xb.regs rcx)
+  have hst3 : step code xb = .next xc := by
+    rw [xstep_of_fetch (m := xb) (by rw [hxb_pc]; exact h3)]; rfl
+  have hxc_pc : xc.pc = base + 3 := by simp [xc, M.arith, M.setReg, hxb_pc]
+  let xd : M := { xc.adv with flags := some (subFlags (xc.regs rsp) (xc.regs rax)) }
+  have hst4 : step code xc = .next xd := by
+    rw [xstep_of_fetch (m := xc) (by rw [hxc_pc]; exact h4)]; rfl
+  refine ⟨xd, (((XSteps.single hst1).trans (XSteps.single hst2)).trans (XSteps.single hst3)).trans
+    (XSteps.single hst4), by simp [xd, M.adv, hxc_pc], ?_, ?_, ?_,
+    fetch_cast h5 (by omega), fetch_cast h6 (by omega)⟩
+  · simp [xd, xc, xb, xa, M.arith, M.mov, M.setReg, M.adv]
+  · simp [xd, xc, xb, xa, M.arith, M.mov, M.setReg, M.adv]
+  · intro r hr hr'; simp [xd, xc, xb, xa, M.arith, M.mov, M.setReg, M.adv, hr, hr']
+
+/-- Room for one more return address: the guard falls through to `base + 6`. -/
+theorem ovfR_pass (hg : Geom c) (hs : Rel0 c p s x) (hLr : L.rGap = ofN (8 * c.rcap - 16))
+    (hfit : s.rstack.length + 2 ≤ c.rcap) (hpc : x.pc = base) (hat : XAt code base (ovfR L base)) :
+    ∃ x1, XSteps code x x1 ∧ Rel0 c p s x1 ∧ x1.pc = base + 6 ∧ x1.mem = x.mem := by
+  obtain ⟨xd, hsd, hpcd, hfd, hmd, hrd, hj, _⟩ := ovfR_run hpc hat
+  have hholds : Cc.ae.holds (subFlags (x.regs Reg.rsp) (x.regs Reg.r12 - L.rGap)) = true := by
+    rw [ovfR_flags hg hs hLr]; simpa using hfit
+  refine ⟨{ xd with pc := base + 4 + 2 }, hsd.trans (ovf_jcc_pass hj hpcd hfd hholds), ?_, rfl, hmd⟩
+  refine hs.congr hmd ?_ ?_ ?_ ?_ ?_ ?_ <;> exact hrd _ (by decide) (by decide)
+
+/-- Return stack full: the guard exits with `overflow`. -/
+theorem ovfR_trap (hg : Geom c) (hs : Rel0 c p s x) (hLr : L.rGap = ofN (8 * c.rcap - 16))
+    (h : ¬ s.rstack.length + 2 ≤ c.rcap) (hpc : x.pc = base) (hat : XAt code base (ovfR L base)) :
+    XExec code x .overflow := by
+  obtain ⟨xd, hsd, hpcd, hfd, _, _, hj, he⟩ := ovfR_run hpc hat
+  have hholds : Cc.ae.holds (subFlags (x.regs Reg.rsp) (x.regs Reg.r12 - L.rGap)) = false := by
+    rw [ovfR_flags hg hs hLr]; simpa using h
+  exact XExec.of_steps hsd (ovf_jcc_trap hj he hpcd hfd hholds)
+
+end Ovf
+
+end X86
+end WordDialect

backend/x86_64/X86/Init.lean

@@ -0,0 +1,135 @@
+import X86.Correct
+import X86.Emit
+
+/-!
+# X86.Init
+
+The state the emitted binary starts the lowered code in, and the end-to-end theorem from it.
+
+The runtime prologue (`Emit.prologue`) is five instructions:
+
+    mov r12, rsp ; lea r13, [rip + irmem] ; lea r14, [rip + regfile] ; movabs r15, dEnd ;
+    movabs rbp, aEnd
+
+`prologueCode` is the same sequence in the model, with each `lea` as a `movImm` of the address the
+linker resolves `irmem` / `regfile` to (that `lea` computes this address is the trusted reading of
+the instruction). Its effect is proved (`prologue_run`), not assumed.
+
+What the operating system's loader provides at `_start` cannot be derived inside the model, so it
+is stated once, explicitly, as `Loader.Holds`:
+* `rsp` is the entry stack pointer `sp0`;
+* the zero-filled `.bss` register file reads as zeros, and `.data` holds the IR memory image word by
+  word (the `.quad` directives `Emit.epilogue` prints);
+* the data stack (`.dstack`, placed at `dBase` by the linker), the auxiliary stack (`.astack`,
+  placed at `aBase`), register file, IR memory and the `rcap` return-stack entries below `sp0` are
+  addressable;
+* the placement is disjoint and in range (`Geom`).
+
+`binary_correct`: under those loader facts, after the prologue the lowered code reaches the IR
+outcome from `State.init` on the memory image, or exits with `overflow`. Its other hypotheses are
+only about the program.
+-/
+
+namespace WordDialect
+namespace X86
+namespace Emit
+
+open Reg
+
+/-- Addresses fixed by the linker and the loader for one run. -/
+structure Loader where
+  mb : Nat      -- link address of `irmem` (`.data`)
+  rf : Nat      -- link address of `regfile` (`.bss`)
+  sp0 : Nat     -- `rsp` at `_start`
+
+/-- The runtime placement for one run, as a `Cfg`. -/
+def cfgOf (r : Runtime) (ld : Loader) : Cfg :=
+  { dEnd := r.dEnd, dBase := r.dBase, rf := ld.rf, nregs := r.nregs, mb := ld.mb,
+    M := r.memImage.length, sp0 := ld.sp0, rcap := r.rcap, aEnd := r.aEnd, aBase := r.aBase }
+
+/-- What the loader guarantees about the machine state `x0` at `_start`. -/
+structure Loader.Holds (r : Runtime) (ld : Loader) (x0 : M) : Prop where
+  rsp : x0.regs Reg.rsp = ofN ld.sp0
+  geom : Geom (cfgOf r ld)
+  valid : RegionsValid (cfgOf r ld) x0.mem.valid
+  regfile : ∀ k, k < r.nregs → x0.mem.read? (ofN (ld.rf + 8 * k)) = some 0#64
+  image : ∀ a, a < r.memImage.length →
+    x0.mem.read? (ofN (ld.mb + 8 * a)) = some (BitVec.ofNat 64 (r.memImage.getD a 0))
+
+/-- The prologue in the model. -/
+def prologueCode (r : Runtime) (ld : Loader) : List (Instr Nat) :=
+  [.movRR r12 rsp, .movImm r13 (ofN ld.mb), .movImm r14 (ofN ld.rf), .movImm r15 (ofN r.dEnd),
+   .movImm rbp (ofN r.aEnd)]
+
+/-- The machine state after the prologue, entering the lowered code at index 0. -/
+def entryState (r : Runtime) (ld : Loader) (x0 : M) : M :=
+  { (((((x0.mov r12 (x0.regs rsp)).mov r13 (ofN ld.mb)).mov r14 (ofN ld.rf)).mov r15 (ofN r.dEnd)).mov
+      rbp (ofN r.aEnd)) with pc := 0 }
+
+theorem prologue_run (r : Runtime) (ld : Loader) (x0 : M) :
+    xseq (prologueCode r ld) x0 =
+      .next { entryState r ld x0 with pc := x0.pc + 5 } := by
+  simp [prologueCode, entryState, xseq, exec, M.mov, M.setReg, M.adv]
+
+theorem isize_le (i : WordDialect.Instr 64) : isize i ≤ 17 := by
+  cases i <;> simp [isize, ufSize]
+
+theorem sum_isize_le : ∀ l : Prog 64, (l.map isize).sum ≤ 17 * l.length
+  | [] => by simp
+  | i :: l => by
+    have := isize_le i
+    have := sum_isize_le l
+    simp only [List.map_cons, List.sum_cons, List.length_cons]
+    omega
+
+/-- Code indices are bounded by the program length. -/
+theorem offs_lt {p : Prog 64} (h : 17 * p.length < 2 ^ 64) (k : Nat) : offs p k < 2 ^ 64 := by
+  have h1 := sum_isize_le (p.take k)
+  have h2 : (p.take k).length ≤ p.length := by rw [List.length_take]; omega
+  simp only [offs]
+  omega
+
+theorem layout_ok (r : Runtime) (ld : Loader) :
+    r.layout.dEnd = ofN (cfgOf r ld).dEnd ∧ r.layout.memSize = (cfgOf r ld).M ∧
+      r.layout.dLim = ofN ((cfgOf r ld).dBase + 8) ∧ r.layout.rGap = ofN (8 * (cfgOf r ld).rcap - 16) ∧
+      r.layout.aEnd = ofN (cfgOf r ld).aEnd ∧ r.layout.aLim = ofN ((cfgOf r ld).aBase + 8) :=
+  ⟨rfl, rfl, rfl, rfl, rfl, rfl⟩
+
+/-- After the prologue, the machine is related to the IR's initial state. -/
+theorem entry_rel (r : Runtime) (ld : Loader) {x0 : M} (h : ld.Holds r x0) (p : Prog 64) :
+    Rel (cfgOf r ld) p (State.init (Memory.ofImage r.memImage)) (entryState r ld x0) := by
+  have hg := h.geom
+  refine init_rel hg rfl rfl rfl (by have := hg.rcap_ge; simp [cfgOf] at this ⊢; omega)
+    ?_ ?_ ?_ ?_ ?_ ?_ ?_ ?_ (fun _ => rfl) ?_ (by simp [entryState, offs, State.init])
+  · simp [entryState, M.mov, M.setReg, M.adv, cfgOf]
+  · simp [entryState, M.mov, M.setReg, M.adv, cfgOf]
+  · simp [entryState, M.mov, M.setReg, M.adv, cfgOf]
+  · simp [entryState, M.mov, M.setReg, M.adv, cfgOf, h.rsp]
+  · simp [entryState, M.mov, M.setReg, M.adv, cfgOf, h.rsp]
+  · simp [entryState, M.mov, M.setReg, M.adv, cfgOf]
+  · intro k hk
+    simpa [entryState, M.mov, M.setReg, M.adv, State.init, cfgOf] using h.regfile k hk
+  · intro a ha
+    have ha' : a < r.memImage.length := ha
+    have hlt : a < 2 ^ 64 := by
+      have := hg.mb_lt; simp [cfgOf] at this ha ⊢; omega
+    simpa [entryState, M.mov, M.setReg, M.adv, State.init, Memory.ofImage, cfgOf, ofN,
+      BitVec.toNat_ofNat, Nat.mod_eq_of_lt hlt] using h.image a ha'
+  · simpa [entryState, M.mov, M.setReg, M.adv] using h.valid
+
+/-- End to end: under the loader facts, the prologue runs, and from there the lowered code reaches
+the outcome the IR reaches from `State.init` on the memory image, or exits with `overflow` (exit
+code 6). Program hypotheses: code indices fit in 64 bits and register indices are in range. -/
+theorem binary_correct (r : Runtime) (ld : Loader) (p : Prog 64) (hlen : 17 * p.length < 2 ^ 64)
+    (hreg : RegsOk (cfgOf r ld) p) {o : Outcome 64}
+    (hx : Exec p (State.init (Memory.ofImage r.memImage)) o) {x0 : M} (h : ld.Holds r x0) :
+    xseq (prologueCode r ld) x0 = .next { entryState r ld x0 with pc := x0.pc + 5 } ∧
+      (Final (cfgOf r ld) p (lowerProg r.layout p) (entryState r ld x0) o ∨
+        XExec (lowerProg r.layout p) (entryState r ld x0) .overflow) := by
+  obtain ⟨hL, hMs, hLd, hLr, hLa, hLal⟩ := layout_ok r ld
+  exact ⟨prologue_run r ld x0,
+    lowerProg_correct_or_overflow h.geom hL hMs hLd hLr hLa hLal (offs_lt hlen) hreg hx (entry_rel r ld h p)⟩
+
+end Emit
+end X86
+end WordDialect

backend/x86_64/X86/Isa.lean

@@ -0,0 +1,227 @@
+import WordDialect
+
+/-!
+# X86.Isa
+
+A Lean model of the x86-64 instruction subset the backend emits.
+
+Scope and trust boundary:
+* 64-bit registers only; the registers the lowering uses.
+* Memory is the shared `Memory 64` model, indexed by byte address. The lowering only performs
+  8-byte-aligned accesses; no unaligned or sub-word access is modelled.
+* Flags `ZF SF CF OF` are modelled concretely. Instructions that architecturally leave the
+  flags undefined (arithmetic, shifts, `imul`, divide) set them to `none`; reading `none`
+  faults. So a proof that the machine never faults shows the lowering never relies on
+  undefined flags.
+* Faults (invalid memory access, divide error, undefined flags, jumping outside the code)
+  are a distinct outcome, never a silent state.
+* `exitHalt` / `exitTrap t` stand for the runtime stubs that dump state and `exit`; they are
+  terminal here. `exitOvf` is the stub for a stack-overflow guard (`exit(6)`); it has no IR
+  counterpart, since IR stacks are unbounded.
+
+That the model matches the hardware is the stated assumption of this backend.
+-/
+
+namespace WordDialect
+namespace X86
+
+abbrev W := BitVec 64
+
+inductive Reg where
+  | rax | rcx | rdx | rbx | rsp | rbp | r12 | r13 | r14 | r15
+  deriving DecidableEq, Repr
+
+/-- Condition codes (the subset used). -/
+inductive Cc where
+  | e | ne | b | be | a | ae | l | le | g | ge
+  deriving DecidableEq, Repr
+
+structure Flags where
+  zf : Bool
+  sf : Bool
+  cf : Bool
+  ovf : Bool
+
+def Cc.holds : Cc → Flags → Bool
+  | .e,  f => f.zf
+  | .ne, f => !f.zf
+  | .b,  f => f.cf
+  | .be, f => f.cf || f.zf
+  | .a,  f => !f.cf && !f.zf
+  | .ae, f => !f.cf
+  | .l,  f => f.sf != f.ovf
+  | .le, f => f.zf || (f.sf != f.ovf)
+  | .g,  f => !f.zf && (f.sf == f.ovf)
+  | .ge, f => f.sf == f.ovf
+
+/-- Flags of `a - b`, as set by `cmp a, b`. -/
+def subFlags (a b : W) : Flags :=
+  let d := a - b
+  { zf := d == 0#64, sf := d.msb, cf := a.ult b,
+    ovf := (a.msb != b.msb) && (a.msb != d.msb) }
+
+/-- Flags of a logical result (`test`, `and`, `or`, `xor`): `CF = OF = 0`. -/
+def logicFlags (r : W) : Flags := { zf := r == 0#64, sf := r.msb, cf := false, ovf := false }
+
+/-- Instructions, generic in the type of jump targets (`Nat` code indices for the model,
+`String` labels for assembly text). -/
+inductive Instr (L : Type) where
+  | movImm (d : Reg) (v : W)
+  | movRR (d s : Reg)
+  | load (d b : Reg) (disp : Int)
+  | store (b : Reg) (disp : Int) (s : Reg)
+  | loadIdx (d b i : Reg)
+  | storeIdx (b i s : Reg)
+  | add (d s : Reg)
+  | sub (d s : Reg)
+  | imul (d s : Reg)
+  | and (d s : Reg)
+  | or (d s : Reg)
+  | xor (d s : Reg)
+  | addImm (d : Reg) (v : Int)
+  | not (d : Reg)
+  | neg (d : Reg)
+  | cmp (a b : Reg)
+  | cmpImm (a : Reg) (v : Int)
+  | test (a b : Reg)
+  | shlCl (d : Reg)
+  | shrCl (d : Reg)
+  | rolCl (d : Reg)
+  | rorCl (d : Reg)
+  | cmov (c : Cc) (d s : Reg)
+  | div (s : Reg)
+  | idiv (s : Reg)
+  | cqo
+  | jmp (t : L)
+  | jcc (c : Cc) (t : L)
+  | call (t : L)
+  | ret
+  | exitHalt
+  | exitTrap (t : Trap)
+  | exitOvf
+
+structure M where
+  regs  : Reg → W
+  flags : Option Flags
+  mem   : Memory 64
+  pc    : Nat
+
+inductive Out where
+  | next    (m : M)
+  | halted  (m : M)
+  | trapped (t : Trap)
+  | overflow
+  | fault
+
+def M.setReg (m : M) (r : Reg) (v : W) : M :=
+  { m with regs := fun x => if x = r then v else m.regs x }
+
+def M.adv (m : M) : M := { m with pc := m.pc + 1 }
+
+/-- Write a register and advance; flags become undefined. -/
+def M.arith (m : M) (r : Reg) (v : W) : M :=
+  { (m.setReg r v) with flags := none, pc := m.pc + 1 }
+
+/-- Write a register and advance; flags untouched (as `mov`). -/
+def M.mov (m : M) (r : Reg) (v : W) : M := (m.setReg r v).adv
+
+def M.ea (m : M) (b : Reg) (disp : Int) : W := m.regs b + BitVec.ofInt 64 disp
+
+def M.eaIdx (m : M) (b i : Reg) : W := m.regs b + m.regs i * 8#64
+
+/-- Semantics of one instruction. -/
+def exec (i : Instr Nat) (m : M) : Out :=
+  match i with
+  | .movImm d v => .next (m.mov d v)
+  | .movRR d s => .next (m.mov d (m.regs s))
+  | .load d b disp =>
+      match m.mem.read? (m.ea b disp) with
+      | some v => .next (m.mov d v)
+      | none => .fault
+  | .store b disp s =>
+      match m.mem.write? (m.ea b disp) (m.regs s) with
+      | some mem' => .next { m.adv with mem := mem' }
+      | none => .fault
+  | .loadIdx d b i =>
+      match m.mem.read? (m.eaIdx b i) with
+      | some v => .next (m.mov d v)
+      | none => .fault
+  | .storeIdx b i s =>
+      match m.mem.write? (m.eaIdx b i) (m.regs s) with
+      | some mem' => .next { m.adv with mem := mem' }
+      | none => .fault
+  | .add d s => .next (m.arith d (m.regs d + m.regs s))
+  | .sub d s => .next (m.arith d (m.regs d - m.regs s))
+  | .imul d s => .next (m.arith d (m.regs d * m.regs s))
+  | .and d s => .next (m.arith d (m.regs d &&& m.regs s))
+  | .or d s => .next (m.arith d (m.regs d ||| m.regs s))
+  | .xor d s => .next (m.arith d (m.regs d ^^^ m.regs s))
+  | .addImm d v => .next (m.arith d (m.regs d + BitVec.ofInt 64 v))
+  | .not d => .next (m.mov d (~~~m.regs d))
+  | .neg d => .next (m.arith d (0#64 - m.regs d))
+  | .cmp a b => .next { m.adv with flags := some (subFlags (m.regs a) (m.regs b)) }
+  | .cmpImm a v => .next { m.adv with flags := some (subFlags (m.regs a) (BitVec.ofInt 64 v)) }
+  | .test a b => .next { m.adv with flags := some (logicFlags (m.regs a &&& m.regs b)) }
+  | .shlCl d => .next (m.arith d (m.regs d <<< ((m.regs .rcx).toNat % 64)))
+  | .shrCl d => .next (m.arith d (m.regs d >>> ((m.regs .rcx).toNat % 64)))
+  | .rolCl d => .next (m.arith d ((m.regs d).rotateLeft ((m.regs .rcx).toNat % 64)))
+  | .rorCl d => .next (m.arith d ((m.regs d).rotateRight ((m.regs .rcx).toNat % 64)))
+  | .cmov c d s =>
+      match m.flags with
+      | none => .fault
+      | some f => .next (if c.holds f then m.mov d (m.regs s) else m.adv)
+  | .div s =>
+      let dv := m.regs s
+      if dv = 0#64 then .fault
+      else
+        let dividend : Nat := (m.regs .rdx).toNat * 2 ^ 64 + (m.regs .rax).toNat
+        let q := dividend / dv.toNat
+        if q < 2 ^ 64 then
+          .next { ((m.setReg .rax (BitVec.ofNat 64 q)).setReg .rdx
+            (BitVec.ofNat 64 (dividend % dv.toNat))) with flags := none, pc := m.pc + 1 }
+        else .fault
+  | .idiv s =>
+      let dv := m.regs s
+      if dv = 0#64 then .fault
+      else
+        let dividend : Int := (m.regs .rdx).toInt * 2 ^ 64 + ((m.regs .rax).toNat : Int)
+        let q := Int.tdiv dividend dv.toInt
+        if -(2 ^ 63 : Int) ≤ q ∧ q < 2 ^ 63 then
+          .next { ((m.setReg .rax (BitVec.ofInt 64 q)).setReg .rdx
+            (BitVec.ofInt 64 (Int.tmod dividend dv.toInt))) with flags := none, pc := m.pc + 1 }
+        else .fault
+  | .cqo => .next (m.mov .rdx (if (m.regs .rax).msb then BitVec.allOnes 64 else 0#64))
+  | .jmp t => .next { m with pc := t }
+  | .jcc c t =>
+      match m.flags with
+      | none => .fault
+      | some f => .next (if c.holds f then { m with pc := t } else m.adv)
+  | .call t =>
+      let sp := m.regs .rsp - 8#64
+      match m.mem.write? sp (BitVec.ofNat 64 (m.pc + 1)) with
+      | some mem' => .next { (m.setReg .rsp sp) with mem := mem', pc := t }
+      | none => .fault
+  | .ret =>
+      match m.mem.read? (m.regs .rsp) with
+      | some v => .next { (m.setReg .rsp (m.regs .rsp + 8#64)) with pc := v.toNat }
+      | none => .fault
+  | .exitHalt => .halted m
+  | .exitTrap t => .trapped t
+  | .exitOvf => .overflow
+
+/-- One machine step over a code array; leaving the code is a fault. -/
+def step (code : List (Instr Nat)) (m : M) : Out :=
+  match code[m.pc]? with
+  | none => .fault
+  | some i => exec i m
+
+/-- Fuel-bounded run. `none`: out of fuel. -/
+def run (code : List (Instr Nat)) : Nat → M → Option Out
+  | 0, _ => none
+  | fuel + 1, m =>
+    match step code m with
+    | .next m' => run code fuel m'
+    | o => some o
+
+end X86
+end WordDialect

backend/x86_64/X86/Lower.lean

@@ -0,0 +1,198 @@
+import X86.Isa
+
+/-!
+# X86.Lower
+
+Lowering of Universal Word IR (64-bit words) to x86-64.
+
+Runtime conventions (all fixed here; the assembly runtime in `X86.Emit` establishes them):
+
+| register | role |
+|----------|------|
+| `r15`    | data-stack pointer; the stack grows downward, `[r15]` is the top, empty = `dEnd` |
+| `r14`    | base of the virtual register file, cell `r` at `r14 + 8r` |
+| `r13`    | base of IR memory; IR word address `a` is at `r13 + 8a` |
+| `r12`    | value of `rsp` at entry; the native stack is the IR return stack |
+| `rbp`    | auxiliary-stack pointer; grows downward, `[rbp]` is the top, empty = `aEnd` |
+| `rax rcx rdx rbx` | scratch |
+
+IR `call`/`ret` are native `call`/`ret`. IR memory is valid exactly on `[0, memSize)`; every
+`load`/`store` is bounds-checked, so an invalid address traps as in the IR semantics. Operand
+counts are checked against `dEnd` before every instruction that pops, so stack underflow
+traps as in the IR semantics. Every instruction that grows the data stack first checks
+`r15 ≥ dBase + 8`, and `call` first checks `rsp ≥ r12 - (8 rcap - 16)`; on overflow the code
+exits 6 (`exitOvf`). `tor` likewise checks `rbp ≥ aBase + 8` before growing the auxiliary
+stack, and `fromr`/`rfetch` trap `returnUnderflow` when `rbp = aEnd` (empty). IR stacks are unbounded, so this exit has no IR counterpart: it reports that
+the run exceeded the target's stack capacity.
+
+Every instruction's code has a size that depends only on the instruction, so jump targets are
+absolute code indices computed from prefix sums (`offs`). One definition serves both the
+model and the assembly text.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+structure Layout where
+  dEnd : W
+  memSize : Nat
+  dLim : W        -- `dBase + 8`: the data stack has room for one more word iff `r15 ≥ dLim`
+  rGap : W        -- `8 rcap - 16`: a call has room iff `rsp ≥ r12 - rGap`
+  aEnd : W        -- empty auxiliary stack: `rbp = aEnd`
+  aLim : W        -- `aBase + 8`: the auxiliary stack has room for one more word iff `rbp ≥ aLim`
+
+/-- Stack-underflow guard for `k` operands. -/
+def uf (L : Layout) (k base : Nat) : List (Instr Nat) :=
+  if k = 0 then []
+  else [.movImm rax (L.dEnd - BitVec.ofNat 64 (8 * k)), .cmp r15 rax, .jcc .be (base + 4),
+        .exitTrap .stackUnderflow]
+
+def ufSize (k : Nat) : Nat := if k = 0 then 0 else 4
+
+/-- Data-stack overflow guard: exit 6 unless one more word fits. -/
+def ovfD (L : Layout) (base : Nat) : List (Instr Nat) :=
+  [.movImm rax L.dLim, .cmp r15 rax, .jcc .ae (base + 4), .exitOvf]
+
+/-- Return-stack overflow guard: exit 6 unless a call has room on the native stack. -/
+def ovfR (L : Layout) (base : Nat) : List (Instr Nat) :=
+  [.movRR rax r12, .movImm rcx L.rGap, .sub rax rcx, .cmp rsp rax, .jcc .ae (base + 6), .exitOvf]
+
+/-- Auxiliary-stack overflow guard: exit 6 unless one more word fits. -/
+def ovfA (L : Layout) (base : Nat) : List (Instr Nat) :=
+  [.movImm rax L.aLim, .cmp rbp rax, .jcc .ae (base + 4), .exitOvf]
+
+/-- Empty-auxiliary-stack guard: trap `returnUnderflow` when `rbp = aEnd`. -/
+def emptyA (L : Layout) (base : Nat) : List (Instr Nat) :=
+  [.movImm rax L.aEnd, .cmp rbp rax, .jcc .ne (base + 4), .exitTrap .returnUnderflow]
+
+def ccOf : WordDialect.Cond → Cc
+  | .eq => .e | .ne => .ne | .ult => .b | .ule => .be | .ugt => .a | .uge => .ae
+  | .slt => .l | .sle => .le | .sgt => .g | .sge => .ge
+
+/-- Code size of one IR instruction. -/
+def isize : WordDialect.Instr 64 → Nat
+  | .word _ | .ptr _ => 7
+  | .load => ufSize 1 + 7
+  | .store => ufSize 2 + 8
+  | .add | .sub | .mul | .and | .or | .xor => ufSize 2 + 5
+  | .div => ufSize 2 + 9
+  | .sdiv => ufSize 2 + 13
+  | .not => ufSize 1 + 3
+  | .shl | .shr => ufSize 2 + 8
+  | .rotl | .rotr => ufSize 2 + 5
+  | .cmp _ => ufSize 2 + 8
+  | .select => ufSize 3 + 7
+  | .jmp _ => 1
+  | .branch _ => ufSize 1 + 4
+  | .call _ => 7
+  | .ret => 4
+  | .push _ => 7
+  | .pop _ => ufSize 1 + 3
+  | .dup => ufSize 1 + 7
+  | .drop => ufSize 1 + 1
+  | .swap => ufSize 2 + 4
+  | .over => ufSize 2 + 7
+  | .rot => ufSize 3 + 6
+  | .tor => ufSize 1 + 8
+  | .fromr => 12
+  | .rfetch => 11
+  | .halt => 1
+
+/-- Code for one IR instruction placed at x86 index `base`; `off t` is the x86 index of IR
+instruction `t` (clamped to the bad-pc stub for out-of-range targets). -/
+def lowerInstr (L : Layout) (base : Nat) (off : Nat → Nat) : WordDialect.Instr 64 → List (Instr Nat)
+  | .word w => ovfD L base ++ [.movImm rax w, .addImm r15 (-8), .store r15 0 rax]
+  | .ptr p => ovfD L base ++ [.movImm rax p.toWord, .addImm r15 (-8), .store r15 0 rax]
+  | .load =>
+    let b0 := base + ufSize 1
+    uf L 1 base ++
+      [.load rax r15 0, .movImm rcx (BitVec.ofNat 64 L.memSize), .cmp rax rcx,
+       .jcc .b (b0 + 5), .exitTrap .badAddress, .loadIdx rax r13 rax, .store r15 0 rax]
+  | .store =>
+    let b0 := base + ufSize 2
+    uf L 2 base ++
+      [.load rax r15 0, .load rcx r15 8, .movImm rdx (BitVec.ofNat 64 L.memSize), .cmp rax rdx,
+       .jcc .b (b0 + 6), .exitTrap .badAddress, .storeIdx r13 rax rcx, .addImm r15 16]
+  | .add => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .add rax rcx, .store r15 8 rax, .addImm r15 8]
+  | .sub => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .sub rax rcx, .store r15 8 rax, .addImm r15 8]
+  | .mul => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .imul rax rcx, .store r15 8 rax, .addImm r15 8]
+  | .and => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .and rax rcx, .store r15 8 rax, .addImm r15 8]
+  | .or => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .or rax rcx, .store r15 8 rax, .addImm r15 8]
+  | .xor => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .xor rax rcx, .store r15 8 rax, .addImm r15 8]
+  | .div =>
+    let b0 := base + ufSize 2
+    uf L 2 base ++
+      [.load rcx r15 0, .load rax r15 8, .test rcx rcx, .jcc .ne (b0 + 5),
+       .exitTrap .divideByZero, .movImm rdx 0#64, .div rcx, .store r15 8 rax, .addImm r15 8]
+  | .sdiv =>
+    let b0 := base + ufSize 2
+    uf L 2 base ++
+      [.load rcx r15 0, .load rax r15 8, .test rcx rcx, .jcc .ne (b0 + 5),
+       .exitTrap .divideByZero, .cmpImm rcx (-1), .jcc .ne (b0 + 9), .neg rax, .jmp (b0 + 11),
+       .cqo, .idiv rcx, .store r15 8 rax, .addImm r15 8]
+  | .not => uf L 1 base ++ [.load rax r15 0, .not rax, .store r15 0 rax]
+  | .shl =>
+    uf L 2 base ++
+      [.load rcx r15 0, .load rax r15 8, .movImm rdx 0#64, .shlCl rax, .cmpImm rcx 64,
+       .cmov .ae rax rdx, .store r15 8 rax, .addImm r15 8]
+  | .shr =>
+    uf L 2 base ++
+      [.load rcx r15 0, .load rax r15 8, .movImm rdx 0#64, .shrCl rax, .cmpImm rcx 64,
+       .cmov .ae rax rdx, .store r15 8 rax, .addImm r15 8]
+  | .rotl => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .rolCl rax, .store r15 8 rax, .addImm r15 8]
+  | .rotr => uf L 2 base ++ [.load rcx r15 0, .load rax r15 8, .rorCl rax, .store r15 8 rax, .addImm r15 8]
+  | .cmp c =>
+    uf L 2 base ++
+      [.load rcx r15 0, .load rax r15 8, .movImm rdx 0#64, .movImm rbx 1#64, .cmp rax rcx,
+       .cmov (ccOf c) rdx rbx, .store r15 8 rdx, .addImm r15 8]
+  | .select =>
+    uf L 3 base ++
+      [.load rcx r15 0, .load rax r15 8, .load rbx r15 16, .test rcx rcx, .cmov .ne rax rbx,
+       .store r15 16 rax, .addImm r15 16]
+  | .jmp t => [.jmp (off t)]
+  | .branch t => uf L 1 base ++ [.load rax r15 0, .addImm r15 8, .test rax rax, .jcc .ne (off t)]
+  | .call t => ovfR L base ++ [.call (off t)]
+  | .ret =>
+    [.cmp rsp r12, .jcc .ne (base + 3), .exitTrap .returnUnderflow, .ret]
+  | .push r => ovfD L base ++ [.load rax r14 (8 * (r : Int)), .addImm r15 (-8), .store r15 0 rax]
+  | .pop r => uf L 1 base ++ [.load rax r15 0, .addImm r15 8, .store r14 (8 * (r : Int)) rax]
+  | .dup =>
+    uf L 1 base ++ ovfD L (base + ufSize 1) ++ [.load rax r15 0, .addImm r15 (-8), .store r15 0 rax]
+  | .drop => uf L 1 base ++ [.addImm r15 8]
+  | .swap => uf L 2 base ++ [.load rax r15 0, .load rcx r15 8, .store r15 0 rcx, .store r15 8 rax]
+  | .over =>
+    uf L 2 base ++ ovfD L (base + ufSize 2) ++ [.load rax r15 8, .addImm r15 (-8), .store r15 0 rax]
+  | .rot =>
+    uf L 3 base ++
+      [.load rax r15 0, .load rcx r15 8, .load rdx r15 16, .store r15 0 rdx, .store r15 8 rax,
+       .store r15 16 rcx]
+  | .tor =>
+    uf L 1 base ++ ovfA L (base + ufSize 1) ++
+      [.load rax r15 0, .addImm r15 8, .addImm rbp (-8), .store rbp 0 rax]
+  | .fromr =>
+    emptyA L base ++ ovfD L (base + 4) ++
+      [.load rax rbp 0, .addImm rbp 8, .addImm r15 (-8), .store r15 0 rax]
+  | .rfetch =>
+    emptyA L base ++ ovfD L (base + 4) ++ [.load rax rbp 0, .addImm r15 (-8), .store r15 0 rax]
+  | .halt => [.exitHalt]
+
+theorem lowerInstr_length (L : Layout) (base : Nat) (off : Nat → Nat) (i : WordDialect.Instr 64) :
+    (lowerInstr L base off i).length = isize i := by
+  cases i <;> simp [lowerInstr, isize, uf, ufSize, ovfD, ovfR, ovfA, emptyA] <;> (try split) <;> simp
+
+/-- Prefix sums of instruction sizes: `offs p k` is the x86 index of IR instruction `k`.
+For `k` past the end it is the index of the final bad-pc stub. -/
+def offs (p : Prog 64) (k : Nat) : Nat := ((p.take k).map isize).sum
+
+def lowerGo (L : Layout) (off : Nat → Nat) : Nat → List (WordDialect.Instr 64) → List (Instr Nat)
+  | _, [] => [.exitTrap .badPc]
+  | b, i :: is => lowerInstr L b off i ++ lowerGo L off (b + isize i) is
+
+/-- The whole program; the last instruction is the bad-pc stub, so jumping past the end of the
+IR program traps `badPc` exactly as the IR semantics does. -/
+def lowerProg (L : Layout) (p : Prog 64) : List (Instr Nat) := lowerGo L (offs p) 0 p
+
+end X86
+end WordDialect

backend/x86_64/X86/Micro.lean

@@ -0,0 +1,280 @@
+import X86.Seq
+
+/-!
+# X86.Micro
+
+Micro-lemmas: how single x86 instructions (and the push pair) act on a machine state related to
+an IR state by `Rel0`. Every IR-instruction simulation proof is a chain of these.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+theorem ea_nat (a j : Nat) : ofN a + BitVec.ofInt 64 (8 * (j : Int)) = ofN (a + 8 * j) := by
+  rw [show (8 * (j : Int)) = ((8 * j : Nat) : Int) by omega, BitVec.ofInt_natCast]
+  exact ofN_add _ _
+
+/-- Load stack slot `j` into a scratch register. -/
+theorem ld_stack {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hs : Rel0 c p s x)
+    {j : Nat} {v : W} (hj : s.dstack[j]? = some v) (rd : Reg) {disp : Int}
+    (hd : disp = 8 * (j : Int)) :
+    exec (.load rd Reg.r15 disp) x = .next (x.mov rd v) := by
+  have hread := hs.stack j v hj
+  simp only [exec, M.ea, hs.r15, hd, ea_nat]
+  rw [hread]
+
+theorem mov_rel0 {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hs : Rel0 c p s x) (rd : Reg)
+    (hr : rd ≠ r15 ∧ rd ≠ r14 ∧ rd ≠ r13 ∧ rd ≠ r12 ∧ rd ≠ rsp ∧ rd ≠ rbp) (v : W) :
+    Rel0 c p s (x.mov rd v) := by
+  obtain ⟨h1, h2, h3, h4, h5, h6⟩ := hr
+  refine hs.congr rfl ?_ ?_ ?_ ?_ ?_ ?_ <;>
+    simp [M.mov, M.setReg, M.adv, Ne.symm h1, Ne.symm h2, Ne.symm h3, Ne.symm h4, Ne.symm h5,
+      Ne.symm h6]
+
+theorem arith_rel0 {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hs : Rel0 c p s x) (rd : Reg)
+    (hr : rd ≠ r15 ∧ rd ≠ r14 ∧ rd ≠ r13 ∧ rd ≠ r12 ∧ rd ≠ rsp ∧ rd ≠ rbp) (v : W) :
+    Rel0 c p s (x.arith rd v) := by
+  obtain ⟨h1, h2, h3, h4, h5, h6⟩ := hr
+  refine hs.congr rfl ?_ ?_ ?_ ?_ ?_ ?_ <;>
+    simp [M.arith, M.setReg, Ne.symm h1, Ne.symm h2, Ne.symm h3, Ne.symm h4, Ne.symm h5,
+      Ne.symm h6]
+
+theorem flags_rel0 {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hs : Rel0 c p s x)
+    (f : Option Flags) (q : Nat) : Rel0 c p s { x with flags := f, pc := q } :=
+  hs.congr rfl rfl rfl rfl rfl rfl rfl
+
+/-- Store a register into stack slot `j`: the relation holds for the stack with that slot replaced. -/
+theorem st_stack {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hg : Geom c) (hs : Rel0 c p s x)
+    {j : Nat} (hj : j < s.dstack.length) (rs : Reg) {disp : Int} (hd : disp = 8 * (j : Int)) :
+    ∃ mem', exec (.store Reg.r15 disp rs) x = .next { x.adv with mem := mem' } ∧
+      Rel0 c p { s with dstack := s.dstack.set j (x.regs rs) } { x.adv with mem := mem' } := by
+  have hcap := hs.capD
+  have hcapR := hs.capR
+  have hdE := hg.dEnd_lt
+  have hA : c.dBase ≤ c.dEnd - 8 * s.dstack.length + 8 * j := by omega
+  have hA' : c.dEnd - 8 * s.dstack.length + 8 * j < c.dEnd := by omega
+  have hvalid := hs.xvalid.1 _ hA hA'
+  obtain ⟨mem', hw⟩ : ∃ m', x.mem.write? (ofN (c.dEnd - 8 * s.dstack.length + 8 * j)) (x.regs rs)
+      = some m' := by simp [Memory.write?, hvalid]
+  refine ⟨mem', ?_, ?_⟩
+  · simp only [exec, M.ea, hs.r15, hd, ea_nat]; rw [hw]
+  · have hlen : (s.dstack.set j (x.regs rs)).length = s.dstack.length := by simp
+    have hAlt : c.dEnd - 8 * s.dstack.length + 8 * j < 2 ^ 64 := by omega
+    refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_, rbp := ?_, stack := ?_,
+             regs := ?_, mem := ?_, rs := ?_, aux := ?_, irvalid := hs.irvalid, xvalid := ?_,
+             capD := ?_, capR := hs.capR, capA := hs.capA }
+    · simpa [M.adv, hlen] using hs.r15
+    · simpa [M.adv] using hs.r14
+    · simpa [M.adv] using hs.r13
+    · simpa [M.adv] using hs.r12
+    · simpa [M.adv] using hs.rsp
+    · simpa [M.adv] using hs.rbp
+    · intro i w hi
+      simp only [hlen]
+      have hik : i < s.dstack.length := by
+        have := (List.getElem?_eq_some_iff.mp hi).1; simpa using this
+      by_cases hij : i = j
+      · subst hij
+        have h1 : (s.dstack.set i (x.regs rs))[i]? = some (x.regs rs) := by simp [hj]
+        rw [h1] at hi
+        cases hi
+        rw [read_write_nat hw hAlt hAlt]; simp
+      · rw [List.getElem?_set_ne (Ne.symm hij)] at hi
+        have hne : c.dEnd - 8 * s.dstack.length + 8 * j ≠ c.dEnd - 8 * s.dstack.length + 8 * i := by
+          omega
+        rw [read_write_nat hw hAlt (by omega)]
+        simp only [hne, ite_false]
+        exact hs.stack i w hi
+    · intro r hr
+      have hrf := hg.rf_lt
+      have hne : c.dEnd - 8 * s.dstack.length + 8 * j ≠ c.rf + 8 * r := by
+        rcases hg.dS_F with h | h <;> omega
+      rw [read_write_nat hw hAlt (by omega)]
+      simp only [hne, ite_false]
+      exact hs.regs r hr
+    · intro a ha
+      have hmb := hg.mb_lt
+      have hne : c.dEnd - 8 * s.dstack.length + 8 * j ≠ c.mb + 8 * a := by
+        rcases hg.dS_M with h | h <;> omega
+      rw [read_write_nat hw hAlt (by omega)]
+      simp only [hne, ite_false]
+      exact hs.mem a ha
+    · intro i a hi
+      have hsp := hg.sp0_lt
+      have hrc := hg.rcap_le
+      have hi' : i < s.rstack.length := by
+        by_cases hh : i < s.rstack.length
+        · exact hh
+        · have hn : s.rstack.length ≤ i := by omega
+          rw [List.getElem?_eq_none hn] at hi; simp at hi
+      have hne : c.dEnd - 8 * s.dstack.length + 8 * j ≠
+          c.sp0 - 8 * s.rstack.length + 8 * i := by
+        rcases hg.dS_K with h | h <;> omega
+      have hkr : 8 * s.rstack.length ≤ c.sp0 := by omega
+      have hB : c.sp0 - 8 * s.rstack.length + 8 * i < 2 ^ 64 := by omega
+      rw [read_write_nat hw hAlt hB]
+      simp only [hne, ite_false]
+      exact hs.rs i a hi
+    · exact aux_write_other hg.aEnd_lt hs.capA hs.aux hw hAlt (by rcases hg.dS_A with h | h <;> omega)
+    · have := Memory.write?_valid hw
+      show RegionsValid c mem'.valid
+      rw [this]; exact hs.xvalid
+    · simpa [hlen] using hcap
+
+/-- Adjust the stack pointer upward by `n` words (popping `n` elements). -/
+theorem adj_drop {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hg : Geom c) (hs : Rel0 c p s x)
+    {n : Nat} (hn : n ≤ s.dstack.length) {δ : Int} (hd : δ = 8 * (n : Int)) :
+    exec (.addImm Reg.r15 δ) x = .next (x.arith Reg.r15 (ofN (c.dEnd - 8 * (s.dstack.length - n)))) ∧
+      Rel0 c p { s with dstack := s.dstack.drop n }
+        (x.arith Reg.r15 (ofN (c.dEnd - 8 * (s.dstack.length - n)))) := by
+  have hcap := hs.capD
+  have hval : x.regs Reg.r15 + BitVec.ofInt 64 δ = ofN (c.dEnd - 8 * (s.dstack.length - n)) := by
+    rw [hs.r15, hd, ea_nat]; congr 1; omega
+  refine ⟨by simp only [exec, hval], ?_⟩
+  refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_, rbp := ?_, stack := ?_,
+           regs := ?_, mem := ?_, rs := ?_, aux := hs.aux, irvalid := hs.irvalid, xvalid := ?_,
+           capD := ?_, capR := hs.capR, capA := hs.capA }
+  · simp [M.arith, M.setReg]
+  · simpa [M.arith, M.setReg] using hs.r14
+  · simpa [M.arith, M.setReg] using hs.r13
+  · simpa [M.arith, M.setReg] using hs.r12
+  · simpa [M.arith, M.setReg] using hs.rsp
+  · simpa [M.arith, M.setReg] using hs.rbp
+  · intro i w hi
+    simp only [List.length_drop]
+    rw [List.getElem?_drop] at hi
+    have := hs.stack (n + i) w hi
+    have e : c.dEnd - 8 * (s.dstack.length - n) + 8 * i =
+        c.dEnd - 8 * s.dstack.length + 8 * (n + i) := by omega
+    simp only [M.arith, M.setReg]
+    rw [e]; exact this
+  · exact hs.regs
+  · exact hs.mem
+  · exact hs.rs
+  · exact hs.xvalid
+  · simp only [List.length_drop]; omega
+
+theorem ea_neg8 {a : Nat} (h : 8 ≤ a) : ofN a + BitVec.ofInt 64 (-8) = ofN (a - 8) := by
+  have : BitVec.ofInt 64 (-8) = -(ofN 8) := by
+    rw [show (-8 : Int) = -((8 : Nat) : Int) by omega, BitVec.ofInt_neg, BitVec.ofInt_natCast]
+    rfl
+  rw [this, ← BitVec.sub_eq_add_neg, ofN_sub h]
+
+/-- A write inside the data-stack region leaves the register-file, IR-memory and return-stack
+views unchanged. -/
+theorem others_write {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (hg : Geom c)
+    (hs : Rel0 c p s x) {A : Nat} {v : W} {mem' : Memory 64} (hA1 : c.dBase ≤ A) (hA2 : A < c.dEnd)
+    (hw : x.mem.write? (ofN A) v = some mem') :
+    RegRel c mem' s.regs ∧ MemRel c mem' s.mem ∧ RsRel c p mem' s.rstack ∧
+      AuxRel c mem' s.astack := by
+  have hdE := hg.dEnd_lt
+  have hAlt : A < 2 ^ 64 := by omega
+  have hcapR := hs.capR
+  have hrc := hg.rcap_le
+  have hsp := hg.sp0_lt
+  refine ⟨?_, ?_, ?_, aux_write_other hg.aEnd_lt hs.capA hs.aux hw hAlt
+    (by rcases hg.dS_A with h | h <;> omega)⟩
+  · intro r hr
+    have hrf := hg.rf_lt
+    have hne : A ≠ c.rf + 8 * r := by rcases hg.dS_F with h | h <;> omega
+    rw [read_write_nat hw hAlt (by omega)]
+    simp only [hne, ite_false]
+    exact hs.regs r hr
+  · intro a ha
+    have hmb := hg.mb_lt
+    have hne : A ≠ c.mb + 8 * a := by rcases hg.dS_M with h | h <;> omega
+    rw [read_write_nat hw hAlt (by omega)]
+    simp only [hne, ite_false]
+    exact hs.mem a ha
+  · intro i a hi
+    have hi' : i < s.rstack.length := by
+      by_cases hh : i < s.rstack.length
+      · exact hh
+      · have hn : s.rstack.length ≤ i := by omega
+        rw [List.getElem?_eq_none hn] at hi; simp at hi
+    have hkr : 8 * s.rstack.length ≤ c.sp0 := by omega
+    have hB : c.sp0 - 8 * s.rstack.length + 8 * i < 2 ^ 64 := by omega
+    have hne : A ≠ c.sp0 - 8 * s.rstack.length + 8 * i := by rcases hg.dS_K with h | h <;> omega
+    rw [read_write_nat hw hAlt hB]
+    simp only [hne, ite_false]
+    exact hs.rs i a hi
+
+/-- `addImm r15, -8; store [r15], rs` pushes the value of `rs`. -/
+theorem push_pair {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+    (hg : Geom c) (hs : Rel0 c p s x) (rs : Reg) (hrs : rs ≠ r15)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd)
+    (hat : XAt code x.pc [.addImm Reg.r15 (-8), .store Reg.r15 0 rs]) :
+    ∃ x', XSteps code x x' ∧
+      Rel0 c p { s with dstack := x.regs rs :: s.dstack } x' ∧ x'.pc = x.pc + 2 ∧
+      (∀ r, r ≠ r15 → x'.regs r = x.regs r) := by
+  obtain ⟨h1, h2, _⟩ := hat
+  have hcap := hs.capD
+  have hdE := hg.dEnd_lt
+  have hA1 : c.dBase ≤ c.dEnd - 8 * (s.dstack.length + 1) := by omega
+  have hA2 : c.dEnd - 8 * (s.dstack.length + 1) < c.dEnd := by omega
+  have hAlt : c.dEnd - 8 * (s.dstack.length + 1) < 2 ^ 64 := by omega
+  -- step 1: r15 := r15 - 8
+  have hval : x.regs Reg.r15 + BitVec.ofInt 64 (-8) = ofN (c.dEnd - 8 * (s.dstack.length + 1)) := by
+    rw [hs.r15, ea_neg8 (by omega)]
+    congr 1
+  have e1 : exec (.addImm Reg.r15 (-8)) x = .next (x.arith Reg.r15 (ofN (c.dEnd - 8 * (s.dstack.length + 1)))) := by
+    simp only [exec, hval]
+  obtain ⟨x1, hx1⟩ : ∃ x1, x1 = x.arith Reg.r15 (ofN (c.dEnd - 8 * (s.dstack.length + 1))) := ⟨_, rfl⟩
+  rw [← hx1] at e1
+  have hst1 : step code x = .next x1 := by rw [xstep_of_fetch h1, e1]
+  -- step 2: store [r15], rs
+  have hr15 : x1.regs Reg.r15 = ofN (c.dEnd - 8 * (s.dstack.length + 1)) := by simp [hx1, M.arith, M.setReg]
+  have hrsv : x1.regs rs = x.regs rs := by simp [hx1, M.arith, M.setReg, hrs]
+  have hvalid := hs.xvalid.1 _ hA1 hA2
+  obtain ⟨mem', hw⟩ : ∃ m', x.mem.write? (ofN (c.dEnd - 8 * (s.dstack.length + 1))) (x.regs rs) = some m' := by
+    simp [Memory.write?, hvalid]
+  have e2 : exec (.store Reg.r15 0 rs) x1 = .next { x1.adv with mem := mem' } := by
+    have : x1.mem = x.mem := by simp [hx1, M.arith, M.setReg]
+    simp only [exec, M.ea, hr15, hrsv, this]
+    have h0 : ofN (c.dEnd - 8 * (s.dstack.length + 1)) + BitVec.ofInt 64 0 = ofN (c.dEnd - 8 * (s.dstack.length + 1)) := by
+      simp
+    rw [h0, hw]
+  have hpc1 : x1.pc = x.pc + 1 := by simp [hx1, M.arith, M.setReg]
+  have hst2 : step code x1 = .next { x1.adv with mem := mem' } := by
+    rw [xstep_of_fetch (m := x1) (by rw [hpc1]; exact h2), e2]
+  refine ⟨{ x1.adv with mem := mem' }, (XSteps.single hst1).trans (XSteps.single hst2), ?_, ?_, ?_⟩
+  · have ⟨hrg, hmm, hrr, hax⟩ := others_write hg hs hA1 hA2 hw
+    have hlen : (x.regs rs :: s.dstack).length = s.dstack.length + 1 := by simp
+    refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_, rbp := ?_, stack := ?_,
+             regs := hrg, mem := hmm, rs := hrr, aux := hax, irvalid := hs.irvalid, xvalid := ?_,
+             capD := ?_, capR := hs.capR, capA := hs.capA }
+    · simpa [hlen, M.adv, hx1, M.arith, M.setReg] using rfl
+    · simpa [M.adv, hx1, M.arith, M.setReg] using hs.r14
+    · simpa [M.adv, hx1, M.arith, M.setReg] using hs.r13
+    · simpa [M.adv, hx1, M.arith, M.setReg] using hs.r12
+    · simpa [M.adv, hx1, M.arith, M.setReg] using hs.rsp
+    · simpa [M.adv, hx1, M.arith, M.setReg] using hs.rbp
+    · intro i w hi
+      simp only [hlen]
+      cases i with
+      | zero =>
+        simp at hi; subst hi
+        rw [show c.dEnd - 8 * (s.dstack.length + 1) + 8 * 0 = c.dEnd - 8 * (s.dstack.length + 1) by omega,
+          read_write_nat hw hAlt hAlt]; simp
+      | succ i =>
+        simp only [List.getElem?_cons_succ] at hi
+        have hik : i < s.dstack.length := by
+          have := (List.getElem?_eq_some_iff.mp hi).1; simpa using this
+        have hB : c.dEnd - 8 * (s.dstack.length + 1) + 8 * (i + 1) < 2 ^ 64 := by omega
+        have hne : c.dEnd - 8 * (s.dstack.length + 1) ≠ c.dEnd - 8 * (s.dstack.length + 1) + 8 * (i + 1) := by omega
+        rw [read_write_nat hw hAlt hB]
+        simp only [hne, ite_false]
+        have e : c.dEnd - 8 * (s.dstack.length + 1) + 8 * (i + 1) = c.dEnd - 8 * s.dstack.length + 8 * i := by omega
+        rw [e]; exact hs.stack i w hi
+    · have := Memory.write?_valid hw
+      show RegionsValid c mem'.valid
+      rw [this]; exact hs.xvalid
+    · simpa [hlen] using hfit
+  · simp [M.adv, hpc1]
+  · intro r hr
+    simp [M.adv, hx1, M.arith, M.setReg, hr]
+
+end X86
+end WordDialect

backend/x86_64/X86/Rel.lean

@@ -0,0 +1,170 @@
+import X86.Run
+
+/-!
+# X86.Rel
+
+The state relation between the IR machine and the x86 model, and the memory-frame lemmas used
+by the per-instruction simulation proofs.
+
+Memory regions (byte intervals, all below `2^64`, pairwise disjoint):
+* data stack  `[dBase, dEnd)`, top at `dEnd - 8k` when `k` words are on the stack;
+* register file `[rf, rf + 8 nregs)`;
+* IR memory `[mb, mb + 8 M)`;
+* return stack: the native stack below `sp0`;
+* auxiliary stack `[aBase, aEnd)`, top at `aEnd - 8k` when `k` words are on it (pointer `rbp`).
+
+Everything is stated with `BitVec.ofNat 64` of natural-number addresses, so address arithmetic
+is ordinary `omega` reasoning.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+structure Cfg where
+  dEnd : Nat
+  dBase : Nat
+  rf : Nat
+  nregs : Nat
+  mb : Nat
+  M : Nat
+  sp0 : Nat
+  rcap : Nat
+  aEnd : Nat
+  aBase : Nat
+
+structure Geom (c : Cfg) : Prop where
+  dEnd_lt : c.dEnd < 2 ^ 64
+  rf_lt : c.rf + 8 * c.nregs ≤ 2 ^ 64
+  mb_lt : c.mb + 8 * c.M ≤ 2 ^ 64
+  sp0_lt : c.sp0 < 2 ^ 64
+  dBase_le : c.dBase ≤ c.dEnd
+  dEnd_ge : 24 ≤ c.dEnd
+  rcap_le : 8 * c.rcap ≤ c.sp0
+  dBase_8 : c.dBase + 8 ≤ c.dEnd
+  rcap_ge : 2 ≤ c.rcap
+  dS_F : c.dEnd ≤ c.rf ∨ c.rf + 8 * c.nregs ≤ c.dBase
+  dS_M : c.dEnd ≤ c.mb ∨ c.mb + 8 * c.M ≤ c.dBase
+  dS_K : c.dEnd ≤ c.sp0 - 8 * c.rcap ∨ c.sp0 ≤ c.dBase
+  dF_M : c.rf + 8 * c.nregs ≤ c.mb ∨ c.mb + 8 * c.M ≤ c.rf
+  dF_K : c.rf + 8 * c.nregs ≤ c.sp0 - 8 * c.rcap ∨ c.sp0 ≤ c.rf
+  dM_K : c.mb + 8 * c.M ≤ c.sp0 - 8 * c.rcap ∨ c.sp0 ≤ c.mb
+  aEnd_lt : c.aEnd < 2 ^ 64
+  aBase_8 : c.aBase + 8 ≤ c.aEnd
+  dS_A : c.dEnd ≤ c.aBase ∨ c.aEnd ≤ c.dBase
+  dA_F : c.aEnd ≤ c.rf ∨ c.rf + 8 * c.nregs ≤ c.aBase
+  dA_M : c.aEnd ≤ c.mb ∨ c.mb + 8 * c.M ≤ c.aBase
+  dA_K : c.aEnd ≤ c.sp0 - 8 * c.rcap ∨ c.sp0 ≤ c.aBase
+
+def ofN (a : Nat) : W := BitVec.ofNat 64 a
+
+theorem ofN_inj {a b : Nat} (ha : a < 2 ^ 64) (hb : b < 2 ^ 64) (h : ofN a = ofN b) : a = b := by
+  have := congrArg BitVec.toNat h
+  simpa [ofN, BitVec.toNat_ofNat, Nat.mod_eq_of_lt ha, Nat.mod_eq_of_lt hb] using this
+
+theorem ofN_add (a b : Nat) : ofN a + ofN b = ofN (a + b) := (BitVec.ofNat_add a b).symm
+
+theorem ofN_sub {a b : Nat} (h : b ≤ a) : ofN a - ofN b = ofN (a - b) := by
+  apply BitVec.eq_of_toNat_eq
+  simp only [ofN, BitVec.toNat_sub, BitVec.toNat_ofNat]
+  have h1 : (a - b) % 2 ^ 64 = ((2 ^ 64 - b % 2 ^ 64) + a % 2 ^ 64) % 2 ^ 64 := by
+    omega
+  exact h1.symm
+
+/-- Reading after a write at a natural-number address. -/
+theorem read_write_nat {mem mem' : Memory 64} {A B : Nat} {v : W}
+    (hw : mem.write? (ofN A) v = some mem') (hA : A < 2 ^ 64) (hB : B < 2 ^ 64) :
+    mem'.read? (ofN B) = if A = B then some v else mem.read? (ofN B) := by
+  by_cases h : A = B
+  · subst h; simp [Memory.read_write_same hw]
+  · have hne : ofN B ≠ ofN A := by
+      intro e; exact h (ofN_inj hA hB e.symm)
+    rw [Memory.read_write_other hw hne]; simp [h]
+
+def StackRel (c : Cfg) (mem : Memory 64) (d : List W) : Prop :=
+  ∀ i v, d[i]? = some v → mem.read? (ofN (c.dEnd - 8 * d.length + 8 * i)) = some v
+
+def AuxRel (c : Cfg) (mem : Memory 64) (as : List W) : Prop :=
+  ∀ i v, as[i]? = some v → mem.read? (ofN (c.aEnd - 8 * as.length + 8 * i)) = some v
+
+def RegRel (c : Cfg) (mem : Memory 64) (regs : Nat → W) : Prop :=
+  ∀ r, r < c.nregs → mem.read? (ofN (c.rf + 8 * r)) = some (regs r)
+
+def MemRel (c : Cfg) (mem : Memory 64) (m : Memory 64) : Prop :=
+  ∀ a, a < c.M → mem.read? (ofN (c.mb + 8 * a)) = some (m.cell (ofN a))
+
+def RsRel (c : Cfg) (p : Prog 64) (mem : Memory 64) (rs : List Nat) : Prop :=
+  ∀ i a, rs[i]? = some a → mem.read? (ofN (c.sp0 - 8 * rs.length + 8 * i)) = some (ofN (offs p a))
+
+/-- The x86 memory's addressable set covers every region. -/
+def RegionsValid (c : Cfg) (v : W → Bool) : Prop :=
+  (∀ a, c.dBase ≤ a → a < c.dEnd → v (ofN a) = true) ∧
+  (∀ a, c.rf ≤ a → a < c.rf + 8 * c.nregs → v (ofN a) = true) ∧
+  (∀ a, c.mb ≤ a → a < c.mb + 8 * c.M → v (ofN a) = true) ∧
+  (∀ a, c.sp0 - 8 * c.rcap ≤ a → a < c.sp0 → v (ofN a) = true) ∧
+  (∀ a, c.aBase ≤ a → a < c.aEnd → v (ofN a) = true)
+
+structure Rel0 (c : Cfg) (p : Prog 64) (s : State 64) (x : M) : Prop where
+  r15 : x.regs r15 = ofN (c.dEnd - 8 * s.dstack.length)
+  r14 : x.regs r14 = ofN c.rf
+  r13 : x.regs r13 = ofN c.mb
+  r12 : x.regs r12 = ofN c.sp0
+  rsp : x.regs rsp = ofN (c.sp0 - 8 * s.rstack.length)
+  rbp : x.regs rbp = ofN (c.aEnd - 8 * s.astack.length)
+  stack : StackRel c x.mem s.dstack
+  regs : RegRel c x.mem s.regs
+  mem : MemRel c x.mem s.mem
+  rs : RsRel c p x.mem s.rstack
+  aux : AuxRel c x.mem s.astack
+  irvalid : ∀ a : Word 64, s.mem.valid a = decide (a.toNat < c.M)
+  xvalid : RegionsValid c x.mem.valid
+  capD : c.dBase + 8 * s.dstack.length ≤ c.dEnd
+  capR : s.rstack.length + 1 ≤ c.rcap
+  capA : c.aBase + 8 * s.astack.length ≤ c.aEnd
+
+/-- Full relation: everything in `Rel0`, and the x86 pc is the start of the IR pc's code. -/
+def Rel (c : Cfg) (p : Prog 64) (s : State 64) (x : M) : Prop :=
+  Rel0 c p s x ∧ x.pc = offs p s.pc
+
+/-- `Rel0` does not look at scratch registers, flags or the pc. -/
+theorem Rel0.congr {c : Cfg} {p : Prog 64} {s : State 64} {x x' : M} (h : Rel0 c p s x)
+    (hm : x'.mem = x.mem) (h15 : x'.regs Reg.r15 = x.regs Reg.r15) (h14 : x'.regs Reg.r14 = x.regs Reg.r14)
+    (h13 : x'.regs Reg.r13 = x.regs Reg.r13) (h12 : x'.regs Reg.r12 = x.regs Reg.r12)
+    (hsp : x'.regs Reg.rsp = x.regs Reg.rsp) (hbp : x'.regs Reg.rbp = x.regs Reg.rbp) :
+    Rel0 c p s x' where
+  r15 := by rw [h15]; exact h.r15
+  r14 := by rw [h14]; exact h.r14
+  r13 := by rw [h13]; exact h.r13
+  r12 := by rw [h12]; exact h.r12
+  rsp := by rw [hsp]; exact h.rsp
+  rbp := by rw [hbp]; exact h.rbp
+  stack := by rw [hm]; exact h.stack
+  regs := by rw [hm]; exact h.regs
+  mem := by rw [hm]; exact h.mem
+  rs := by rw [hm]; exact h.rs
+  aux := by rw [hm]; exact h.aux
+  irvalid := h.irvalid
+  xvalid := by rw [hm]; exact h.xvalid
+  capD := h.capD
+  capR := h.capR
+  capA := h.capA
+
+/-- A write outside the auxiliary-stack region leaves the auxiliary-stack view unchanged. -/
+theorem aux_write_other {c : Cfg} {mem mem' : Memory 64} {as : List W} (haE : c.aEnd < 2 ^ 64)
+    (hcap : c.aBase + 8 * as.length ≤ c.aEnd) (h : AuxRel c mem as) {A : Nat} {v : W}
+    (hw : mem.write? (ofN A) v = some mem') (hAlt : A < 2 ^ 64) (hA : A < c.aBase ∨ c.aEnd ≤ A) :
+    AuxRel c mem' as := by
+  intro i w hi
+  have hik : i < as.length := by
+    by_cases hh : i < as.length
+    · exact hh
+    · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+  have hB : c.aEnd - 8 * as.length + 8 * i < 2 ^ 64 := by omega
+  have hne : A ≠ c.aEnd - 8 * as.length + 8 * i := by omega
+  rw [read_write_nat hw hAlt hB]
+  simp only [hne, ite_false]
+  exact h i w hi
+
+end X86
+end WordDialect

backend/x86_64/X86/Run.lean

@@ -0,0 +1,143 @@
+import X86.Flags
+
+/-!
+# X86.Run
+
+Run relations for the x86 model (`XSteps`, `XExec`), code placement (`XAt`), and the lemma
+locating each IR instruction's lowered code inside `lowerProg`.
+-/
+
+namespace WordDialect
+namespace X86
+
+inductive XSteps (code : List (Instr Nat)) : M → M → Prop where
+  | refl {m : M} : XSteps code m m
+  | cons {m m1 m2 : M} : step code m = .next m1 → XSteps code m1 m2 → XSteps code m m2
+
+theorem XSteps.single {code : List (Instr Nat)} {m m1 : M} (h : step code m = .next m1) :
+    XSteps code m m1 := .cons h .refl
+
+theorem XSteps.trans {code : List (Instr Nat)} {m m1 m2 : M}
+    (h₁ : XSteps code m m1) (h₂ : XSteps code m1 m2) : XSteps code m m2 := by
+  induction h₁ with
+  | refl => exact h₂
+  | cons hs _ ih => exact .cons hs (ih h₂)
+
+/-- Running to a final outcome. -/
+inductive XExec (code : List (Instr Nat)) : M → Out → Prop where
+  | halt {m m' : M} : step code m = .halted m' → XExec code m (.halted m')
+  | trap {m : M} {t : Trap} : step code m = .trapped t → XExec code m (.trapped t)
+  | ovf {m : M} : step code m = .overflow → XExec code m .overflow
+  | next {m m1 : M} {o : Out} : step code m = .next m1 → XExec code m1 o → XExec code m o
+
+theorem XExec.of_steps {code : List (Instr Nat)} {m m1 : M} {o : Out}
+    (hs : XSteps code m m1) (he : XExec code m1 o) : XExec code m o := by
+  induction hs with
+  | refl => exact he
+  | cons h _ ih => exact .next h (ih he)
+
+/-- `seg` occurs in `code` starting at index `pc`. -/
+def XAt : List (Instr Nat) → Nat → List (Instr Nat) → Prop
+  | _, _, [] => True
+  | code, pc, i :: is => code[pc]? = some i ∧ XAt code (pc + 1) is
+
+theorem xat_append {code : List (Instr Nat)} {pc : Nat} {c₁ c₂ : List (Instr Nat)} :
+    XAt code pc (c₁ ++ c₂) ↔ XAt code pc c₁ ∧ XAt code (pc + c₁.length) c₂ := by
+  induction c₁ generalizing pc with
+  | nil => simp [XAt]
+  | cons i is ih =>
+    simp only [List.cons_append, XAt, ih, List.length_cons]
+    constructor
+    · rintro ⟨h, h1, h2⟩; refine ⟨⟨h, h1⟩, ?_⟩
+      have e : pc + 1 + is.length = pc + (is.length + 1) := by omega
+      rw [← e]; exact h2
+    · rintro ⟨⟨h, h1⟩, h2⟩; refine ⟨h, h1, ?_⟩
+      have e : pc + 1 + is.length = pc + (is.length + 1) := by omega
+      rw [e]; exact h2
+
+theorem fetch_cast {code : List (Instr Nat)} {i : Instr Nat} {a b : Nat}
+    (h : code[a]? = some i) (hab : a = b) : code[b]? = some i := hab ▸ h
+
+theorem xstep_of_fetch {code : List (Instr Nat)} {m : M} {i : Instr Nat}
+    (h : code[m.pc]? = some i) : step code m = exec i m := by
+  simp [step, h]
+
+/-- Prefix sums: `offs` of a cons. -/
+theorem offs_cons (i : WordDialect.Instr 64) (is : Prog 64) (k : Nat) :
+    offs (i :: is) (k + 1) = isize i + offs is k := by
+  simp [offs, List.take_succ_cons]
+
+theorem offs_zero (p : Prog 64) : offs p 0 = 0 := by simp [offs]
+
+theorem xat_embed (pre seg post : List (Instr Nat)) : XAt (pre ++ seg ++ post) pre.length seg := by
+  induction seg generalizing pre with
+  | nil => simp [XAt]
+  | cons i is ih =>
+    refine ⟨by simp, ?_⟩
+    have := ih (pre ++ [i])
+    simpa [List.append_assoc] using this
+
+/-- Where the lowered code of IR instruction `k` sits: at index `pre.length + offs ps k`. -/
+theorem lowerGo_at (L : Layout) (off : Nat → Nat) :
+    ∀ (ps : Prog 64) (pre : List (Instr Nat)) (k : Nat) (i : WordDialect.Instr 64),
+      ps[k]? = some i →
+      XAt (pre ++ lowerGo L off pre.length ps) (pre.length + offs ps k)
+        (lowerInstr L (pre.length + offs ps k) off i) := by
+  intro ps
+  induction ps with
+  | nil => intro pre k i h; simp at h
+  | cons j js ih =>
+    intro pre k i h
+    cases k with
+    | zero =>
+      simp at h; subst h
+      simp only [offs_zero, Nat.add_zero, lowerGo]
+      have := xat_embed pre (lowerInstr L pre.length off j) (lowerGo L off (pre.length + isize j) js)
+      simpa [List.append_assoc] using this
+    | succ k =>
+      simp only [List.getElem?_cons_succ] at h
+      have := ih (pre ++ lowerInstr L pre.length off j) k i h
+      have hl : (pre ++ lowerInstr L pre.length off j).length = pre.length + isize j := by
+        simp [lowerInstr_length]
+      rw [hl] at this
+      simp only [lowerGo, offs_cons]
+      have e : pre.length + (isize j + offs js k) = pre.length + isize j + offs js k := by omega
+      rw [e]
+      simpa [List.append_assoc] using this
+
+theorem lowerProg_at (L : Layout) (p : Prog 64) (k : Nat) (i : WordDialect.Instr 64)
+    (h : p[k]? = some i) :
+    XAt (lowerProg L p) (offs p k) (lowerInstr L (offs p k) (offs p) i) := by
+  have := lowerGo_at L (offs p) p [] k i h
+  simpa [lowerProg] using this
+
+/-- The final stub (bad-pc trap) sits at `offs p p.length`. -/
+theorem lowerGo_stub (L : Layout) (off : Nat → Nat) :
+    ∀ (ps : Prog 64) (pre : List (Instr Nat)),
+      XAt (pre ++ lowerGo L off pre.length ps) (pre.length + offs ps ps.length) [.exitTrap .badPc] := by
+  intro ps
+  induction ps with
+  | nil =>
+    intro pre
+    simp only [lowerGo, List.length_nil, offs, List.take_nil, List.map_nil, List.sum_nil,
+      Nat.add_zero]
+    have := xat_embed pre [.exitTrap .badPc] []
+    simpa using this
+  | cons j js ih =>
+    intro pre
+    have := ih (pre ++ lowerInstr L pre.length off j)
+    have hl : (pre ++ lowerInstr L pre.length off j).length = pre.length + isize j := by
+      simp [lowerInstr_length]
+    rw [hl] at this
+    simp only [lowerGo, List.length_cons, offs_cons]
+    have e : pre.length + (isize j + offs js js.length) = pre.length + isize j + offs js js.length := by omega
+    rw [e]
+    simpa [List.append_assoc] using this
+
+theorem lowerProg_stub (L : Layout) (p : Prog 64) :
+    XAt (lowerProg L p) (offs p p.length) [.exitTrap .badPc] := by
+  have := lowerGo_stub L (offs p) p []
+  simpa [lowerProg] using this
+
+end X86
+end WordDialect

backend/x86_64/X86/Seq.lean

@@ -0,0 +1,77 @@
+import X86.Rel
+
+/-!
+# X86.Seq
+
+Straight-line x86 execution (`xseq`) with its `XSteps` correctness, and the guard pattern
+`jcc c (pc+2); exitTrap t` used for every trap check in the lowering.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+def Instr.straightX : Instr Nat → Bool
+  | .jmp _ | .jcc _ _ | .call _ | .ret | .exitHalt | .exitTrap _ | .exitOvf => false
+  | _ => true
+
+def xseq : List (Instr Nat) → M → Out
+  | [], m => .next m
+  | i :: is, m =>
+    match exec i m with
+    | .next m' => xseq is m'
+    | o => o
+
+theorem exec_straightX_pc (i : Instr Nat) (m m' : M) (hi : i.straightX = true)
+    (h : exec i m = .next m') : m'.pc = m.pc + 1 := by
+  cases i <;> simp only [Instr.straightX] at hi <;> (try contradiction) <;>
+    simp only [exec] at h <;> (try split at h) <;> (try split at h) <;> (try split at h) <;>
+    (try split at h) <;> (try cases h) <;> simp [M.mov, M.arith, M.adv, M.setReg]
+
+theorem xseq_steps {code : List (Instr Nat)} :
+    ∀ {seg : List (Instr Nat)} {m m' : M},
+      (∀ i ∈ seg, i.straightX = true) → XAt code m.pc seg → xseq seg m = .next m' →
+      XSteps code m m' ∧ m'.pc = m.pc + seg.length := by
+  intro seg
+  induction seg with
+  | nil => intro m m' _ _ h; simp [xseq] at h; subst h; exact ⟨.refl, by simp⟩
+  | cons i is ih =>
+    intro m m' hs ha h
+    obtain ⟨hf, hrest⟩ := ha
+    have hi : i.straightX = true := hs i (by simp)
+    simp only [xseq] at h
+    cases hx : exec i m with
+    | next m1 =>
+      rw [hx] at h
+      have hpc := exec_straightX_pc i m m1 hi hx
+      have hst : step code m = .next m1 := by rw [xstep_of_fetch hf, hx]
+      obtain ⟨h1, h2⟩ := ih (fun j hj => hs j (by simp [hj])) (by rw [hpc]; exact hrest) h
+      exact ⟨.cons hst h1, by rw [h2, hpc]; simp; omega⟩
+    | halted _ => rw [hx] at h; simp at h
+    | trapped _ => rw [hx] at h; simp at h
+    | overflow => rw [hx] at h; simp at h
+    | fault => rw [hx] at h; simp at h
+
+theorem guard_pass {code : List (Instr Nat)} {pc : Nat} {m : M} {c : Cc} {t : Trap} {f : Flags}
+    (hat : XAt code pc [.jcc c (pc + 2), .exitTrap t]) (hpc : m.pc = pc)
+    (hf : m.flags = some f) (hc : c.holds f = true) :
+    XSteps code m { m with pc := pc + 2 } := by
+  obtain ⟨h1, _⟩ := hat
+  apply XSteps.single
+  rw [xstep_of_fetch (by rw [hpc]; exact h1)]
+  simp [exec, hf, hc, hpc]
+
+theorem guard_trap {code : List (Instr Nat)} {pc : Nat} {m : M} {c : Cc} {t : Trap} {f : Flags}
+    (hat : XAt code pc [.jcc c (pc + 2), .exitTrap t]) (hpc : m.pc = pc)
+    (hf : m.flags = some f) (hc : c.holds f = false) :
+    XExec code m (.trapped t) := by
+  obtain ⟨h1, h2, _⟩ := hat
+  refine .next (m1 := { m with pc := pc + 1 }) ?_ (.trap ?_)
+  · rw [xstep_of_fetch (by rw [hpc]; exact h1)]
+    simp [exec, hf, hc, hpc, M.adv]
+  · rw [xstep_of_fetch (m := { m with pc := pc + 1 }) h2]
+    simp [exec]
+
+end X86
+end WordDialect

backend/x86_64/X86/SimAux.lean

@@ -0,0 +1,448 @@
+import X86.SimCtl
+
+/-!
+# X86.SimAux
+
+The auxiliary data stack (`tor fromr rfetch`). It lives in its own region `[aBase, aEnd)`, grows
+downward from `aEnd`, and its pointer is `rbp`, related by `AuxRel`; native `call`/`ret` never
+touch it. This file has the step lemmas for `rbp` (load the top, push, drop), the two guards
+(`ovfA`: room for one more word, else exit 6; `emptyA`: nonempty, else trap `returnUnderflow`) and
+the simulation theorems for the three instructions, for every outcome.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+section Steps
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+
+/-- A write inside the auxiliary-stack region leaves the data-stack, register-file, IR-memory and
+return-stack views unchanged. -/
+theorem aux_region_write (hg : Geom c) (hs : Rel0 c p s x) {A : Nat} {v : W} {mem' : Memory 64}
+    (hA1 : c.aBase ≤ A) (hA2 : A < c.aEnd) (hw : x.mem.write? (ofN A) v = some mem') :
+    StackRel c mem' s.dstack ∧ RegRel c mem' s.regs ∧ MemRel c mem' s.mem ∧
+      RsRel c p mem' s.rstack := by
+  have haE := hg.aEnd_lt
+  have hAlt : A < 2 ^ 64 := by omega
+  have hcap := hs.capD
+  have hdE := hg.dEnd_lt
+  have hcapR := hs.capR
+  have hrc := hg.rcap_le
+  have hsp := hg.sp0_lt
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro i w hi
+    have hik : i < s.dstack.length := by
+      by_cases hh : i < s.dstack.length
+      · exact hh
+      · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+    have hB : c.dEnd - 8 * s.dstack.length + 8 * i < 2 ^ 64 := by omega
+    have hne : A ≠ c.dEnd - 8 * s.dstack.length + 8 * i := by
+      rcases hg.dS_A with h | h <;> omega
+    rw [read_write_nat hw hAlt hB]
+    simp only [hne, ite_false]
+    exact hs.stack i w hi
+  · intro r hr
+    have hrf := hg.rf_lt
+    have hne : A ≠ c.rf + 8 * r := by rcases hg.dA_F with h | h <;> omega
+    rw [read_write_nat hw hAlt (by omega)]
+    simp only [hne, ite_false]
+    exact hs.regs r hr
+  · intro a ha
+    have hmb := hg.mb_lt
+    have hne : A ≠ c.mb + 8 * a := by rcases hg.dA_M with h | h <;> omega
+    rw [read_write_nat hw hAlt (by omega)]
+    simp only [hne, ite_false]
+    exact hs.mem a ha
+  · intro i a hi
+    have hi' : i < s.rstack.length := by
+      by_cases hh : i < s.rstack.length
+      · exact hh
+      · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+    have hkr : 8 * s.rstack.length ≤ c.sp0 := by omega
+    have hB : c.sp0 - 8 * s.rstack.length + 8 * i < 2 ^ 64 := by omega
+    have hne : A ≠ c.sp0 - 8 * s.rstack.length + 8 * i := by
+      rcases hg.dA_K with h | h <;> omega
+    rw [read_write_nat hw hAlt hB]
+    simp only [hne, ite_false]
+    exact hs.rs i a hi
+
+/-- Load the auxiliary-stack top into a scratch register. -/
+theorem ld_aux_step (hs : Rel0 c p s x) {a : W} {as : List W} (hd : s.astack = a :: as) {rd : Reg}
+    (hrd : rd = rax ∨ rd = rcx ∨ rd = rdx ∨ rd = rbx)
+    (hf : code[x.pc]? = some (.load rd Reg.rbp 0)) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = x.pc + 1 ∧ x'.regs rd = a ∧
+      (∀ r, r ≠ rd → x'.regs r = x.regs r) ∧ x'.mem = x.mem := by
+  have hread := hs.aux 0 a (by simp [hd])
+  have e : exec (.load rd Reg.rbp 0) x = .next (x.mov rd a) := by
+    simp only [exec, M.ea, hs.rbp]
+    have h0 : ofN (c.aEnd - 8 * s.astack.length) + BitVec.ofInt 64 0 =
+        ofN (c.aEnd - 8 * s.astack.length + 8 * 0) := by simp
+    rw [h0, hread]
+  refine ⟨x.mov rd a, XSteps.single (by rw [xstep_of_fetch hf, e]),
+    mov_rel0 hs rd (scratch_ne rd hrd) a, ?_, ?_, ?_, ?_⟩
+  · simp [M.mov, M.setReg, M.adv]
+  · simp [M.mov, M.setReg, M.adv]
+  · intro r hr; simp [M.mov, M.setReg, M.adv, hr]
+  · simp [M.mov, M.setReg, M.adv]
+
+/-- `addImm rbp, 8` drops the auxiliary-stack top. -/
+theorem aux_drop (hs : Rel0 c p s x) {a : W} {as : List W} (hd : s.astack = a :: as)
+    (hf : code[x.pc]? = some (.addImm Reg.rbp 8)) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with astack := as } x' ∧ x'.pc = x.pc + 1 ∧
+      (∀ r, r ≠ Reg.rbp → x'.regs r = x.regs r) := by
+  have hcap := hs.capA
+  rw [hd] at hcap
+  simp only [List.length_cons] at hcap
+  have hval : x.regs Reg.rbp + BitVec.ofInt 64 8 = ofN (c.aEnd - 8 * as.length) := by
+    rw [hs.rbp, show (8 : Int) = 8 * ((1 : Nat) : Int) by simp, ea_nat, hd]
+    congr 1
+    simp only [List.length_cons]
+    omega
+  refine ⟨x.arith Reg.rbp (ofN (c.aEnd - 8 * as.length)),
+    XSteps.single (by rw [xstep_of_fetch hf]; simp only [exec, hval]), ?_, by simp [M.arith],
+    by intro r hr; simp [M.arith, M.setReg, hr]⟩
+  refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_, rbp := ?_, stack := hs.stack,
+           regs := hs.regs, mem := hs.mem, rs := hs.rs, aux := ?_, irvalid := hs.irvalid,
+           xvalid := hs.xvalid, capD := hs.capD, capR := hs.capR, capA := ?_ }
+  · simpa [M.arith, M.setReg] using hs.r15
+  · simpa [M.arith, M.setReg] using hs.r14
+  · simpa [M.arith, M.setReg] using hs.r13
+  · simpa [M.arith, M.setReg] using hs.r12
+  · simpa [M.arith, M.setReg] using hs.rsp
+  · simp [M.arith, M.setReg]
+  · intro i w hi
+    have hi' : as[i]? = some w := hi
+    have h := hs.aux (i + 1) w (by rw [hd]; simpa using hi')
+    rw [hd] at h
+    simp only [List.length_cons] at h
+    have e : c.aEnd - 8 * (as.length + 1) + 8 * (i + 1) = c.aEnd - 8 * as.length + 8 * i := by
+      omega
+    rw [e] at h
+    exact h
+  · show c.aBase + 8 * as.length ≤ c.aEnd
+    omega
+
+/-- `addImm rbp, -8; store [rbp], rs` pushes the value of `rs` onto the auxiliary stack. -/
+theorem aux_push (hg : Geom c) (hs : Rel0 c p s x) (rs : Reg) (hrs : rs ≠ rbp)
+    (hfit : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd)
+    (hat : XAt code x.pc [.addImm Reg.rbp (-8), .store Reg.rbp 0 rs]) :
+    ∃ x', XSteps code x x' ∧
+      Rel0 c p { s with astack := x.regs rs :: s.astack } x' ∧ x'.pc = x.pc + 2 ∧
+      (∀ r, r ≠ rbp → x'.regs r = x.regs r) := by
+  obtain ⟨h1, h2, _⟩ := hat
+  have hcap := hs.capA
+  have haE := hg.aEnd_lt
+  have hA1 : c.aBase ≤ c.aEnd - 8 * (s.astack.length + 1) := by omega
+  have hA2 : c.aEnd - 8 * (s.astack.length + 1) < c.aEnd := by omega
+  have hAlt : c.aEnd - 8 * (s.astack.length + 1) < 2 ^ 64 := by omega
+  have hval : x.regs Reg.rbp + BitVec.ofInt 64 (-8) = ofN (c.aEnd - 8 * (s.astack.length + 1)) := by
+    rw [hs.rbp, ea_neg8 (by omega)]
+    congr 1
+  obtain ⟨x1, hx1⟩ : ∃ x1, x1 = x.arith Reg.rbp (ofN (c.aEnd - 8 * (s.astack.length + 1))) :=
+    ⟨_, rfl⟩
+  have e1 : exec (.addImm Reg.rbp (-8)) x = .next x1 := by rw [hx1]; simp only [exec, hval]
+  have hst1 : step code x = .next x1 := by rw [xstep_of_fetch h1, e1]
+  have hbp1 : x1.regs Reg.rbp = ofN (c.aEnd - 8 * (s.astack.length + 1)) := by
+    simp [hx1, M.arith, M.setReg]
+  have hrsv : x1.regs rs = x.regs rs := by simp [hx1, M.arith, M.setReg, hrs]
+  have hm1 : x1.mem = x.mem := by simp [hx1, M.arith, M.setReg]
+  have hvalid := hs.xvalid.2.2.2.2 _ hA1 hA2
+  obtain ⟨mem', hw⟩ : ∃ m', x.mem.write? (ofN (c.aEnd - 8 * (s.astack.length + 1))) (x.regs rs)
+      = some m' := by simp [Memory.write?, hvalid]
+  have e2 : exec (.store Reg.rbp 0 rs) x1 = .next { x1.adv with mem := mem' } := by
+    simp only [exec, M.ea, hbp1, hrsv, hm1]
+    have h0 : ofN (c.aEnd - 8 * (s.astack.length + 1)) + BitVec.ofInt 64 0 =
+        ofN (c.aEnd - 8 * (s.astack.length + 1)) := by simp
+    rw [h0, hw]
+  have hpc1 : x1.pc = x.pc + 1 := by simp [hx1, M.arith, M.setReg]
+  have hst2 : step code x1 = .next { x1.adv with mem := mem' } := by
+    rw [xstep_of_fetch (m := x1) (by rw [hpc1]; exact h2), e2]
+  refine ⟨{ x1.adv with mem := mem' }, (XSteps.single hst1).trans (XSteps.single hst2), ?_,
+    by simp [M.adv, hpc1], by intro r hr; simp [M.adv, hx1, M.arith, M.setReg, hr]⟩
+  obtain ⟨hst, hrg, hmm, hrr⟩ := aux_region_write hg hs hA1 hA2 hw
+  refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_, rbp := ?_, stack := hst,
+           regs := hrg, mem := hmm, rs := hrr, aux := ?_, irvalid := hs.irvalid, xvalid := ?_,
+           capD := hs.capD, capR := hs.capR, capA := ?_ }
+  · simpa [M.adv, hx1, M.arith, M.setReg] using hs.r15
+  · simpa [M.adv, hx1, M.arith, M.setReg] using hs.r14
+  · simpa [M.adv, hx1, M.arith, M.setReg] using hs.r13
+  · simpa [M.adv, hx1, M.arith, M.setReg] using hs.r12
+  · simpa [M.adv, hx1, M.arith, M.setReg] using hs.rsp
+  · simp [M.adv, hx1, M.arith, M.setReg]
+  · intro i w hi
+    show mem'.read? _ = some w
+    simp only [List.length_cons]
+    cases i with
+    | zero =>
+      simp at hi; subst hi
+      rw [show c.aEnd - 8 * (s.astack.length + 1) + 8 * 0 = c.aEnd - 8 * (s.astack.length + 1) by
+        omega, read_write_nat hw hAlt hAlt]
+      simp
+    | succ i =>
+      simp only [List.getElem?_cons_succ] at hi
+      have hik : i < s.astack.length := by
+        have := (List.getElem?_eq_some_iff.mp hi).1; simpa using this
+      have hB : c.aEnd - 8 * (s.astack.length + 1) + 8 * (i + 1) < 2 ^ 64 := by omega
+      have hne : c.aEnd - 8 * (s.astack.length + 1) ≠
+          c.aEnd - 8 * (s.astack.length + 1) + 8 * (i + 1) := by omega
+      rw [read_write_nat hw hAlt hB]
+      simp only [hne, ite_false]
+      have e : c.aEnd - 8 * (s.astack.length + 1) + 8 * (i + 1) =
+          c.aEnd - 8 * s.astack.length + 8 * i := by omega
+      rw [e]; exact hs.aux i w hi
+  · have := Memory.write?_valid hw
+    show RegionsValid c mem'.valid
+    rw [this]; exact hs.xvalid
+  · simpa using hfit
+
+end Steps
+
+section Guards
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)} {L : Layout}
+  {base : Nat}
+
+/-- The auxiliary-stack guard's comparison, in terms of its depth. -/
+theorem ovfA_flags (hg : Geom c) (hs : Rel0 c p s x) (hLal : L.aLim = ofN (c.aBase + 8)) :
+    Cc.ae.holds (subFlags (x.regs Reg.rbp) L.aLim) =
+      decide (c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) := by
+  have hcap := hs.capA
+  have haE := hg.aEnd_lt
+  have h8 := hg.aBase_8
+  rw [holds_ae, hs.rbp, hLal, ule_ofN (by omega) (by omega)]
+  by_cases h : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd
+  · simp [h]; omega
+  · simp [h]; omega
+
+theorem ovfA_run (hpc : x.pc = base) (hat : XAt code base (ovfA L base)) :
+    ∃ xb : M, XSteps code x xb ∧ xb.pc = base + 2 ∧
+      xb.flags = some (subFlags (x.regs Reg.rbp) L.aLim) ∧ xb.mem = x.mem ∧
+      (∀ r, r ≠ rax → xb.regs r = x.regs r) ∧
+      code[base + 2]? = some (.jcc .ae (base + 2 + 2)) ∧ code[base + 2 + 1]? = some .exitOvf := by
+  obtain ⟨h1, h2, h3, h4, _⟩ := hat
+  let xa := x.mov rax L.aLim
+  have hst1 : step code x = .next xa := by rw [xstep_of_fetch (by rw [hpc]; exact h1)]; rfl
+  have hxa_pc : xa.pc = base + 1 := by simp [xa, M.mov, M.setReg, M.adv, hpc]
+  let xb : M := { xa.adv with flags := some (subFlags (xa.regs rbp) (xa.regs rax)) }
+  have hst2 : step code xa = .next xb := by
+    rw [xstep_of_fetch (m := xa) (by rw [hxa_pc]; exact h2)]; rfl
+  refine ⟨xb, (XSteps.single hst1).trans (XSteps.single hst2), by simp [xb, M.adv, hxa_pc],
+    by simp [xb, xa, M.mov, M.setReg, M.adv], by simp [xb, xa, M.adv, M.mov, M.setReg], ?_,
+    fetch_cast h3 (by omega), fetch_cast h4 (by omega)⟩
+  intro r hr; simp [xb, xa, M.adv, M.mov, M.setReg, hr]
+
+/-- Room for one more auxiliary word: the guard falls through to `base + 4`. -/
+theorem ovfA_pass (hg : Geom c) (hs : Rel0 c p s x) (hLal : L.aLim = ofN (c.aBase + 8))
+    (hfit : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) (hpc : x.pc = base)
+    (hat : XAt code base (ovfA L base)) :
+    ∃ x1, XSteps code x x1 ∧ Rel0 c p s x1 ∧ x1.pc = base + 4 ∧ x1.mem = x.mem ∧
+      (∀ r, r ≠ rax → x1.regs r = x.regs r) := by
+  obtain ⟨xb, hsb, hpcb, hfb, hmb, hrb, hj, _⟩ := ovfA_run hpc hat
+  have hholds : Cc.ae.holds (subFlags (x.regs Reg.rbp) L.aLim) = true := by
+    rw [ovfA_flags hg hs hLal]; simpa using hfit
+  refine ⟨{ xb with pc := base + 2 + 2 }, hsb.trans (ovf_jcc_pass hj hpcb hfb hholds), ?_, rfl, hmb,
+    hrb⟩
+  refine hs.congr hmb ?_ ?_ ?_ ?_ ?_ ?_ <;> exact hrb _ (by decide)
+
+/-- Auxiliary stack full: the guard exits with `overflow`. -/
+theorem ovfA_trap (hg : Geom c) (hs : Rel0 c p s x) (hLal : L.aLim = ofN (c.aBase + 8))
+    (h : ¬ c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) (hpc : x.pc = base)
+    (hat : XAt code base (ovfA L base)) : XExec code x .overflow := by
+  obtain ⟨xb, hsb, hpcb, hfb, _, _, hj, he⟩ := ovfA_run hpc hat
+  have hholds : Cc.ae.holds (subFlags (x.regs Reg.rbp) L.aLim) = false := by
+    rw [ovfA_flags hg hs hLal]; simpa using h
+  exact XExec.of_steps hsb (ovf_jcc_trap hj he hpcb hfb hholds)
+
+/-- The emptiness check's comparison: `rbp ≠ aEnd` exactly when the auxiliary stack is nonempty. -/
+theorem emptyA_flags (hg : Geom c) (hs : Rel0 c p s x) (hLa : L.aEnd = ofN c.aEnd) :
+    Cc.ne.holds (subFlags (x.regs Reg.rbp) L.aEnd) = decide (s.astack ≠ []) := by
+  have hcap := hs.capA
+  have haE := hg.aEnd_lt
+  rw [holds_ne, hs.rbp, hLa]
+  by_cases h : s.astack = []
+  · simp [h]
+  · have hlen : 1 ≤ s.astack.length := by
+      cases hh : s.astack with
+      | nil => exact absurd hh h
+      | cons a as => simp
+    have hne : ofN (c.aEnd - 8 * s.astack.length) ≠ ofN c.aEnd := by
+      intro e; have := ofN_inj (by omega) haE e; omega
+    simp [hne, h]
+
+theorem emptyA_run (hpc : x.pc = base) (hat : XAt code base (emptyA L base)) :
+    ∃ xb : M, XSteps code x xb ∧ xb.pc = base + 2 ∧
+      xb.flags = some (subFlags (x.regs Reg.rbp) L.aEnd) ∧ xb.mem = x.mem ∧
+      (∀ r, r ≠ rax → xb.regs r = x.regs r) ∧
+      XAt code (base + 2) [.jcc .ne (base + 2 + 2), .exitTrap .returnUnderflow] := by
+  obtain ⟨h1, h2, h3, h4, _⟩ := hat
+  let xa := x.mov rax L.aEnd
+  have hst1 : step code x = .next xa := by rw [xstep_of_fetch (by rw [hpc]; exact h1)]; rfl
+  have hxa_pc : xa.pc = base + 1 := by simp [xa, M.mov, M.setReg, M.adv, hpc]
+  let xb : M := { xa.adv with flags := some (subFlags (xa.regs rbp) (xa.regs rax)) }
+  have hst2 : step code xa = .next xb := by
+    rw [xstep_of_fetch (m := xa) (by rw [hxa_pc]; exact h2)]; rfl
+  refine ⟨xb, (XSteps.single hst1).trans (XSteps.single hst2), by simp [xb, M.adv, hxa_pc],
+    by simp [xb, xa, M.mov, M.setReg, M.adv], by simp [xb, xa, M.adv, M.mov, M.setReg], ?_,
+    fetch_cast h3 (by omega), fetch_cast h4 (by omega), trivial⟩
+  intro r hr; simp [xb, xa, M.adv, M.mov, M.setReg, hr]
+
+/-- Nonempty auxiliary stack: the check falls through to `base + 4`. -/
+theorem emptyA_pass (hg : Geom c) (hs : Rel0 c p s x) (hLa : L.aEnd = ofN c.aEnd)
+    (hne : s.astack ≠ []) (hpc : x.pc = base) (hat : XAt code base (emptyA L base)) :
+    ∃ x1, XSteps code x x1 ∧ Rel0 c p s x1 ∧ x1.pc = base + 4 ∧ x1.mem = x.mem ∧
+      (∀ r, r ≠ rax → x1.regs r = x.regs r) := by
+  obtain ⟨xb, hsb, hpcb, hfb, hmb, hrb, hj⟩ := emptyA_run hpc hat
+  have hholds : Cc.ne.holds (subFlags (x.regs Reg.rbp) L.aEnd) = true := by
+    rw [emptyA_flags hg hs hLa]; simpa using hne
+  refine ⟨{ xb with pc := base + 2 + 2 }, hsb.trans (guard_pass hj hpcb hfb hholds), ?_, rfl, hmb,
+    hrb⟩
+  refine hs.congr hmb ?_ ?_ ?_ ?_ ?_ ?_ <;> exact hrb _ (by decide)
+
+/-- Empty auxiliary stack: the check traps `returnUnderflow`. -/
+theorem emptyA_trap (hg : Geom c) (hs : Rel0 c p s x) (hLa : L.aEnd = ofN c.aEnd)
+    (he : s.astack = []) (hpc : x.pc = base) (hat : XAt code base (emptyA L base)) :
+    XExec code x (.trapped .returnUnderflow) := by
+  obtain ⟨xb, hsb, hpcb, hfb, _, _, hj⟩ := emptyA_run hpc hat
+  have hholds : Cc.ne.holds (subFlags (x.regs Reg.rbp) L.aEnd) = false := by
+    rw [emptyA_flags hg hs hLa]; simp [he]
+  exact XExec.of_steps hsb (guard_trap hj hpcb hfb hholds)
+
+end Guards
+
+section Ops
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+  {L : Layout} {base : Nat} {off : Nat → Nat}
+
+/-- Placement of the `tor` code. -/
+theorem xat_tor (hat : XAt code base (lowerInstr L base off .tor)) :
+    XAt code base (uf L 1 base) ∧ XAt code (base + 4) (ovfA L (base + 4)) ∧
+      XAt code (base + 8) [.load rax Reg.r15 0, .addImm Reg.r15 8, .addImm Reg.rbp (-8),
+        .store Reg.rbp 0 rax] := by
+  have hat' : XAt code base (uf L 1 base ++ ovfA L (base + 4) ++
+      [.load rax Reg.r15 0, .addImm Reg.r15 8, .addImm Reg.rbp (-8), .store Reg.rbp 0 rax]) := hat
+  obtain ⟨hatuo, hatr⟩ := xat_append.mp hat'
+  obtain ⟨hatuf, hato⟩ := xat_append.mp hatuo
+  have hufl : (uf L 1 base).length = 4 := by simp [uf]
+  rw [hufl] at hato
+  have hl : (uf L 1 base ++ ovfA L (base + 4)).length = 8 := by simp [hufl, ovfA]
+  rw [hl] at hatr
+  exact ⟨hatuf, hato, hatr⟩
+
+theorem sim_tor_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hLal : L.aLim = ofN (c.aBase + 8))
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .tor))
+    {a : W} {d : List W} (hd : s.dstack = a :: d)
+    (hfit : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := d, astack := a :: s.astack } x' ∧
+      x'.pc = base + isize (.tor : WordDialect.Instr 64) := by
+  obtain ⟨hatuf, hato, f0, f1, f2, f3, _⟩ := xat_tor hat
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x1', hs1', hr1', hpc1', _, _⟩ := ovfA_pass hg hr1 hLal hfit hpc1 hato
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_step (code := code) hr1' (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, ho3⟩ := adj_step (code := code) hg hr2 (n := 1) (by simp [hd])
+    (δ := 8) (by simp) (fetch_cast f1 (by omega))
+  have hax3 : x3.regs rax = a := by rw [ho3 rax (by decide), hv2]
+  have e : s.dstack.drop 1 = d := by simp [hd]
+  rw [e] at hr3
+  obtain ⟨x4, hs4, hr4, hpc4, _⟩ := aux_push hg hr3 rax (by decide) hfit
+    ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), trivial⟩
+  rw [hax3] at hr4
+  exact ⟨x4, (((hs1.trans hs1').trans hs2).trans hs3).trans hs4, hr4,
+    by simp [isize, ufSize]; omega⟩
+
+theorem sim_tor_ovf (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hLal : L.aLim = ofN (c.aBase + 8))
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .tor))
+    (hk : 1 ≤ s.dstack.length) (h : ¬ c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd) :
+    XExec code x .overflow := by
+  obtain ⟨hatuf, hato, _⟩ := xat_tor hat
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  exact XExec.of_steps hs1 (ovfA_trap hg hr1 hLal h hpc1 hato)
+
+/-- Placement of `emptyA L base ++ ovfD L (base + 4) ++ rest`. -/
+theorem xat_take {rest : List (Instr Nat)}
+    (hat : XAt code base (emptyA L base ++ ovfD L (base + 4) ++ rest)) :
+    XAt code base (emptyA L base) ∧ XAt code (base + 4) (ovfD L (base + 4)) ∧
+      XAt code (base + 8) rest := by
+  obtain ⟨hatuo, hatr⟩ := xat_append.mp hat
+  obtain ⟨hate, hato⟩ := xat_append.mp hatuo
+  have hel : (emptyA L base).length = 4 := rfl
+  rw [hel] at hato
+  have hl : (emptyA L base ++ ovfD L (base + 4)).length = 8 := rfl
+  rw [hl] at hatr
+  exact ⟨hate, hato, hatr⟩
+
+theorem sim_fromr_ok (hg : Geom c) (hLa : L.aEnd = ofN c.aEnd) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .fromr))
+    {a : W} {as : List W} (hd : s.astack = a :: as)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a :: s.dstack, astack := as } x' ∧
+      x'.pc = base + isize (.fromr : WordDialect.Instr 64) := by
+  obtain ⟨hate, hato, f0, f1, f2, f3, _⟩ := xat_take (L := L) (rest := [.load rax Reg.rbp 0,
+    .addImm Reg.rbp 8, .addImm Reg.r15 (-8), .store Reg.r15 0 rax]) hat
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := emptyA_pass hg hs hLa (by simp [hd]) hpc hate
+  obtain ⟨x1', hs1', hr1', hpc1', _, _⟩ := ovfD_pass hg hr1 hLd hfit hpc1 hato
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_aux_step (code := code) hr1' hd (rd := rax)
+    (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, ho3⟩ := aux_drop (code := code) hr2 hd (fetch_cast f1 (by omega))
+  have hax3 : x3.regs rax = a := by rw [ho3 rax (by decide), hv2]
+  obtain ⟨x4, hs4, hr4, hpc4, _⟩ := push_pair hg hr3 rax (by decide) hfit
+    ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), trivial⟩
+  rw [hax3] at hr4
+  exact ⟨x4, (((hs1.trans hs1').trans hs2).trans hs3).trans hs4, hr4, by simp [isize]; omega⟩
+
+theorem sim_fromr_trap (hg : Geom c) (hLa : L.aEnd = ofN c.aEnd) (hs : Rel0 c p s x)
+    (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .fromr)) (he : s.astack = []) :
+    XExec code x (.trapped .returnUnderflow) :=
+  emptyA_trap hg hs hLa he hpc (xat_take (L := L) (rest := [.load rax Reg.rbp 0,
+    .addImm Reg.rbp 8, .addImm Reg.r15 (-8), .store Reg.r15 0 rax]) hat).1
+
+theorem sim_fromr_ovf (hg : Geom c) (hLa : L.aEnd = ofN c.aEnd) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .fromr))
+    (hne : s.astack ≠ []) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    XExec code x .overflow := by
+  obtain ⟨hate, hato, _⟩ := xat_take (L := L) (rest := [.load rax Reg.rbp 0,
+    .addImm Reg.rbp 8, .addImm Reg.r15 (-8), .store Reg.r15 0 rax]) hat
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := emptyA_pass hg hs hLa hne hpc hate
+  exact XExec.of_steps hs1 (ovfD_trap hg hr1 hLd h hpc1 hato)
+
+theorem sim_rfetch_ok (hg : Geom c) (hLa : L.aEnd = ofN c.aEnd) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .rfetch))
+    {a : W} {as : List W} (hd : s.astack = a :: as)
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a :: s.dstack } x' ∧
+      x'.pc = base + isize (.rfetch : WordDialect.Instr 64) := by
+  obtain ⟨hate, hato, f0, f1, f2, _⟩ := xat_take (L := L) (rest := [.load rax Reg.rbp 0,
+    .addImm Reg.r15 (-8), .store Reg.r15 0 rax]) hat
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := emptyA_pass hg hs hLa (by simp [hd]) hpc hate
+  obtain ⟨x1', hs1', hr1', hpc1', _, _⟩ := ovfD_pass hg hr1 hLd hfit hpc1 hato
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_aux_step (code := code) hr1' hd (rd := rax)
+    (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, _⟩ := push_pair hg hr2 rax (by decide) hfit
+    ⟨fetch_cast f1 (by omega), fetch_cast f2 (by omega), trivial⟩
+  rw [hv2] at hr3
+  exact ⟨x3, ((hs1.trans hs1').trans hs2).trans hs3, hr3, by simp [isize]; omega⟩
+
+theorem sim_rfetch_trap (hg : Geom c) (hLa : L.aEnd = ofN c.aEnd) (hs : Rel0 c p s x)
+    (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .rfetch)) (he : s.astack = []) :
+    XExec code x (.trapped .returnUnderflow) :=
+  emptyA_trap hg hs hLa he hpc (xat_take (L := L) (rest := [.load rax Reg.rbp 0,
+    .addImm Reg.r15 (-8), .store Reg.r15 0 rax]) hat).1
+
+theorem sim_rfetch_ovf (hg : Geom c) (hLa : L.aEnd = ofN c.aEnd) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .rfetch))
+    (hne : s.astack ≠ []) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    XExec code x .overflow := by
+  obtain ⟨hate, hato, _⟩ := xat_take (L := L) (rest := [.load rax Reg.rbp 0,
+    .addImm Reg.r15 (-8), .store Reg.r15 0 rax]) hat
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := emptyA_pass hg hs hLa hne hpc hate
+  exact XExec.of_steps hs1 (ovfD_trap hg hr1 hLd h hpc1 hato)
+
+end Ops
+
+end X86
+end WordDialect

backend/x86_64/X86/SimBin.lean

@@ -0,0 +1,100 @@
+import X86.Guard
+
+/-!
+# X86.SimBin
+
+Generic simulation of the binary-operation lowering shape
+
+    uf 2 ; load rcx,[r15] ; load rax,[r15+8] ; <mid> ; store [r15+8],rr ; add r15,8
+
+`mid` only has to compute `f a b` into `rr` from `rax = a`, `rcx = b`, touching nothing but
+scratch state. Instantiated below for add/sub/mul/and/or/xor, shifts, rotates and compares.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+def MidSpec (mid : List (Instr Nat)) (rr : Reg) (f : W → W → W) : Prop :=
+  ∀ (m : M) (a b : W), m.regs rax = a → m.regs rcx = b →
+    ∃ m', xseq mid m = .next m' ∧ m'.regs rr = f a b ∧ m'.mem = m.mem ∧
+      m'.regs r15 = m.regs r15 ∧ m'.regs r14 = m.regs r14 ∧ m'.regs r13 = m.regs r13 ∧
+      m'.regs r12 = m.regs r12 ∧ m'.regs rsp = m.regs rsp ∧ m'.regs rbp = m.regs rbp ∧
+      m'.pc = m.pc + mid.length
+
+theorem scratch_ne (r : Reg) (h : r = rax ∨ r = rcx ∨ r = rdx ∨ r = rbx) :
+    r ≠ r15 ∧ r ≠ r14 ∧ r ≠ r13 ∧ r ≠ r12 ∧ r ≠ rsp ∧ r ≠ rbp := by
+  rcases h with rfl | rfl | rfl | rfl <;> decide
+
+theorem sim_bin_ok {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+    {L : Layout} {base : Nat} (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x)
+    (hpc : x.pc = base) (mid : List (Instr Nat)) (rr : Reg)
+    (hrr : rr = rax ∨ rr = rcx ∨ rr = rdx ∨ rr = rbx) (f : W → W → W)
+    (hmid : MidSpec mid rr f) (hstr : ∀ i ∈ mid, i.straightX = true)
+    (hat : XAt code base (uf L 2 base ++
+      ([.load rcx r15 0, .load rax r15 8] ++ mid ++ [.store r15 8 rr, .addImm r15 8])))
+    {b a : W} {d : List W} (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := f a b :: d } x' ∧
+      x'.pc = base + 4 + (4 + mid.length) := by
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨hatuf, hatrest⟩ := xat_append.mp hat
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatrest
+  obtain ⟨hatA, hatB⟩ := xat_append.mp hatrest
+  obtain ⟨hatLd, hatMid⟩ := xat_append.mp hatA
+  obtain ⟨f0, f1, _⟩ := hatLd
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  have hrcx := scratch_ne rcx (by simp)
+  have hrax := scratch_ne rax (by simp)
+  -- load rcx, [r15 + 0]
+  have e0 := ld_stack hr1 (j := 0) (v := b) (by simp [hd]) rcx (disp := 0) (by simp)
+  obtain ⟨x2, hx2⟩ : ∃ x2, x2 = x1.mov rcx b := ⟨_, rfl⟩
+  have hst0 : XSteps code x1 x2 := XSteps.single (by
+    rw [xstep_of_fetch (m := x1) (by rw [hpc1]; exact f0), e0, hx2])
+  have hr2 : Rel0 c p s x2 := by rw [hx2]; exact mov_rel0 hr1 rcx hrcx b
+  have hpc2 : x2.pc = base + 4 + 1 := by simp [hx2, M.mov, M.setReg, M.adv, hpc1]
+  -- load rax, [r15 + 8]
+  have e1 := ld_stack hr2 (j := 1) (v := a) (by simp [hd]) rax (disp := 8) (by simp)
+  obtain ⟨x3, hx3⟩ : ∃ x3, x3 = x2.mov rax a := ⟨_, rfl⟩
+  have hst1 : XSteps code x2 x3 := XSteps.single (by
+    rw [xstep_of_fetch (m := x2) (by rw [hpc2]; exact f1), e1, hx3])
+  have hr3 : Rel0 c p s x3 := by rw [hx3]; exact mov_rel0 hr2 rax hrax a
+  have hpc3 : x3.pc = base + 4 + 2 := by simp [hx3, M.mov, M.setReg, M.adv, hpc2]
+  have hax : x3.regs rax = a := by simp [hx3, M.mov, M.setReg, M.adv]
+  have hcx : x3.regs rcx = b := by simp [hx3, hx2, M.mov, M.setReg, M.adv]
+  -- mid
+  obtain ⟨x4, hx4, hrr4, hm4, h15, h14, h13, h12, hsp, hbp, hpc4⟩ := hmid x3 a b hax hcx
+  obtain ⟨hstM, _⟩ := xseq_steps hstr (by rw [hpc3]; exact hatMid) hx4
+  have hr4 : Rel0 c p s x4 := hr3.congr hm4 h15 h14 h13 h12 hsp hbp
+  -- store [r15 + 8], rr
+  have hlen : 1 < s.dstack.length := by simp [hd]
+  obtain ⟨mem', e2, hr5⟩ := st_stack hg hr4 (j := 1) hlen rr (disp := 8) (by simp)
+  obtain ⟨st, adj, _⟩ := hatB
+  have hpc4' : x4.pc = base + 4 + (2 + mid.length) := by rw [hpc4, hpc3]; omega
+  obtain ⟨x5, hx5⟩ : ∃ x5, x5 = ({ x4.adv with mem := mem' } : M) := ⟨_, rfl⟩
+  have hst2 : XSteps code x4 x5 := XSteps.single (by
+    rw [xstep_of_fetch (m := x4) (fetch_cast st (by rw [hpc4']; simp; omega)), e2, hx5])
+  rw [← hx5] at hr5
+  have hpc5 : x5.pc = base + 4 + (2 + mid.length + 1) := by
+    simp [hx5, M.adv]; omega
+  -- adjust r15
+  have hlen5 : 1 ≤ ({ s with dstack := s.dstack.set 1 (x4.regs rr) } : State 64).dstack.length := by
+    simp [hd]
+  obtain ⟨e3, hr6⟩ := adj_drop hg hr5 (n := 1) hlen5 (δ := 8) (by simp)
+  obtain ⟨x6, hx6⟩ : ∃ x6, x6 = x5.arith Reg.r15
+      (ofN (c.dEnd - 8 * (({ s with dstack := s.dstack.set 1 (x4.regs rr) } : State 64).dstack.length - 1))) :=
+    ⟨_, rfl⟩
+  rw [← hx6] at e3 hr6
+  have hst3 : XSteps code x5 x6 := XSteps.single (by
+    rw [xstep_of_fetch (m := x5) (fetch_cast adj (by rw [hpc5]; simp; omega)), e3])
+  have hrrv : x4.regs rr = f a b := hrr4
+  refine ⟨x6, ((((hst0 |> fun h => (hs1.trans h)).trans hst1).trans hstM).trans hst2).trans hst3, ?_, ?_⟩
+  · have e : (({ s with dstack := s.dstack.set 1 (x4.regs rr) } : State 64).dstack).drop 1 = f a b :: d := by
+      simp [hd, hrrv]
+    simpa [e] using hr6
+  · simp [hx6, M.arith, hpc5]
+    omega
+
+end X86
+end WordDialect

backend/x86_64/X86/SimCtl.lean

@@ -0,0 +1,282 @@
+import X86.SimDiv
+
+/-!
+# X86.SimCtl
+
+Control flow: `jmp branch call ret halt`. `call` and `ret` are native, so the IR return stack is
+the native stack below `sp0`, related by `RsRel` (cells hold the x86 code index of the return
+instruction).
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+theorem offs_succ {p : Prog 64} {k : Nat} {i : WordDialect.Instr 64} (h : p[k]? = some i) :
+    offs p (k + 1) = offs p k + isize i := by
+  have hk : k < p.length := (List.getElem?_eq_some_iff.mp h).1
+  have hi : p[k] = i := (List.getElem?_eq_some_iff.mp h).2
+  simp [offs, List.take_succ, h, List.sum_append]
+
+section Ctl
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+  {L : Layout} {base : Nat} {off : Nat → Nat}
+
+theorem sim_jmp_ok (hs : Rel0 c p s x) (hpc : x.pc = base) {t : Nat}
+    (hat : XAt code base (lowerInstr L base off (.jmp t))) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = off t := by
+  have hat' : XAt code base [.jmp (off t)] := hat
+  obtain ⟨f0, _⟩ := hat'
+  refine ⟨{ x with pc := off t }, XSteps.single (by rw [xstep_of_fetch (by rw [hpc]; exact f0)]; rfl),
+    hs.congr rfl rfl rfl rfl rfl rfl rfl, rfl⟩
+
+/-- `branch t`: both outcomes. -/
+theorem sim_branch_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x)
+    (hpc : x.pc = base) {t : Nat} (hat : XAt code base (lowerInstr L base off (.branch t)))
+    {cc : W} {d : List W} (hd : s.dstack = cc :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := d } x' ∧
+      x'.pc = (if Word.isTrue cc then off t else base + isize (.branch t : WordDialect.Instr 64)) := by
+  have hat' : XAt code base (uf L 1 base ++ [.load rax Reg.r15 0, .addImm Reg.r15 8, .test rax rax,
+      .jcc .ne (off t)]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 1 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, _⟩ := hatr
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, _⟩ := ld_step (code := code) hr1 (j := 0) (v := cc)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, ho3⟩ := adj_step (code := code) hg hr2 (n := 1) (by simp [hd])
+    (δ := 8) (by simp) (fetch_cast f1 (by omega))
+  have hax3 : x3.regs rax = cc := by rw [ho3 rax (by decide), hv2]
+  have e : s.dstack.drop 1 = d := by simp [hd]
+  rw [e] at hr3
+  let x4 : M := { x3.adv with flags := some (logicFlags (x3.regs rax &&& x3.regs rax)) }
+  have hst4 : step code x3 = .next x4 := by
+    rw [xstep_of_fetch (m := x3) (fetch_cast f2 (by omega))]; rfl
+  have hr4 : Rel0 c p { s with dstack := d } x4 := hr3.congr rfl rfl rfl rfl rfl rfl rfl
+  have hpc4 : x4.pc = base + 4 + 3 := by simp [x4, M.adv]; omega
+  have hfl4 : x4.flags = some (logicFlags (cc &&& cc)) := by simp [x4, hax3]
+  by_cases hc : cc = 0#64
+  · have hst5 : step code x4 = .next x4.adv := by
+      rw [xstep_of_fetch (m := x4) (fetch_cast f3 (by omega))]
+      simp [exec, hfl4, hc, Cc.holds, logicFlags]
+    refine ⟨x4.adv, (((hs1.trans hs2).trans hs3).trans (XSteps.single hst4)).trans
+      (XSteps.single hst5), hr4.congr rfl rfl rfl rfl rfl rfl rfl, ?_⟩
+    simp [hc, Word.isTrue, M.adv, hpc4, isize, ufSize]
+  · have hst5 : step code x4 = .next { x4 with pc := off t } := by
+      rw [xstep_of_fetch (m := x4) (fetch_cast f3 (by omega))]
+      simp [exec, hfl4, hc, Cc.holds, logicFlags]
+    refine ⟨{ x4 with pc := off t }, (((hs1.trans hs2).trans hs3).trans (XSteps.single hst4)).trans
+      (XSteps.single hst5), hr4.congr rfl rfl rfl rfl rfl rfl rfl, ?_⟩
+    simp [hc, Word.isTrue]
+
+theorem sim_halt (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .halt)) : XExec code x (.halted x) := by
+  have hat' : XAt code base [.exitHalt] := hat
+  obtain ⟨f0, _⟩ := hat'
+  exact XExec.halt (by rw [xstep_of_fetch (by rw [hpc]; exact f0)]; rfl)
+
+/-- The native `call` itself: pushes the x86 index of the return instruction onto the native
+stack. -/
+theorem sim_call_core (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) {t : Nat}
+    (hat : XAt code base [.call (off t)])
+    (hret : base + 1 = offs p (s.pc + 1)) (hfitR : s.rstack.length + 2 ≤ c.rcap) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with rstack := (s.pc + 1) :: s.rstack } x' ∧
+      x'.pc = off t := by
+  obtain ⟨f0, _⟩ := hat
+  have hcapR := hs.capR
+  have hrc := hg.rcap_le
+  have hsp := hg.sp0_lt
+  have hA1 : c.sp0 - 8 * c.rcap ≤ c.sp0 - 8 * (s.rstack.length + 1) := by omega
+  have hA2 : c.sp0 - 8 * (s.rstack.length + 1) < c.sp0 := by omega
+  have hAlt : c.sp0 - 8 * (s.rstack.length + 1) < 2 ^ 64 := by omega
+  have hvalid := hs.xvalid.2.2.2.1 _ hA1 hA2
+  have hsub : x.regs rsp - 8#64 = ofN (c.sp0 - 8 * (s.rstack.length + 1)) := by
+    rw [hs.rsp]
+    show ofN _ - ofN 8 = _
+    rw [ofN_sub (by omega)]
+    congr 1
+  obtain ⟨mem', hw⟩ : ∃ m', x.mem.write? (ofN (c.sp0 - 8 * (s.rstack.length + 1)))
+      (BitVec.ofNat 64 (x.pc + 1)) = some m' := by simp [Memory.write?, hvalid]
+  have hst : step code x = .next { (x.setReg rsp (ofN (c.sp0 - 8 * (s.rstack.length + 1)))) with
+      mem := mem', pc := off t } := by
+    rw [xstep_of_fetch (by rw [hpc]; exact f0)]
+    simp only [exec, hsub, hw]
+  refine ⟨_, XSteps.single hst, ?_, rfl⟩
+  have hdE := hg.dEnd_lt
+  have hcap := hs.capD
+  refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_, stack := ?_, regs := ?_,
+           mem := ?_, rs := ?_, irvalid := hs.irvalid, xvalid := ?_, capD := hs.capD, capR := ?_,
+           rbp := by simpa [M.setReg] using hs.rbp,
+           aux := aux_write_other hg.aEnd_lt hs.capA hs.aux hw hAlt
+             (by rcases hg.dA_K with h | h <;> omega),
+           capA := hs.capA }
+  · simpa [M.setReg] using hs.r15
+  · simpa [M.setReg] using hs.r14
+  · simpa [M.setReg] using hs.r13
+  · simpa [M.setReg] using hs.r12
+  · simp [M.setReg]
+  · intro i w hi
+    have hi : s.dstack[i]? = some w := hi
+    have hik : i < s.dstack.length := by
+      by_cases hh : i < s.dstack.length
+      · exact hh
+      · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+    have hB : c.dEnd - 8 * s.dstack.length + 8 * i < 2 ^ 64 := by omega
+    have hne : c.sp0 - 8 * (s.rstack.length + 1) ≠ c.dEnd - 8 * s.dstack.length + 8 * i := by
+      rcases hg.dS_K with h | h <;> omega
+    show mem'.read? _ = some w
+    rw [read_write_nat hw hAlt hB]
+    simp only [hne, ite_false]
+    exact hs.stack i w hi
+  · intro r hr
+    have hrf := hg.rf_lt
+    have hne : c.sp0 - 8 * (s.rstack.length + 1) ≠ c.rf + 8 * r := by
+      rcases hg.dF_K with h | h <;> omega
+    show mem'.read? _ = some _
+    rw [read_write_nat hw hAlt (by omega)]
+    simp only [hne, ite_false]
+    exact hs.regs r hr
+  · intro a ha
+    have hmb := hg.mb_lt
+    have hne : c.sp0 - 8 * (s.rstack.length + 1) ≠ c.mb + 8 * a := by
+      rcases hg.dM_K with h | h <;> omega
+    show mem'.read? _ = some _
+    rw [read_write_nat hw hAlt (by omega)]
+    simp only [hne, ite_false]
+    exact hs.mem a ha
+  · intro i a hi
+    show mem'.read? _ = some _
+    simp only [List.length_cons]
+    cases i with
+    | zero =>
+      simp at hi; subst hi
+      rw [show c.sp0 - 8 * (s.rstack.length + 1) + 8 * 0 = c.sp0 - 8 * (s.rstack.length + 1) by omega,
+        read_write_nat hw hAlt hAlt]
+      simp [hpc, hret, ofN]
+    | succ i =>
+      simp only [List.getElem?_cons_succ] at hi
+      have hik : i < s.rstack.length := by
+        have := (List.getElem?_eq_some_iff.mp hi).1; simpa using this
+      have hB : c.sp0 - 8 * (s.rstack.length + 1) + 8 * (i + 1) < 2 ^ 64 := by omega
+      have hne : c.sp0 - 8 * (s.rstack.length + 1) ≠
+          c.sp0 - 8 * (s.rstack.length + 1) + 8 * (i + 1) := by omega
+      rw [read_write_nat hw hAlt hB]
+      simp only [hne, ite_false]
+      have e : c.sp0 - 8 * (s.rstack.length + 1) + 8 * (i + 1) =
+          c.sp0 - 8 * s.rstack.length + 8 * i := by omega
+      rw [e]; exact hs.rs i a hi
+  · have := Memory.write?_valid hw
+    show RegionsValid c mem'.valid
+    rw [this]; exact hs.xvalid
+  · simp only [List.length_cons]; omega
+
+theorem sim_ret_ok (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .ret)) {a : Nat} {rs : List Nat}
+    (hr : s.rstack = a :: rs) (hsz : offs p a < 2 ^ 64) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with rstack := rs } x' ∧ x'.pc = offs p a := by
+  have hat' : XAt code base [.cmp rsp r12, .jcc .ne (base + 3), .exitTrap .returnUnderflow, .ret] := hat
+  obtain ⟨f0, f1, f2, f3, _⟩ := hat'
+  have hcapR := hs.capR
+  have hrc := hg.rcap_le
+  have hsp := hg.sp0_lt
+  rw [hr] at hcapR
+  simp only [List.length_cons] at hcapR
+  let x1 : M := { x.adv with flags := some (subFlags (x.regs rsp) (x.regs r12)) }
+  have hst1 : step code x = .next x1 := by
+    rw [xstep_of_fetch (by rw [hpc]; exact f0)]; rfl
+  have hpc1 : x1.pc = base + 1 := by simp [x1, M.adv, hpc]
+  have hrsp : x.regs rsp = ofN (c.sp0 - 8 * (rs.length + 1)) := by rw [hs.rsp, hr]; simp
+  have hne : (x.regs rsp != x.regs r12) = true := by
+    rw [hrsp, hs.r12]
+    have : ofN (c.sp0 - 8 * (rs.length + 1)) ≠ ofN c.sp0 := by
+      intro e; have := ofN_inj (by omega) hsp e; omega
+    simpa using this
+  have hst2 : step code x1 = .next { x1 with pc := base + 3 } := by
+    rw [xstep_of_fetch (m := x1) (by rw [hpc1]; exact f1)]
+    simp [exec, x1, holds_ne, hne]
+  have hread := hs.rs 0 a (by simp [hr])
+  rw [hr] at hread
+  simp only [List.length_cons, Nat.mul_zero, Nat.add_zero] at hread
+  have hst3 : step code { x1 with pc := base + 3 } = .next { (x1.setReg rsp (ofN (c.sp0 - 8 * rs.length))) with
+      pc := offs p a } := by
+    rw [xstep_of_fetch (m := { x1 with pc := base + 3 }) f3]
+    have hx1r : x1.regs rsp = ofN (c.sp0 - 8 * (rs.length + 1)) := hrsp
+    have hx1m : x1.mem = x.mem := rfl
+    have hadd : ofN (c.sp0 - 8 * (rs.length + 1)) + 8#64 = ofN (c.sp0 - 8 * rs.length) := by
+      show ofN _ + ofN 8 = _
+      rw [ofN_add]; congr 1; omega
+    have hv : (ofN (offs p a)).toNat = offs p a := by
+      simp [ofN, BitVec.toNat_ofNat, Nat.mod_eq_of_lt hsz]
+    simp only [exec]
+    rw [hx1m, hx1r, hread]
+    simp only [hadd, hv]
+    rfl
+  refine ⟨_, ((XSteps.single hst1).trans (XSteps.single hst2)).trans (XSteps.single hst3), ?_, rfl⟩
+  refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_, stack := ?_, regs := ?_,
+           mem := ?_, rs := ?_, irvalid := hs.irvalid, xvalid := ?_, capD := hs.capD, capR := ?_,
+           rbp := by simpa [M.setReg, x1, M.adv] using hs.rbp, aux := hs.aux, capA := hs.capA }
+  · simpa [M.setReg, x1, M.adv] using hs.r15
+  · simpa [M.setReg, x1, M.adv] using hs.r14
+  · simpa [M.setReg, x1, M.adv] using hs.r13
+  · simpa [M.setReg, x1, M.adv] using hs.r12
+  · simp [M.setReg]
+  · exact hs.stack
+  · exact hs.regs
+  · exact hs.mem
+  · intro i a' hi
+    have h := hs.rs (i + 1) a' (by simpa [hr] using hi)
+    rw [hr] at h
+    simp only [List.length_cons] at h
+    have e : c.sp0 - 8 * (rs.length + 1) + 8 * (i + 1) = c.sp0 - 8 * rs.length + 8 * i := by omega
+    rw [e] at h
+    exact h
+  · exact hs.xvalid
+  · show rs.length + 1 ≤ c.rcap
+    omega
+
+theorem sim_ret_trap (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .ret)) (hr : s.rstack = []) :
+    XExec code x (.trapped .returnUnderflow) := by
+  have hat' : XAt code base [.cmp rsp r12, .jcc .ne (base + 3), .exitTrap .returnUnderflow, .ret] := hat
+  obtain ⟨f0, f1, f2, f3, _⟩ := hat'
+  let x1 : M := { x.adv with flags := some (subFlags (x.regs rsp) (x.regs r12)) }
+  have hst1 : step code x = .next x1 := by
+    rw [xstep_of_fetch (by rw [hpc]; exact f0)]; rfl
+  have hpc1 : x1.pc = base + 1 := by simp [x1, M.adv, hpc]
+  have heq : x.regs rsp = x.regs r12 := by rw [hs.rsp, hs.r12, hr]; simp
+  have hfl : x1.flags = some (subFlags (x.regs rsp) (x.regs rsp)) := by simp [x1, heq]
+  have hhold : Cc.ne.holds (subFlags (x.regs rsp) (x.regs rsp)) = false := by
+    rw [holds_ne]; simp
+  exact XExec.of_steps (XSteps.single hst1)
+    (guard_trap (code := code) (pc := base + 1) (m := x1) (c := .ne) (t := .returnUnderflow)
+      (f := subFlags (x.regs rsp) (x.regs rsp)) ⟨f1, f2, trivial⟩ hpc1 hfl hhold)
+
+/-- `call t`: the return-stack guard, then the native `call`. -/
+theorem sim_call_ok (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) {t : Nat}
+    (hLr : L.rGap = ofN (8 * c.rcap - 16)) (hat : XAt code base (lowerInstr L base off (.call t)))
+    (hret : base + isize (.call t : WordDialect.Instr 64) = offs p (s.pc + 1))
+    (hfitR : s.rstack.length + 2 ≤ c.rcap) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with rstack := (s.pc + 1) :: s.rstack } x' ∧
+      x'.pc = off t := by
+  have hat' : XAt code base (ovfR L base ++ [.call (off t)]) := hat
+  obtain ⟨hato, hatc⟩ := xat_append.mp hat'
+  have hl : (ovfR L base).length = 6 := rfl
+  rw [hl] at hatc
+  obtain ⟨x1, hs1, hr1, hpc1, _⟩ := ovfR_pass hg hs hLr hfitR hpc hato
+  obtain ⟨x', hs', hr', hpc'⟩ := sim_call_core hg hr1 hpc1 hatc (by simpa [isize] using hret) hfitR
+  exact ⟨x', hs1.trans hs', hr', hpc'⟩
+
+theorem sim_call_ovf (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) {t : Nat}
+    (hLr : L.rGap = ofN (8 * c.rcap - 16)) (hat : XAt code base (lowerInstr L base off (.call t)))
+    (h : ¬ s.rstack.length + 2 ≤ c.rcap) : XExec code x .overflow := by
+  have hat' : XAt code base (ovfR L base ++ [.call (off t)]) := hat
+  exact ovfR_trap hg hs hLr h hpc (xat_append.mp hat').1
+
+end Ctl
+
+end X86
+end WordDialect

backend/x86_64/X86/SimDiv.lean

@@ -0,0 +1,368 @@
+import X86.SimMemOps
+
+/-!
+# X86.SimDiv
+
+`select`, `div`, `sdiv`: the three-operand select, and the divisions with their zero guard
+(`divideByZero` trap), the `-1` special case of `sdiv` (avoiding the hardware overflow fault), and
+the relation between `idiv` and `BitVec.sdiv`.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+section Div
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+  {L : Layout} {base : Nat} {off : Nat → Nat}
+
+/-- `Rel0` ignores scratch registers. -/
+theorem rel0_scratch (hs : Rel0 c p s x) {x' : M} (hm : x'.mem = x.mem)
+    (hr : ∀ r, r ≠ rax → r ≠ rcx → r ≠ rdx → r ≠ rbx → x'.regs r = x.regs r) : Rel0 c p s x' :=
+  hs.congr hm (hr _ (by decide) (by decide) (by decide) (by decide))
+    (hr _ (by decide) (by decide) (by decide) (by decide))
+    (hr _ (by decide) (by decide) (by decide) (by decide))
+    (hr _ (by decide) (by decide) (by decide) (by decide))
+    (hr _ (by decide) (by decide) (by decide) (by decide))
+    (hr _ (by decide) (by decide) (by decide) (by decide))
+
+theorem zg_pass (hs : Rel0 c p s x) {b : W} (hb : x.regs rcx = b) (hne : b ≠ 0#64) {t : Nat}
+    (ht : t = x.pc + 3)
+    (hat : XAt code x.pc [.test rcx rcx, .jcc .ne t, .exitTrap .divideByZero]) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = x.pc + 3 ∧ x'.regs = x.regs ∧
+      x'.mem = x.mem := by
+  obtain ⟨f0, f1, f2, _⟩ := hat
+  let x1 : M := { x.adv with flags := some (logicFlags (x.regs rcx &&& x.regs rcx)) }
+  have hst1 : step code x = .next x1 := by rw [xstep_of_fetch f0]; rfl
+  have hpc1 : x1.pc = x.pc + 1 := by simp [x1, M.adv]
+  have hfl : x1.flags = some (logicFlags (b &&& b)) := by simp [x1, hb]
+  have hhold : Cc.ne.holds (logicFlags (b &&& b)) = true := by simp [Cc.holds, logicFlags, hne]
+  have e : x.pc + 1 + 2 = t := by omega
+  have hg := guard_pass (code := code) (pc := x.pc + 1) (m := x1) (c := .ne) (t := .divideByZero)
+    (f := logicFlags (b &&& b)) (by rw [e]; exact ⟨f1, f2, trivial⟩) hpc1 hfl hhold
+  refine ⟨{ x1 with pc := x.pc + 1 + 2 }, (XSteps.single hst1).trans hg, ?_, by simp, rfl, rfl⟩
+  exact hs.congr rfl rfl rfl rfl rfl rfl rfl
+
+theorem zg_trap (hs : Rel0 c p s x) (hb : x.regs rcx = 0#64) {t : Nat}
+    (hat : XAt code x.pc [.test rcx rcx, .jcc .ne t, .exitTrap .divideByZero]) (ht : t = x.pc + 3) :
+    XExec code x (.trapped .divideByZero) := by
+  obtain ⟨f0, f1, f2, _⟩ := hat
+  let x1 : M := { x.adv with flags := some (logicFlags (x.regs rcx &&& x.regs rcx)) }
+  have hst1 : step code x = .next x1 := by rw [xstep_of_fetch f0]; rfl
+  have hpc1 : x1.pc = x.pc + 1 := by simp [x1, M.adv]
+  have hfl : x1.flags = some (logicFlags (0#64 &&& 0#64)) := by simp [x1, hb]
+  have hhold : Cc.ne.holds (logicFlags (0#64 &&& 0#64)) = false := by simp [Cc.holds, logicFlags]
+  have e : x.pc + 1 + 2 = t := by omega
+  exact XExec.of_steps (XSteps.single hst1)
+    (guard_trap (code := code) (pc := x.pc + 1) (m := x1) (c := .ne) (t := .divideByZero)
+      (f := logicFlags (0#64 &&& 0#64)) (by rw [e]; exact ⟨f1, f2, trivial⟩) hpc1 hfl hhold)
+
+theorem div_step (hf : code[x.pc]? = some (.div rcx)) {a b : W} (ha : x.regs rax = a)
+    (hb : x.regs rcx = b) (hd : x.regs rdx = 0#64) (hne : b ≠ 0#64) :
+    ∃ x', step code x = .next x' ∧ x'.regs rax = a.udiv b ∧ x'.pc = x.pc + 1 ∧
+      x'.mem = x.mem ∧ (∀ r, r ≠ rax → r ≠ rdx → x'.regs r = x.regs r) := by
+  have hq : a.toNat / b.toNat < 2 ^ 64 := Nat.lt_of_le_of_lt (Nat.div_le_self _ _) a.isLt
+  have e : step code x = .next { ((x.setReg rax (BitVec.ofNat 64 (a.toNat / b.toNat))).setReg rdx
+      (BitVec.ofNat 64 (a.toNat % b.toNat))) with flags := none, pc := x.pc + 1 } := by
+    rw [xstep_of_fetch hf]
+    simp [exec, hb, hd, ha, hne, hq]
+  refine ⟨_, e, ?_, rfl, rfl, ?_⟩
+  · simp [M.setReg, BitVec.udiv_def]
+  · intro r h1 h2; simp [M.setReg, h1, h2]
+
+theorem sim_div_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .div)) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) (hb : b ≠ 0#64) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a.udiv b :: d } x' ∧
+      x'.pc = base + isize (.div : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 2 base ++ [.load rcx Reg.r15 0, .load rax Reg.r15 8, .test rcx rcx,
+      .jcc .ne (base + ufSize 2 + 5), .exitTrap .divideByZero, .movImm rdx 0#64, .div rcx,
+      .store Reg.r15 8 rax, .addImm Reg.r15 8]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, f5, f6, f7, f8, _⟩ := hatr
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, _⟩ := ld_step (code := code) hr1 (j := 0) (v := b)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, _⟩ := ld_step (code := code) hr2 (j := 1) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  have hcx3 : x3.regs rcx = b := by rw [ho3 rcx (by decide), hv2]
+  obtain ⟨x4, hs4, hr4, hpc4, hreg4, _⟩ := zg_pass (code := code) hr3 hcx3 hb
+    (t := base + ufSize 2 + 5) (by simp [ufSize]; omega)
+    ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), fetch_cast f4 (by omega), trivial⟩
+  obtain ⟨x5, hs5, hr5, hpc5, hv5, ho5, hm5⟩ := movimm_step (code := code) hr4 (rd := rdx) (by simp)
+    (v := 0#64) (fetch_cast f5 (by omega))
+  have hax5 : x5.regs rax = a := by rw [ho5 rax (by decide), hreg4, hv3]
+  have hcx5 : x5.regs rcx = b := by rw [ho5 rcx (by decide), hreg4, hcx3]
+  obtain ⟨x6, hst6, hax6, hpc6, hm6, ho6⟩ := div_step (code := code) (x := x5)
+    (fetch_cast f6 (by omega)) hax5 hcx5 hv5 hb
+  have hr6 : Rel0 c p s x6 := rel0_scratch hr5 hm6 (fun r h1 h2 h3 h4 => ho6 r h1 h3)
+  obtain ⟨x7, hs7, hr7, hpc7, hreg7⟩ := st_step (code := code) hg hr6 (j := 1) (by simp [hd])
+    (rs := rax) (disp := 8) (by simp) (fetch_cast f7 (by omega))
+  have hlen : 1 ≤ ({ s with dstack := s.dstack.set 1 (x6.regs rax) } : State 64).dstack.length := by
+    simp [hd]
+  obtain ⟨x8, hs8, hr8, hpc8, _⟩ := adj_step (code := code) hg hr7 (n := 1) hlen (δ := 8) (by simp)
+    (fetch_cast f8 (by omega))
+  have hr8' : Rel0 c p { s with dstack := (s.dstack.set 1 (x6.regs rax)).drop 1 } x8 := hr8
+  have e : (s.dstack.set 1 (x6.regs rax)).drop 1 = a.udiv b :: d := by simp [hd, hax6]
+  rw [e] at hr8'
+  exact ⟨x8, ((((hs1.trans hs2).trans hs3).trans hs4).trans hs5).trans
+    ((XSteps.single hst6).trans (hs7.trans hs8)), hr8', by simp [isize, ufSize]; omega⟩
+
+theorem sim_div_zero (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x)
+    (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .div)) {a : W} {d : List W}
+    (hd : s.dstack = 0#64 :: a :: d) : XExec code x (.trapped .divideByZero) := by
+  have hat' : XAt code base (uf L 2 base ++ [.load rcx Reg.r15 0, .load rax Reg.r15 8, .test rcx rcx,
+      .jcc .ne (base + ufSize 2 + 5), .exitTrap .divideByZero, .movImm rdx 0#64, .div rcx,
+      .store Reg.r15 8 rax, .addImm Reg.r15 8]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, _⟩ := hatr
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, _⟩ := ld_step (code := code) hr1 (j := 0) (v := 0#64)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, _⟩ := ld_step (code := code) hr2 (j := 1) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  have hcx3 : x3.regs rcx = 0#64 := by rw [ho3 rcx (by decide), hv2]
+  exact XExec.of_steps (((hs1.trans hs2).trans hs3)) (zg_trap (code := code) hr3 hcx3
+    ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), fetch_cast f4 (by omega), trivial⟩
+    (t := base + ufSize 2 + 5) (by simp [ufSize]; omega))
+
+theorem ofInt_m1 : BitVec.ofInt 64 (-1) = -(1#64) := by decide
+
+theorem sdiv_m1 (a : W) : a.sdiv (BitVec.ofInt 64 (-1)) = 0#64 - a := by
+  rw [ofInt_m1, BitVec.sdiv_neg (by decide), BitVec.sdiv_one]; simp
+
+theorem dividend_eq (a : W) :
+    (if a.msb then BitVec.allOnes 64 else 0#64).toInt * 2 ^ 64 + (a.toNat : Int) = a.toInt := by
+  rw [BitVec.toInt_eq_msb_cond a]
+  cases h : a.msb <;> simp [h] <;> omega
+
+theorem idiv_step (hf : code[x.pc]? = some (.idiv rcx)) {a b : W} (ha : x.regs rax = a)
+    (hb : x.regs rcx = b) (hd : x.regs rdx = if a.msb then BitVec.allOnes 64 else 0#64)
+    (hne : b ≠ 0#64) (hm1 : b ≠ -(1#64)) :
+    ∃ x', step code x = .next x' ∧ x'.regs rax = a.sdiv b ∧ x'.pc = x.pc + 1 ∧
+      x'.mem = x.mem ∧ (∀ r, r ≠ rax → r ≠ rdx → x'.regs r = x.regs r) := by
+  have hq : (a.sdiv b).toInt = Int.tdiv a.toInt b.toInt :=
+    BitVec.toInt_sdiv_of_ne_or_ne a b (Or.inr hm1)
+  have hlo := BitVec.le_toInt (a.sdiv b)
+  have hhi : (a.sdiv b).toInt < 2 ^ (64 - 1) := BitVec.toInt_lt
+  rw [hq] at hlo hhi
+  have hrange : -(2 ^ 63 : Int) ≤ Int.tdiv a.toInt b.toInt ∧ Int.tdiv a.toInt b.toInt < 2 ^ 63 := by
+    constructor <;> simpa using ‹_›
+  have hdiv : ((x.regs rdx).toInt * 2 ^ 64 + ((x.regs rax).toNat : Int)) = a.toInt := by
+    rw [hd, ha]; exact dividend_eq a
+  have hofq : BitVec.ofInt 64 (Int.tdiv a.toInt b.toInt) = a.sdiv b := by
+    rw [← hq]; simp
+  have e : step code x = .next { ((x.setReg rax (a.sdiv b)).setReg rdx
+      (BitVec.ofInt 64 (Int.tmod a.toInt b.toInt))) with flags := none, pc := x.pc + 1 } := by
+    rw [xstep_of_fetch hf]
+    simp only [exec, hb, hne, ite_false, hdiv, hrange, and_self, ite_true, hofq]
+  refine ⟨_, e, ?_, rfl, rfl, ?_⟩
+  · simp [M.setReg]
+  · intro r h1 h2; simp [M.setReg, h1, h2]
+
+/-- Core of `sdiv`, from the `cmpImm rcx, -1` on: both branches end with `rax = a.sdiv b`. -/
+theorem sdiv_core (hs : Rel0 c p s x) {a b : W} (ha : x.regs rax = a) (hb : x.regs rcx = b)
+    (hne : b ≠ 0#64) {t1 t2 : Nat} (ht1 : t1 = x.pc + 4) (ht2 : t2 = x.pc + 6)
+    (hat : XAt code x.pc [.cmpImm rcx (-1), .jcc .ne t1, .neg rax, .jmp t2, .cqo, .idiv rcx]) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = x.pc + 6 ∧ x'.regs rax = a.sdiv b := by
+  obtain ⟨f0, f1, f2, f3, f4, f5, _⟩ := hat
+  let x1 : M := { x.adv with flags := some (subFlags (x.regs rcx) (BitVec.ofInt 64 (-1))) }
+  have hst1 : step code x = .next x1 := by rw [xstep_of_fetch f0]; rfl
+  have hpc1 : x1.pc = x.pc + 1 := by simp [x1, M.adv]
+  have hfl : x1.flags = some (subFlags b (BitVec.ofInt 64 (-1))) := by simp [x1, hb]
+  have hr1 : Rel0 c p s x1 := hs.congr rfl rfl rfl rfl rfl rfl rfl
+  have hax1 : x1.regs rax = a := by simpa [x1, M.adv] using ha
+  have hcx1 : x1.regs rcx = b := by simpa [x1, M.adv] using hb
+  by_cases hb1 : b = BitVec.ofInt 64 (-1)
+  · -- b = -1: jcc falls through, neg rax, jmp to the join point
+    have hst2 : step code x1 = .next x1.adv := by
+      rw [xstep_of_fetch (m := x1) (fetch_cast f1 (by omega))]
+      simp [exec, hfl, holds_ne, hb1, M.adv]
+    have hpc2 : x1.adv.pc = x.pc + 2 := by simp [M.adv, hpc1]
+    have hr2 : Rel0 c p s x1.adv := hr1.congr rfl rfl rfl rfl rfl rfl rfl
+    have hax2 : x1.adv.regs rax = a := by simpa [M.adv] using hax1
+    let x3 := x1.adv.arith rax (0#64 - x1.adv.regs rax)
+    have hst3 : step code x1.adv = .next x3 := by
+      rw [xstep_of_fetch (m := x1.adv) (fetch_cast f2 (by omega))]; rfl
+    have hpc3 : x3.pc = x.pc + 3 := by simp [x3, M.arith, M.setReg, hpc2]
+    have hr3 : Rel0 c p s x3 := arith_rel0 hr2 rax (scratch_ne rax (by simp)) _
+    have hst4 : step code x3 = .next { x3 with pc := t2 } := by
+      rw [xstep_of_fetch (m := x3) (fetch_cast f3 (by omega))]; rfl
+    refine ⟨{ x3 with pc := t2 }, (((XSteps.single hst1).trans (XSteps.single hst2)).trans
+      (XSteps.single hst3)).trans (XSteps.single hst4), hr3.congr rfl rfl rfl rfl rfl rfl rfl,
+      by simp [ht2], ?_⟩
+    have h3 : x3.regs rax = 0#64 - a := by simp [x3, M.arith, M.setReg, hax2]
+    show x3.regs rax = a.sdiv b
+    rw [h3, hb1, sdiv_m1]
+  · -- b ≠ -1: jump to cqo; idiv
+    have hbm : b ≠ -(1#64) := by rwa [← ofInt_m1]
+    have hst2 : step code x1 = .next { x1 with pc := t1 } := by
+      rw [xstep_of_fetch (m := x1) (fetch_cast f1 (by omega))]
+      have hb1' : (b != BitVec.ofInt 64 (-1)) = true := by simpa using hb1
+      simp only [exec, hfl, holds_ne, hb1', ite_true]
+    have hr2 : Rel0 c p s { x1 with pc := t1 } := hr1.congr rfl rfl rfl rfl rfl rfl rfl
+    have hax2 : ({ x1 with pc := t1 } : M).regs rax = a := hax1
+    have hcx2 : ({ x1 with pc := t1 } : M).regs rcx = b := hcx1
+    let x3 : M := ({ x1 with pc := t1 } : M).mov rdx (if (({ x1 with pc := t1 } : M).regs rax).msb
+      then BitVec.allOnes 64 else 0#64)
+    have hst3 : step code { x1 with pc := t1 } = .next x3 := by
+      rw [xstep_of_fetch (m := { x1 with pc := t1 }) (fetch_cast f4 (by simp; omega))]; rfl
+    have hr3 : Rel0 c p s x3 := mov_rel0 hr2 rdx (scratch_ne rdx (by simp)) _
+    have hpc3 : x3.pc = x.pc + 5 := by simp [x3, M.mov, M.setReg, M.adv]; omega
+    have hax3 : x3.regs rax = a := by simp [x3, M.mov, M.setReg, M.adv]; exact hax2
+    have hcx3 : x3.regs rcx = b := by simp [x3, M.mov, M.setReg, M.adv]; exact hcx2
+    have hdx3 : x3.regs rdx = if a.msb then BitVec.allOnes 64 else 0#64 := by
+      simp [x3, M.mov, M.setReg, M.adv]; rw [hax2]
+    obtain ⟨x4, hst4, hax4, hpc4, hm4, ho4⟩ := idiv_step (code := code) (x := x3)
+      (fetch_cast f5 (by omega)) hax3 hcx3 hdx3 hne hbm
+    refine ⟨x4, (((XSteps.single hst1).trans (XSteps.single hst2)).trans (XSteps.single hst3)).trans
+      (XSteps.single hst4), rel0_scratch hr3 hm4 (fun r h1 h2 h3 h4 => ho4 r h1 h3), by omega, hax4⟩
+
+theorem sim_sdiv_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .sdiv)) {a b : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) (hb : b ≠ 0#64) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a.sdiv b :: d } x' ∧
+      x'.pc = base + isize (.sdiv : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 2 base ++ [.load rcx Reg.r15 0, .load rax Reg.r15 8, .test rcx rcx,
+      .jcc .ne (base + ufSize 2 + 5), .exitTrap .divideByZero, .cmpImm rcx (-1),
+      .jcc .ne (base + ufSize 2 + 9), .neg rax, .jmp (base + ufSize 2 + 11), .cqo, .idiv rcx,
+      .store Reg.r15 8 rax, .addImm Reg.r15 8]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11, f12, _⟩ := hatr
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, _⟩ := ld_step (code := code) hr1 (j := 0) (v := b)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, _⟩ := ld_step (code := code) hr2 (j := 1) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  have hcx3 : x3.regs rcx = b := by rw [ho3 rcx (by decide), hv2]
+  obtain ⟨x4, hs4, hr4, hpc4, hreg4, _⟩ := zg_pass (code := code) hr3 hcx3 hb
+    (t := base + ufSize 2 + 5) (by simp [ufSize]; omega)
+    ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), fetch_cast f4 (by omega), trivial⟩
+  have hax4 : x4.regs rax = a := by rw [hreg4, hv3]
+  have hcx4 : x4.regs rcx = b := by rw [hreg4, hcx3]
+  obtain ⟨x5, hs5, hr5, hpc5, hax5⟩ := sdiv_core (code := code) hr4 hax4 hcx4 hb
+    (t1 := base + ufSize 2 + 9) (t2 := base + ufSize 2 + 11) (by simp [ufSize]; omega)
+    (by simp [ufSize]; omega)
+    ⟨fetch_cast f5 (by omega), fetch_cast f6 (by omega), fetch_cast f7 (by omega),
+      fetch_cast f8 (by omega), fetch_cast f9 (by omega), fetch_cast f10 (by omega), trivial⟩
+  obtain ⟨x6, hs6, hr6, hpc6, hreg6⟩ := st_step (code := code) hg hr5 (j := 1) (by simp [hd])
+    (rs := rax) (disp := 8) (by simp) (fetch_cast f11 (by omega))
+  have hlen : 1 ≤ ({ s with dstack := s.dstack.set 1 (x5.regs rax) } : State 64).dstack.length := by
+    simp [hd]
+  obtain ⟨x7, hs7, hr7, hpc7, _⟩ := adj_step (code := code) hg hr6 (n := 1) hlen (δ := 8) (by simp)
+    (fetch_cast f12 (by omega))
+  have hr7' : Rel0 c p { s with dstack := (s.dstack.set 1 (x5.regs rax)).drop 1 } x7 := hr7
+  have e : (s.dstack.set 1 (x5.regs rax)).drop 1 = a.sdiv b :: d := by simp [hd, hax5]
+  rw [e] at hr7'
+  exact ⟨x7, (((((hs1.trans hs2).trans hs3).trans hs4).trans hs5).trans hs6).trans hs7, hr7',
+    by simp [isize, ufSize]; omega⟩
+
+theorem sim_sdiv_zero (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x)
+    (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .sdiv)) {a : W} {d : List W}
+    (hd : s.dstack = 0#64 :: a :: d) : XExec code x (.trapped .divideByZero) := by
+  have hat' : XAt code base (uf L 2 base ++ [.load rcx Reg.r15 0, .load rax Reg.r15 8, .test rcx rcx,
+      .jcc .ne (base + ufSize 2 + 5), .exitTrap .divideByZero]) := by
+    have h : XAt code base (uf L 2 base ++ [.load rcx Reg.r15 0, .load rax Reg.r15 8, .test rcx rcx,
+      .jcc .ne (base + ufSize 2 + 5), .exitTrap .divideByZero, .cmpImm rcx (-1),
+      .jcc .ne (base + ufSize 2 + 9), .neg rax, .jmp (base + ufSize 2 + 11), .cqo, .idiv rcx,
+      .store Reg.r15 8 rax, .addImm Reg.r15 8]) := hat
+    obtain ⟨h1, h2⟩ := xat_append.mp h
+    refine xat_append.mpr ⟨h1, ?_⟩
+    obtain ⟨g0, g1, g2, g3, g4, _⟩ := h2
+    exact ⟨g0, g1, g2, g3, g4, trivial⟩
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, _⟩ := hatr
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, _⟩ := ld_step (code := code) hr1 (j := 0) (v := 0#64)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, _⟩ := ld_step (code := code) hr2 (j := 1) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  have hcx3 : x3.regs rcx = 0#64 := by rw [ho3 rcx (by decide), hv2]
+  exact XExec.of_steps (((hs1.trans hs2)).trans hs3) (zg_trap (code := code) hr3 hcx3
+    ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), fetch_cast f4 (by omega), trivial⟩
+    (t := base + ufSize 2 + 5) (by simp [ufSize]; omega))
+
+theorem cmov_ne_step (hf : code[x.pc]? = some (.cmov .ne rax rbx)) {cc : W}
+    (hfl : x.flags = some (logicFlags (cc &&& cc))) :
+    ∃ x', step code x = .next x' ∧ x'.pc = x.pc + 1 ∧ x'.mem = x.mem ∧
+      x'.regs rax = (if cc = 0#64 then x.regs rax else x.regs rbx) ∧
+      (∀ r, r ≠ rax → x'.regs r = x.regs r) := by
+  by_cases hc : cc = 0#64
+  · subst hc
+    refine ⟨x.adv, ?_, by simp [M.adv], by simp [M.adv], by simp [M.adv], ?_⟩
+    · rw [xstep_of_fetch hf]; simp [exec, hfl, Cc.holds, logicFlags]
+    · intro r _; simp [M.adv]
+  · refine ⟨x.mov rax (x.regs rbx), ?_, by simp [M.mov, M.setReg, M.adv],
+      by simp [M.mov, M.setReg, M.adv], by simp [M.mov, M.setReg, M.adv, hc], ?_⟩
+    · rw [xstep_of_fetch hf]; simp [exec, hfl, Cc.holds, logicFlags, hc]
+    · intro r h; simp [M.mov, M.setReg, M.adv, h]
+
+theorem sim_select_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x)
+    (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .select)) {cc y v : W}
+    {d : List W} (hd : s.dstack = cc :: y :: v :: d) :
+    ∃ x', XSteps code x x' ∧
+      Rel0 c p { s with dstack := (if Word.isTrue cc then v else y) :: d } x' ∧
+      x'.pc = base + isize (.select : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 3 base ++ [.load rcx Reg.r15 0, .load rax Reg.r15 8,
+      .load rbx Reg.r15 16, .test rcx rcx, .cmov .ne rax rbx, .store Reg.r15 16 rax,
+      .addImm Reg.r15 16]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 3 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, f5, f6, _⟩ := hatr
+  have hk : 3 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, _⟩ := ld_step (code := code) hr1 (j := 0) (v := cc)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, _⟩ := ld_step (code := code) hr2 (j := 1) (v := y)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  obtain ⟨x4, hs4, hr4, hpc4, hv4, ho4, _⟩ := ld_step (code := code) hr3 (j := 2) (v := v)
+    (by simp [hd]) (rd := rbx) (by simp) (disp := 16) (by simp) (fetch_cast f2 (by omega))
+  have hcx4 : x4.regs rcx = cc := by rw [ho4 rcx (by decide), ho3 rcx (by decide), hv2]
+  have hax4 : x4.regs rax = y := by rw [ho4 rax (by decide), hv3]
+  -- test rcx, rcx
+  let x5 : M := { x4.adv with flags := some (logicFlags (x4.regs rcx &&& x4.regs rcx)) }
+  have hst5 : step code x4 = .next x5 := by
+    rw [xstep_of_fetch (m := x4) (fetch_cast f3 (by omega))]; rfl
+  have hr5 : Rel0 c p s x5 := hr4.congr rfl rfl rfl rfl rfl rfl rfl
+  have hpc5 : x5.pc = base + 4 + 4 := by simp [x5, M.adv]; omega
+  have hfl5 : x5.flags = some (logicFlags (cc &&& cc)) := by simp [x5, hcx4]
+  have hax5 : x5.regs rax = y := by simpa [x5, M.adv] using hax4
+  have hbx5 : x5.regs rbx = v := by simpa [x5, M.adv] using hv4
+  obtain ⟨x6, hst6, hpc6, hm6, hax6, ho6⟩ := cmov_ne_step (code := code) (x := x5)
+    (fetch_cast f4 (by omega)) hfl5
+  have hr6 : Rel0 c p s x6 := rel0_scratch hr5 hm6 (fun r h1 h2 h3 h4 => ho6 r h1)
+  have hval : x6.regs rax = (if Word.isTrue cc then v else y) := by
+    rw [hax6, hax5, hbx5]
+    by_cases hc : cc = 0#64 <;> simp [Word.isTrue, hc]
+  obtain ⟨x7, hs7, hr7, hpc7, _⟩ := st_step (code := code) hg hr6 (j := 2) (by simp [hd])
+    (rs := rax) (disp := 16) (by simp) (fetch_cast f5 (by omega))
+  have hlen : 2 ≤ ({ s with dstack := s.dstack.set 2 (x6.regs rax) } : State 64).dstack.length := by
+    simp [hd]
+  obtain ⟨x8, hs8, hr8, hpc8, _⟩ := adj_step (code := code) hg hr7 (n := 2) hlen (δ := 16) (by simp)
+    (fetch_cast f6 (by omega))
+  have hr8' : Rel0 c p { s with dstack := (s.dstack.set 2 (x6.regs rax)).drop 2 } x8 := hr8
+  have e : (s.dstack.set 2 (x6.regs rax)).drop 2 = (if Word.isTrue cc then v else y) :: d := by
+    simp [hd, hval]
+  rw [e] at hr8'
+  exact ⟨x8, (((((((hs1.trans hs2).trans hs3).trans hs4).trans (XSteps.single hst5)).trans
+    (XSteps.single hst6)).trans hs7).trans hs8), hr8', by simp [isize, ufSize]; omega⟩
+
+end Div
+
+end X86
+end WordDialect

backend/x86_64/X86/SimMem.lean

@@ -0,0 +1,213 @@
+import X86.SimStack
+
+/-!
+# X86.SimMem
+
+Register-file and IR-memory cells: frame lemmas for writes into those regions, the address
+bounds guard, and the simulation theorems for `push pop load store` (success and `badAddress`).
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+theorem ofN_toNat (a : W) : ofN a.toNat = a := by
+  apply BitVec.eq_of_toNat_eq
+  simp [ofN, BitVec.toNat_ofNat, Nat.mod_eq_of_lt a.isLt]
+
+theorem eaIdx_nat (mb : Nat) (a : W) : ofN mb + a * 8#64 = ofN (mb + 8 * a.toNat) := by
+  have h : a * 8#64 = ofN (8 * a.toNat) := by
+    have e : a = ofN a.toNat := (ofN_toNat a).symm
+    calc a * 8#64 = ofN a.toNat * 8#64 := by rw [← e]
+      _ = ofN (8 * a.toNat) := by
+        simp only [ofN]; rw [Nat.mul_comm 8, BitVec.ofNat_mul]
+  rw [h, ofN_add]
+
+section Frame
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M}
+
+/-- A write into the register file or IR memory leaves the data-stack view unchanged. -/
+theorem wf_stack (hg : Geom c) (hs : Rel0 c p s x) {A : Nat} {v : W} {mem' : Memory 64}
+    (hw : x.mem.write? (ofN A) v = some mem') (hAlt : A < 2 ^ 64)
+    (hA : (c.rf ≤ A ∧ A < c.rf + 8 * c.nregs) ∨ (c.mb ≤ A ∧ A < c.mb + 8 * c.M)) :
+    StackRel c mem' s.dstack := by
+  have hcap := hs.capD
+  have hdE := hg.dEnd_lt
+  intro i w hi
+  have hik : i < s.dstack.length := by
+    by_cases hh : i < s.dstack.length
+    · exact hh
+    · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+  have hB : c.dEnd - 8 * s.dstack.length + 8 * i < 2 ^ 64 := by omega
+  have hne : A ≠ c.dEnd - 8 * s.dstack.length + 8 * i := by
+    rcases hA with ⟨h1, h2⟩ | ⟨h1, h2⟩ <;> rcases hg.dS_F with h | h <;>
+      rcases hg.dS_M with h' | h' <;> omega
+  rw [read_write_nat hw hAlt hB]
+  simp only [hne, ite_false]
+  exact hs.stack i w hi
+
+theorem wf_rs (hg : Geom c) (hs : Rel0 c p s x) {A : Nat} {v : W} {mem' : Memory 64}
+    (hw : x.mem.write? (ofN A) v = some mem') (hAlt : A < 2 ^ 64)
+    (hA : (c.rf ≤ A ∧ A < c.rf + 8 * c.nregs) ∨ (c.mb ≤ A ∧ A < c.mb + 8 * c.M)) :
+    RsRel c p mem' s.rstack := by
+  have hcapR := hs.capR
+  have hrc := hg.rcap_le
+  have hsp := hg.sp0_lt
+  intro i a hi
+  have hi' : i < s.rstack.length := by
+    by_cases hh : i < s.rstack.length
+    · exact hh
+    · rw [List.getElem?_eq_none (by omega)] at hi; simp at hi
+  have hB : c.sp0 - 8 * s.rstack.length + 8 * i < 2 ^ 64 := by omega
+  have hne : A ≠ c.sp0 - 8 * s.rstack.length + 8 * i := by
+    rcases hA with ⟨h1, h2⟩ | ⟨h1, h2⟩ <;> rcases hg.dF_K with h | h <;>
+      rcases hg.dM_K with h' | h' <;> omega
+  rw [read_write_nat hw hAlt hB]
+  simp only [hne, ite_false]
+  exact hs.rs i a hi
+
+theorem wf_regs_mb (hg : Geom c) (hs : Rel0 c p s x) {A : Nat} {v : W} {mem' : Memory 64}
+    (hw : x.mem.write? (ofN A) v = some mem') (hAlt : A < 2 ^ 64)
+    (hA : c.mb ≤ A ∧ A < c.mb + 8 * c.M) : RegRel c mem' s.regs := by
+  have hrf := hg.rf_lt
+  intro r hr
+  have hne : A ≠ c.rf + 8 * r := by rcases hg.dF_M with h | h <;> omega
+  rw [read_write_nat hw hAlt (by omega)]
+  simp only [hne, ite_false]
+  exact hs.regs r hr
+
+theorem wf_mem_rf (hg : Geom c) (hs : Rel0 c p s x) {A : Nat} {v : W} {mem' : Memory 64}
+    (hw : x.mem.write? (ofN A) v = some mem') (hAlt : A < 2 ^ 64)
+    (hA : c.rf ≤ A ∧ A < c.rf + 8 * c.nregs) : MemRel c mem' s.mem := by
+  have hmb := hg.mb_lt
+  intro a ha
+  have hne : A ≠ c.mb + 8 * a := by rcases hg.dF_M with h | h <;> omega
+  rw [read_write_nat hw hAlt (by omega)]
+  simp only [hne, ite_false]
+  exact hs.mem a ha
+
+/-- Load virtual register `r` (through `r14`). -/
+theorem ld_reg (hs : Rel0 c p s x) {r : Nat} (hr : r < c.nregs) (rd : Reg) {disp : Int}
+    (hd : disp = 8 * (r : Int)) :
+    exec (.load rd Reg.r14 disp) x = .next (x.mov rd (s.regs r)) := by
+  have hread := hs.regs r hr
+  simp only [exec, M.ea, hs.r14, hd, ea_nat]
+  rw [hread]
+
+/-- Store into virtual register `r`. -/
+theorem st_reg (hg : Geom c) (hs : Rel0 c p s x) {r : Nat} (hr : r < c.nregs) (rs : Reg)
+    {disp : Int} (hd : disp = 8 * (r : Int)) :
+    ∃ mem', exec (.store Reg.r14 disp rs) x = .next { x.adv with mem := mem' } ∧
+      Rel0 c p { s with regs := State.setReg s.regs r (x.regs rs) } { x.adv with mem := mem' } := by
+  have hrf := hg.rf_lt
+  have hA1 : c.rf ≤ c.rf + 8 * r := by omega
+  have hA2 : c.rf + 8 * r < c.rf + 8 * c.nregs := by omega
+  have hAlt : c.rf + 8 * r < 2 ^ 64 := by omega
+  have hvalid := hs.xvalid.2.1 _ hA1 hA2
+  obtain ⟨mem', hw⟩ : ∃ m', x.mem.write? (ofN (c.rf + 8 * r)) (x.regs rs) = some m' := by
+    simp [Memory.write?, hvalid]
+  refine ⟨mem', ?_, ?_⟩
+  · simp only [exec, M.ea, hs.r14, hd, ea_nat]; rw [hw]
+  · have hA : (c.rf ≤ c.rf + 8 * r ∧ c.rf + 8 * r < c.rf + 8 * c.nregs) ∨
+        (c.mb ≤ c.rf + 8 * r ∧ c.rf + 8 * r < c.mb + 8 * c.M) := Or.inl ⟨hA1, hA2⟩
+    refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_,
+             stack := wf_stack hg hs hw hAlt hA, regs := ?_, mem := wf_mem_rf hg hs hw hAlt ⟨hA1, hA2⟩,
+             rs := wf_rs hg hs hw hAlt hA, irvalid := hs.irvalid, xvalid := ?_, capD := hs.capD,
+             capR := hs.capR, rbp := by simpa [M.adv] using hs.rbp,
+             aux := aux_write_other hg.aEnd_lt hs.capA hs.aux hw hAlt
+               (by rcases hg.dA_F with h | h <;> omega),
+             capA := hs.capA }
+    · simpa [M.adv] using hs.r15
+    · simpa [M.adv] using hs.r14
+    · simpa [M.adv] using hs.r13
+    · simpa [M.adv] using hs.r12
+    · simpa [M.adv] using hs.rsp
+    · intro r' hr'
+      rw [read_write_nat hw hAlt (by omega)]
+      by_cases h : r' = r
+      · subst h; simp [State.setReg]
+      · have hne : c.rf + 8 * r ≠ c.rf + 8 * r' := by omega
+        simp only [hne, ite_false, State.setReg, h]
+        exact hs.regs r' hr'
+    · have := Memory.write?_valid hw
+      show RegionsValid c mem'.valid
+      rw [this]; exact hs.xvalid
+
+/-- Load IR memory cell at word address `a` (`rax = a`). -/
+theorem ld_mem (hs : Rel0 c p s x) {a v : W} (hr : s.mem.read? a = some v) (hrax : x.regs rax = a) :
+    exec (.loadIdx rax Reg.r13 rax) x = .next (x.mov rax v) := by
+  obtain ⟨hv, hc⟩ := Memory.read?_some hr
+  have hlt : a.toNat < c.M := by
+    have := hs.irvalid a
+    rw [hv] at this
+    simpa using this.symm
+  have hread := hs.mem a.toNat hlt
+  rw [ofN_toNat, hc] at hread
+  simp only [exec, M.eaIdx, hs.r13, hrax, eaIdx_nat]
+  rw [hread]
+
+/-- Store into IR memory cell `a` (`rax = a`, `rcx = v`). -/
+theorem st_mem (hg : Geom c) (hs : Rel0 c p s x) {a v : W} {m : Memory 64}
+    (hw : s.mem.write? a v = some m) (hrax : x.regs rax = a) (hrcx : x.regs rcx = v) :
+    ∃ mem', exec (.storeIdx Reg.r13 rax rcx) x = .next { x.adv with mem := mem' } ∧
+      Rel0 c p { s with mem := m } { x.adv with mem := mem' } := by
+  have hv : s.mem.valid a = true := by
+    by_cases hh : s.mem.valid a = true
+    · exact hh
+    · have := (Memory.write?_none_iff s.mem a v).mpr (by simpa using hh); rw [hw] at this; simp at this
+  have hlt : a.toNat < c.M := by
+    have := hs.irvalid a
+    rw [hv] at this
+    simpa using this.symm
+  have hmb := hg.mb_lt
+  have hA1 : c.mb ≤ c.mb + 8 * a.toNat := by omega
+  have hA2 : c.mb + 8 * a.toNat < c.mb + 8 * c.M := by omega
+  have hAlt : c.mb + 8 * a.toNat < 2 ^ 64 := by omega
+  have hvalid := hs.xvalid.2.2.1 _ hA1 hA2
+  obtain ⟨mem', hw'⟩ : ∃ m', x.mem.write? (ofN (c.mb + 8 * a.toNat)) v = some m' := by
+    simp [Memory.write?, hvalid]
+  refine ⟨mem', ?_, ?_⟩
+  · simp only [exec, M.eaIdx, hs.r13, hrax, hrcx, eaIdx_nat]; rw [hw']
+  · have hA : (c.rf ≤ c.mb + 8 * a.toNat ∧ c.mb + 8 * a.toNat < c.rf + 8 * c.nregs) ∨
+        (c.mb ≤ c.mb + 8 * a.toNat ∧ c.mb + 8 * a.toNat < c.mb + 8 * c.M) := Or.inr ⟨hA1, hA2⟩
+    refine { r15 := ?_, r14 := ?_, r13 := ?_, r12 := ?_, rsp := ?_,
+             stack := wf_stack hg hs hw' hAlt hA, regs := wf_regs_mb hg hs hw' hAlt ⟨hA1, hA2⟩,
+             mem := ?_, rs := wf_rs hg hs hw' hAlt hA, irvalid := ?_, xvalid := ?_,
+             capD := hs.capD, capR := hs.capR, rbp := by simpa [M.adv] using hs.rbp,
+             aux := aux_write_other hg.aEnd_lt hs.capA hs.aux hw' hAlt
+               (by rcases hg.dA_M with h | h <;> omega),
+             capA := hs.capA }
+    · simpa [M.adv] using hs.r15
+    · simpa [M.adv] using hs.r14
+    · simpa [M.adv] using hs.r13
+    · simpa [M.adv] using hs.r12
+    · simpa [M.adv] using hs.rsp
+    · intro a' ha'
+      have hMlt : c.M < 2 ^ 64 := by omega
+      rw [read_write_nat hw' hAlt (by omega)]
+      by_cases h : a' = a.toNat
+      · subst h
+        simp only [ite_true]
+        rw [ofN_toNat]
+        have := (Memory.read?_some (Memory.read_write_same hw)).2
+        rw [this]
+      · have hne : c.mb + 8 * a.toNat ≠ c.mb + 8 * a' := by omega
+        have hne' : ofN a' ≠ a := by
+          intro e
+          apply h
+          have := ofN_inj (by omega) a.isLt (e.trans (ofN_toNat a).symm)
+          omega
+        simp only [hne, ite_false]
+        rw [Memory.cell_write_other hw hne']
+        exact hs.mem a' ha'
+    · intro a'; rw [Memory.write?_valid hw]; exact hs.irvalid a'
+    · have := Memory.write?_valid hw'
+      show RegionsValid c mem'.valid
+      rw [this]; exact hs.xvalid
+
+end Frame
+
+end X86
+end WordDialect

backend/x86_64/X86/SimMemOps.lean

@@ -0,0 +1,281 @@
+import X86.SimMem
+
+/-!
+# X86.SimMemOps
+
+The address bounds guard `movImm rt, memSize; cmp rax, rt; jb ok; exitTrap badAddress`, and the
+simulation theorems for `push`, `pop`, `load`, `store`.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+section Ops
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+  {L : Layout} {base : Nat} {off : Nat → Nat}
+
+theorem ult_memSize {a : W} {n : Nat} (hn : n < 2 ^ 64) :
+    a.ult (BitVec.ofNat 64 n) = decide (a.toNat < n) := by
+  simp [BitVec.ult_eq_decide, BitVec.toNat_ofNat, Nat.mod_eq_of_lt hn]
+
+/-- The bounds guard, passing case. -/
+theorem addr_pass (hs : Rel0 c p s x) {rt : Reg} (hrt : rt = rcx ∨ rt = rdx) {n : Nat}
+    (hn : n < 2 ^ 64) {t : Nat} (ht : t = x.pc + 4) {a : W} (hrax : x.regs rax = a) (ha : a.toNat < n)
+    (hat : XAt code x.pc [.movImm rt (BitVec.ofNat 64 n), .cmp rax rt, .jcc .b t,
+      .exitTrap .badAddress]) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = x.pc + 4 ∧ x'.regs rax = a ∧
+      (∀ r, r ≠ rt → x'.regs r = x.regs r) ∧ x'.mem = x.mem := by
+  subst ht
+  obtain ⟨f0, f1, f2, f3, _⟩ := hat
+  have hrt' : rt = rax ∨ rt = rcx ∨ rt = rdx ∨ rt = rbx := by rcases hrt with h | h <;> simp [h]
+  have hne : rax ≠ rt := by rcases hrt with h | h <;> simp [h]
+  obtain ⟨x1, hs1, hr1, hpc1, hv1, ho1, hm1⟩ := movimm_step (code := code) hs (rd := rt) hrt'
+    (v := BitVec.ofNat 64 n) f0
+  have hax1 : x1.regs rax = a := by rw [ho1 rax hne, hrax]
+  let x2 : M := { x1.adv with flags := some (subFlags (x1.regs rax) (x1.regs rt)) }
+  have hst2 : step code x1 = .next x2 := by
+    rw [xstep_of_fetch (m := x1) (fetch_cast f1 (by omega))]; rfl
+  have hpc2 : x2.pc = x.pc + 2 := by simp [x2, M.adv, hpc1]
+  have hr2 : Rel0 c p s x2 := hr1.congr (by simp [x2, M.adv]) (by simp [x2, M.adv]) (by simp [x2, M.adv])
+    (by simp [x2, M.adv]) (by simp [x2, M.adv]) (by simp [x2, M.adv]) (by simp [x2, M.adv])
+  have hfl : x2.flags = some (subFlags a (BitVec.ofNat 64 n)) := by simp [x2, hax1, hv1]
+  have hhold : Cc.b.holds (subFlags a (BitVec.ofNat 64 n)) = true := by
+    rw [holds_b, ult_memSize hn]; simpa using ha
+  have hg := guard_pass (code := code) (pc := x.pc + 2) (m := x2) (c := .b) (t := .badAddress)
+    (f := subFlags a (BitVec.ofNat 64 n))
+    ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), trivial⟩ hpc2 hfl hhold
+  refine ⟨{ x2 with pc := x.pc + 2 + 2 }, (hs1.trans (XSteps.single hst2)).trans hg, ?_, by simp,
+    by simp [x2, M.adv, hax1], ?_, by simp [x2, M.adv, hm1]⟩
+  · exact hr2.congr rfl rfl rfl rfl rfl rfl rfl
+  · intro r hr; simp [x2, M.adv, ho1 r hr]
+
+/-- The bounds guard, failing case. -/
+theorem addr_trap (hs : Rel0 c p s x) {rt : Reg} (hrt : rt = rcx ∨ rt = rdx) {n : Nat}
+    (hn : n < 2 ^ 64) {t : Nat} (ht : t = x.pc + 4) {a : W} (hrax : x.regs rax = a) (ha : ¬ a.toNat < n)
+    (hat : XAt code x.pc [.movImm rt (BitVec.ofNat 64 n), .cmp rax rt, .jcc .b t,
+      .exitTrap .badAddress]) :
+    XExec code x (.trapped .badAddress) := by
+  subst ht
+  obtain ⟨f0, f1, f2, f3, _⟩ := hat
+  have hrt' : rt = rax ∨ rt = rcx ∨ rt = rdx ∨ rt = rbx := by rcases hrt with h | h <;> simp [h]
+  have hne : rax ≠ rt := by rcases hrt with h | h <;> simp [h]
+  obtain ⟨x1, hs1, hr1, hpc1, hv1, ho1, hm1⟩ := movimm_step (code := code) hs (rd := rt) hrt'
+    (v := BitVec.ofNat 64 n) f0
+  have hax1 : x1.regs rax = a := by rw [ho1 rax hne, hrax]
+  let x2 : M := { x1.adv with flags := some (subFlags (x1.regs rax) (x1.regs rt)) }
+  have hst2 : step code x1 = .next x2 := by
+    rw [xstep_of_fetch (m := x1) (fetch_cast f1 (by omega))]; rfl
+  have hpc2 : x2.pc = x.pc + 2 := by simp [x2, M.adv, hpc1]
+  have hfl : x2.flags = some (subFlags a (BitVec.ofNat 64 n)) := by simp [x2, hax1, hv1]
+  have hhold : Cc.b.holds (subFlags a (BitVec.ofNat 64 n)) = false := by
+    rw [holds_b, ult_memSize hn]; simpa using ha
+  exact XExec.of_steps (hs1.trans (XSteps.single hst2))
+    (guard_trap (code := code) (pc := x.pc + 2) (m := x2) (c := .b) (t := .badAddress)
+      (f := subFlags a (BitVec.ofNat 64 n))
+      ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), trivial⟩ hpc2 hfl hhold)
+
+theorem sim_push_ok (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) {r : Nat}
+    (hr : r < c.nregs) (hLd : L.dLim = ofN (c.dBase + 8))
+    (hat : XAt code base (lowerInstr L base off (.push r)))
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := s.regs r :: s.dstack } x' ∧
+      x'.pc = base + isize (.push r : WordDialect.Instr 64) := by
+  obtain ⟨hato, f0, f1, f2⟩ := xat_ovf3 (L := L) (by exact hat)
+  obtain ⟨x0, hs0, hr0, hpc0, _, _⟩ := ovfD_pass hg hs hLd hfit hpc hato
+  have hst : step code x0 = .next (x0.mov rax (s.regs r)) := by
+    rw [xstep_of_fetch (by rw [hpc0]; exact f0), ld_reg hr0 hr rax rfl]
+  have hr1 : Rel0 c p s (x0.mov rax (s.regs r)) := mov_rel0 hr0 rax (scratch_ne rax (by simp)) _
+  have hpc1 : (x0.mov rax (s.regs r)).pc = base + 4 + 1 := by simp [M.mov, M.setReg, M.adv, hpc0]
+  obtain ⟨x2, hs2, hr2, hpc2, _⟩ := push_pair hg hr1 rax (by decide) hfit
+    ⟨fetch_cast f1 (by omega), fetch_cast f2 (by omega), trivial⟩
+  have hv : (x0.mov rax (s.regs r)).regs rax = s.regs r := by simp [M.mov, M.setReg, M.adv]
+  rw [hv] at hr2
+  exact ⟨x2, (hs0.trans (XSteps.single hst)).trans hs2, hr2, by simp [isize]; omega⟩
+
+theorem sim_push_ovf (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) {r : Nat}
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off (.push r)))
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) : XExec code x .overflow := by
+  obtain ⟨hato, _⟩ := xat_ovf3 (L := L) (by exact hat)
+  exact ovfD_trap hg hs hLd h hpc hato
+
+theorem sim_pop_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    {r : Nat} (hr : r < c.nregs) (hat : XAt code base (lowerInstr L base off (.pop r)))
+    {a : W} {d : List W} (hd : s.dstack = a :: d) :
+    ∃ x', XSteps code x x' ∧
+      Rel0 c p { s with dstack := d, regs := State.setReg s.regs r a } x' ∧
+      x'.pc = base + isize (.pop r : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 1 base ++ [.load rax Reg.r15 0, .addImm Reg.r15 8,
+      .store Reg.r14 (8 * (r : Int)) rax]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 1 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, _⟩ := hatr
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_step (code := code) hr1 (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, ho3⟩ := adj_step (code := code) hg hr2 (n := 1) (by simp [hd])
+    (δ := 8) (by simp) (fetch_cast f1 (by omega))
+  have hax3 : x3.regs rax = a := by rw [ho3 rax (by decide), hv2]
+  obtain ⟨mem', e4, hr4⟩ := st_reg hg hr3 hr rax (disp := 8 * (r : Int)) rfl
+  have hst4 : step code x3 = .next { x3.adv with mem := mem' } := by
+    rw [xstep_of_fetch (fetch_cast f2 (by omega)), e4]
+  have hr4' : Rel0 c p { s with dstack := s.dstack.drop 1, regs := State.setReg s.regs r (x3.regs rax) }
+      { x3.adv with mem := mem' } := hr4
+  have e : s.dstack.drop 1 = d := by simp [hd]
+  rw [e, hax3] at hr4'
+  exact ⟨_, ((hs1.trans hs2).trans hs3).trans (XSteps.single hst4), hr4',
+    by simp [M.adv, isize, ufSize]; omega⟩
+
+theorem sim_load_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M)
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .load))
+    {a v : W} {d : List W} (hd : s.dstack = a :: d) (hv : s.mem.read? a = some v) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := v :: d } x' ∧
+      x'.pc = base + isize (.load : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 1 base ++ [.load rax Reg.r15 0, .movImm rcx (BitVec.ofNat 64 L.memSize),
+      .cmp rax rcx, .jcc .b (base + ufSize 1 + 5), .exitTrap .badAddress, .loadIdx rax Reg.r13 rax,
+      .store Reg.r15 0 rax]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 1 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, f5, f6, _⟩ := hatr
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  have hMlt : c.M < 2 ^ 64 := by have := hg.mb_lt; omega
+  have hlt : a.toNat < c.M := by
+    obtain ⟨hvv, _⟩ := Memory.read?_some hv
+    have := hs.irvalid a
+    rw [hvv] at this
+    simpa using this.symm
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, hm2⟩ := ld_step (code := code) hr1 (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hax3, ho3, hm3⟩ := addr_pass (code := code) hr2 (rt := rcx) (by simp)
+    (n := c.M) hMlt (t := base + ufSize 1 + 5) (by simp [ufSize]; omega) hv2 hlt (by
+      rw [← hMs]
+      refine ⟨fetch_cast f1 (by omega), fetch_cast f2 (by omega), fetch_cast f3 (by omega),
+        fetch_cast f4 (by omega), trivial⟩)
+  have hst4 : step code x3 = .next (x3.mov rax v) := by
+    rw [xstep_of_fetch (fetch_cast f5 (by omega)), ld_mem hr3 hv hax3]
+  have hr4 : Rel0 c p s (x3.mov rax v) := mov_rel0 hr3 rax (scratch_ne rax (by simp)) v
+  have hpc4 : (x3.mov rax v).pc = base + 4 + 1 + 4 + 1 := by simp [M.mov, M.setReg, M.adv]; omega
+  obtain ⟨x5, hs5, hr5, hpc5, _⟩ := st_step (code := code) hg hr4 (j := 0) (by simp [hd])
+    (rs := rax) (disp := 0) (by simp) (fetch_cast f6 (by omega))
+  have e : s.dstack.set 0 ((x3.mov rax v).regs rax) = v :: d := by
+    simp [hd, M.mov, M.setReg, M.adv]
+  rw [e] at hr5
+  exact ⟨x5, (((hs1.trans hs2).trans hs3).trans (XSteps.single hst4)).trans hs5, hr5,
+    by simp [isize, ufSize]; omega⟩
+
+theorem sim_load_trap (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M)
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .load))
+    {a : W} {d : List W} (hd : s.dstack = a :: d) (hv : s.mem.read? a = none) :
+    XExec code x (.trapped .badAddress) := by
+  have hat' : XAt code base (uf L 1 base ++ [.load rax Reg.r15 0, .movImm rcx (BitVec.ofNat 64 L.memSize),
+      .cmp rax rcx, .jcc .b (base + ufSize 1 + 5), .exitTrap .badAddress, .loadIdx rax Reg.r13 rax,
+      .store Reg.r15 0 rax]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 1 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, _⟩ := hatr
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  have hMlt : c.M < 2 ^ 64 := by have := hg.mb_lt; omega
+  have hge : ¬ a.toNat < c.M := by
+    have hvv := (Memory.read?_none_iff s.mem a).mp hv
+    have := hs.irvalid a
+    rw [hvv] at this
+    simpa using this
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, hm2⟩ := ld_step (code := code) hr1 (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  exact XExec.of_steps (hs1.trans hs2) (addr_trap (code := code) hr2 (rt := rcx) (by simp)
+    (n := c.M) hMlt (t := base + ufSize 1 + 5) (by simp [ufSize]; omega) hv2 hge (by
+      rw [← hMs]
+      refine ⟨fetch_cast f1 (by omega), fetch_cast f2 (by omega), fetch_cast f3 (by omega),
+        fetch_cast f4 (by omega), trivial⟩))
+
+theorem sim_store_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M)
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .store))
+    {a v : W} {d : List W} (hd : s.dstack = a :: v :: d) {m : Memory 64}
+    (hw : s.mem.write? a v = some m) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := d, mem := m } x' ∧
+      x'.pc = base + isize (.store : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 2 base ++ [.load rax Reg.r15 0, .load rcx Reg.r15 8,
+      .movImm rdx (BitVec.ofNat 64 L.memSize), .cmp rax rdx, .jcc .b (base + ufSize 2 + 6),
+      .exitTrap .badAddress, .storeIdx Reg.r13 rax rcx, .addImm Reg.r15 16]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, f5, f6, f7, _⟩ := hatr
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  have hMlt : c.M < 2 ^ 64 := by have := hg.mb_lt; omega
+  have hv : s.mem.valid a = true := by
+    by_cases hh : s.mem.valid a = true
+    · exact hh
+    · have := (Memory.write?_none_iff s.mem a v).mpr (by simpa using hh); rw [hw] at this; simp at this
+  have hlt : a.toNat < c.M := by
+    have := hs.irvalid a
+    rw [hv] at this
+    simpa using this.symm
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, hm2⟩ := ld_step (code := code) hr1 (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, hm3⟩ := ld_step (code := code) hr2 (j := 1) (v := v)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  have hax3 : x3.regs rax = a := by rw [ho3 rax (by decide), hv2]
+  obtain ⟨x4, hs4, hr4, hpc4, hax4, ho4, hm4⟩ := addr_pass (code := code) hr3 (rt := rdx) (by simp)
+    (n := c.M) hMlt (t := base + ufSize 2 + 6) (by simp [ufSize]; omega) hax3 hlt (by
+      rw [← hMs]
+      refine ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), fetch_cast f4 (by omega),
+        fetch_cast f5 (by omega), trivial⟩)
+  have hcx4 : x4.regs rcx = v := by rw [ho4 rcx (by decide), hv3]
+  obtain ⟨mem', e5, hr5⟩ := st_mem hg hr4 hw hax4 hcx4
+  have hst5 : step code x4 = .next { x4.adv with mem := mem' } := by
+    rw [xstep_of_fetch (fetch_cast f6 (by omega)), e5]
+  have hlen : 2 ≤ ({ s with mem := m } : State 64).dstack.length := by simp [hd]
+  obtain ⟨x6, hs6, hr6, hpc6, _⟩ := adj_step (code := code) hg hr5 (n := 2) hlen (δ := 16) (by simp)
+    (fetch_cast f7 (by simp [M.adv]; omega))
+  have e : ({ s with mem := m } : State 64).dstack.drop 2 = d := by simp [hd]
+  have hr6' : Rel0 c p { s with dstack := d, mem := m } x6 := by
+    have : ({ { s with mem := m } with dstack := ({ s with mem := m } : State 64).dstack.drop 2 } : State 64)
+        = { s with dstack := d, mem := m } := by simp [hd]
+    rw [← this]; exact hr6
+  exact ⟨x6, (((((hs1.trans hs2).trans hs3).trans hs4).trans (XSteps.single hst5))).trans hs6, hr6',
+    by simp [M.adv, isize, ufSize] at *; omega⟩
+
+theorem sim_store_trap (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M)
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off .store))
+    {a v : W} {d : List W} (hd : s.dstack = a :: v :: d) (hw : s.mem.write? a v = none) :
+    XExec code x (.trapped .badAddress) := by
+  have hat' : XAt code base (uf L 2 base ++ [.load rax Reg.r15 0, .load rcx Reg.r15 8,
+      .movImm rdx (BitVec.ofNat 64 L.memSize), .cmp rax rdx, .jcc .b (base + ufSize 2 + 6),
+      .exitTrap .badAddress, .storeIdx Reg.r13 rax rcx, .addImm Reg.r15 16]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, f5, _⟩ := hatr
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  have hMlt : c.M < 2 ^ 64 := by have := hg.mb_lt; omega
+  have hge : ¬ a.toNat < c.M := by
+    have hvv := (Memory.write?_none_iff s.mem a v).mp hw
+    have := hs.irvalid a
+    rw [hvv] at this
+    simpa using this
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, ho2, hm2⟩ := ld_step (code := code) hr1 (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, hm3⟩ := ld_step (code := code) hr2 (j := 1) (v := v)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  have hax3 : x3.regs rax = a := by rw [ho3 rax (by decide), hv2]
+  exact XExec.of_steps ((hs1.trans hs2).trans hs3) (addr_trap (code := code) hr3 (rt := rdx)
+    (by simp) (n := c.M) hMlt (t := base + ufSize 2 + 6) (by simp [ufSize]; omega) hax3 hge (by
+      rw [← hMs]
+      refine ⟨fetch_cast f2 (by omega), fetch_cast f3 (by omega), fetch_cast f4 (by omega),
+        fetch_cast f5 (by omega), trivial⟩))
+
+end Ops
+
+end X86
+end WordDialect

backend/x86_64/X86/SimOps.lean

@@ -0,0 +1,217 @@
+import X86.SimBin
+
+/-!
+# X86.SimOps
+
+Per-instruction simulation theorems. Each states, for an IR instruction `i` whose lowered code
+is placed at `base`:
+* success: from a related state, the x86 model reaches a state related to the IR result;
+* trap: when the IR traps with `t`, the x86 model exits with `t`.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+/-- Operand-count trap: any lowering that starts with `uf n` exits with `stackUnderflow`. -/
+theorem sim_uf_trap {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+    {L : Layout} {base n : Nat} {rest : List (Instr Nat)} (hg : Geom c) (hs : Rel0 c p s x)
+    (hL : L.dEnd = ofN c.dEnd) (hn : 0 < n) (hn3 : n ≤ 3) (hk : s.dstack.length < n)
+    (hpc : x.pc = base) (hat : XAt code base (uf L n base ++ rest)) :
+    XExec code x (.trapped .stackUnderflow) :=
+  uf_trap hg hs hL hn hn3 hk hpc (xat_append.mp hat).1
+
+macro "mid_tac" : tactic =>
+  `(tactic| (intro m a b ha hb
+             simp [xseq, exec, M.arith, M.mov, M.setReg, M.adv, ha, hb, MidSpec]))
+
+theorem sim_bin_instr {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+    {L : Layout} {base : Nat} {off : Nat → Nat} (hg : Geom c) (hL : L.dEnd = ofN c.dEnd)
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (i : WordDialect.Instr 64) (mid : List (Instr Nat))
+    (rr : Reg) (hrr : rr = rax ∨ rr = rcx ∨ rr = rdx ∨ rr = rbx) (f : W → W → W)
+    (hmid : MidSpec mid rr f) (hstr : ∀ j ∈ mid, j.straightX = true)
+    (hlow : lowerInstr L base off i = uf L 2 base ++
+      ([.load rcx r15 0, .load rax r15 8] ++ mid ++ [.store r15 8 rr, .addImm r15 8]))
+    (hsize : isize i = 4 + (4 + mid.length))
+    (hat : XAt code base (lowerInstr L base off i)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := f a b :: d } x' ∧
+      x'.pc = base + isize i := by
+  rw [hlow] at hat
+  obtain ⟨x', h1, h2, h3⟩ := sim_bin_ok hg hL hs hpc mid rr hrr f hmid hstr hat hd
+  exact ⟨x', h1, h2, by rw [h3, hsize]; omega⟩
+
+theorem sim_uf2_trap {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+    {L : Layout} {base : Nat} {off : Nat → Nat} (hg : Geom c) (hL : L.dEnd = ofN c.dEnd)
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (i : WordDialect.Instr 64) (rest : List (Instr Nat))
+    (hlow : lowerInstr L base off i = uf L 2 base ++ rest)
+    (hat : XAt code base (lowerInstr L base off i)) (hk : s.dstack.length < 2) :
+    XExec code x (.trapped .stackUnderflow) := by
+  rw [hlow] at hat
+  exact sim_uf_trap hg hs hL (by decide) (by decide) hk hpc hat
+
+/-! ### Middle computations -/
+
+theorem midspec_arith (i : Instr Nat) (f : W → W → W)
+    (h : ∀ m : M, exec i m = .next (m.arith rax (f (m.regs rax) (m.regs rcx)))) :
+    MidSpec [i] rax f := by
+  intro m a b ha hb
+  refine ⟨m.arith rax (f (m.regs rax) (m.regs rcx)), by simp [xseq, h], ?_⟩
+  simp [M.arith, M.setReg, ha, hb]
+
+theorem midspec_add : MidSpec [.add rax rcx] rax (· + ·) :=
+  midspec_arith _ _ (fun m => by simp [exec])
+theorem midspec_sub : MidSpec [.sub rax rcx] rax (· - ·) :=
+  midspec_arith _ _ (fun m => by simp [exec])
+theorem midspec_mul : MidSpec [.imul rax rcx] rax (· * ·) :=
+  midspec_arith _ _ (fun m => by simp [exec])
+theorem midspec_and : MidSpec [.and rax rcx] rax (· &&& ·) :=
+  midspec_arith _ _ (fun m => by simp [exec])
+theorem midspec_or : MidSpec [.or rax rcx] rax (· ||| ·) :=
+  midspec_arith _ _ (fun m => by simp [exec])
+theorem midspec_xor : MidSpec [.xor rax rcx] rax (· ^^^ ·) :=
+  midspec_arith _ _ (fun m => by simp [exec])
+
+theorem midspec_shl : MidSpec [.movImm rdx 0#64, .shlCl rax, .cmpImm rcx 64, .cmov .ae rax rdx]
+    rax Word.shl := by
+  intro m a b ha hb
+  by_cases h : 64 ≤ BitVec.toNat b
+  · have h' : ¬ BitVec.toNat b < 64 := by omega
+    simp [xseq, exec, M.arith, M.mov, M.setReg, M.adv, ha, hb, holds_ae, BitVec.ule_eq_decide,
+      Word.shl, h, h']
+  · have h' : BitVec.toNat b < 64 := by omega
+    simp [xseq, exec, M.arith, M.mov, M.setReg, M.adv, ha, hb, holds_ae, BitVec.ule_eq_decide,
+      Word.shl, h, h', Nat.mod_eq_of_lt h']
+
+theorem ushiftRight_ge (a : W) (n : Nat) (h : 64 ≤ n) : a >>> n = 0#64 := by
+  apply BitVec.eq_of_toNat_eq
+  rw [BitVec.toNat_ushiftRight, Nat.shiftRight_eq_div_pow]
+  have : a.toNat < 2 ^ n := Nat.lt_of_lt_of_le a.isLt (Nat.pow_le_pow_right (by omega) h)
+  simp [Nat.div_eq_of_lt this]
+
+theorem midspec_shr : MidSpec [.movImm rdx 0#64, .shrCl rax, .cmpImm rcx 64, .cmov .ae rax rdx]
+    rax Word.shr := by
+  intro m a b ha hb
+  by_cases h : 64 ≤ BitVec.toNat b
+  · have h' : ¬ BitVec.toNat b < 64 := by omega
+    simp [xseq, exec, M.arith, M.mov, M.setReg, M.adv, ha, hb, holds_ae, BitVec.ule_eq_decide,
+      Word.shr, h, h', ushiftRight_ge a _ h]
+  · have h' : BitVec.toNat b < 64 := by omega
+    simp [xseq, exec, M.arith, M.mov, M.setReg, M.adv, ha, hb, holds_ae, BitVec.ule_eq_decide,
+      Word.shr, h, h', Nat.mod_eq_of_lt h']
+
+theorem midspec_rotl : MidSpec [.rolCl rax] rax Word.rotl := by
+  intro m a b ha hb
+  simp [xseq, exec, M.arith, M.setReg, ha, hb, Word.rotl, BitVec.rotateLeft]
+
+theorem midspec_rotr : MidSpec [.rorCl rax] rax Word.rotr := by
+  intro m a b ha hb
+  simp [xseq, exec, M.arith, M.setReg, ha, hb, Word.rotr, BitVec.rotateRight]
+
+theorem midspec_cmp (cd : WordDialect.Cond) :
+    MidSpec [.movImm rdx 0#64, .movImm rbx 1#64, .cmp rax rcx, .cmov (ccOf cd) rdx rbx] rdx
+      (fun a b => Word.ofBool (cd.eval a b)) := by
+  intro m a b ha hb
+  cases h : cd.eval a b <;>
+    simp [xseq, exec, M.arith, M.mov, M.setReg, M.adv, ha, hb, holds_ccOf, Word.ofBool, h]
+
+/-! ### Instruction theorems -/
+
+section Ops
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)} {L : Layout}
+  {base : Nat} {off : Nat → Nat}
+
+theorem sim_add_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .add)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := (a + b) :: d } x' ∧
+      x'.pc = base + isize (.add : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .add [.add rax rcx] rax (by simp) (· + ·) midspec_add
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_sub_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .sub)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := (a - b) :: d } x' ∧
+      x'.pc = base + isize (.sub : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .sub [.sub rax rcx] rax (by simp) (· - ·) midspec_sub
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_mul_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .mul)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := (a * b) :: d } x' ∧
+      x'.pc = base + isize (.mul : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .mul [.imul rax rcx] rax (by simp) (· * ·) midspec_mul
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_and_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .and)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := (a &&& b) :: d } x' ∧
+      x'.pc = base + isize (.and : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .and [.and rax rcx] rax (by simp) (· &&& ·) midspec_and
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_or_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .or)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := (a ||| b) :: d } x' ∧
+      x'.pc = base + isize (.or : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .or [.or rax rcx] rax (by simp) (· ||| ·) midspec_or
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_xor_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .xor)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := (a ^^^ b) :: d } x' ∧
+      x'.pc = base + isize (.xor : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .xor [.xor rax rcx] rax (by simp) (· ^^^ ·) midspec_xor
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_shl_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .shl)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := Word.shl a b :: d } x' ∧
+      x'.pc = base + isize (.shl : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .shl _ rax (by simp) Word.shl midspec_shl
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_shr_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .shr)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := Word.shr a b :: d } x' ∧
+      x'.pc = base + isize (.shr : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .shr _ rax (by simp) Word.shr midspec_shr
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_rotl_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .rotl)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := Word.rotl a b :: d } x' ∧
+      x'.pc = base + isize (.rotl : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .rotl _ rax (by simp) Word.rotl midspec_rotl
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_rotr_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .rotr)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := Word.rotr a b :: d } x' ∧
+      x'.pc = base + isize (.rotr : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc .rotr _ rax (by simp) Word.rotr midspec_rotr
+    (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+theorem sim_cmp_ok (cd : WordDialect.Cond) (hg : Geom c) (hL : L.dEnd = ofN c.dEnd)
+    (hs : Rel0 c p s x) (hpc : x.pc = base) (hat : XAt code base (lowerInstr L base off (.cmp cd)))
+    {b a : W} {d : List W} (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧
+      Rel0 c p { s with dstack := Word.ofBool (cd.eval a b) :: d } x' ∧
+      x'.pc = base + isize (.cmp cd : WordDialect.Instr 64) :=
+  sim_bin_instr hg hL hs hpc (.cmp cd) _ rdx (by simp) (fun a b => Word.ofBool (cd.eval a b))
+    (midspec_cmp cd) (by simp [Instr.straightX]) rfl (by simp [isize, ufSize]) hat hd
+
+end Ops
+
+end X86
+end WordDialect

backend/x86_64/X86/SimStack.lean

@@ -0,0 +1,292 @@
+import X86.SimOps
+
+/-!
+# X86.SimStack
+
+Single-instruction step lemmas (`load`/`store`/`addImm` on the data stack, `movImm`, `not`) and
+the simulation theorems for the instructions that only move words on the data stack:
+`word ptr not dup drop swap over rot`.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+section Steps
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+
+theorem ld_step (hs : Rel0 c p s x) {j : Nat} {v : W} (hj : s.dstack[j]? = some v) {rd : Reg}
+    (hrd : rd = rax ∨ rd = rcx ∨ rd = rdx ∨ rd = rbx) {disp : Int} (hd : disp = 8 * (j : Int))
+    (hf : code[x.pc]? = some (.load rd Reg.r15 disp)) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = x.pc + 1 ∧ x'.regs rd = v ∧
+      (∀ r, r ≠ rd → x'.regs r = x.regs r) ∧ x'.mem = x.mem := by
+  refine ⟨x.mov rd v, XSteps.single (by rw [xstep_of_fetch hf, ld_stack hs hj rd hd]),
+    mov_rel0 hs rd (scratch_ne rd hrd) v, ?_, ?_, ?_, ?_⟩
+  · simp [M.mov, M.setReg, M.adv]
+  · simp [M.mov, M.setReg, M.adv]
+  · intro r hr; simp [M.mov, M.setReg, M.adv, hr]
+  · simp [M.mov, M.setReg, M.adv]
+
+theorem st_step (hg : Geom c) (hs : Rel0 c p s x) {j : Nat} (hj : j < s.dstack.length) {rs : Reg}
+    {disp : Int} (hd : disp = 8 * (j : Int)) (hf : code[x.pc]? = some (.store Reg.r15 disp rs)) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := s.dstack.set j (x.regs rs) } x' ∧
+      x'.pc = x.pc + 1 ∧ x'.regs = x.regs := by
+  obtain ⟨mem', e, hr⟩ := st_stack hg hs hj rs hd
+  exact ⟨_, XSteps.single (by rw [xstep_of_fetch hf, e]), hr, by simp [M.adv], by simp [M.adv]⟩
+
+theorem adj_step (hg : Geom c) (hs : Rel0 c p s x) {n : Nat} (hn : n ≤ s.dstack.length) {δ : Int}
+    (hd : δ = 8 * (n : Int)) (hf : code[x.pc]? = some (.addImm Reg.r15 δ)) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := s.dstack.drop n } x' ∧
+      x'.pc = x.pc + 1 ∧ (∀ r, r ≠ Reg.r15 → x'.regs r = x.regs r) := by
+  obtain ⟨e, hr⟩ := adj_drop hg hs hn hd
+  exact ⟨_, XSteps.single (by rw [xstep_of_fetch hf, e]), hr, by simp [M.arith, M.setReg],
+    by intro r hr; simp [M.arith, M.setReg, hr]⟩
+
+theorem movimm_step (hs : Rel0 c p s x) {rd : Reg} (hrd : rd = rax ∨ rd = rcx ∨ rd = rdx ∨ rd = rbx)
+    {v : W} (hf : code[x.pc]? = some (.movImm rd v)) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = x.pc + 1 ∧ x'.regs rd = v ∧
+      (∀ r, r ≠ rd → x'.regs r = x.regs r) ∧ x'.mem = x.mem := by
+  refine ⟨x.mov rd v, XSteps.single (by rw [xstep_of_fetch hf]; rfl),
+    mov_rel0 hs rd (scratch_ne rd hrd) v, ?_, ?_, ?_, ?_⟩
+  · simp [M.mov, M.setReg, M.adv]
+  · simp [M.mov, M.setReg, M.adv]
+  · intro r hr; simp [M.mov, M.setReg, M.adv, hr]
+  · simp [M.mov, M.setReg, M.adv]
+
+theorem not_step (hs : Rel0 c p s x) (hf : code[x.pc]? = some (.not rax)) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p s x' ∧ x'.pc = x.pc + 1 ∧ x'.regs rax = ~~~x.regs rax := by
+  refine ⟨x.mov rax (~~~x.regs rax), XSteps.single (by rw [xstep_of_fetch hf]; rfl),
+    mov_rel0 hs rax (scratch_ne rax (by simp)) _, ?_, ?_⟩
+  · simp [M.mov, M.setReg, M.adv]
+  · simp [M.mov, M.setReg, M.adv]
+
+end Steps
+
+/-- Placement of `ovfD L base ++ [i0, i1, i2]`. -/
+theorem xat_ovf3 {code : List (Instr Nat)} {L : Layout} {base : Nat} {i0 i1 i2 : Instr Nat}
+    (hat : XAt code base (ovfD L base ++ [i0, i1, i2])) :
+    XAt code base (ovfD L base) ∧ code[base + 4]? = some i0 ∧ code[base + 4 + 1]? = some i1 ∧
+      code[base + 4 + 1 + 1]? = some i2 := by
+  obtain ⟨hato, hatr⟩ := xat_append.mp hat
+  have hl : (ovfD L base).length = 4 := rfl
+  rw [hl] at hatr
+  obtain ⟨f0, f1, f2, _⟩ := hatr
+  exact ⟨hato, f0, f1, f2⟩
+
+/-- Placement of `uf L n base ++ ovfD L (base + ufSize n) ++ [i0, i1, i2]`. -/
+theorem xat_uf_ovf {code : List (Instr Nat)} {L : Layout} {base n : Nat} (hn : 0 < n)
+    {i0 i1 i2 : Instr Nat} {rest : List (Instr Nat)} (hrest : rest = [i0, i1, i2])
+    (hat : XAt code base (uf L n base ++ ovfD L (base + ufSize n) ++ rest)) :
+    XAt code base (uf L n base) ∧ XAt code (base + 4) (ovfD L (base + 4)) ∧
+      code[base + 8]? = some i0 ∧ code[base + 8 + 1]? = some i1 ∧ code[base + 8 + 1 + 1]? = some i2 := by
+  subst hrest
+  rw [ufSize_pos hn] at hat
+  obtain ⟨hatuo, hatr⟩ := xat_append.mp hat
+  obtain ⟨hatuf, hato⟩ := xat_append.mp hatuo
+  have hufl : (uf L n base).length = 4 := by rw [uf_eq L hn]; rfl
+  rw [hufl] at hato
+  have hl : (uf L n base ++ ovfD L (base + 4)).length = 8 := by simp [hufl, ovfD]
+  rw [hl] at hatr
+  obtain ⟨f0, f1, f2, _⟩ := hatr
+  exact ⟨hatuf, hato, f0, f1, f2⟩
+
+section Ops
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {code : List (Instr Nat)}
+  {L : Layout} {base : Nat} {off : Nat → Nat}
+
+theorem sim_not_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .not)) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := (~~~a) :: d } x' ∧
+      x'.pc = base + isize (.not : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 1 base ++ [.load rax Reg.r15 0, .not rax, .store Reg.r15 0 rax]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 1 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, _⟩ := hatr
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_step (code := code) hr1 (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3⟩ := not_step (code := code) hr2 (fetch_cast f1 (by omega))
+  obtain ⟨x4, hs4, hr4, hpc4, _⟩ := st_step (code := code) hg hr3 (j := 0) (by simp [hd])
+    (rs := rax) (disp := 0) (by simp) (fetch_cast f2 (by omega))
+  have e : s.dstack.set 0 (x3.regs rax) = (~~~a) :: d := by simp [hd, hv3, hv2]
+  rw [e] at hr4
+  exact ⟨x4, ((hs1.trans hs2).trans hs3).trans hs4, hr4, by simp [isize, ufSize]; omega⟩
+
+theorem sim_dup_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off .dup)) {a : W}
+    {d : List W} (hd : s.dstack = a :: d) (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a :: a :: d } x' ∧
+      x'.pc = base + isize (.dup : WordDialect.Instr 64) := by
+  obtain ⟨hatuf, hato, f0, f1, f2⟩ := xat_uf_ovf (L := L) (n := 1) (by decide) rfl hat
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x1', hs1', hr1', hpc1', _, _⟩ := ovfD_pass hg hr1 hLd hfit hpc1 hato
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_step (code := code) hr1' (j := 0) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, _⟩ := push_pair hg hr2 rax (by decide) hfit
+    ⟨fetch_cast f1 (by omega), fetch_cast f2 (by omega), trivial⟩
+  rw [hv2, hd] at hr3
+  exact ⟨x3, ((hs1.trans hs1').trans hs2).trans hs3, hr3, by simp [isize, ufSize]; omega⟩
+
+theorem sim_dup_ovf (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off .dup)) {a : W}
+    {d : List W} (hd : s.dstack = a :: d) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    XExec code x .overflow := by
+  obtain ⟨hatuf, hato, _⟩ := xat_uf_ovf (L := L) (n := 1) (by decide) rfl hat
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := uf_pass hg hs hL (by decide) (by decide) (by simp [hd]) hpc hatuf
+  exact XExec.of_steps hs1 (ovfD_trap hg hr1 hLd h hpc1 hato)
+
+theorem sim_drop_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .drop)) {a : W} {d : List W}
+    (hd : s.dstack = a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := d } x' ∧
+      x'.pc = base + isize (.drop : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 1 base ++ [.addImm Reg.r15 8]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 1 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, _⟩ := hatr
+  have hk : 1 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, _⟩ := adj_step (code := code) hg hr1 (n := 1) (by simp [hd])
+    (δ := 8) (by simp) (fetch_cast f0 (by omega))
+  have e : (s.dstack).drop 1 = d := by simp [hd]
+  rw [e] at hr2
+  exact ⟨x2, hs1.trans hs2, hr2, by simp [isize, ufSize]; omega⟩
+
+theorem sim_word_ok (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) (w : W)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off (.word w)))
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := w :: s.dstack } x' ∧
+      x'.pc = base + isize (.word w : WordDialect.Instr 64) := by
+  obtain ⟨hato, f0, f1, f2⟩ := xat_ovf3 (L := L) (by exact hat)
+  obtain ⟨x0, hs0, hr0, hpc0, _, _⟩ := ovfD_pass hg hs hLd hfit hpc hato
+  obtain ⟨x1, hs1, hr1, hpc1, hv1, _⟩ := movimm_step (code := code) hr0 (rd := rax) (by simp)
+    (v := w) (by rw [hpc0]; exact f0)
+  obtain ⟨x2, hs2, hr2, hpc2, _⟩ := push_pair hg hr1 rax (by decide) hfit
+    ⟨fetch_cast f1 (by omega), fetch_cast f2 (by omega), trivial⟩
+  rw [hv1] at hr2
+  exact ⟨x2, (hs0.trans hs1).trans hs2, hr2, by simp [isize]; omega⟩
+
+theorem sim_word_ovf (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) (w : W)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off (.word w)))
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) : XExec code x .overflow := by
+  obtain ⟨hato, _⟩ := xat_ovf3 (L := L) (by exact hat)
+  exact ovfD_trap hg hs hLd h hpc hato
+
+theorem sim_ptr_ok (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) (q : WordDialect.Ptr 64)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off (.ptr q)))
+    (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := q.toWord :: s.dstack } x' ∧
+      x'.pc = base + isize (.ptr q : WordDialect.Instr 64) :=
+  sim_word_ok (L := L) (off := off) hg hs hpc q.toWord hLd hat hfit
+
+theorem sim_ptr_ovf (hg : Geom c) (hs : Rel0 c p s x) (hpc : x.pc = base) (q : WordDialect.Ptr 64)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off (.ptr q)))
+    (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) : XExec code x .overflow :=
+  sim_word_ovf (L := L) (off := off) hg hs hpc q.toWord hLd hat h
+
+theorem sim_swap_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .swap)) {b a : W} {d : List W}
+    (hd : s.dstack = b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a :: b :: d } x' ∧
+      x'.pc = base + isize (.swap : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 2 base ++ [.load rax Reg.r15 0, .load rcx Reg.r15 8,
+      .store Reg.r15 0 rcx, .store Reg.r15 8 rax]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 2 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, _⟩ := hatr
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_step (code := code) hr1 (j := 0) (v := b)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, _⟩ := ld_step (code := code) hr2 (j := 1) (v := a)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  have hax3 : x3.regs rax = b := by rw [ho3 rax (by decide), hv2]
+  obtain ⟨x4, hs4, hr4, hpc4, hreg4⟩ := st_step (code := code) hg hr3 (j := 0) (by simp [hd])
+    (rs := rcx) (disp := 0) (by simp) (fetch_cast f2 (by omega))
+  have hlen : 1 < ({ s with dstack := s.dstack.set 0 (x3.regs rcx) } : State 64).dstack.length := by
+    simp [hd]
+  obtain ⟨x5, hs5, hr5, hpc5, _⟩ := st_step (code := code) hg hr4 (j := 1) hlen
+    (rs := rax) (disp := 8) (by simp) (fetch_cast f3 (by omega))
+  have hr5' : Rel0 c p { s with dstack := (s.dstack.set 0 (x3.regs rcx)).set 1 (x4.regs rax) } x5 := hr5
+  have e : (s.dstack.set 0 (x3.regs rcx)).set 1 (x4.regs rax) = a :: b :: d := by
+    simp [hd, hv3, hreg4, hax3]
+  rw [e] at hr5'
+  exact ⟨x5, (((hs1.trans hs2).trans hs3).trans hs4).trans hs5, hr5', by simp [isize, ufSize]; omega⟩
+
+theorem sim_over_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off .over)) {b a : W}
+    {d : List W} (hd : s.dstack = b :: a :: d) (hfit : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a :: b :: a :: d } x' ∧
+      x'.pc = base + isize (.over : WordDialect.Instr 64) := by
+  obtain ⟨hatuf, hato, f0, f1, f2⟩ := xat_uf_ovf (L := L) (n := 2) (by decide) rfl hat
+  have hk : 2 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x1', hs1', hr1', hpc1', _, _⟩ := ovfD_pass hg hr1 hLd hfit hpc1 hato
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_step (code := code) hr1' (j := 1) (v := a)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 8) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, _⟩ := push_pair hg hr2 rax (by decide) hfit
+    ⟨fetch_cast f1 (by omega), fetch_cast f2 (by omega), trivial⟩
+  rw [hv2, hd] at hr3
+  exact ⟨x3, ((hs1.trans hs1').trans hs2).trans hs3, hr3, by simp [isize, ufSize]; omega⟩
+
+theorem sim_over_ovf (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hat : XAt code base (lowerInstr L base off .over)) {b a : W}
+    {d : List W} (hd : s.dstack = b :: a :: d) (h : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd) :
+    XExec code x .overflow := by
+  obtain ⟨hatuf, hato, _⟩ := xat_uf_ovf (L := L) (n := 2) (by decide) rfl hat
+  obtain ⟨x1, hs1, hr1, hpc1, _, _⟩ := uf_pass hg hs hL (by decide) (by decide) (by simp [hd]) hpc hatuf
+  exact XExec.of_steps hs1 (ovfD_trap hg hr1 hLd h hpc1 hato)
+
+theorem sim_rot_ok (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hs : Rel0 c p s x) (hpc : x.pc = base)
+    (hat : XAt code base (lowerInstr L base off .rot)) {cc b a : W} {d : List W}
+    (hd : s.dstack = cc :: b :: a :: d) :
+    ∃ x', XSteps code x x' ∧ Rel0 c p { s with dstack := a :: cc :: b :: d } x' ∧
+      x'.pc = base + isize (.rot : WordDialect.Instr 64) := by
+  have hat' : XAt code base (uf L 3 base ++ [.load rax Reg.r15 0, .load rcx Reg.r15 8,
+      .load rdx Reg.r15 16, .store Reg.r15 0 rdx, .store Reg.r15 8 rax, .store Reg.r15 16 rcx]) := hat
+  obtain ⟨hatuf, hatr⟩ := xat_append.mp hat'
+  have hufl : (uf L 3 base).length = 4 := by simp [uf]
+  rw [hufl] at hatr
+  obtain ⟨f0, f1, f2, f3, f4, f5, _⟩ := hatr
+  have hk : 3 ≤ s.dstack.length := by simp [hd]
+  obtain ⟨x1, hs1, hr1, hpc1, hm1, _⟩ := uf_pass hg hs hL (by decide) (by decide) hk hpc hatuf
+  obtain ⟨x2, hs2, hr2, hpc2, hv2, _, _⟩ := ld_step (code := code) hr1 (j := 0) (v := cc)
+    (by simp [hd]) (rd := rax) (by simp) (disp := 0) (by simp) (fetch_cast f0 (by omega))
+  obtain ⟨x3, hs3, hr3, hpc3, hv3, ho3, _⟩ := ld_step (code := code) hr2 (j := 1) (v := b)
+    (by simp [hd]) (rd := rcx) (by simp) (disp := 8) (by simp) (fetch_cast f1 (by omega))
+  obtain ⟨x4, hs4, hr4, hpc4, hv4, ho4, _⟩ := ld_step (code := code) hr3 (j := 2) (v := a)
+    (by simp [hd]) (rd := rdx) (by simp) (disp := 16) (by simp) (fetch_cast f2 (by omega))
+  have hax4 : x4.regs rax = cc := by rw [ho4 rax (by decide), ho3 rax (by decide), hv2]
+  have hcx4 : x4.regs rcx = b := by rw [ho4 rcx (by decide), hv3]
+  obtain ⟨x5, hs5, hr5, hpc5, hreg5⟩ := st_step (code := code) hg hr4 (j := 0) (by simp [hd])
+    (rs := rdx) (disp := 0) (by simp) (fetch_cast f3 (by omega))
+  have hl1 : 1 < ({ s with dstack := s.dstack.set 0 (x4.regs rdx) } : State 64).dstack.length := by
+    simp [hd]
+  obtain ⟨x6, hs6, hr6, hpc6, hreg6⟩ := st_step (code := code) hg hr5 (j := 1) hl1
+    (rs := rax) (disp := 8) (by simp) (fetch_cast f4 (by omega))
+  have hl2 : 2 < ({ { s with dstack := s.dstack.set 0 (x4.regs rdx) } with
+      dstack := (s.dstack.set 0 (x4.regs rdx)).set 1 (x5.regs rax) } : State 64).dstack.length := by
+    simp [hd]
+  obtain ⟨x7, hs7, hr7, hpc7, _⟩ := st_step (code := code) hg hr6 (j := 2) hl2
+    (rs := rcx) (disp := 16) (by simp) (fetch_cast f5 (by omega))
+  have hr7' : Rel0 c p { s with dstack := ((s.dstack.set 0 (x4.regs rdx)).set 1 (x5.regs rax)).set 2 (x6.regs rcx) } x7 := hr7
+  have e : ((s.dstack.set 0 (x4.regs rdx)).set 1 (x5.regs rax)).set 2 (x6.regs rcx) =
+      a :: cc :: b :: d := by
+    simp [hd, hv4, hreg5, hreg6, hax4, hcx4]
+  rw [e] at hr7'
+  exact ⟨x7, (((((hs1.trans hs2).trans hs3).trans hs4).trans hs5).trans hs6).trans hs7, hr7',
+    by simp [isize, ufSize]; omega⟩
+
+end Ops
+
+end X86
+end WordDialect

backend/x86_64/X86/SimStep.lean

@@ -0,0 +1,353 @@
+import X86.SimAux
+
+/-!
+# X86.SimStep
+
+One IR step is simulated by the lowered x86 code, for every instruction and every outcome
+(`next`, `halted`, `trapped`). This is the case analysis over the whole instruction set that the
+whole-program theorem iterates.
+
+Every instruction that grows the data stack or the auxiliary stack, and every `call`, first checks
+for room and exits with `overflow` when the stack is full. So `sim_exec` has no capacity hypothesis: the code either
+simulates the IR step, or the state lacks the headroom `Fits` describes and the code overflows.
+-/
+
+namespace WordDialect
+namespace X86
+
+open Reg
+
+/-- Headroom for one step: room to push one data word, two return addresses' worth of native
+stack, and one auxiliary word. -/
+def Fits (c : Cfg) (s : State 64) : Prop :=
+  c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd ∧ s.rstack.length + 2 ≤ c.rcap ∧
+    c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd
+
+/-- What simulating an IR outcome means on the x86 side. -/
+def Sim (c : Cfg) (p : Prog 64) (code : List (Instr Nat)) (x : M) : Outcome 64 → Prop
+  | .next s' => ∃ x', XSteps code x x' ∧ Rel c p s' x'
+  | .halted s' => ∃ x', XExec code x (.halted x') ∧ Rel0 c p s' x'
+  | .trapped t => XExec code x (.trapped t)
+
+theorem shape1 {l : List W} (h : 1 ≤ l.length) : ∃ a d, l = a :: d := by
+  cases l with
+  | nil => simp at h
+  | cons a d => exact ⟨a, d, rfl⟩
+
+theorem shape2 {l : List W} (h : 2 ≤ l.length) : ∃ b a d, l = b :: a :: d := by
+  cases l with
+  | nil => simp at h
+  | cons b l =>
+    cases l with
+    | nil => simp at h
+    | cons a d => exact ⟨b, a, d, rfl⟩
+
+theorem shape3 {l : List W} (h : 3 ≤ l.length) : ∃ cc y v d, l = cc :: y :: v :: d := by
+  cases l with
+  | nil => simp at h
+  | cons cc l =>
+    cases l with
+    | nil => simp at h
+    | cons y l =>
+      cases l with
+      | nil => simp at h
+      | cons v d => exact ⟨cc, y, v, d, rfl⟩
+
+theorem lowerInstr_uf (L : Layout) (base : Nat) (off : Nat → Nat) (i : WordDialect.Instr 64)
+    (h : 0 < i.pops) :
+    ∃ rest, lowerInstr L base off i = uf L i.pops base ++ rest ∧ i.pops ≤ 3 := by
+  cases i <;> first | exact ⟨_, rfl, by simp [Instr.pops]⟩ | exact absurd h (by simp [Instr.pops])
+
+theorem Rel0.setPc {c : Cfg} {p : Prog 64} {s : State 64} {x : M} (h : Rel0 c p s x) (n : Nat) :
+    Rel0 c p { s with pc := n } x :=
+  { r15 := h.r15, r14 := h.r14, r13 := h.r13, r12 := h.r12, rsp := h.rsp, rbp := h.rbp,
+    stack := h.stack, regs := h.regs, mem := h.mem, rs := h.rs, aux := h.aux, irvalid := h.irvalid,
+    xvalid := h.xvalid, capD := h.capD, capR := h.capR, capA := h.capA }
+
+section Step
+
+variable {c : Cfg} {p : Prog 64} {s : State 64} {x : M} {L : Layout}
+
+theorem sim_next {code : List (Instr Nat)} {s' : State 64}
+    (h : ∃ x', XSteps code x x' ∧ Rel c p s' x') : Sim c p code x (.next s') := h
+
+theorem sim_halted {code : List (Instr Nat)} {s' : State 64}
+    (h : ∃ x', XExec code x (.halted x') ∧ Rel0 c p s' x') : Sim c p code x (.halted s') := h
+
+theorem sim_trapped {code : List (Instr Nat)} {t : Trap} (h : XExec code x (.trapped t)) :
+    Sim c p code x (.trapped t) := h
+
+theorem rel_fall {i : WordDialect.Instr 64} (hi : p[s.pc]? = some i) {s' : State 64}
+    {x' : M} (h0 : Rel0 c p s' x') (hpc : x'.pc = offs p s.pc + isize i) :
+    Rel c p { s' with pc := s.pc + 1 } x' :=
+  ⟨h0.setPc _, by rw [hpc, offs_succ hi]⟩
+
+theorem sim_exec (hg : Geom c) (hL : L.dEnd = ofN c.dEnd) (hMs : L.memSize = c.M)
+    (hLd : L.dLim = ofN (c.dBase + 8)) (hLr : L.rGap = ofN (8 * c.rcap - 16))
+    (hLa : L.aEnd = ofN c.aEnd) (hLal : L.aLim = ofN (c.aBase + 8))
+    (hsz : ∀ k, offs p k < 2 ^ 64) (hs : Rel c p s x)
+    {i : WordDialect.Instr 64} (hi : p[s.pc]? = some i)
+    (hreg : ∀ r, (i = .push r ∨ i = .pop r) → r < c.nregs) :
+    Sim c p (lowerProg L p) x (WordDialect.exec i s) ∨
+      (¬ Fits c s ∧ XExec (lowerProg L p) x .overflow) := by
+  have nfD : ¬ c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd → ¬ Fits c s := fun h hf => h hf.1
+  have nfR : ¬ s.rstack.length + 2 ≤ c.rcap → ¬ Fits c s := fun h hf => h hf.2.1
+  have nfA : ¬ c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd → ¬ Fits c s := fun h hf => h hf.2.2
+  have hpc : x.pc = offs p s.pc := hs.2
+  have hs0 : Rel0 c p s x := hs.1
+  have hat := lowerProg_at L p s.pc i hi
+  by_cases hk : s.dstack.length < i.pops
+  · rw [exec_underflow i s hk]
+    obtain ⟨rest, hlow, h3⟩ := lowerInstr_uf L (offs p s.pc) (offs p) i (by omega)
+    rw [hlow] at hat
+    exact .inl <| sim_trapped (sim_uf_trap hg hs0 hL (by omega) h3 hk hpc hat)
+  · have hk' : i.pops ≤ s.dstack.length := by omega
+    cases i with
+    | word w =>
+      by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+      rotate_left
+      · exact .inr ⟨nfD hf, sim_word_ovf hg hs0 hpc w hLd hat hf⟩
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_word_ok hg hs0 hpc w hLd hat hf
+      rw [exec_word]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | ptr q =>
+      by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+      rotate_left
+      · exact .inr ⟨nfD hf, sim_ptr_ovf hg hs0 hpc q hLd hat hf⟩
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_ptr_ok hg hs0 hpc q hLd hat hf
+      rw [exec_ptr]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | load =>
+      obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+      cases hm : s.mem.read? a with
+      | none =>
+        rw [exec_load_bad hd hm]
+        exact .inl <| sim_trapped (sim_load_trap hg hL hMs hs0 hpc hat hd hm)
+      | some v =>
+        obtain ⟨x', hst, h0, hpc'⟩ := sim_load_ok hg hL hMs hs0 hpc hat hd hm
+        rw [exec_load hd hm]
+        exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | store =>
+      obtain ⟨a, v, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      cases hm : s.mem.write? a v with
+      | none =>
+        rw [exec_store_bad hd hm]
+        exact .inl <| sim_trapped (sim_store_trap hg hL hMs hs0 hpc hat hd hm)
+      | some m =>
+        obtain ⟨x', hst, h0, hpc'⟩ := sim_store_ok hg hL hMs hs0 hpc hat hd hm
+        rw [exec_store hd hm]
+        exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | add =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_add_ok hg hL hs0 hpc hat hd
+      rw [exec_add hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | sub =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_sub_ok hg hL hs0 hpc hat hd
+      rw [exec_sub hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | mul =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_mul_ok hg hL hs0 hpc hat hd
+      rw [exec_mul hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | and =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_and_ok hg hL hs0 hpc hat hd
+      rw [exec_and hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | or =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_or_ok hg hL hs0 hpc hat hd
+      rw [exec_or hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | xor =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_xor_ok hg hL hs0 hpc hat hd
+      rw [exec_xor hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | shl =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_shl_ok hg hL hs0 hpc hat hd
+      rw [exec_shl hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | shr =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_shr_ok hg hL hs0 hpc hat hd
+      rw [exec_shr hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | rotl =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_rotl_ok hg hL hs0 hpc hat hd
+      rw [exec_rotl hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | rotr =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_rotr_ok hg hL hs0 hpc hat hd
+      rw [exec_rotr hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | cmp cd =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_cmp_ok cd hg hL hs0 hpc hat hd
+      rw [exec_cmp hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | div =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      by_cases hb : b = 0#64
+      · subst hb
+        rw [exec_div_zero hd]
+        exact .inl <| sim_trapped (sim_div_zero hg hL hs0 hpc hat hd)
+      · obtain ⟨x', hst, h0, hpc'⟩ := sim_div_ok hg hL hs0 hpc hat hd hb
+        rw [exec_div hd hb]
+        exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | sdiv =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      by_cases hb : b = 0#64
+      · subst hb
+        rw [exec_sdiv_zero hd]
+        exact .inl <| sim_trapped (sim_sdiv_zero hg hL hs0 hpc hat hd)
+      · obtain ⟨x', hst, h0, hpc'⟩ := sim_sdiv_ok hg hL hs0 hpc hat hd hb
+        rw [exec_sdiv hd hb]
+        exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | not =>
+      obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_not_ok hg hL hs0 hpc hat hd
+      rw [exec_not hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | select =>
+      obtain ⟨cc, y, v, d, hd⟩ := shape3 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_select_ok hg hL hs0 hpc hat hd
+      rw [exec_select hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | jmp t =>
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_jmp_ok hs0 hpc hat
+      exact .inl <| sim_next ⟨x', hst, h0.setPc _, hpc'⟩
+    | branch t =>
+      obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_branch_ok hg hL hs0 hpc hat hd
+      by_cases hc : Word.isTrue a = true
+      · have e : WordDialect.exec (WordDialect.Instr.branch t) s = .next { s with pc := t, dstack := d } := by
+          simp [WordDialect.exec, hd, hc]
+        rw [e]
+        simp only [hc, if_true] at hpc'
+        exact .inl <| sim_next ⟨x', hst, h0.setPc _, hpc'⟩
+      · have hc' : Word.isTrue a = false := by simpa using hc
+        have e : WordDialect.exec (WordDialect.Instr.branch t) s = s.fall d := by simp [WordDialect.exec, hd, hc']
+        rw [e]
+        simp only [hc', Bool.false_eq_true, if_false] at hpc'
+        exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | call t =>
+      have hret : offs p s.pc + isize (.call t : WordDialect.Instr 64) = offs p (s.pc + 1) := by
+        rw [offs_succ hi]
+      by_cases hf : s.rstack.length + 2 ≤ c.rcap
+      rotate_left
+      · exact .inr ⟨nfR hf, sim_call_ovf hg hs0 hpc hLr hat hf⟩
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_call_ok hg hs0 hpc hLr hat hret hf
+      exact .inl <| sim_next ⟨x', hst, h0.setPc _, hpc'⟩
+    | ret =>
+      cases hr : s.rstack with
+      | nil =>
+        have e : WordDialect.exec WordDialect.Instr.ret s = .trapped .returnUnderflow := by simp [WordDialect.exec, hr]
+        rw [e]
+        exact .inl <| sim_trapped (sim_ret_trap hs0 hpc hat hr)
+      | cons a rs =>
+        obtain ⟨x', hst, h0, hpc'⟩ := sim_ret_ok hg hs0 hpc hat hr (hsz a)
+        have e : WordDialect.exec WordDialect.Instr.ret s = .next { s with pc := a, rstack := rs } := by simp [WordDialect.exec, hr]
+        rw [e]
+        exact .inl <| sim_next ⟨x', hst, h0.setPc _, hpc'⟩
+    | push r =>
+      by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+      rotate_left
+      · exact .inr ⟨nfD hf, sim_push_ovf hg hs0 hpc hLd hat hf⟩
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_push_ok hg hs0 hpc (hreg r (Or.inl rfl)) hLd hat hf
+      rw [exec_push]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | pop r =>
+      obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_pop_ok hg hL hs0 hpc (hreg r (Or.inr rfl)) hat hd
+      rw [exec_pop hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | dup =>
+      obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+      by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+      rotate_left
+      · exact .inr ⟨nfD hf, sim_dup_ovf hg hL hs0 hpc hLd hat hd hf⟩
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_dup_ok hg hL hs0 hpc hLd hat hd hf
+      rw [exec_dup hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | drop =>
+      obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_drop_ok hg hL hs0 hpc hat hd
+      rw [exec_drop hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | swap =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_swap_ok hg hL hs0 hpc hat hd
+      rw [exec_swap hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | over =>
+      obtain ⟨b, a, d, hd⟩ := shape2 (by simpa [Instr.pops] using hk')
+      by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+      rotate_left
+      · exact .inr ⟨nfD hf, sim_over_ovf hg hL hs0 hpc hLd hat hd hf⟩
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_over_ok hg hL hs0 hpc hLd hat hd hf
+      rw [exec_over hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | rot =>
+      obtain ⟨cc, b, a, d, hd⟩ := shape3 (by simpa [Instr.pops] using hk')
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_rot_ok hg hL hs0 hpc hat hd
+      rw [exec_rot hd]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | tor =>
+      obtain ⟨a, d, hd⟩ := shape1 (by simpa [Instr.pops] using hk')
+      by_cases hf : c.aBase + 8 * (s.astack.length + 1) ≤ c.aEnd
+      rotate_left
+      · exact .inr ⟨nfA hf, sim_tor_ovf hg hL hLal hs0 hpc hat (by simp [hd]) hf⟩
+      obtain ⟨x', hst, h0, hpc'⟩ := sim_tor_ok hg hL hLal hs0 hpc hat hd hf
+      have e : WordDialect.exec WordDialect.Instr.tor s =
+          .next { s with pc := s.pc + 1, dstack := d, astack := a :: s.astack } := by
+        simp [WordDialect.exec, hd]
+      rw [e]
+      exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | fromr =>
+      cases ha : s.astack with
+      | nil =>
+        have e : WordDialect.exec WordDialect.Instr.fromr s = .trapped .returnUnderflow := by
+          simp [WordDialect.exec, ha]
+        rw [e]
+        exact .inl <| sim_trapped (sim_fromr_trap hg hLa hs0 hpc hat ha)
+      | cons a as =>
+        by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+        rotate_left
+        · exact .inr ⟨nfD hf, sim_fromr_ovf hg hLa hLd hs0 hpc hat (by simp [ha]) hf⟩
+        obtain ⟨x', hst, h0, hpc'⟩ := sim_fromr_ok hg hLa hLd hs0 hpc hat ha hf
+        have e : WordDialect.exec WordDialect.Instr.fromr s =
+            .next { s with pc := s.pc + 1, dstack := a :: s.dstack, astack := as } := by
+          simp [WordDialect.exec, ha]
+        rw [e]
+        exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | rfetch =>
+      cases ha : s.astack with
+      | nil =>
+        have e : WordDialect.exec WordDialect.Instr.rfetch s = .trapped .returnUnderflow := by
+          simp [WordDialect.exec, ha]
+        rw [e]
+        exact .inl <| sim_trapped (sim_rfetch_trap hg hLa hs0 hpc hat ha)
+      | cons a as =>
+        by_cases hf : c.dBase + 8 * (s.dstack.length + 1) ≤ c.dEnd
+        rotate_left
+        · exact .inr ⟨nfD hf, sim_rfetch_ovf hg hLa hLd hs0 hpc hat (by simp [ha]) hf⟩
+        obtain ⟨x', hst, h0, hpc'⟩ := sim_rfetch_ok hg hLa hLd hs0 hpc hat ha hf
+        have e : WordDialect.exec WordDialect.Instr.rfetch s = s.fall (a :: s.dstack) := by
+          simp [WordDialect.exec, ha]
+        rw [e]
+        exact .inl <| sim_next ⟨x', hst, rel_fall hi h0 hpc'⟩
+    | halt =>
+      rw [exec_halt]
+      exact .inl <| sim_halted ⟨x, sim_halt hs0 hpc hat, hs0⟩
+
+end Step
+
+end X86
+end WordDialect

bcpl/BCPL.lean

@@ -0,0 +1,5 @@
+import BCPL.Semantics
+import BCPL.Compile
+import BCPL.ExprCorrect
+import BCPL.Correct
+import BCPL.Example

bcpl/BCPL/Compile.lean

@@ -0,0 +1,63 @@
+import BCPL.Semantics
+
+/-!
+# BCPL.Compile
+
+Lowering of BCPL to Universal Word IR. There is no BCPL runtime: variables are memory cells
+at `addr x`, expressions leave their value on the data stack, and statements leave the data
+stack as they found it.
+-/
+
+namespace WordDialect
+namespace BCPL
+
+open IR
+
+def binCode {n : Nat} : BinOp → List (Instr n)
+  | .add => [.add]
+  | .sub => [.sub]
+  | .mul => [.mul]
+  | .div => [.sdiv]
+  | .and => [.and]
+  | .or => [.or]
+  | .neqv => [.xor]
+  | .shl => [.shl]
+  | .shr => [.shr]
+  | .eq => cmpFlagCode .eq
+  | .ne => cmpFlagCode .ne
+  | .lt => cmpFlagCode .slt
+  | .gt => cmpFlagCode .sgt
+  | .le => cmpFlagCode .sle
+  | .ge => cmpFlagCode .sge
+
+/-- `neg`: compute `0 - v` as `v 0 SWAP SUB`. -/
+def unCode {n : Nat} : UnOp → List (Instr n)
+  | .neg => [.word 0#n, .swap, .sub]
+  | .not => [.not]
+
+def compileE {n : Nat} (addr : Var → Word n) : Expr → List (Instr n)
+  | .num z => [.word (BitVec.ofInt n z)]
+  | .var x => [.word (addr x), .load]
+  | .addrOf x => [.word (addr x)]
+  | .rv e => compileE addr e ++ [.load]
+  | .un o e => compileE addr e ++ unCode o
+  | .bin o a b => compileE addr a ++ compileE addr b ++ binCode o
+
+/-- Right-hand side first, then (for an indirect target) the address, then `STORE`. -/
+def assignCode {n : Nat} (addr : Var → Word n) : LVal → Expr → List (Instr n)
+  | .var x, e => compileE addr e ++ [.word (addr x), .store]
+  | .rv a, e => compileE addr e ++ compileE addr a ++ [.store]
+
+def compile {n : Nat} (addr : Var → Word n) : Stmt → Frag n
+  | .skip => Frag.empty
+  | .assign l e => Frag.ofCode (assignCode addr l e)
+  | .seq a b => (compile addr a).seq (compile addr b)
+  | .test c t e => (Frag.ofCode (compileE addr c)).seq (Frag.ite (compile addr t) (compile addr e))
+  | .while c body => Frag.whileLoop (Frag.ofCode (compileE addr c)) (compile addr body)
+
+/-- A complete program: the statement at address 0, followed by `HALT`. -/
+def compileProgram {n : Nat} (addr : Var → Word n) (s : Stmt) : Prog n :=
+  (compile addr s).emit 0 ++ [.halt]
+
+end BCPL
+end WordDialect

bcpl/BCPL/Correct.lean

@@ -0,0 +1,298 @@
+import BCPL.ExprCorrect
+
+/-!
+# BCPL.Correct
+
+Translation correctness of the BCPL lowering.
+
+`compile_correct`: whenever the reference semantics derives result `r` for statement `s`
+from memory `m`, the machine, started at the statement's address with memory `m`, either
+* reaches (via `Steps`) the end of the statement's code with the data stack unchanged and
+  memory equal to the BCPL result, or
+* reaches a state whose next step traps with exactly the trap BCPL reports.
+
+`compileProgram_correct` lifts this to a whole program run from the initial machine state.
+-/
+
+namespace WordDialect
+namespace BCPL
+
+open IR
+
+theorem assignCode_ok {n : Nat} (addr : Var → Word n) (l : LVal) (e : Expr) (s : State n)
+    (m' : Memory n) (h : assignSem addr l e s.mem = .ok m') :
+    execSeq (assignCode addr l e) s =
+      .next { s with pc := s.pc + (assignCode addr l e).length, mem := m' } := by
+  cases l with
+  | var x =>
+    simp only [assignSem] at h
+    split at h
+    · cases h
+    · rename_i v hv
+      simp only [writeW] at h
+      split at h
+      · rename_i hw; cases h
+        rw [assignCode, execSeq_append, compileE_ok addr e s v hv]
+        simp [Outcome.andThen, execSeq, exec, State.fall, hw, Nat.add_assoc]
+      · cases h
+  | rv a =>
+    simp only [assignSem] at h
+    split at h
+    · cases h
+    · rename_i v hv
+      split at h
+      · cases h
+      · rename_i a' ha
+        simp only [writeW] at h
+        split at h
+        · rename_i hw; cases h
+          rw [assignCode, execSeq_append, execSeq_append, compileE_ok addr e s v hv]
+          simp only [Outcome.andThen]
+          rw [compileE_ok addr a { s with pc := s.pc + (compileE addr e).length, dstack := v :: s.dstack } a' ha]
+          simp [Outcome.andThen, execSeq, exec, State.fall, hw, Nat.add_assoc]
+        · cases h
+
+theorem assignCode_err {n : Nat} (addr : Var → Word n) (l : LVal) (e : Expr) (s : State n)
+    (t : Trap) (h : assignSem addr l e s.mem = .error t) :
+    execSeq (assignCode addr l e) s = .trapped t := by
+  cases l with
+  | var x =>
+    simp only [assignSem] at h
+    split at h
+    · rename_i _ ht; cases h
+      rw [assignCode, execSeq_append, compileE_err addr e s _ ht] <;> rfl
+    · rename_i v hv
+      simp only [writeW] at h
+      split at h
+      · cases h
+      · rename_i hw; cases h
+        rw [assignCode, execSeq_append, compileE_ok addr e s v hv]
+        simp [Outcome.andThen, execSeq, exec, State.fall, hw]
+  | rv a =>
+    simp only [assignSem] at h
+    split at h
+    · rename_i _ ht; cases h
+      rw [assignCode, execSeq_append, execSeq_append, compileE_err addr e s _ ht] <;> rfl
+    · rename_i v hv
+      split at h
+      · rename_i _ ht; cases h
+        rw [assignCode, execSeq_append, execSeq_append, compileE_ok addr e s v hv]
+        simp only [Outcome.andThen]
+        rw [compileE_err addr a { s with pc := s.pc + (compileE addr e).length, dstack := v :: s.dstack } _ ht] <;> rfl
+      · rename_i a' ha
+        simp only [writeW] at h
+        split at h
+        · cases h
+        · rename_i hw; cases h
+          rw [assignCode, execSeq_append, execSeq_append, compileE_ok addr e s v hv]
+          simp only [Outcome.andThen]
+          rw [compileE_ok addr a { s with pc := s.pc + (compileE addr e).length, dstack := v :: s.dstack } a' ha]
+          simp [Outcome.andThen, execSeq, exec, State.fall, hw]
+/-- The machine realizes result `r`, ending at address `e` with data stack `d` on success. -/
+def Reaches {n : Nat} (p : Prog n) (s : State n) (d : List (Word n)) (e : Nat) :
+    Except Trap (Memory n) → Prop
+  | .ok m' => ∃ s', Steps p s s' ∧ s'.pc = e ∧ s'.dstack = d ∧ s'.mem = m'
+  | .error t => ∃ s1, Steps p s s1 ∧ step p s1 = .trapped t
+
+theorem reaches_trans {n : Nat} {p : Prog n} {s s1 : State n} {d : List (Word n)} {e : Nat}
+    {r : Except Trap (Memory n)} (h1 : Steps p s s1) (h2 : Reaches p s1 d e r) :
+    Reaches p s d e r := by
+  cases r with
+  | ok m' =>
+    obtain ⟨s', hs, hpc, hd, hm⟩ := h2
+    exact ⟨s', h1.trans hs, hpc, hd, hm⟩
+  | error t =>
+    obtain ⟨s2, hs, ht⟩ := h2
+    exact ⟨s2, h1.trans hs, ht⟩
+
+theorem reaches_cast {n : Nat} {p : Prog n} {s : State n} {d : List (Word n)} {e e' : Nat}
+    {r : Except Trap (Memory n)} (h : e = e') (hr : Reaches p s d e r) : Reaches p s d e' r := by
+  subst h; exact hr
+
+theorem reaches_dstack {n : Nat} {p : Prog n} {s : State n} {d d' : List (Word n)} {e : Nat}
+    {r : Except Trap (Memory n)} (h : d = d') (hr : Reaches p s d e r) : Reaches p s d' e r := by
+  subst h; exact hr
+
+theorem size_assign {n : Nat} (addr : Var → Word n) (l : LVal) (e : Expr) :
+    (compile addr (.assign l e)).size = (assignCode addr l e).length := rfl
+
+theorem size_seq {n : Nat} (addr : Var → Word n) (a b : Stmt) :
+    (compile addr (.seq a b)).size = (compile addr a).size + (compile addr b).size := rfl
+
+theorem size_test {n : Nat} (addr : Var → Word n) (c : Expr) (t e : Stmt) :
+    (compile addr (.test c t e)).size =
+      (compileE addr c).length + ((compile addr e).size + (compile addr t).size + 2) := rfl
+
+theorem size_while {n : Nat} (addr : Var → Word n) (c : Expr) (body : Stmt) :
+    (compile addr (.while c body)).size =
+      (compileE addr c).length + (compile addr body).size + 3 := rfl
+
+theorem compile_correct {n : Nat} {addr : Var → Word n} {s : Stmt} {m : Memory n}
+    {r : Except Trap (Memory n)} (h : Exec addr s m r) :
+    ∀ (p : Prog n) (base : Nat) (st : State n),
+      At p base ((compile addr s).emit base) → st.pc = base → st.mem = m →
+      Reaches p st st.dstack (base + (compile addr s).size) r := by
+  induction h with
+  | skip =>
+    intro p base st _ hpc hm
+    exact ⟨st, .refl, by simp [compile, Frag.empty, Frag.ofCode, hpc], rfl, hm⟩
+  | @assign l e m r hr =>
+    intro p base st hat hpc hm
+    subst hr
+    have hcode : At p base (assignCode addr l e) := by simpa [compile, Frag.ofCode] using hat
+    cases hres : assignSem addr l e m with
+    | ok m' =>
+      have hx := assignCode_ok addr l e st m' (by rw [hm]; exact hres)
+      obtain ⟨hst, hpc'⟩ :=
+        execSeq_steps (assignCode_straight addr l e) (by rw [hpc]; exact hcode) hx
+      exact ⟨_, hst, by rw [size_assign]; simp [hpc], rfl, rfl⟩
+    | error t =>
+      have hx := assignCode_err addr l e st t (by rw [hm]; exact hres)
+      exact execSeq_trap (assignCode_straight addr l e) (by rw [hpc]; exact hcode) hx
+  | @seqOk a b m m1 r _ _ iha ihb =>
+    intro p base st hat hpc hm
+    have hat' := Frag.seq_at (by simpa [compile] using hat)
+    obtain ⟨s1, hs1, hpc1, hd1, hm1⟩ := iha p base st hat'.1 hpc hm
+    have ih2 := ihb p (base + (compile addr a).size) s1 hat'.2 hpc1 hm1
+    rw [hd1] at ih2
+    refine reaches_cast ?_ (reaches_trans hs1 ih2)
+    rw [size_seq]; omega
+  | @seqErr a b m t _ iha =>
+    intro p base st hat hpc hm
+    have hat' := Frag.seq_at (by simpa [compile] using hat)
+    exact iha p base st hat'.1 hpc hm
+  | @testErr c t e m x hc =>
+    intro p base st hat hpc hm
+    have hat' := Frag.seq_at (by simpa [compile] using hat)
+    have hcode : At p base (compileE addr c) := by simpa [Frag.ofCode] using hat'.1
+    exact execSeq_trap (compileE_straight addr c) (by rw [hpc]; exact hcode)
+      (compileE_err addr c st x (by rw [hm]; exact hc))
+  | @testTrue c t e m v r hc ht _ iht =>
+    intro p base st hat hpc hm
+    have hat' := Frag.seq_at (by simpa [compile] using hat)
+    have hcode : At p base (compileE addr c) := by simpa [Frag.ofCode] using hat'.1
+    have hx := compileE_ok addr c st v (by rw [hm]; exact hc)
+    obtain ⟨hst, hpc1⟩ := execSeq_steps (compileE_straight addr c) (by rw [hpc]; exact hcode) hx
+    have hite : At p (base + (compileE addr c).length)
+        ((Frag.ite (compile addr t) (compile addr e)).emit (base + (compileE addr c).length)) :=
+      hat'.2
+    obtain ⟨_, _, _, ht'⟩ := ite_decode hite
+    have h1 := ite_true_rule hite
+      (s := { st with pc := st.pc + (compileE addr c).length, dstack := v :: st.dstack })
+      (by simp [hpc]) rfl ht
+    have ih2 := iht p (base + (compileE addr c).length + 2 + (compile addr e).size)
+      { st with pc := base + (compileE addr c).length + 2 + (compile addr e).size, dstack := st.dstack }
+      ht' (by simp [hpc]) hm
+    refine reaches_cast ?_ (reaches_trans (hst.trans (by simpa [hpc] using h1)) ih2)
+    rw [size_test]; omega
+  | @testFalse c t e m v r hc hf _ ihe =>
+    intro p base st hat hpc hm
+    have hat' := Frag.seq_at (by simpa [compile] using hat)
+    have hcode : At p base (compileE addr c) := by simpa [Frag.ofCode] using hat'.1
+    have hx := compileE_ok addr c st v (by rw [hm]; exact hc)
+    obtain ⟨hst, hpc1⟩ := execSeq_steps (compileE_straight addr c) (by rw [hpc]; exact hcode) hx
+    have hite : At p (base + (compileE addr c).length)
+        ((Frag.ite (compile addr t) (compile addr e)).emit (base + (compileE addr c).length)) :=
+      hat'.2
+    obtain ⟨h0, he, _, _⟩ := ite_decode hite
+    cases r with
+    | ok m1 =>
+      obtain ⟨s2, hs2, hpc2, hd2, hm2⟩ := ihe p (base + (compileE addr c).length + 1)
+        { st with pc := base + (compileE addr c).length + 1, dstack := st.dstack }
+        he (by simp [hpc]) hm
+      have h1 := ite_false_rule hite
+        (s := { st with pc := st.pc + (compileE addr c).length, dstack := v :: st.dstack })
+        (by simp [hpc]) rfl hf
+        (s1 := s2) (by simpa [hpc] using hs2) (by simpa using hpc2)
+      refine ⟨_, hst.trans h1, ?_, hd2, hm2⟩
+      show base + (compileE addr c).length + 2 + (compile addr e).size + (compile addr t).size = _
+      rw [size_test]; omega
+    | error t' =>
+      obtain ⟨s2, hs2, ht2⟩ := ihe p (base + (compileE addr c).length + 1)
+        { st with pc := base + (compileE addr c).length + 1, dstack := st.dstack }
+        he (by simp [hpc]) hm
+      have hfall := step_branch_fall
+        (s := { st with pc := st.pc + (compileE addr c).length, dstack := v :: st.dstack })
+        (by simp [hpc]; exact h0) rfl hf
+      exact ⟨s2, hst.trans (.cons (by simpa [hpc] using hfall) hs2), ht2⟩
+  | @whileErr c body m x hc =>
+    intro p base st hat hpc hm
+    obtain ⟨hc_at, _, _, _, _⟩ := while_decode (by simpa [compile] using hat)
+    have hcode : At p base (compileE addr c) := by simpa [Frag.ofCode] using hc_at
+    exact execSeq_trap (compileE_straight addr c) (by rw [hpc]; exact hcode)
+      (compileE_err addr c st x (by rw [hm]; exact hc))
+  | @whileExit c body m v hc hf =>
+    intro p base st hat hpc hm
+    have hat' : At p base ((Frag.whileLoop (Frag.ofCode (compileE addr c)) (compile addr body)).emit base) := by
+      simpa [compile] using hat
+    obtain ⟨hc_at, _, _, _, _⟩ := while_decode hat'
+    have hcode : At p base (compileE addr c) := by simpa [Frag.ofCode] using hc_at
+    have hx := compileE_ok addr c st v (by rw [hm]; exact hc)
+    obtain ⟨hst, hpc1⟩ := execSeq_steps (compileE_straight addr c) (by rw [hpc]; exact hcode) hx
+    have h1 := while_exit_rule hat'
+      (s1 := { st with pc := st.pc + (compileE addr c).length, dstack := v :: st.dstack })
+      (by simp [hpc, Frag.ofCode]) rfl hf
+    refine ⟨_, hst.trans h1, ?_, rfl, hm⟩
+    rw [size_while]; simp [Frag.ofCode]; omega
+  | @whileBodyErr c body m v x hc ht _ ihb =>
+    intro p base st hat hpc hm
+    have hat' : At p base ((Frag.whileLoop (Frag.ofCode (compileE addr c)) (compile addr body)).emit base) := by
+      simpa [compile] using hat
+    obtain ⟨hc_at, _, _, hb_at, _⟩ := while_decode hat'
+    have hcode : At p base (compileE addr c) := by simpa [Frag.ofCode] using hc_at
+    have hx := compileE_ok addr c st v (by rw [hm]; exact hc)
+    obtain ⟨hst, hpc1⟩ := execSeq_steps (compileE_straight addr c) (by rw [hpc]; exact hcode) hx
+    have h1 := while_enter_rule hat'
+      (s1 := { st with pc := st.pc + (compileE addr c).length, dstack := v :: st.dstack })
+      (by simp [hpc, Frag.ofCode]) rfl ht
+    have ih2 := ihb p (base + (Frag.ofCode (compileE addr c)).size + 2)
+      { st with pc := base + (Frag.ofCode (compileE addr c)).size + 2, dstack := st.dstack }
+      hb_at (by simp [hpc]) hm
+    exact reaches_trans (hst.trans h1) ih2
+  | @whileAgain c body m v m1 r hc ht _ _ ihb ihl =>
+    intro p base st hat hpc hm
+    have hat' : At p base ((Frag.whileLoop (Frag.ofCode (compileE addr c)) (compile addr body)).emit base) := by
+      simpa [compile] using hat
+    obtain ⟨hc_at, _, _, hb_at, _⟩ := while_decode hat'
+    have hcode : At p base (compileE addr c) := by simpa [Frag.ofCode] using hc_at
+    have hx := compileE_ok addr c st v (by rw [hm]; exact hc)
+    obtain ⟨hst, hpc1⟩ := execSeq_steps (compileE_straight addr c) (by rw [hpc]; exact hcode) hx
+    have h1 := while_enter_rule hat'
+      (s1 := { st with pc := st.pc + (compileE addr c).length, dstack := v :: st.dstack })
+      (by simp [hpc, Frag.ofCode]) rfl ht
+    obtain ⟨s3, hs3, hpc3, hd3, hm3⟩ := ihb p (base + (Frag.ofCode (compileE addr c)).size + 2)
+      { st with pc := base + (Frag.ofCode (compileE addr c)).size + 2, dstack := st.dstack }
+      hb_at (by simp [hpc]) hm
+    have h2 := while_back_rule hat' (s1 := s3) hpc3
+    have hd3' : s3.dstack = st.dstack := hd3
+    have ih4 : Reaches p { s3 with pc := base } st.dstack
+        (base + (compile addr (Stmt.while c body)).size) r :=
+      reaches_dstack hd3' (ihl p base { s3 with pc := base } hat rfl hm3)
+    exact reaches_trans (((hst.trans h1).trans hs3).trans h2) ih4
+
+/-- Whole-program correctness from the initial machine state (empty stacks, given memory). -/
+theorem compileProgram_correct {n : Nat} {addr : Var → Word n} {s : Stmt} {mem : Memory n}
+    {r : Except Trap (Memory n)} (h : Exec addr s mem r) :
+    match r with
+    | .ok m' =>
+        ∃ s', WordDialect.Exec (compileProgram addr s) (State.init mem) (.halted s') ∧
+          s'.dstack = [] ∧ s'.mem = m'
+    | .error t => WordDialect.Exec (compileProgram addr s) (State.init mem) (.trapped t) := by
+  have hat : At (compileProgram addr s) 0 ((compile addr s).emit 0) := by
+    have := at_embed ([] : Prog n) ((compile addr s).emit 0) [.halt]
+    simpa [compileProgram] using this
+  have key := compile_correct h (compileProgram addr s) 0 (State.init mem) hat rfl rfl
+  cases r with
+  | ok m' =>
+    obtain ⟨s', hs, hpc, hd, hm⟩ := key
+    have hfetch : (compileProgram addr s)[s'.pc]? = some .halt := by
+      rw [hpc]
+      simp [compileProgram, (compile addr s).len]
+    refine ⟨s', WordDialect.Exec.of_steps hs (.halt ?_), hd, hm⟩
+    rw [step_of_fetch hfetch]; rfl
+  | error t =>
+    obtain ⟨s1, hs, ht⟩ := key
+    exact WordDialect.Exec.of_steps hs (.trap ht)
+
+end BCPL
+end WordDialect