Prove the stored host's construction, copies, period and network in Rocq for every word width, give each unit its own window cell, and revise Section 8 with the new records

.gitignore

@@ -20,6 +20,10 @@ rocq/extract/physnet.mli
 rocq/extract/hostnet.ml
 rocq/extract/hostnet.mli
 rocq/extract/dumphost
+rocq/extract/storednet.ml
+rocq/extract/storednet.mli
+rocq/extract/dumpstored
+rocq/extract/stored_rocq.bin
 rocq/.nia.cache
 rocq/extract/dump
 rocq/extract/*.cm*

README.md

@@ -600,19 +600,20 @@ proves for every window of 2^α cells, number of banks, bank and tape. `rocq/`
 also proves that the host family computes SUBLEQ at every word width, that the
 21- and 27-instruction programs do what the paper states at every word width from
 8 on, and that the H_8 it defines is the netlist of the published serialization.
-The host itself, compiled by `src/twohead.py` into 36,080 records of two inputs
-with records that load its memory, its tape device and a hand-over, and stored in
-the member with 4096 window cells, runs the 27-instruction program on a recipe
-for its own records: it writes them into the next bank, copies the recipe onto
-the next tape and hands control to the copy, so that it reproduces itself,
-weights included, by the dynamics alone, and the copies accumulate until every
-bank holds one; `src/ring_run.c` runs six generations of 79,501,750,295 steps
-each in a ring of three banks. The fixed network's own weights are the
-transition rule and are not reproduced. The paper proves that every member of the
-host family with wider words does the same in a larger window. An organism of 143
+The host itself, compiled into 36,080 records of two inputs with records that
+load its memory, its tape device and a hand-over, and stored in the member with
+32,768 window cells, runs the 27-instruction program on a recipe for its own
+records: it writes them into the next bank, copies the recipe onto the next tape
+and hands control to the copy, so that it reproduces itself, weights included, by
+the dynamics alone, and the copies accumulate until every bank holds one;
+`src/ring_run.c` runs six generations of 95,762,842,100 steps each in a ring of
+three banks. The fixed network's own weights are the transition rule and are not
+reproduced. `rocq/` defines the stored host for every word width from 8 on, the
+records `src/twohead.py` writes among them, and proves its universal
+construction, its reproduction in every ring, the accumulation of the copies and
+the period of the state, in the machine and in the network. An organism of 143
 records on the member with 64 window cells does the same with a description code
-of its own, and its universal construction, its reproduction in every ring and
-the period of the state are proved in Rocq. Its robustness section gives the
+of its own, also proved in Rocq. Its robustness section gives the
 margin every orbit has against perturbation, a certificate of the leakage an
 orbit tolerates from the inputs active along it, a bound on the failure rate
 under read noise that lies within the 95% interval of the measured rate, and the
@@ -1020,9 +1021,11 @@ paper/                              the manuscript, and the record of every run
 rocq/                               Rocq proofs: the host family H_A computes SUBLEQ for every word
                                     width, P and P* do what the paper states at every width from 8,
                                     the netlist of the ring machine computes its step for every
-                                    window, ring, bank and tape, and the organism builds every image
-                                    that fits a bank from any description of it and reproduces in
-                                    every ring, the state periodic once every bank holds a copy
+                                    window, ring, bank and tape, the host stored as records builds
+                                    every image that fits a bank and reproduces in every ring at
+                                    every width from 8, and the organism builds every image that
+                                    fits a bank from any description of it and reproduces in every
+                                    ring, the state periodic once every bank holds a copy
 tools/play.py                       the playground, and a demonstration on each machine
 llm_integration/
   ├── llm.py                        SmolLM2 with the frozen circuits: the circuit wrapper, the

paper/README.md

@@ -36,7 +36,7 @@ Each command is `python src/<file>.py <command>` and writes its record to `runs/
 | `paper.py family-gate` | `paper_runs_family_gate.json` | four of them on the netlist of sigma |
 | `paper.py c` | `paper_c_evaluator.json` | the host on the evaluator in C, `src/netlist_eval.c` |
 | `paper.py throughput` | `paper_throughput.json` | the rate of each evaluator |
-| `paper.py rocq` | `paper_rocq.json` | the Rocq development of `rocq/`, its assumptions, the host family extracted from it for A = 8, 9, 10 against sigma(N_host) and the generator, the memory images of P and P*, and the ring netlist extracted for three members |
+| `paper.py rocq` | `paper_rocq.json` | the Rocq development of `rocq/`, its assumptions, the host family extracted from it for A = 8, 9, 10 against sigma(N_host) and the generator, the stored host extracted for A = 8, 9 against the image `twohead.py stored` builds, the memory images of P and P*, and the ring netlist extracted for three members |
 | `twohead.py organism` | `paper_twohead.json` | the organism on the ring machine M_{3,160,3200}, six generations with the copies and the period (`organism run --generations 6 --S 160 --L 3200`); `organism rocq` writes `rocq/Organism.v` |
 | `twohead.py net` | `paper_twohead_net.json` | the netlist N_{K,S,L} against the machine on random states of three members (`net check`), one generation of the organism on it in C beside the machine (`net lockstep`), the netlists extracted from Rocq (`net extract`), and the rows of its levelization with the noise a generation of the stored host survives (`net lev`) |
 | `twohead.py stored` | `paper_stored_host.json` | the host compiled into records of the ring machine: one pass against the host's step and its device on random states (`stored check`), the startup, step, device and hand-over records on decision diagrams (`stored symbolic`), and six generations in C in a ring of three banks (`stored run 6`); `--width A` checks H_A in place of H_8, and `stored widths` tabulates A = 8 to 12 |

paper/runs/paper_rocq.json

@@ -1,7 +1,7 @@
 {
  "rocq": "The Rocq Prover, version 9.1.1",
- "files": 27,
- "build_seconds": 66.5,
+ "files": 44,
+ "build_seconds": 198.9,
  "theorems": {
   "PhysSem.netlist_step": "closed",
   "PhysMain.network_orbit": "closed",
@@ -22,10 +22,27 @@
   "Pstar.constructor_run": "closed",
   "Pstar.selfrep_run": "closed",
   "Pstar.image_Pstar_8": "closed",
-  "Pstar.image_P_8": "closed"
+  "Pstar.image_P_8": "closed",
+  "StoredBoot.startup_run": "closed",
+  "StoredPass.step_view": "closed",
+  "StoredDev.device_run": "closed",
+  "StoredBoot.handover_run": "closed",
+  "StoredOk.stored_ok": "closed",
+  "StoredPass.pass_first": "closed",
+  "StoredPass.pass_next": "closed",
+  "StoredRun.machine_pass": "closed",
+  "StoredRun.stored_construct": "closed",
+  "StoredWbr.wbr_stored": "closed",
+  "StoredMain.reproduces": "closed",
+  "StoredMain.copies": "closed",
+  "StoredMain.periodic": "closed",
+  "StoredMain.network_reproduces": "closed",
+  "StoredMain.network_periodic": "closed",
+  "StoredWidth.width_exists": "closed",
+  "StoredWidth.recipe_of_image": "closed"
  },
  "extraction_identical": true,
- "lines": 7391,
+ "lines": 13795,
  "host_extraction": {
   "members": [
    {
@@ -55,5 +72,26 @@
  "pstar_images": {
   "m_star": true,
   "m_P": true
+ },
+ "stored_extraction": {
+  "members": [
+   {
+    "A": 8,
+    "w": 20,
+    "records": 36080,
+    "bytes": 239030,
+    "identical": true,
+    "sha256": "9a7821a540fed2ed58fbb263213f65aead6bbbd8cca6344abcabcc5f4289903c"
+   },
+   {
+    "A": 9,
+    "w": 21,
+    "records": 80463,
+    "bytes": 563241,
+    "identical": true,
+    "sha256": "8fe4d6719955e5e4c776514f3910facf60d8d6357f677f9978682e4932b1fbf8"
+   }
+  ],
+  "identical": true
  }
 }

paper/runs/paper_stored_host.json

@@ -3,19 +3,19 @@
   "A": 8,
   "K": 3,
   "S": 36085,
-  "L": 1600072,
+  "L": 1927264,
   "records": 36080,
-  "window_cells": 2901,
-  "record_bits": 44,
+  "window_cells": 19765,
+  "record_bits": 53,
   "counter_bits": 20,
-  "image_bytes": 198440,
-  "tau_bytes": 200001,
-  "passes_expected": 2203180,
-  "steps_expected": 79501750295,
+  "image_bytes": 239030,
+  "tau_bytes": 240900,
+  "passes_expected": 2653813,
+  "steps_expected": 95762842100,
   "generations": [
    {
     "generation": 1,
-    "steps": 79501750295,
+    "steps": 95762842100,
     "kappa": 1,
     "copies": 2,
     "descriptions": 2,
@@ -24,7 +24,7 @@
    },
    {
     "generation": 2,
-    "steps": 79501750295,
+    "steps": 95762842100,
     "kappa": 2,
     "copies": 3,
     "descriptions": 3,
@@ -33,7 +33,7 @@
    },
    {
     "generation": 3,
-    "steps": 79501750295,
+    "steps": 95762842100,
     "kappa": 0,
     "copies": 3,
     "descriptions": 3,
@@ -42,7 +42,7 @@
    },
    {
     "generation": 4,
-    "steps": 79501750295,
+    "steps": 95762842100,
     "kappa": 1,
     "copies": 3,
     "descriptions": 3,
@@ -51,7 +51,7 @@
    },
    {
     "generation": 5,
-    "steps": 79501750295,
+    "steps": 95762842100,
     "kappa": 2,
     "copies": 3,
     "descriptions": 3,
@@ -60,7 +60,7 @@
    },
    {
     "generation": 6,
-    "steps": 79501750295,
+    "steps": 95762842100,
     "kappa": 0,
     "copies": 3,
     "descriptions": 3,
@@ -68,17 +68,17 @@
     "equals_generation_minus_K": 1
    }
   ],
-  "seconds": 2599.9,
-  "sha256_image": "2aad2478143153562622be27d67385523203f5c0519604ef43eca0a510b986a0",
-  "sha256_tau": "c74c4f479fa5f60cd561ea66ff071003f3d559890171c217f27d2943e79ff14d",
+  "seconds": 2929.7,
+  "sha256_image": "9a7821a540fed2ed58fbb263213f65aead6bbbd8cca6344abcabcc5f4289903c",
+  "sha256_tau": "dbb2cfe5fe8e53e303a51ddbe52964f70f83169181ec4dc05450cb244b9b5a97",
   "every_generation_exact": true
  },
  "pass_check": {
   "trials": 300,
   "disagreements": 0,
   "records": 36080,
-  "window_cells": 2901,
-  "seconds": 506.3
+  "window_cells": 19765,
+  "seconds": 693.5
  },
  "symbolic": {
   "A": 8,
@@ -91,53 +91,53 @@
   "step_exact": true,
   "device_exact": true,
   "handover_exact": true,
-  "sha256_image": "2aad2478143153562622be27d67385523203f5c0519604ef43eca0a510b986a0",
-  "nodes": 87140,
-  "seconds": 0.8
+  "sha256_image": "9a7821a540fed2ed58fbb263213f65aead6bbbd8cca6344abcabcc5f4289903c",
+  "nodes": 115812,
+  "seconds": 2.6
  },
  "symbolic_A9": {
   "A": 9,
-  "startup_records": 4665,
+  "startup_records": 4667,
   "step_records": 75366,
-  "device_records": 414,
-  "padding_records": 7,
+  "device_records": 426,
+  "padding_records": 0,
   "handover_records": 4,
   "startup_exact": true,
   "step_exact": true,
   "device_exact": true,
   "handover_exact": true,
-  "sha256_image": "6b06f29515b866070e60efafe286302d71400d5c6be4ec03b9c542c4aa50c148",
-  "nodes": 185281,
-  "seconds": 2.0
+  "sha256_image": "8fe4d6719955e5e4c776514f3910facf60d8d6357f677f9978682e4932b1fbf8",
+  "nodes": 243216,
+  "seconds": 5.4
  },
  "symbolic_A10": {
   "A": 10,
   "startup_records": 10302,
   "step_records": 167351,
   "device_records": 449,
-  "padding_records": 2,
+  "padding_records": 6,
   "handover_records": 4,
   "startup_exact": true,
   "step_exact": true,
   "device_exact": true,
   "handover_exact": true,
-  "sha256_image": "0be370b9ffb824a7cc0e8a4612c16dc4e35cb6f0e48a51acbd28f1126df41405",
-  "nodes": 401141,
-  "seconds": 5.6
+  "sha256_image": "222e17b6fab50dfe3c4b97274826bc740b799e35a3cdd8a1825f2d915ad8d3a5",
+  "nodes": 515829,
+  "seconds": 8.0
  },
  "pass_check_A9": {
-  "trials": 300,
+  "trials": 100,
   "disagreements": 0,
-  "records": 80448,
-  "window_cells": 6228,
-  "seconds": 204.6
+  "records": 80463,
+  "window_cells": 43862,
+  "seconds": 602.8
  },
  "pass_check_A10": {
-  "trials": 100,
+  "trials": 30,
   "disagreements": 0,
-  "records": 178100,
-  "window_cells": 13404,
-  "seconds": 156.2
+  "records": 178112,
+  "window_cells": 96632,
+  "seconds": 362.4
  },
  "widths": [
   {
@@ -148,97 +148,97 @@
    "device": 403,
    "padding": 1,
    "handover": 4,
-   "window_cells": 2901,
-   "alpha": 12,
-   "record_bits": 44,
+   "window_cells": 19765,
+   "alpha": 15,
+   "record_bits": 53,
    "counter_bits": 20,
-   "image_bytes": 198440,
-   "tau_bytes": 200001,
-   "literal_tokens": 1565,
-   "repeat_tokens": 2,
-   "passes": 2203180,
-   "applications": 79490734400,
-   "seconds": 1.1
+   "image_bytes": 239030,
+   "tau_bytes": 240900,
+   "literal_tokens": 1888,
+   "repeat_tokens": 8,
+   "passes": 2653813,
+   "applications": 95749573040,
+   "seconds": 1.0
   },
   {
    "A": 9,
-   "records": 80456,
-   "startup": 4665,
+   "records": 80463,
+   "startup": 4667,
    "step": 75366,
-   "device": 414,
-   "padding": 7,
+   "device": 426,
+   "padding": 0,
    "handover": 4,
-   "window_cells": 6233,
-   "alpha": 13,
-   "record_bits": 47,
-   "counter_bits": 20,
-   "image_bytes": 472679,
-   "tau_bytes": 476363,
-   "literal_tokens": 3723,
-   "repeat_tokens": 2,
-   "passes": 5247618,
-   "applications": 422202353808,
+   "window_cells": 43862,
+   "alpha": 16,
+   "record_bits": 56,
+   "counter_bits": 21,
+   "image_bytes": 563241,
+   "tau_bytes": 567647,
+   "literal_tokens": 4462,
+   "repeat_tokens": 28,
+   "passes": 6253470,
+   "applications": 503172956610,
    "seconds": 2.7
   },
   {
    "A": 10,
-   "records": 178108,
+   "records": 178112,
    "startup": 10302,
    "step": 167351,
    "device": 449,
-   "padding": 2,
+   "padding": 6,
    "handover": 4,
-   "window_cells": 13409,
-   "alpha": 14,
-   "record_bits": 50,
+   "window_cells": 96632,
+   "alpha": 17,
+   "record_bits": 59,
    "counter_bits": 22,
-   "image_bytes": 1113175,
-   "tau_bytes": 1121929,
-   "literal_tokens": 8766,
-   "repeat_tokens": 2,
-   "passes": 12358822,
-   "applications": 2201205068776,
-   "seconds": 11.7
+   "image_bytes": 1313576,
+   "tau_bytes": 1323842,
+   "literal_tokens": 10372,
+   "repeat_tokens": 33,
+   "passes": 14583670,
+   "applications": 2597526631040,
+   "seconds": 7.3
   },
   {
    "A": 11,
-   "records": 391224,
+   "records": 391220,
    "startup": 22593,
    "step": 368148,
    "device": 472,
-   "padding": 7,
+   "padding": 3,
    "handover": 4,
-   "window_cells": 28775,
-   "alpha": 15,
-   "record_bits": 53,
+   "window_cells": 211355,
+   "alpha": 18,
+   "record_bits": 62,
    "counter_bits": 23,
-   "image_bytes": 2591859,
-   "tau_bytes": 2612223,
-   "literal_tokens": 20410,
-   "repeat_tokens": 2,
-   "passes": 28775480,
-   "applications": 11257658387520,
-   "seconds": 34.0
+   "image_bytes": 3031955,
+   "tau_bytes": 3055757,
+   "literal_tokens": 23912,
+   "repeat_tokens": 45,
+   "passes": 33661915,
+   "applications": 13169214386300,
+   "seconds": 18.8
   },
   {
    "A": 12,
-   "records": 853173,
+   "records": 853176,
    "startup": 49220,
    "step": 803454,
    "device": 495,
-   "padding": 0,
+   "padding": 3,
    "handover": 4,
-   "window_cells": 61549,
-   "alpha": 16,
-   "record_bits": 56,
+   "window_cells": 459199,
+   "alpha": 19,
+   "record_bits": 65,
    "counter_bits": 24,
-   "image_bytes": 5972211,
-   "tau_bytes": 6019191,
-   "literal_tokens": 47060,
-   "repeat_tokens": 40,
-   "passes": 66305830,
-   "applications": 56570343898590,
-   "seconds": 83.7
+   "image_bytes": 6932055,
+   "tau_bytes": 6986545,
+   "literal_tokens": 54626,
+   "repeat_tokens": 52,
+   "passes": 76962164,
+   "applications": 65662271232864,
+   "seconds": 48.1
   }
  ]
 }

paper/runs/paper_twohead_net.json

@@ -107,63 +107,63 @@
  },
  "levelized": {
   "K": 3,
-  "alpha": 12,
+  "alpha": 15,
   "members": [
    {
     "S": 2,
     "L": 3,
     "depth": 19,
-    "rows": 151066
+    "rows": 1128191
    },
    {
     "S": 3,
     "L": 3,
     "depth": 19,
-    "rows": 155095
+    "rows": 1133030
    },
    {
     "S": 2,
     "L": 5,
     "depth": 19,
-    "rows": 151372
+    "rows": 1128497
    },
    {
     "S": 3,
     "L": 5,
     "depth": 19,
-    "rows": 155401
+    "rows": 1133336
    },
    {
     "S": 4,
     "L": 9,
     "depth": 19,
-    "rows": 160042
+    "rows": 1138787
    },
    {
     "S": 6,
     "L": 4,
     "depth": 19,
-    "rows": 167335
+    "rows": 1147700
    }
   ],
   "rows": {
-   "constant": 142549,
-   "per_slot": 4029,
+   "constant": 1118054,
+   "per_slot": 4839,
    "per_cell": 153
   },
   "affine": true,
   "depth": 19,
   "stored_member": {
    "S": 36085,
-   "L": 1600072,
-   "rows": 390340030,
-   "steps": 79501750295
+   "L": 1927264,
+   "rows": 470604761,
+   "steps": 95762842100
   },
   "s_max_0999": {
-   "1": 0.0504,
-   "3": 0.1495,
-   "5": 0.2479
+   "1": 0.0502,
+   "3": 0.1489,
+   "5": 0.247
   },
-  "seconds": 4.3
+  "seconds": 23.8
  }
 }

paper/universal_construction_ternary.pdf

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:87c4967c252151a84821cf702b931e88738fd04599d65cbac7c7a61944567f83
-size 354390
+oid sha256:922ef023fe09cef59891dc62bd7eab1b68b15be41216f4425959ef241ec8b9ad
+size 355574

paper/universal_construction_ternary.tex

@@ -80,10 +80,12 @@ of banks and tapes. Stored in the ring as $36{,}080$ records of two inputs, the
 SUBLEQ computer decodes a description of its own records into the next bank, copies
 the description onto the next tape and hands control to the copy. The fixed network
 thus rebuilds the stored computer, weights included, in every generation; its own
-weights are the transition rule and are not reproduced. A constructor of $143$
-records builds every image that fits a bank from its description, and its
-reproduction is proved in Rocq for every ring: the copies accumulate until every
-bank holds one, and from then on the whole state repeats every $K$ generations.
+weights are the transition rule and are not reproduced. For every word width from
+$8$ on and every ring it is proved in Rocq that the stored computer builds every
+image that fits a bank from a description of it, and that, started on its own, it
+reproduces: the copies accumulate until every bank holds one, and from then on the
+whole state repeats every $K$ generations. A constructor of $143$ records with a
+description code of its own does the same, also proved in Rocq.
 Every pre-activation is an integer, so every orbit survives perturbations below
 $1/2$ of each pre-activation. Under independent Gaussian noise on the
 pre-activations, a bound computed from the orbit lies within the $95\%$ interval of
@@ -172,13 +174,13 @@ Stored in the ring, the host $H_A$ of every word width $A\ge8$ running $P^\ast$
 builds every image that fits a bank, from every recipe that fits a tape, into the
 next bank and hands control to it. Started on a recipe for its own records it
 reproduces in every generation, weights included; the copies accumulate until every
-bank holds one, and from then on the state repeats every $K$ generations
-(Theorems~\ref{thm:storedconstruct} to~\ref{thm:widths}). Six generations of $H_8$,
-$36{,}080$ records and $7.95\times10^{10}$ steps each, were run in a ring of three
+bank holds one, and from then on the state repeats every $K$ generations. All of it
+is proved in Rocq for every $A\ge8$ and every ring
+(Theorems~\ref{thm:storedconstruct} to~\ref{thm:widths}), and six generations of
+$H_8$, $36{,}080$ records and $9.58\times10^{10}$ steps each, were run in a ring of three
 banks. A constructor of $143$ records with a description code of its own does the
-same in the machine with $64$ window cells, and its universal construction and its
-reproduction in every ring, with the copies and the period, are proved in Rocq
-(Section~\ref{sec:organism}).
+same in the machine with $64$ window cells, with its universal construction, its
+reproduction, the copies and the period proved in Rocq (Section~\ref{sec:organism}).
 \item \emph{Robustness.} Every orbit survives perturbations below $1/2$ of each
 pre-activation. Under independent Gaussian noise on the pre-activations, the
 probability that some unit fails in a step, computed from the pre-activation profile
@@ -220,8 +222,8 @@ Margin $1/2$ and the profile bound & Thm.~\ref{thm:margin}, Prop.~\ref{prop:prof
 Amplification under the three noise models & Thm.~\ref{thm:amplify}, Cor.~\ref{cor:synapse}, Prop.~\ref{prop:flip} & proof\\
 Restoration bound for $N_3$ & Prop.~\ref{prop:restore} & proof; measured rates of Table~\ref{tab:bound3}\\
 The netlist computes the ring machine; its size and weights & Thm.~\ref{thm:physnet} & Rocq; extraction equal to the generator's; random states\\
-A pass of the stored host & Prop.~\ref{prop:storedpass} & proof; decision diagrams of all four blocks and random states, $A=8,9,10$\\
-Construction and reproduction by the stored host & Thms.~\ref{thm:storedconstruct}--\ref{thm:widths} & proof over the Rocq results; six generations of $\mathcal S_8$ run\\
+A pass of the stored host, every $A\ge8$ & Prop.~\ref{prop:storedpass} & Rocq, block by block; decision diagrams of all four blocks and random states, $A=8,9,10$\\
+Construction and reproduction by the stored host: copies, period, network, every $A\ge8$ & Thms.~\ref{thm:storedconstruct}--\ref{thm:widths} & Rocq, the counts of Thm.~\ref{thm:widths} by counting; the extracted image equal to the generator's for $A=8,9$; six generations of $\mathcal S_8$ run\\
 The organism: code, pass, construction, copies, period, network & Lem.~\ref{lem:code}, Prop.~\ref{prop:pass}, Thms.~\ref{thm:construct}, \ref{thm:organism} & Rocq; six generations run, one on the netlist\\
 \bottomrule
 \end{tabularx}
@@ -1762,12 +1764,13 @@ every step.
 Inside the ring machine the instantiation step of Section~\ref{sec:selfrep} is a
 write into the next bank followed by a hand-over. This section stores the host, and
 every member of its family with wider words, as a network of two-input records in a
-bank of a ring machine whose window holds its state bits, $4096$ cells for
+bank of a ring machine whose window holds its state bits, $32{,}768$ cells for
 $\Nhost$. A device compiled into the same records writes the bytes the host emits
 under the arm until the tape is rewound, and under the copy head after it. Run on a
 recipe for its own records, $P^\ast$ then writes the host into the next bank, copies
 the recipe onto the next tape and hands control to the copy
-(Figure~\ref{fig:generation}).
+(Figure~\ref{fig:generation}). The Rocq development defines the stored host for
+every word width from $8$ on and proves its construction and its reproduction.
 
 \begin{lemma}[Stored netlists]\label{lem:feedback}
 If the active bank holds records followed by empty slots and no record but the last
@@ -1814,12 +1817,13 @@ others are, and its base cases are the chains and the constants.
 \end{proof}
 
 \begin{construction}[The stored host]\label{con:stored}
-Let $A\ge8$ and $w\ge20$. The window holds, after the thirteen cells of
+Let $A\ge8$ and $w\ge1$. The window holds, after the thirteen cells of
 Definition~\ref{def:twohead}, a cell $\mathrm{booted}$ at $13$, a counter
 $\mathrm{cnt}$ of $w$ bits from $14$ on, least significant first, a cell
 $\mathrm{dest}$, a limit $\mathrm{lim}$ of $w$ bits, the $n=A+1+A2^A$ state bits of
-$H_A$ in the order of Construction~\ref{con:host}, and temporaries. The stored host
-$\mathcal S_{A,w}$ lists the following records.
+$H_A$ in the order of Construction~\ref{con:host}, a cell for each unit of $H_A$,
+three cells for each level of the recursion of Lemma~\ref{cor:compile}, and $2w+9$
+cells for the device. The stored host $\mathcal S_{A,w}$ lists the following records.
 \begin{enumerate}[label=(\alph*),leftmargin=2em]
 \item \emph{Startup}, $A2^A+A+2w+8$ records: for each memory bit $c$,
 $c\leftarrow c\vee\neg\mathrm{booted}$ if its value in $m^\ast_A$ is $1$ and
@@ -1828,12 +1832,11 @@ $c\leftarrow c\wedge\mathrm{booted}$ for the bits of the counter, the halt bit a
 the bits of $\mathrm{cnt}$, $\mathrm{lim}$ and $\mathrm{dest}$; then five records
 copying $\neg\mathrm{booted}$ into RR, CB, RA, CT and RC; then
 $\mathrm{booted}\leftarrow1$.
-\item \emph{Step}: the units of $H_A$ compiled by Lemma~\ref{cor:compile}, in two
-stages. The first evaluates every unit that a next value depends on, other than the
-units of the next values and the units read by a single unit, each after its
-predecessors. The second takes the counter bits, the halt bit and the memory bits
-in this order, and evaluates for each the unit of its next value, with the units
-read by it alone just before it, its last record writing the bit.
+\item \emph{Step}: the units of $H_A$ in the order of the netlist, each compiled by
+Lemma~\ref{cor:compile} into its own cell, which also accumulates its chain; the
+unit of the next value of a state bit writes that bit instead, with its last
+record. A unit compiled by the recursion holds $T_t$, $T_{t-1}$ and the conjunction
+of each level in the three cells of that level.
 \item \emph{Device}, $11A+12w+75$ records: the device of Definition~\ref{def:ring}
 on the state that~(b) leaves.
 \item \emph{Hand-over}: the fewest empty records, at most seven, that make the image
@@ -1841,12 +1844,12 @@ a whole number of bytes; then $\mathrm{booted}\leftarrow\mathrm{booted}\wedge\ne
 where $h$ is the halt bit, and three records copying $h$ into RA, RC and HO, the
 last record.
 \end{enumerate}
-Temporaries whose live intervals, from the first write to the last read, are
-disjoint share a cell, and the window is the least $2^\alpha$ that holds the cells
-used. The host $\mathcal S=\mathcal S_{8,20}$ has $36{,}080$ records, its state bits at $55$ to $2111$
-and $789$ cells of temporaries after them, so $\alpha=12$; its image, its records in
-order, has $1{,}587{,}520$ bits, read as $198{,}440$ bytes most significant bit
-first, and $\tau_{\mathcal S}=\describe(\mathcal S)$ has $200{,}001$ bytes.
+The window is the least $2^\alpha$ that holds these cells. The host
+$\mathcal S=\mathcal S_{8,20}$ has $36{,}080$ records, its state bits at $55$ to
+$2111$, the cells of its $17{,}598$ units after them, and $19{,}765$ cells in all,
+so $\alpha=15$ and $b=53$; its image, its records in order, has $1{,}912{,}240$ bits,
+read as $239{,}030$ bytes most significant bit first, and
+$\tau_{\mathcal S}=\describe(\mathcal S)$ has $240{,}900$ bytes.
 \end{construction}
 
 \begin{definition}[The device of the stored host]\label{def:ring}
@@ -1887,7 +1890,7 @@ to cell $0$;
 \node[note,anchor=south] at (a3.north) {$403$};
 \node[note,anchor=south] at (a4.north) {$1+4$};
 \node[lab] at (0,-1.1) {read tape $D_\kappa$};
-\node[s,minimum width=76mm] (d0) at (0.15,-1.1) {$\tau_{\mathcal S}=\describe(\mathcal S)$, $200{,}001$ bytes};
+\node[s,minimum width=76mm] (d0) at (0.15,-1.1) {$\tau_{\mathcal S}=\describe(\mathcal S)$, $240{,}900$ bytes};
 \node[lab] at (0,-2.2) {next bank $Q_{\kappa+1}$};
 \node[s,densely dashed,minimum width=76mm] (q1) at (0.15,-2.2) {$\mathcal S$, written under the arm in phase~(A)};
 \node[lab] at (0,-3.3) {next tape $D_{\kappa+1}$};
@@ -1930,14 +1933,11 @@ Construction~\ref{con:stored} in order. The startup records leave every cell
 unchanged when $\mathrm{booted}=1$. Otherwise they set each memory bit to its value
 in $m^\ast_A$, clear the other cells they name, and set the five requests that
 return the heads and clear the idle bank and the copy tape. The step block is $H_A$
-compiled by Lemma~\ref{cor:compile}, in an order that Lemma~\ref{lem:feedback}
-admits. The first stage writes temporaries only. In the second, the group of a state
-bit evaluates with its unit only units read by that unit alone: $HP_i$, $Q_i$,
-$TA_i$ and $TB_i$ for a counter bit, $AC$, $HA$ and $HB$ for the halt bit, and
-$KP_{j,t}$ and $WR_{j,t}$ for a memory bit (Table~\ref{tab:blocks}). Besides
-temporaries these read only that bit and, for a counter bit, the halt bit, whose
-group comes later. So after the block the state bits hold the next state of $H_A$,
-which Remark~\ref{rem:storedcheck} also checks on every window for $A\le10$.
+compiled by Lemma~\ref{cor:compile} in the order of the netlist, which
+Lemma~\ref{lem:feedback} admits: every unit follows its predecessors, a unit that
+reads a state bit comes no later than the unit of its next value, which reads the bit
+before its last record writes it, and no unit reads the unit of a next value. So
+after the block the state bits hold the next state of $H_A$.
 
 The device records form the requests $[y_c=1]$ as conjunctions of $A$ literals, the
 bit $[\mathrm{cnt}=\mathrm{lim}]$ as a conjunction of $w$ equivalences, and its
@@ -1956,34 +1956,35 @@ return the arm and the copy head and, last, HO. Every temporary is written in th
 pass before it is read and is not written after its last read, so a cell shared by
 temporaries holds, at each read, the value of the temporary read. No record writes
 the active bank, and the empty slots after the records change nothing but the slot
-head.
+head. Each block is proved in Rocq from every window and every state of $H_A$, and
+the records of a pass are carried to the steps of the machine.
 \end{proof}
 
-The theorems below use only what Proposition~\ref{prop:storedpass} states. Call an
-image $\mathcal S'$ of $G$ records a \emph{stored host} if, on the window cells of
-Construction~\ref{con:stored}, a pass of $M^\alpha_{K,S,L}$ over it does what
-Proposition~\ref{prop:storedpass} states for some $\mathcal S_{A,w}$, and every cell
-that a record after the startup records reads, other than the cells under the heads
-and the sink, is written earlier in the pass. It has $B=bG/8$ bytes, with
-$b=8+3\alpha$, and $w$ is the width of its counters; its step block may compile any
-netlist whose step is that of $H_A$. Every $\mathcal S_{A,w}$ is a stored host, and
-$\mathcal S$ is one with $\alpha=12$, $G=36{,}080$ and $B=198{,}440$.
+The theorems below use what Proposition~\ref{prop:storedpass} states and one more
+property of the image: every cell that a record after the startup records reads,
+other than the cells under the heads and the sink, is written earlier in the pass.
+The image $\mathcal S_{A,w}$ has this property for every $A\ge8$ and $w\ge1$, and
+$B=bG/8$ bytes, with $b=8+3\alpha$; $\mathcal S$ has $\alpha=15$, $G=36{,}080$ and
+$B=239{,}030$. The proofs apply to every image with these two properties, whatever
+netlist with the step of $H_A$ its step block compiles.
 
 \begin{theorem}[Universal construction by the dynamics]\label{thm:storedconstruct}
-Let $\mathcal S'$ be a stored host of $G$ records, $K\ge2$ and $S\ge G$. Let $X$ be a byte
-string of at most $Sb/8$ bytes, $r$ a recipe with $\delta(r)=X$ and $|r|<2^w$, and
-$L\ge8|r|$. Let $x$ be a state of $M^\alpha_{K,S,L}$ with $\mathcal S'$ in the active bank
-from slot $0$, followed by empty slots, with the slot head at slot $0$, $r$ on the
-read tape from cell $0$, and in the window $\mathrm{booted}=0$ and clear requests,
-whatever the other banks, tapes and cells hold. Let $P$ be the number of steps that
+Let $A\ge8$ and $w\ge1$, let $\mathcal S_{A,w}$ have $G$ records, and let $K\ge2$ and
+$S\ge G$. Let $X$ be a byte string of at most $Sb/8$ bytes, $r$ a recipe with
+$\delta(r)=X$ and $|r|<2^w$, and $L\ge8|r|$. Let $x$ be a state of
+$M^\alpha_{K,S,L}$ with $\mathcal S_{A,w}$ in the active bank from slot $0$,
+followed by empty slots, with the slot head at slot $0$, $r$ on the read tape from
+cell $0$ followed by zeros, and in the window $\mathrm{booted}=0$ and clear
+requests, whatever the other banks, tapes and cells hold. Let $P$ be the number of steps that
 Proposition~\ref{prop:steps} gives for $r$. After $P$ passes, each of $S$ steps but
 the last, which has $G$:
 \begin{enumerate}[label=(\roman*),leftmargin=2em]
 \item the next bank holds the bits of $X$ from slot $0$, followed by zeros, with
 both its heads at $0$, and the next tape holds $r$ from cell $0$, followed by zeros,
 with its head at $0$;
-\item the active bank still holds $\mathcal S'$ and the read tape $r$, the window
-holds $\mathrm{booted}=0$ and clear requests, and no other bank or tape has changed;
+\item the active bank still holds $\mathcal S_{A,w}$ and the read tape $r$, the
+window holds $\mathrm{booted}=0$ and clear requests, and no other bank or tape has
+changed;
 \item the bank index has moved to the next bank.
 \end{enumerate}
 From then on $M^\alpha_{K,S,L}$ evaluates the records of $X$.
@@ -2013,67 +2014,77 @@ bit $0$ of the cleared bank, the arm moving on by one bit after each, and fit si
 $8|X|\le Sb$. Those emitted after it, $r$, are written under the copy head from cell
 $0$ of the cleared tape, and fit since $8|r|\le L$. The active bank and the read tape
 are not written, and no other bank or tape is addressed. From the next step on the
-bank holding $X$ is active, at slot $0$.
+bank holding $X$ is active, at slot $0$. The proof is checked in Rocq for every
+$A\ge8$, $w\ge1$, $K\ge2$, $S\ge G$ and $L\ge8|r|$, each pass related to one step of
+the run of $P^\ast$ on $r$ with the device of Definition~\ref{def:transducer}.
 \end{proof}
 
-By Lemma~\ref{lem:complete} every byte string has a recipe, so a stored host builds
-every image that fits a bank from a recipe that fits a tape, itself among them; the
-images need not have its size.
+By Lemma~\ref{lem:complete} every byte string has a recipe, so $\mathcal S_{A,w}$
+builds every image that fits a bank from a recipe that fits a tape, itself among
+them; the images need not have its size.
 
 \begin{theorem}[Self-reproduction of the host by the dynamics]\label{thm:storedrep}
-Let $\mathcal S'$ be a stored host of $G$ records and $B$ bytes, $\tau'=\describe(\mathcal S')$ with
-$|\tau'|<2^w$, $K\ge2$, $S\ge G$ and $L\ge8|\tau'|$. Let $x_0$ be a state of
-$M^\alpha_{K,S,L}$ with $\kappa=0$, $\mathcal S'$ in bank $0$ from slot $0$ with its slot
-head at slot $0$, $\tau'$ on tape $0$ from cell $0$ followed by zeros, and in the
-window $\mathrm{booted}=0$ and clear requests, whatever the other banks, tapes and
-cells hold. A generation is $(P-1)S+G$ steps, where $P=11B+13\lceil B/127\rceil+16$
-if $\mathcal S'$ has no four equal consecutive bytes and $P\le\tfrac{25}{2}B+29$ in any case.
-For every $g\ge1$, after $g$ generations $\kappa=g\bmod K$, and the banks
-$0,\dots,\min(g,K-1)$ of the ring, counted back from bank $\kappa$, hold $\mathcal S'$ from
-slot $0$ and their tapes $\tau'$ from cell $0$: the copies accumulate until every
-bank holds one. From the $K$-th generation on the state repeats every $K$
-generations. The network $N^\alpha_{K,S,L}$ started from the bits of $x_0$ holds the
-bits of these states at the same steps. For $\mathcal S$, with $K=3$, $S=G+5=36{,}085$ and
-$L=8|\tau_{\mathcal S}|+64=1{,}600{,}072$, a generation is $P=2{,}203{,}180$ passes,
-$79{,}501{,}750{,}295$ applications of $M^{12}_{3,S,L}$.
+Let $A\ge8$ and $w\ge1$, let $\mathcal S_{A,w}$ have $G$ records and $B$ bytes, let
+$\tau'$ be a recipe of its image with $|\tau'|<2^w$, and let $K\ge2$, $S\ge G$ and
+$L\ge8|\tau'|$. Let $x_0$ be a state of $M^\alpha_{K,S,L}$ with $\kappa=0$,
+$\mathcal S_{A,w}$ in bank $0$ from slot $0$ with its slot head at slot $0$, $\tau'$ on
+tape $0$ from cell $0$ followed by zeros, and in the window $\mathrm{booted}=0$ and
+clear requests, whatever the other banks, tapes and cells hold. A generation is
+$(P-1)S+G$ steps, where $P$ is the number of steps that
+Proposition~\ref{prop:steps} gives for $\tau'$; for $\tau'=\describe(\mathcal S_{A,w})$,
+$P=11B+13\lceil B/127\rceil+16$ if the image has no four equal consecutive bytes and
+$P\le\tfrac{25}{2}B+29$ in any case. For every $g\ge1$, after $g$ generations
+$\kappa=g\bmod K$, and the banks $0,\dots,\min(g,K-1)$ of the ring, counted back from
+bank $\kappa$, hold $\mathcal S_{A,w}$ from slot $0$ and their tapes $\tau'$ from cell
+$0$: the copies accumulate until every bank holds one. From the $K$-th generation on
+the state repeats every $K$ generations. The network $N^\alpha_{K,S,L}$ started from
+the bits of $x_0$ holds the bits of these states at the same steps. For $\mathcal S$,
+with $K=3$, $S=G+5=36{,}085$ and $L=8|\tau_{\mathcal S}|+64=1{,}927{,}264$, a
+generation is $P=2{,}653{,}813$ passes, $95{,}762{,}842{,}100$ applications of
+$M^{15}_{3,S,L}$.
 \end{theorem}
 
 \begin{proof}
-The first generation is Theorem~\ref{thm:storedconstruct} with $X=\mathcal S'$ and
-$r=\tau'$, a recipe for $\mathcal S'$ by Lemma~\ref{lem:describe}. After it the next bank
-holds $\mathcal S'$ from slot $0$ with its heads at $0$, the next tape $\tau'$ from cell $0$
-followed by zeros, and the window $\mathrm{booted}=0$ and clear requests, so the
-state satisfies the hypothesis of Theorem~\ref{thm:storedconstruct} for the next
-bank. A generation changes only the active bank's slot head, the read tape's head,
-and the next bank and tape, which it rebuilds; induction over the generations gives
-$\kappa$ and the copies. Let $\tau'$ have $\ell$ literal and $R$ repeat tokens.
-Since $|\tau'|=f_{\mathrm{lit}}+\ell+2R+1$, Proposition~\ref{prop:steps} gives
+The first generation is Theorem~\ref{thm:storedconstruct} with $X$ the image of
+$\mathcal S_{A,w}$ and $r=\tau'$. After it the next bank holds $\mathcal S_{A,w}$ from
+slot $0$ with its heads at $0$, the next tape $\tau'$ from cell $0$ followed by
+zeros, and the window $\mathrm{booted}=0$ and clear requests, so the state satisfies
+the hypothesis of Theorem~\ref{thm:storedconstruct} for the next bank. A generation
+changes only the active bank's slot head, the read tape's head, and the next bank
+and tape, which it rebuilds; induction over the generations gives $\kappa$ and the
+copies. Let $\tau'$ have $\ell$ literal and $R$ repeat tokens. Since
+$|\tau'|=f_{\mathrm{lit}}+\ell+2R+1$, Proposition~\ref{prop:steps} gives
 $P=11f_{\mathrm{lit}}+4f_{\mathrm{rep}}+13\ell+21R+16$. Without four equal
 consecutive bytes $\describe$ emits $\lceil B/127\rceil$ literal tokens and
 nothing else (Lemma~\ref{lem:describe}); in general its proof gives
 $\ell\le f_{\mathrm{lit}}/127+R+1$ and $4R\le f_{\mathrm{rep}}$, hence
-$P\le\tfrac{25}{2}B+29$; $\tau_{\mathcal S}$ has $1565$ literal and $2$ repeat tokens.
+$P\le\tfrac{25}{2}B+29$; $\tau_{\mathcal S}$ has $1888$ literal and $8$ repeat tokens.
 
 For the period, let $g\ge K$. Every bank has then been rebuilt and has been active
-since: the bank active $a$ generations ago, $1\le a<K$, holds $\mathcal S'$ with its slot head
-where its hand-over pass left it, at slot $G\bmod S$, and its bit head at $0$, and
-its tape holds $\tau'$ followed by zeros with the head where the copying left it,
-after $\tau'$; the active bank and its tape have all heads at $0$. So the banks, the
-tapes and $\kappa$ after generation $g$ depend only on $g\bmod K$. In the window,
-the cells no record writes keep their values. Every other cell is written in every
-pass, and after a generation holds what the last pass, the one that hands over,
-left in it. That pass starts in every generation from the same state of the host,
-the halted run of $P^\ast$ on $\tau'$, the same registers and the same cells under
-the heads, and every cell a record reads in it is written earlier in the pass,
-apart from the cells under the heads and the sink. So the windows after any two
-generations agree, and the state after generation $g+K$ equals the state after
-generation $g$. Theorem~\ref{thm:physnet} carries the statement to the network.
+since: the bank active $a$ generations ago, $1\le a<K$, holds $\mathcal S_{A,w}$
+with its slot head where its hand-over pass left it, at slot $G\bmod S$, and its bit
+head at $0$, and its tape holds $\tau'$ followed by zeros with the head where the
+copying left it, after $\tau'$; the active bank and its tape have all heads at $0$.
+So the banks, the tapes and $\kappa$ after generation $g$ depend only on $g\bmod K$.
+In the window, the cells no record writes keep their values. The first pass of a
+generation loads the same state of the host and the same registers into every
+window with $\mathrm{booted}=0$, and the heads and the tapes they read are the same
+in every generation; every cell a record after the startup reads is written earlier
+in the pass, apart from the cells under the heads and the sink. So, pass by pass,
+the windows of any two generations agree on every cell the records read or write,
+and after a generation the window is the same in every generation. The state after
+generation $g+K$ therefore equals the state after generation $g$, and
+Theorem~\ref{thm:physnet} carries the statement to the network. All of it is
+checked in Rocq for every $A\ge8$, $w\ge1$, every recipe $\tau'$ of the image with
+$|\tau'|<2^w$, $K\ge2$, $S\ge G$ and $L\ge8|\tau'|$.
 \end{proof}
 
 \begin{theorem}[Every word width]\label{thm:widths}
-For every $A\ge8$ there is a least $w_A\ge20$ for which $\mathcal S_A=\mathcal S_{A,w_A}$ has
-$|\describe(\mathcal S_A)|<2^{w_A}$. The stored host $\mathcal S_A$ builds every image that fits a bank
-and reproduces itself by the dynamics of $N^{\alpha_A}_{K,S,L}$ as
+For every $A\ge8$ there is a least $w_A\ge20$ for which the image of
+$\mathcal S_A=\mathcal S_{A,w_A}$, of $B_A$ bytes, has $2B_A+1<2^{w_A}$; then its
+recipe of literal tokens and $\describe(\mathcal S_A)$ are shorter than $2^{w_A}$.
+The stored host $\mathcal S_A$ builds every image that fits a bank and reproduces
+itself by the dynamics of $N^{\alpha_A}_{K,S,L}$ as
 Theorems~\ref{thm:storedconstruct} and~\ref{thm:storedrep} state, with
 \[
 G_A=35A2^{A-1}-2^{A+1}+\tfrac16(A^3-A)+A^2+29A+14w_A+91+\pi_A
@@ -2084,36 +2095,38 @@ of $\Theta(A^34^A)$ applications of $M^{\alpha_A}_{K,S,L}$.
 \end{theorem}
 
 \begin{proof}
-A pass of $\mathcal S_A$ does what Proposition~\ref{prop:storedpass} states, and every cell
-a record after the startup reads, other than the cells under the heads and the sink,
-is written earlier in the pass, so $\mathcal S_A$ is a stored host; $w_A$ exists since
-$|\describe(\mathcal S_A)|\le2B+1$ grows with $w$ far slower than $2^w$. The startup and device
+The records of $\mathcal S_{A,w}$ grow linearly in $w$ and its window
+logarithmically, so $B$ grows quadratically in $w$ while $2^w$ grows exponentially,
+and $w_A$ exists; this is proved in Rocq. The recipe of literal tokens of
+Lemma~\ref{lem:complete} has $B+\lceil B/127\rceil+1\le2B+1$ bytes, and
+$\describe$ gives no more by Lemma~\ref{lem:describe}. The startup and device
 records are counted in Construction~\ref{con:stored} and the hand-over has
 $4+\pi_A$. Lemma~\ref{cor:compile} compiles a conjunction or a disjunction of
 $k\ge2$ literals into $k-1$ records and a unit of threshold $2$ on three or four
 literals into four or eight, and summing over the blocks of Table~\ref{tab:blocks}
 gives $\tfrac{33}{2}A2^A-2^{A+1}+\tfrac16(A^3-A)+A^2+17A+4$ step records, the cubic
-term from the carry terms. The window holds the $A2^A+A+1$ state bits and at most
-$G_A$ temporaries, so $\alpha_A=A+\Theta(\log A)$; then $b=8+3\alpha_A=\Theta(A)$,
+term from the carry terms. The window holds the $A2^A+A+1$ state bits, a cell for
+each of the $\Theta(A2^A)$ units of $H_A$ and $O(A+w_A)$ further cells, so
+$\alpha_A=A+\Theta(\log A)$; then $b=8+3\alpha_A=\Theta(A)$,
 $B=bG_A/8=\Theta(A^22^A)$, and Theorem~\ref{thm:storedrep} gives a generation of
 $\Theta(B)$ passes of $S=G_A$ steps.
 \end{proof}
 
-For $A=8$ to $12$, $\mathcal S_A$ has $36{,}080$, $80{,}456$, $178{,}108$, $391{,}224$ and
-$853{,}173$ records, windows of $2^{12}$ to $2^{16}$ cells, counters of $20$, $20$,
-$22$, $23$ and $24$ bits and images of $198{,}440$ to $5{,}972{,}211$ bytes, and a
-generation takes $2{,}203{,}180$, $5{,}247{,}618$, $12{,}358{,}822$,
-$28{,}775{,}480$ and $66{,}305{,}830$ passes, $7.95\times10^{10}$ to
-$5.66\times10^{13}$ applications of $M$ with $S=G_A$.
+For $A=8$ to $12$, $\mathcal S_A$ has $36{,}080$, $80{,}463$, $178{,}112$, $391{,}220$ and
+$853{,}176$ records, windows of $2^{15}$ to $2^{19}$ cells, counters of $20$, $21$,
+$22$, $23$ and $24$ bits and images of $239{,}030$ to $6{,}932{,}055$ bytes, and a
+generation takes $2{,}653{,}813$, $6{,}253{,}470$, $14{,}583{,}670$,
+$33{,}661{,}915$ and $76{,}962{,}164$ passes, $9.57\times10^{10}$ to
+$6.57\times10^{13}$ applications of $M$ with $S=G_A$.
 
 \begin{corollary}[Self-reproduction under noise]\label{cor:storednoise}
-$\Lev(N^{12}_{3,S,L})$ has depth $19$ and $142{,}549+4{,}029S+153L$ rows,
-$M=390{,}340{,}030$ for the member of Theorem~\ref{thm:storedrep} that holds $\mathcal S$.
+$\Lev(N^{15}_{3,S,L})$ has depth $19$ and $1{,}118{,}054+4{,}839S+153L$ rows,
+$M=470{,}604{,}761$ for the member of Theorem~\ref{thm:storedrep} that holds $\mathcal S$.
 Under independent centred Gaussian perturbations of deviation $s$ on every
-pre-activation, a generation of $\mathcal S$, $T=79{,}501{,}750{,}295$ applications, runs
+pre-activation, a generation of $\mathcal S$, $T=95{,}762{,}842{,}100$ applications, runs
 exactly with probability at least $1-TM\erfc\bigl(1/(2\sqrt2\,s)\bigr)$, which
 exceeds $0.999$ for $s\le0.050$. The threefold and fivefold amplifications of
-Definition~\ref{def:amplify} reach the same probability for $s\le0.149$ and
+Definition~\ref{def:amplify} reach the same probability for $s\le0.148$ and
 $s\le0.247$.
 \end{corollary}
 
@@ -2126,7 +2139,7 @@ members and the affine form fits all of them.
 
 \begin{remark}[Corroboration]\label{rem:storedcheck}
 Six generations of $\mathcal S$ from $x_0$ were run in a ring of three banks,
-$S=36{,}085$ and $L=1{,}600{,}072$, on a transcription of Definition~\ref{def:twohead}
+$S=36{,}085$ and $L=1{,}927{,}264$, on a transcription of Definition~\ref{def:twohead}
 in C. After each, the new active bank held $\mathcal S$ and the new read tape
 $\tau_{\mathcal S}$ from their origins with their heads there. The copies accumulated,
 two after the first generation and three from the second on, and the full states
@@ -2134,8 +2147,8 @@ after the sixth and the fifth generation equalled those after the third and the
 second. One pass of $\mathcal S$ agreed with the startup, one step of $\Nhost$ and
 the device of Definition~\ref{def:ring} from $300$ random states, a fifth of them not
 booted and a third with requests holding random words, with random tapes, banks,
-registers and temporaries; so did one pass of $\mathcal S_9$ from $300$ and of
-$\mathcal S_{10}$ from $100$.
+registers and temporaries; so did one pass of $\mathcal S_9$ from $100$ and of
+$\mathcal S_{10}$ from $30$.
 
 All four blocks of $\mathcal S_8$ to $\mathcal S_{10}$ were also evaluated on reduced
 ordered decision diagrams over variables for the window, the cells under the heads
@@ -2153,14 +2166,13 @@ with the construction for $A=8$ to $12$.
 \end{remark}
 
 % =============================================================================
-\section{A constructor proved in Rocq}\label{sec:organism}
+\section{A constructor with a description code of its own}\label{sec:organism}
 % =============================================================================
 
-Theorem~\ref{thm:storedrep} is proved on paper over the Rocq proofs of
-Proposition~\ref{prop:host}, Theorems~\ref{thm:univ} and~\ref{thm:selfrep} and
-Theorem~\ref{thm:physnet}. This section gives a smaller stored network, the
-organism, that performs von Neumann's cycle in $M_{K,S,L}$, the machine of $64$
-window cells, with a description code of its own. Its universal construction, its
+The stored host reproduces through a computer of $36{,}080$ records that runs a
+program. This section gives a stored network of $143$ records, the organism, that
+performs von Neumann's cycle directly in $M_{K,S,L}$, the machine of $64$ window
+cells, with a description code of its own. Its universal construction, its
 reproduction in every ring, the accumulation of its copies and the period of the
 state are proved in Rocq, in the machine and in the network.
 
@@ -2531,17 +2543,18 @@ The ring machine was evaluated by transcriptions of Definition~\ref{def:twohead}
 Python and in C and by the netlist $N^\alpha_{K,S,L}$ in Python and in C. The
 stored host is built from $\sigma(\Nhost)$ by \texttt{src/twohead.py}, and its
 generations are run by \texttt{src/ring\_run.c}, which decodes the active bank once
-per hand-over and steps over its empty slots, about seven minutes per generation.
+per hand-over and steps over its empty slots, about eight minutes per generation.
 Separate code in \texttt{src/independent.py}, written from the definitions of this
 paper, rebuilds $H_A$ for $A=3$ to $12$, levelizes $\sigma(\Nhost)$ and repeats the
 measurements of Section~\ref{sec:certified} and Appendix~\ref{app:measure} in C and
 on the accelerator; it gives the sizes, depths and exact runs stated here, and noisy
 runs within sampling error.
 
-The Rocq development, \texttt{rocq/} in the artifact, has $27$ files and
-$7{,}391$ lines and builds with Rocq 9.1.1 in about seventy seconds on the machine
+The Rocq development, \texttt{rocq/} in the artifact, has $44$ files and
+$13{,}795$ lines and builds with Rocq 9.1.1 in about three minutes on the machine
 below, most of it in the kernel's evaluation of the $15{,}872$ abstract passes of
-Proposition~\ref{prop:pass}. It defines the host family $H_A$ block by block and
+Proposition~\ref{prop:pass} and in the device records of the stored host. It defines
+the host family $H_A$ block by block and
 proves that its step is the step of $\mathrm{SUBLEQ}_A$ for every $A\ge3$
 (Proposition~\ref{prop:host}). It defines the device of
 Definition~\ref{def:transducer} and the programs $P$ and $P^\ast$ in $2^A$ words,
@@ -2552,14 +2565,22 @@ block by block, the organism, the description code and the decoder, and proves
 Theorem~\ref{thm:physnet} for every $\alpha\ge4$, $K\ge2$ and $S,L\ge1$, together
 with the number of units and the weights; and it proves Lemma~\ref{lem:code},
 Proposition~\ref{prop:pass}, Theorem~\ref{thm:construct} and
-Theorem~\ref{thm:organism}, with the copies, the period and the network.
+Theorem~\ref{thm:organism}, with the copies, the period and the network. It
+defines the stored host $\mathcal S_{A,w}$ of Construction~\ref{con:stored} for
+every $A\ge8$ and $w\ge1$ and proves its four blocks from every window
+(Proposition~\ref{prop:storedpass}), that every cell a pass reads after the startup
+is written earlier in the pass, Theorems~\ref{thm:storedconstruct}
+and~\ref{thm:storedrep} with the copies, the period and the network, and the
+existence of $w_A$ in Theorem~\ref{thm:widths}.
 
 The file that defines the organism and its description is written by
 \texttt{src/twohead.py}. The netlist definitions, extracted to OCaml, write for $H_8$
 the netlist that $\sigma(\Nhost)$ denotes, for $H_9$ and $H_{10}$ those that
 \texttt{src/host.py} generates, and for $N^6_{3,160,3200}$, $N^{12}_{2,3,40}$ and
 $N^6_{5,2,7}$ files byte for byte equal to those that \texttt{src/twohead.py}
-writes.
+writes. The definition of $\mathcal S_{A,w}$, extracted to OCaml, writes for $A=8$
+and $9$ the images of $\mathcal S_8$ and $\mathcal S_9$ that \texttt{src/twohead.py}
+builds.
 
 The encoder satisfies $\delta(\describe(f))=f$ within the bound of
 Lemma~\ref{lem:describe} on the $29$ serialized machines of the artifact,
@@ -2587,8 +2608,8 @@ $1$:
 \normalfont $N^6_{3,160,3200}$ & 5ca111e612df8546683a9f8a9e3873c967537a963a6f4fb4a196d84676d6bb9f\\
 \normalfont organism $\rho$ & d4913db0b5ef6d3f122c44974cf9a58015fe7dabacb7176cf377d5cd0743f00b\\
 \normalfont $\describe(\rho)$ & b0c8dc6efa0e7b581790304b21eb4698d3aeb2f442e02d26948fcef5c88a5ec0\\
-\normalfont stored host $\mathcal S$ & 2aad2478143153562622be27d67385523203f5c0519604ef43eca0a510b986a0\\
-\normalfont $\tau_{\mathcal S}$ & c74c4f479fa5f60cd561ea66ff071003f3d559890171c217f27d2943e79ff14d
+\normalfont stored host $\mathcal S$ & 9a7821a540fed2ed58fbb263213f65aead6bbbd8cca6344abcabcc5f4289903c\\
+\normalfont $\tau_{\mathcal S}$ & dbb2cfe5fe8e53e303a51ddbe52964f70f83169181ec4dc05450cb244b9b5a97
 \end{tabular}
 \end{center}
 The layouts behind these digests are the following. The metadata of
@@ -2614,10 +2635,9 @@ index of the signal computing its next value, the state bits being numbered firs
 in the order of Theorem~\ref{thm:physnet}, and the units after them in the order of
 the Rocq definition. The records of the organism and of $\mathcal S$ are laid out as in
 Definition~\ref{def:twohead}, with the window cells of
-Constructions~\ref{con:organism} and~\ref{con:stored}; within each block of
-Construction~\ref{con:stored} the order of the records is that of
-\texttt{src/twohead.py}, which gives each temporary the least cell free over
-its live interval.
+Constructions~\ref{con:organism} and~\ref{con:stored}; in $\mathcal S$ the cells of
+the units, of the levels and of the device follow the state bits in that order, and
+the order of the records is that of the Rocq definition.
 One generation of $\Omega^\ast$ takes $0.3$ seconds on~(a), $45$ seconds on~(d)
 and $9$ minutes on~(b). All figures were
 produced with Python 3.12.3, PyTorch 2.14.0 with CUDA 12.6, NumPy 2.5.3,

rocq/Assumptions.v

@@ -1,5 +1,6 @@
 (* The assumptions of the main theorems, printed by src/paper.py rocq after the build. *)
-From TH Require Import PhysSem PhysMain PhysFacts NetMain Complete Decoder Run PassLemma Main HostSem Pstar.
+From TH Require Import PhysSem PhysMain PhysFacts NetMain Complete Decoder Run PassLemma Main HostSem Pstar
+  StoredBoot StoredPass StoredDev StoredOk StoredRun StoredWbr StoredMain StoredWidth.
 
 Print Assumptions PhysSem.netlist_step.
 Print Assumptions PhysMain.network_orbit.
@@ -21,3 +22,20 @@ Print Assumptions Pstar.constructor_run.
 Print Assumptions Pstar.selfrep_run.
 Print Assumptions Pstar.image_Pstar_8.
 Print Assumptions Pstar.image_P_8.
+Print Assumptions StoredBoot.startup_run.
+Print Assumptions StoredPass.step_view.
+Print Assumptions StoredDev.device_run.
+Print Assumptions StoredBoot.handover_run.
+Print Assumptions StoredOk.stored_ok.
+Print Assumptions StoredPass.pass_first.
+Print Assumptions StoredPass.pass_next.
+Print Assumptions StoredRun.machine_pass.
+Print Assumptions StoredRun.stored_construct.
+Print Assumptions StoredWbr.wbr_stored.
+Print Assumptions StoredMain.reproduces.
+Print Assumptions StoredMain.copies.
+Print Assumptions StoredMain.periodic.
+Print Assumptions StoredMain.network_reproduces.
+Print Assumptions StoredMain.network_periodic.
+Print Assumptions StoredWidth.width_exists.
+Print Assumptions StoredWidth.recipe_of_image.

rocq/ExtractStored.v

@@ -0,0 +1,5 @@
+From Stdlib Require Import Extraction ExtrOcamlBasic ExtrOcamlNatInt ExtrOcamlZInt.
+From TH Require Import Stored.
+Extraction Language OCaml.
+Set Extraction Output Directory "extract".
+Extraction "storednet.ml" stored_bits.

rocq/HostIP.v

@@ -0,0 +1,329 @@
+(* The host netlist read in its own order, for every A >= 3: every weight is 1 or -1, no unit reads the
+   unit of a next value, and a unit that reads a state bit comes no later than the unit of that bit's next
+   value. So the unit of each next value may write its state bit in place. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Gates Host HostWF PhysFacts.
+
+(* ---- flat indices and block coordinates ------------------------------------------------------------ *)
+Lemma flat_loc : forall bs, Forall shaped bs -> forall k, k < boff bs (length bs) ->
+  exists b j r, b < length bs /\ j < bcount (nth b bs blk0) /\ r < bsize (nth b bs blk0)
+                /\ k = boff bs b + bsize (nth b bs blk0) * j + r.
+Proof.
+  intros bs Hsh. induction Hsh as [|blk t Hs Ht IH]; intros k Hk; cbn [boff length] in Hk; [lia|].
+  destruct (Nat.lt_ge_cases k (bcount blk * bsize blk)) as [Hl|Hg].
+  - exists 0, (k / bsize blk), (k mod bsize blk).
+    assert (bsize blk <> 0) by (intro E; rewrite E in Hl; lia).
+    cbn [nth length boff]. split; [lia|]. split; [apply Nat.Div0.div_lt_upper_bound; nia|].
+    split; [apply Nat.mod_upper_bound; exact H|]. rewrite (Nat.div_mod k (bsize blk)) at 1 by exact H. lia.
+  - destruct (IH (k - bcount blk * bsize blk) ltac:(lia)) as (b & j & r & Hb & Hj & Hr & Hk').
+    exists (S b), j, r. cbn [nth length boff]. split; [lia|]. split; [exact Hj|]. split; [exact Hr|]. lia.
+Qed.
+
+Lemma idx_inj : forall bs n x y, valid bs n x -> valid bs n y -> idx n bs x = idx n bs y -> x = y.
+Proof.
+  intros bs n [i|b j r] [i'|b' j' r'] Hx Hy E; cbn [valid idx] in Hx, Hy, E.
+  - subst. reflexivity.
+  - lia.
+  - lia.
+  - destruct Hx as (Hb & Hj & Hr). destruct Hy as (Hb' & Hj' & Hr').
+    assert (Bb : b = b').
+    { destruct (Nat.lt_trichotomy b b') as [L|[L|L]]; [|exact L|].
+      - pose proof (boff_mono bs b' b L ltac:(lia)). nia.
+      - pose proof (boff_mono bs b b' L ltac:(lia)). nia. }
+    subst b'. assert (Jj : j = j') by nia. subst j'. f_equal. lia.
+Qed.
+
+(* ---- the inputs of the last four blocks ------------------------------------------------------------ *)
+Ltac solve_disj := repeat (first [left; reflexivity | right]); reflexivity.
+
+Ltac lits3 Hin := let H := fresh "H" in
+  first [pose proof (in_sin_lits _ _ _ (or_introl Hin)) as H | pose proof (in_sin_lits _ _ _ (or_intror Hin)) as H];
+  cbn [map fst] in H; destruct H as [<-|[<-|[<-|[]]]]; solve_disj.
+
+Ltac lits2 Hin := let H := fresh "H" in
+  first [pose proof (in_sin_lits _ _ _ (or_introl Hin)) as H | pose proof (in_sin_lits _ _ _ (or_intror Hin)) as H];
+  cbn [map fst] in H; destruct H as [<-|[<-|[]]]; solve_disj.
+
+Section Last.
+Variable A : nat.
+Hypothesis HA : 3 <= A.
+
+Lemma len_hb : length (hblocks A) = tb A + 15.
+Proof. apply length_hblocks. lia. Qed.
+
+Lemma inputs_NP : forall j r x w, j < A -> r < 1 -> In (x, w) (sin (sunit (hblocks A) (tb A + 11) j r)) ->
+  x = SRef 1 j 0 \/ x = SRef (tb A + 9) j 0 \/ x = SRef (tb A + 10) j 0.
+Proof.
+  intros j r x w Hj Hr Hin. unfold sunit in Hin. rewrite nth_hb_post in Hin by lia.
+  cbn [nth hpost bshape blk_NP] in Hin. destruct r as [|r]; [|lia]. cbn [nth] in Hin. lits3 Hin.
+Qed.
+
+Lemma inputs_HAB : forall j r x w, j < 1 -> r < 3 -> In (x, w) (sin (sunit (hblocks A) (tb A + 12) j r)) ->
+  x = haltb A \/ x = SRef (tb A + 8) 0 0 \/ x = SRef 9 0 0 \/ x = SRef 0 (SW A - 4) 0
+  \/ x = SRef (tb A + 12) 0 0 \/ x = SRef (tb A + 12) 0 1.
+Proof.
+  intros j r x w Hj Hr Hin. unfold sunit in Hin. rewrite nth_hb_post in Hin by lia.
+  cbn [nth hpost bshape blk_HAB] in Hin.
+  assert (Hr3 : r = 0 \/ r = 1 \/ r = 2) by lia.
+  destruct Hr3 as [->|[->| ->]]; cbn [nth] in Hin; lits3 Hin.
+Qed.
+
+Lemma inputs_WR : forall j r x w, r < 1 -> In (x, w) (sin (sunit (hblocks A) (tb A + 13) j r)) ->
+  x = rbit A (A - 1 - j mod A) \/ x = SRef 10 (j / A) 0.
+Proof.
+  intros j r x w Hr Hin. unfold sunit in Hin. rewrite nth_hb_post in Hin by lia.
+  cbn [nth hpost bshape blk_WR] in Hin. destruct r as [|r]; [|lia]. cbn [nth] in Hin. lits2 Hin.
+Qed.
+
+Lemma inputs_NM : forall j r x w, r < 1 -> In (x, w) (sin (sunit (hblocks A) (tb A + 14) j r)) ->
+  x = SRef 13 j 0 \/ x = SRef (tb A + 13) j 0.
+Proof.
+  intros j r x w Hr Hin. unfold sunit in Hin. rewrite nth_hb_post in Hin by lia.
+  cbn [nth hpost bshape blk_NM] in Hin. destruct r as [|r]; [|lia]. cbn [nth] in Hin. lits2 Hin.
+Qed.
+
+Lemma rbit_not : forall k b j r, rbit A k = SRef b j r -> b < tb A + 8.
+Proof.
+  intros k b j r. unfold rbit. destruct (Nat.eqb_spec k 0); intro E; injection E as <- _ _; unfold tb; lia.
+Qed.
+
+Lemma bsize_post : forall i, i < 15 -> bsize (nth (tb A + i) (hblocks A) blk0) = bsize (nth i (hpost A) blk0).
+Proof. intros i Hi. rewrite nth_hb_post by lia. reflexivity. Qed.
+
+Lemma bcount_post : forall i, i < 15 -> bcount (nth (tb A + i) (hblocks A) blk0) = bcount (nth i (hpost A) blk0).
+Proof. intros i Hi. rewrite nth_hb_post by lia. reflexivity. Qed.
+
+(* the units of the next values are valid units *)
+Lemma hout_valid : forall i, i < nH A -> valid (hblocks A) (nH A) (hout A i).
+Proof.
+  intros i Hi. pose proof (SW_ge A HA). unfold hout.
+  destruct (Nat.ltb_spec i A); [|destruct (Nat.eqb_spec i A)]; cbn [valid]; rewrite len_hb;
+    (split; [lia|]); rewrite ?bcount_post, ?bsize_post by lia;
+    cbn [nth hpost bcount bsize blk_NP blk_HAB blk_NM]; unfold nH in Hi; nia.
+Qed.
+
+(* no unit reads the unit of a next value *)
+Theorem reads_no_out : forall b j r x w,
+  b < length (hblocks A) -> j < bcount (nth b (hblocks A) blk0) -> r < bsize (nth b (hblocks A) blk0) ->
+  In (x, w) (sin (sunit (hblocks A) b j r)) -> forall i, i < nH A -> x <> hout A i.
+Proof.
+  intros b j r x w Hb Hj Hr Hin i Hi E. rewrite len_hb in Hb.
+  pose proof (proj2 (host_wf A HA) b j r x w ltac:(rewrite len_hb; lia) Hj Hr Hin) as Hrb.
+  unfold hout in E.
+  destruct (Nat.ltb_spec i A) as [Hia|Hia]; [|destruct (Nat.eqb_spec i A) as [Hie|Hie]]; subst x;
+    cbn [reads_back] in Hrb.
+  - (* SRef (tb + 11) i 0 *)
+    destruct Hrb as [(Hb' & _ & _)|(Eb & Ej & Hr')].
+    + assert (Hc : b = tb A + 12 \/ b = tb A + 13 \/ b = tb A + 14) by lia.
+      destruct Hc as [->|[->| ->]].
+      * rewrite bcount_post in Hj by lia. rewrite bsize_post in Hr by lia.
+        cbn [nth hpost bcount bsize blk_HAB] in Hj, Hr.
+        destruct (inputs_HAB j r _ w Hj Hr Hin) as [E|[E|[E|[E|[E|E]]]]]; try discriminate;
+          injection E; unfold tb; lia.
+      * rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_WR] in Hr.
+        destruct (inputs_WR j r _ w Hr Hin) as [E|E]; [|injection E; unfold tb; lia].
+        pose proof (rbit_not (A - 1 - j mod A) _ _ _ (eq_sym E)). lia.
+      * rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_NM] in Hr.
+        destruct (inputs_NM j r _ w Hr Hin) as [E|E]; injection E; unfold tb; lia.
+    + subst b. rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_NP] in Hr. lia.
+  - (* SRef (tb + 12) 0 2 *)
+    destruct Hrb as [(Hb' & _ & _)|(Eb & Ej & Hr')].
+    + assert (Hc : b = tb A + 13 \/ b = tb A + 14) by lia.
+      destruct Hc as [->| ->].
+      * rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_WR] in Hr.
+        destruct (inputs_WR j r _ w Hr Hin) as [E|E]; [|injection E; unfold tb; lia].
+        pose proof (rbit_not (A - 1 - j mod A) _ _ _ (eq_sym E)). lia.
+      * rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_NM] in Hr.
+        destruct (inputs_NM j r _ w Hr Hin) as [E|E]; injection E; unfold tb; lia.
+    + subst b. rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_HAB] in Hr. lia.
+  - (* SRef (tb + 14) (i - A - 1) 0 *)
+    destruct Hrb as [(Hb' & _ & _)|(Eb & Ej & Hr')]; [lia|].
+    subst b. rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_NM] in Hr. lia.
+Qed.
+
+(* the state bits the last four blocks read: the halt bit, read by the halt latch alone *)
+Lemma last_reads_halt : forall b j r i w, tb A + 11 <= b < tb A + 15 ->
+  j < bcount (nth b (hblocks A) blk0) -> r < bsize (nth b (hblocks A) blk0) ->
+  In (SIn i, w) (sin (sunit (hblocks A) b j r)) -> b = tb A + 12 /\ i = A.
+Proof.
+  intros b j r i w Hb Hj Hr Hin.
+  assert (Hc : b = tb A + 11 \/ b = tb A + 12 \/ b = tb A + 13 \/ b = tb A + 14) by lia.
+  destruct Hc as [->|[->|[->| ->]]].
+  - rewrite bcount_post in Hj by lia. rewrite bsize_post in Hr by lia.
+    cbn [nth hpost bcount bsize blk_NP] in Hj, Hr.
+    destruct (inputs_NP j r _ w Hj Hr Hin) as [E|[E|E]]; discriminate.
+  - rewrite bcount_post in Hj by lia. rewrite bsize_post in Hr by lia.
+    cbn [nth hpost bcount bsize blk_HAB] in Hj, Hr.
+    destruct (inputs_HAB j r _ w Hj Hr Hin) as [E|[E|[E|[E|[E|E]]]]]; try discriminate.
+    unfold haltb in E. injection E as <-. split; reflexivity.
+  - rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_WR] in Hr.
+    destruct (inputs_WR j r _ w Hr Hin) as [E|E]; [|discriminate].
+    unfold rbit in E. destruct (Nat.eqb (A - 1 - j mod A) 0); discriminate.
+  - rewrite bsize_post in Hr by lia. cbn [nth hpost bsize blk_NM] in Hr.
+    destruct (inputs_NM j r _ w Hr Hin) as [E|E]; discriminate.
+Qed.
+
+(* a unit that reads state bit i comes no later than the unit of its next value *)
+Theorem reads_in_before : forall b j r i w,
+  b < length (hblocks A) -> j < bcount (nth b (hblocks A) blk0) -> r < bsize (nth b (hblocks A) blk0) ->
+  In (SIn i, w) (sin (sunit (hblocks A) b j r)) ->
+  i < nH A /\ idx (nH A) (hblocks A) (SRef b j r) <= idx (nH A) (hblocks A) (hout A i).
+Proof.
+  intros b j r i w Hb Hj Hr Hin.
+  pose proof (proj2 (host_wf A HA) b j r (SIn i) w Hb Hj Hr Hin) as Hi. cbn [reads_back] in Hi.
+  split; [exact Hi|]. rewrite len_hb in Hb.
+  pose proof (hout_valid i Hi) as Hv.
+  destruct (Nat.lt_ge_cases b (tb A + 11)) as [Hlt|Hge].
+  - (* every unit before the next counter comes before every unit of a next value *)
+    assert (Hb2 : forall b' j' r', tb A + 11 <= b' -> b' < tb A + 15 ->
+                  idx (nH A) (hblocks A) (SRef b j r) < idx (nH A) (hblocks A) (SRef b' j' r')).
+    { intros b' j' r' H1 H2. cbn [idx].
+      pose proof (boff_mono (hblocks A) b' b ltac:(lia) ltac:(rewrite len_hb; lia)). nia. }
+    unfold hout in *. destruct (Nat.ltb i A); [|destruct (Nat.eqb i A)]; apply Nat.lt_le_incl, Hb2; lia.
+  - destruct (last_reads_halt b j r i w ltac:(lia) Hj Hr Hin) as [-> ->].
+    unfold hout. rewrite Nat.ltb_irrefl, Nat.eqb_refl. cbn [idx].
+    rewrite bcount_post in Hj by lia. rewrite bsize_post in Hr by lia.
+    cbn [nth hpost bcount bsize blk_HAB] in Hj, Hr.
+    rewrite bsize_post by lia. cbn [nth hpost bsize blk_HAB]. lia.
+Qed.
+
+(* every weight of the host is 1 or -1 *)
+Lemma ter_hblocks : forall b j, Forall ter (bshape (nth b (hblocks A) blk0) j).
+Proof.
+  intros b j.
+  assert (Hm : forall f n, (forall i, ter (f i)) -> Forall ter (map f (seq 0 n)))
+    by (intros f n Hf; apply Forall_map, Forall_forall; intros; apply Hf).
+  assert (Hsu : forall bb ws, Forall (fun p => snd p = 1%Z \/ snd p = (-1)%Z) ws -> ter (SU bb ws)).
+  { intros bb ws H x w0 Hin. rewrite Forall_forall in H. exact (H (x, w0) Hin). }
+  destruct (Nat.lt_ge_cases b (length (hblocks A))) as [Hb|Hb];
+    [|rewrite nth_overflow by exact Hb; cbn [bshape blk0]; constructor].
+  rewrite len_hb in Hb.
+  destruct (Nat.lt_ge_cases b 17) as [Hp|Hp].
+  { rewrite nth_hb_pre by exact Hp.
+    assert (Hc : b = 0 \/ b = 1 \/ b = 2 \/ b = 3 \/ b = 4 \/ b = 5 \/ b = 6 \/ b = 7 \/ b = 8 \/ b = 9
+                 \/ b = 10 \/ b = 11 \/ b = 12 \/ b = 13 \/ b = 14 \/ b = 15 \/ b = 16) by lia.
+    destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]]]];
+      cbn [nth hpre bshape blk_P blk_HP blk_FA blk_Q blk_F blk_PA blk_PB blk_AC blk_W
+           blk_RX blk_RY blk_KP blk_X blk_Y blk_PR];
+      apply Forall_forall; intros u Hu; destruct Hu as [<-|[]]; first [apply ter_and | apply ter_or]. }
+  destruct (Nat.lt_ge_cases b (tb A)) as [HT|HT].
+  { unfold tb in HT. replace b with (16 + (b - 16)) by lia.
+    rewrite nth_hb_T by lia. cbn [bshape blk_T].
+    constructor; [apply ter_and | apply Forall_map, Forall_forall; intros; apply ter_and]. }
+  replace b with (tb A + (b - tb A)) by lia. rewrite nth_hb_post by lia.
+  assert (Hi : b - tb A < 15) by lia. remember (b - tb A) as i eqn:Ei. clear Ei.
+  assert (Hc : i = 0 \/ i = 1 \/ i = 2 \/ i = 3 \/ i = 4 \/ i = 5 \/ i = 6 \/ i = 7 \/ i = 8 \/ i = 9
+               \/ i = 10 \/ i = 11 \/ i = 12 \/ i = 13 \/ i = 14) by lia.
+  assert (Hw : forall bb ws, (forall p, In p ws -> snd p = 1%Z \/ snd p = (-1)%Z) -> ter (SU bb ws))
+    by (intros bb ws H; apply Hsu, Forall_forall, H).
+  destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]]]]]]]];
+    cbn [nth hpost bshape blk_C blk_AX blk_NX blk_XN blk_EQ blk_R0 blk_H blk_R blk_LEQ
+         blk_TA blk_TB blk_NP blk_HAB blk_WR blk_NM map];
+    apply Forall_forall; intros u Hu;
+    repeat (destruct Hu as [<-|Hu];
+            [first [apply ter_and | apply ter_or
+                   | apply Hw; intros p Hq; repeat (destruct Hq as [<-|Hq]; [cbn [snd]; lia|]); destruct Hq] |]);
+    destruct Hu.
+Qed.
+
+End Last.
+
+(* ---- the same facts on the flat netlist ------------------------------------------------------------- *)
+Section Flat.
+Variable A : nat.
+Hypothesis HA : 3 <= A.
+
+Let us := host_units A.
+
+Lemma hb_shaped : Forall shaped (hblocks A).
+Proof. exact (proj1 (host_wf A HA)). Qed.
+
+Lemma length_hu : length us = boff (hblocks A) (length (hblocks A)).
+Proof. apply length_compile. exact hb_shaped. Qed.
+
+Lemma hu_loc : forall k, k < length us -> exists b j r,
+  b < length (hblocks A) /\ j < bcount (nth b (hblocks A) blk0) /\ r < bsize (nth b (hblocks A) blk0)
+  /\ nH A + k = idx (nH A) (hblocks A) (SRef b j r)
+  /\ nth k us tu0 = flat_unit (nH A) (hblocks A) (sunit (hblocks A) b j r).
+Proof.
+  intros k Hk. rewrite length_hu in Hk.
+  destruct (flat_loc (hblocks A) hb_shaped k Hk) as (b & j & r & Hb & Hj & Hr & ->).
+  exists b, j, r. split; [exact Hb|]. split; [exact Hj|]. split; [exact Hr|]. split.
+  - cbn [idx]. lia.
+  - apply compile_nth; [exact hb_shaped | exact Hb | exact Hj | exact Hr].
+Qed.
+
+(* an input of a unit, in block coordinates *)
+Lemma hu_input : forall k i w, k < length us -> In (i, w) (tin (nth k us tu0)) ->
+  exists b j r x, b < length (hblocks A) /\ j < bcount (nth b (hblocks A) blk0) /\ r < bsize (nth b (hblocks A) blk0)
+  /\ nH A + k = idx (nH A) (hblocks A) (SRef b j r) /\ In (x, w) (sin (sunit (hblocks A) b j r))
+  /\ i = idx (nH A) (hblocks A) x /\ valid (hblocks A) (nH A) x.
+Proof.
+  intros k i w Hk Hin. destruct (hu_loc k Hk) as (b & j & r & Hb & Hj & Hr & Hidx & Hu).
+  rewrite Hu in Hin. unfold flat_unit in Hin. cbn [tin] in Hin.
+  apply in_map_iff in Hin as ([x w'] & E & Hx). cbn [fst snd] in E. injection E as <- <-.
+  exists b, j, r, x. refine (conj Hb (conj Hj (conj Hr (conj Hidx (conj Hx (conj eq_refl _)))))).
+  pose proof (proj2 (host_wf A HA) b j r x w' Hb Hj Hr Hx) as Hrb.
+  destruct x as [i|b' j' r']; cbn [reads_back valid] in *; [exact Hrb|].
+  destruct Hrb as [(H1 & H2 & H3)|(-> & -> & H3)]; [split; [lia | auto] | split; [exact Hb | split; [exact Hj | lia]]].
+Qed.
+
+Lemma hnext_nth : forall i, i < nH A -> nth i (host_next A) 0 = idx (nH A) (hblocks A) (hout A i).
+Proof. intros i Hi. unfold host_next. apply nth_map_seq. exact Hi. Qed.
+
+Lemma hout_inj : forall i i', hout A i = hout A i' -> i = i'.
+Proof.
+  intros i i'. unfold hout.
+  destruct (Nat.ltb_spec i A), (Nat.ltb_spec i' A); try destruct (Nat.eqb_spec i A); try destruct (Nat.eqb_spec i' A);
+    intro E; try injection E; intros; unfold tb in *; lia.
+Qed.
+
+Theorem host_weights : forall k i w, k < length us -> In (i, w) (tin (nth k us tu0)) -> w = 1%Z \/ w = (-1)%Z.
+Proof.
+  intros k i w Hk Hin. destruct (hu_input k i w Hk Hin) as (b & j & r & x & _ & _ & _ & _ & Hx & _).
+  unfold sunit in Hx. pose proof (ter_hblocks A HA b j) as T.
+  destruct (Nat.lt_ge_cases r (length (bshape (nth b (hblocks A) blk0) j))) as [Hr|Hr].
+  - exact (ter_nth _ r T x w Hx).
+  - rewrite nth_overflow in Hx by exact Hr. destruct Hx.
+Qed.
+
+Theorem host_no_out : forall k i w, k < length us -> In (i, w) (tin (nth k us tu0)) ->
+  forall i', i' < nH A -> i <> nth i' (host_next A) 0.
+Proof.
+  intros k i w Hk Hin i' Hi' E. destruct (hu_input k i w Hk Hin) as (b & j & r & x & Hb & Hj & Hr & _ & Hx & -> & Hv).
+  rewrite hnext_nth in E by exact Hi'.
+  apply (idx_inj _ _ _ _ Hv (hout_valid A HA i' Hi')) in E.
+  exact (reads_no_out A HA b j r x w Hb Hj Hr Hx i' Hi' E).
+Qed.
+
+Theorem host_in_before : forall k i w, k < length us -> In (i, w) (tin (nth k us tu0)) -> i < nH A ->
+  nH A + k <= nth i (host_next A) 0.
+Proof.
+  intros k i w Hk Hin Hi. destruct (hu_input k i w Hk Hin) as (b & j & r & x & Hb & Hj & Hr & Hidx & Hx & Ex & Hv).
+  destruct x as [i0|b' j' r']; cbn [idx] in Ex; [subst i0|lia].
+  rewrite hnext_nth by exact Hi. rewrite Hidx.
+  exact (proj2 (reads_in_before A HA b j r i w Hb Hj Hr Hx)).
+Qed.
+
+Lemma host_next_range : forall i, i < nH A -> nH A <= nth i (host_next A) 0 < nH A + length us.
+Proof.
+  intros i Hi. rewrite hnext_nth by exact Hi. pose proof (hout_valid A HA i Hi) as Hv.
+  pose proof (idx_lt_total _ _ _ Hv) as H. rewrite <- length_hu in H.
+  unfold hout in *. destruct (Nat.ltb i A); [|destruct (Nat.eqb i A)]; cbn [idx] in *;
+    (split; [nia | exact H]).
+Qed.
+
+Lemma host_next_inj : forall i i', i < nH A -> i' < nH A -> nth i (host_next A) 0 = nth i' (host_next A) 0 -> i = i'.
+Proof.
+  intros i i' Hi Hi' E. rewrite !hnext_nth in E by assumption.
+  apply hout_inj. exact (idx_inj _ _ _ _ (hout_valid A HA i Hi) (hout_valid A HA i' Hi') E).
+Qed.
+
+Lemma host_reads_below : forall k, k < length us -> reads_below (nth k us tu0) (nH A + k).
+Proof. intros k Hk. apply wf_reads_below; [exact (host_wf A HA) | exact Hk]. Qed.
+
+Lemma length_host_next : length (host_next A) = nH A.
+Proof. unfold host_next. rewrite length_map, length_seq. reflexivity. Qed.
+
+End Flat.

rocq/Stored.v

@@ -0,0 +1,201 @@
+(* The stored host S_{A,w} of Construction 8.3: the host H_A and its device compiled into records of the
+   ring machine. Each unit of H_A has a window cell of its own, the units are evaluated in the order of
+   the netlist, and the unit of the next value of a state bit writes that bit with its last record. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Host Device.
+
+(* ---- records of two literals ---------------------------------------------------------------- *)
+(* a literal is a window cell and its polarity *)
+Definition pm (p : bool) : Z := if p then 1%Z else (-1)%Z.
+
+Definition gAND (x y : nat * bool) (d : nat) : rec :=
+  Rec (fst x) (pm (snd x)) (fst y) (pm (snd y)) (- (b2z (snd x) + b2z (snd y)))%Z d.
+Definition gOR (x y : nat * bool) (d : nat) : rec :=
+  Rec (fst x) (pm (snd x)) (fst y) (pm (snd y)) (1 - b2z (snd x) - b2z (snd y))%Z d.
+Definition gCOPY (x : nat * bool) (d : nat) : rec :=
+  Rec (fst x) (pm (snd x)) SINK 0 (if snd x then (-1)%Z else 0%Z) d.
+Definition gCONST (b : bool) (d : nat) : rec :=
+  if b then gOR (SINK, true) (SINK, false) d else gAND (SINK, true) (SINK, false) d.
+Definition EMPTY : rec := Rec 0 0 0 0 0 0.
+
+(* the literals joined by g, accumulated in acc, the last record writing d *)
+Fixpoint chain_tail (g : nat * bool -> nat * bool -> nat -> rec) (acc : nat) (l : nat * bool)
+  (ls : list (nat * bool)) (d : nat) : list rec :=
+  match ls with
+  | [] => [g (acc, true) l d]
+  | l' :: t => g (acc, true) l acc :: chain_tail g acc l' t d
+  end.
+
+Definition chain (g : nat * bool -> nat * bool -> nat -> rec) (ls : list (nat * bool)) (d acc : nat) : list rec :=
+  match ls with
+  | [] => []
+  | [l0] => [gCOPY l0 d]
+  | [l0; l1] => [g l0 l1 d]
+  | l0 :: l1 :: l2 :: t => g l0 l1 acc :: chain_tail g acc l2 t d
+  end.
+
+(* at least t of the literals, into d: T_t(x1..xk) = T_t(x2..xk) or (x1 and T_{t-1}(x2..xk)), the three
+   cells xc lev 0, 1, 2 holding T_t(x2..xk), T_{t-1}(x2..xk) and the conjunction *)
+Section Unit.
+Variable xc : nat -> nat -> nat.
+
+Fixpoint ucomp (t : Z) (ls : list (nat * bool)) (d acc lev : nat) {struct ls} : list rec :=
+  if Z.leb t 0 then [gCONST true d]
+  else if Z.ltb (Z.of_nat (length ls)) t then [gCONST false d]
+  else if Z.eqb t 1 then chain gOR ls d acc
+  else if Z.eqb t (Z.of_nat (length ls)) then chain gAND ls d acc
+  else match ls with
+       | [] => []
+       | l0 :: rest =>
+           ucomp t rest (xc lev 0) (xc lev 0) (S lev) ++ ucomp (t - 1) rest (xc lev 1) (xc lev 1) (S lev)
+           ++ [gAND l0 (xc lev 1, true) (xc lev 2); gOR (xc lev 0, true) (xc lev 2, true) d]
+       end.
+
+End Unit.
+
+(* the least number of true literals at which a unit of weights 1 and -1 fires *)
+Definition tval (u : tu) : Z := (Z.of_nat (length (filter (fun p => Z.ltb (snd p) 0) (tin u))) - Net.tb u)%Z.
+
+Definition thr_unit (u : tu) : bool := Z.ltb 1 (tval u) && Z.ltb (tval u) (Z.of_nat (length (tin u))).
+
+(* the levels of cells the threshold units use *)
+Definition levels (us : list tu) : nat :=
+  fold_left Nat.max (map (fun u => if thr_unit u then length (tin u) - 2 else 0) us) 0.
+
+Fixpoint setopt (l : list (option nat)) (k x : nat) : list (option nat) :=
+  match l, k with
+  | [], _ => []
+  | _ :: t, O => Some x :: t
+  | y :: t, S k' => y :: setopt t k' x
+  end.
+
+(* the state bit whose next value each of nu units is, if any *)
+Definition next_tbl (n nu : nat) (nx : list nat) : list (option nat) :=
+  fold_left (fun tbl p => setopt tbl (snd p - n) (fst p)) (combine (seq 0 n) nx) (repeat None nu).
+
+Section Layout.
+Variables A w nu lv : nat.
+
+(* ---- the window: the requests, booted, the counter, dest, the limit, the state of H_A, a cell for each
+   of the nu units, lv levels of three cells for the threshold units, and the cells of the device ---- *)
+Definition nh : nat := nH A.
+
+Definition BOOT : nat := 13.
+Definition CNT (i : nat) : nat := 14 + i.
+Definition DEST : nat := 14 + w.
+Definition LIM (i : nat) : nat := 15 + w + i.
+Definition ST (i : nat) : nat := 15 + 2 * w + i.
+Definition UC (u : nat) : nat := 15 + 2 * w + nh + u.
+Definition XC (lev k : nat) : nat := 15 + 2 * w + nh + nu + 3 * lev + k.
+
+Definition DB : nat := 15 + 2 * w + nh + nu + 3 * lv.
+Definition dWR : nat := DB.
+Definition dRD : nat := DB + 1.
+Definition dRW : nat := DB + 2.
+Definition dE (i : nat) : nat := DB + 3 + i.
+Definition dEQ : nat := DB + 3 + w.
+Definition dEOT : nat := DB + 4 + w.
+Definition dCA : nat := DB + 5 + w.
+Definition dCC : nat := DB + 6 + w.
+Definition dG : nat := DB + 7 + w.
+Definition dCAR (i : nat) : nat := DB + 7 + w + i.
+Definition M0 : nat := DB + 7 + 2 * w.
+Definition M1 : nat := DB + 8 + 2 * w.
+Definition ncells : nat := DB + 9 + 2 * w.
+
+(* bit t, of value 2^t, of memory word j *)
+Definition MB (j t : nat) : nat := ST (A + 1 + A * j + (A - 1 - t)).
+
+(* ---- the startup: while booted is 0, load the memory image m, clear the counter, the halt bit and the
+   registers, return the heads to their origins and clear the idle bank and the copy tape ----------- *)
+Definition boot_word (j v : nat) : list rec :=
+  map (fun t => if Nat.testbit v t then gOR (MB j t, true) (BOOT, false) (MB j t)
+                else gAND (MB j t, true) (BOOT, true) (MB j t)) (seq 0 A).
+
+Definition startup (m : list nat) : list rec :=
+  concat (map (fun p => boot_word (fst p) (snd p)) (combine (seq 0 (SW A)) m))
+  ++ map (fun t => gAND (ST (A - 1 - t), true) (BOOT, true) (ST (A - 1 - t))) (seq 0 A)
+  ++ [gAND (ST A, true) (BOOT, true) (ST A)]
+  ++ concat (map (fun i => [gAND (CNT i, true) (BOOT, true) (CNT i); gAND (LIM i, true) (BOOT, true) (LIM i)])
+                 (seq 0 w))
+  ++ [gAND (DEST, true) (BOOT, true) DEST]
+  ++ map (fun c => gCOPY (BOOT, false) c) [RR; CB; RA; CT; RC]
+  ++ [gCONST true BOOT].
+
+(* ---- the step of H_A: unit u into its cell, or into the state bit whose next value it is -------- *)
+Definition lit_of (p : nat * Z) : nat * bool :=
+  (if fst p <? nh then ST (fst p) else UC (fst p - nh), Z.ltb 0 (snd p)).
+
+Fixpoint step_go (u : nat) (us : list tu) (nt : list (option nat)) : list rec :=
+  match us, nt with
+  | U :: us', o :: nt' =>
+      ucomp XC (tval U) (map lit_of (tin U)) (match o with Some i => ST i | None => UC u end) (UC u) 0
+      ++ step_go (S u) us' nt'
+  | _, _ => []
+  end.
+
+(* ---- the device of Definition 8.4 ---------------------------------------------------------------- *)
+Definition gMUX (s : nat) (a b : nat * bool) (d : nat) : list rec :=
+  [gAND (s, true) a M0; gAND (s, false) b M1; gOR (M0, true) (M1, true) d].
+Definition gXOR (x y : nat * bool) (d : nat) : list rec :=
+  [gOR x y M0; gOR (fst x, negb (snd x)) (fst y, negb (snd y)) M1; gAND (M0, true) (M1, true) d].
+
+Definition word1 (j d : nat) : list rec :=
+  chain gAND ((MB j 0, true) :: map (fun t => (MB j t, false)) (seq 1 (A - 1))) d d.
+
+Definition carry (i : nat) : nat := if Nat.eqb i 0 then dG else dCAR i.
+
+Definition device : list rec :=
+  word1 (cwr A) dWR ++ word1 (crd A) dRD ++ word1 (crw A) dRW
+  ++ concat (map (fun i => [gAND (CNT i, true) (LIM i, true) M0; gAND (CNT i, false) (LIM i, false) M1;
+                            gOR (M0, true) (M1, true) (dE i)]) (seq 0 w))
+  ++ chain gAND (map (fun i => (dE i, true)) (seq 0 w)) dEQ dEQ
+  ++ [gAND (dEQ, true) (DEST, true) dEOT; gAND (dWR, true) (DEST, false) dCA; gAND (dWR, true) (DEST, true) dCC]
+  ++ concat (map (fun k => gMUX dCA (MB (rout A) (7 - k), true) (ARM, true) ARM ++ [gCOPY (dCA, true) AA]
+                           ++ gMUX dCC (MB (rout A) (7 - k), true) (CPY, true) CPY ++ [gCOPY (dCC, true) AC])
+                 (seq 0 8))
+  ++ map (fun t => gAND (MB (rout A) t, true) (dWR, false) (MB (rout A) t)) (seq 0 A)
+  ++ [gAND (dRD, true) (dEOT, false) dG]
+  ++ concat (map (fun k => gMUX dG (RD, true) (MB (rin A) (7 - k), true) (MB (rin A) (7 - k))
+                           ++ [gCOPY (dG, true) AR]) (seq 0 8))
+  ++ concat (map (fun t => gMUX dG (MB (rin A) 7, true) (MB (rin A) t, true) (MB (rin A) t)) (seq 8 (A - 8)))
+  ++ gMUX dRD (dEOT, true) (MB (ceot A) 0, true) (MB (ceot A) 0)
+  ++ map (fun t => gAND (MB (ceot A) t, true) (dRD, false) (MB (ceot A) t)) (seq 1 (A - 1))
+  ++ map (fun i => gAND (carry i, true) (CNT i, true) (dCAR (S i))) (seq 0 (w - 1))
+  ++ concat (map (fun i => gXOR (CNT i, true) (carry i, true) (CNT i)) (seq 0 w))
+  ++ [gCOPY (dRW, true) RR]
+  ++ concat (map (fun i => gMUX dRW (CNT i, true) (LIM i, true) (LIM i) ++ [gAND (CNT i, true) (dRW, false) (CNT i)])
+                 (seq 0 w))
+  ++ [gOR (DEST, true) (dRW, true) DEST]
+  ++ concat (map (fun c => map (fun t => gCONST false (MB c t)) (seq 0 A)) [cwr A; crd A; crw A]).
+
+(* ---- the hand-over: at the halt, booted cleared, the arm and the copy head home, and control to the
+   next bank ---------------------------------------------------------------------------------------- *)
+Definition handover : list rec :=
+  [gAND (BOOT, true) (ST A, false) BOOT; gCOPY (ST A, true) RA; gCOPY (ST A, true) RC; gCOPY (ST A, true) HO].
+
+End Layout.
+
+(* ---- the image: the least window that holds the cells, and the fewest empty records before the
+   hand-over that make it a whole number of bytes ---------------------------------------------------- *)
+Definition padn (al len : nat) : nat :=
+  match find (fun p => Nat.eqb ((recw al * (len + 4 + p)) mod 8) 0) (seq 0 8) with
+  | Some p => p
+  | None => 0
+  end.
+
+Definition stored_of (A w : nat) (us : list tu) (nx m : list nat) : list rec * nat :=
+  let nu := length us in
+  let lv := levels us in
+  let al := Nat.log2_up (ncells A w nu lv) in
+  let body := startup A w m ++ step_go A w nu 0 us (next_tbl (nH A) nu nx) ++ device A w nu lv in
+  (body ++ repeat EMPTY (padn al (length body)) ++ handover A w, al).
+
+Definition stored (A w : nat) : list rec := fst (stored_of A w (host_units A) (host_next A) (image A (progPstar A))).
+
+Definition alS (A w : nat) : nat := snd (stored_of A w (host_units A) (host_next A) (image A (progPstar A))).
+
+Definition stored_bits (A w : nat) : list bool :=
+  let sa := stored_of A w (host_units A) (host_next A) (image A (progPstar A)) in
+  concat (map (enc_recA (snd sa)) (fst sa)).

rocq/StoredBoot.v

@@ -0,0 +1,417 @@
+(* The startup, padding and hand-over records of the stored host. While booted is 0 the startup loads the
+   initial state of the host and clears the registers, the heads and the next bank and tape; when booted
+   is 1 it changes nothing. The hand-over clears booted at the halt, returns the arm and the copy head to
+   their origins and hands over. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run View Stored WinRun ViewOps Host HostSem.
+
+(* ---- records that each set their own cell from that cell and booted -------------------------------- *)
+Definition self_rec (r : rec) : Prop :=
+  HO < ao_of r /\ ao_of r <> BOOT
+  /\ forall w1 w2, wget w1 (ao_of r) = wget w2 (ao_of r) -> wget w1 BOOT = wget w2 BOOT -> wval w1 r = wval w2 r.
+
+Lemma wrun_self : forall rs w, NoDup (map ao_of rs) -> Forall self_rec rs -> (forall r, In r rs -> ao_of r < length w) ->
+  (forall r, In r rs -> wget (wrun rs w) (ao_of r) = wval w r)
+  /\ (forall c, ~ In c (map ao_of rs) -> wget (wrun rs w) c = wget w c).
+Proof.
+  induction rs as [|r rs IH]; intros w Hnd Hs Hl; [split; [intros r [] | intros; reflexivity]|].
+  inversion Hnd as [|? ? Hni Hnd']; subst. apply Forall_cons_iff in Hs as [(Hr1 & Hr2 & Hr3) Hs'].
+  cbn [wrun]. unfold wexec.
+  set (w1 := wnext w (ao_of r) (wval w r)).
+  assert (Hw1 : forall c, wget w1 c = if Nat.eqb c (ao_of r) then wval w r else wget w c)
+    by (intro c; unfold w1; apply wget_wnext; [exact Hr1 | apply Hl; left; reflexivity]).
+  assert (Hl1 : forall r', In r' rs -> ao_of r' < length w1)
+    by (intros r' Hr'; unfold w1; rewrite length_wnext; apply Hl; right; exact Hr').
+  destruct (IH w1 Hnd' Hs' Hl1) as [IH1 IH2]. split.
+  - intros r' [<-|Hr'].
+    + rewrite IH2 by exact Hni. rewrite Hw1, Nat.eqb_refl. reflexivity.
+    + rewrite (IH1 r' Hr'). rewrite Forall_forall in Hs'. destruct (Hs' r' Hr') as (_ & _ & S3). apply S3.
+      * rewrite Hw1. replace (Nat.eqb (ao_of r') (ao_of r)) with false; [reflexivity|].
+        symmetry. apply Nat.eqb_neq. intro E. apply Hni. rewrite <- E. apply in_map. exact Hr'.
+      * rewrite Hw1. replace (Nat.eqb BOOT (ao_of r)) with false by (symmetry; apply Nat.eqb_neq; congruence). reflexivity.
+  - intros c Hc. rewrite IH2 by (intro H; apply Hc; right; exact H). rewrite Hw1.
+    replace (Nat.eqb c (ao_of r)) with false by (symmetry; apply Nat.eqb_neq; intro E; apply Hc; left; congruence).
+    reflexivity.
+Qed.
+
+Lemma wval_or_boot : forall w c, HO < c -> wval w (gOR (c, true) (BOOT, false) c) = wget w c || negb (wget w BOOT).
+Proof.
+  intros w c H. rewrite wval_or. unfold wl, wcell. cbn [fst snd].
+  replace (Nat.eqb c SINK) with false by (symmetry; apply Nat.eqb_neq; unfold SINK, HO in *; lia). reflexivity.
+Qed.
+
+Lemma wval_and_boot : forall w c, HO < c -> wval w (gAND (c, true) (BOOT, true) c) = wget w c && wget w BOOT.
+Proof.
+  intros w c H. rewrite wval_and. unfold wl, wcell. cbn [fst snd].
+  replace (Nat.eqb c SINK) with false by (symmetry; apply Nat.eqb_neq; unfold SINK, HO in *; lia). reflexivity.
+Qed.
+
+Lemma self_or : forall c, HO < c -> c <> BOOT -> self_rec (gOR (c, true) (BOOT, false) c).
+Proof.
+  intros c H1 H2. cbn [ao_of gOR]. split; [exact H1|]. split; [exact H2|].
+  intros w1 w2 E1 E2. cbn [ao_of gOR] in E1. rewrite !wval_or_boot by exact H1. rewrite E1, E2. reflexivity.
+Qed.
+
+Lemma self_and : forall c, HO < c -> c <> BOOT -> self_rec (gAND (c, true) (BOOT, true) c).
+Proof.
+  intros c H1 H2. cbn [ao_of gAND]. split; [exact H1|]. split; [exact H2|].
+  intros w1 w2 E1 E2. cbn [ao_of gAND] in E1. rewrite !wval_and_boot by exact H1. rewrite E1, E2. reflexivity.
+Qed.
+
+(* ---- lists of cells ------------------------------------------------------------------------------------ *)
+Lemma map_combine_seq : forall (T : Type) (F : nat -> nat -> T) (m : list nat) k,
+  map (fun p => F (fst p) (snd p)) (combine (seq k (length m)) m) = map (fun j => F j (nth (j - k) m 0)) (seq k (length m)).
+Proof.
+  intros T F m. induction m as [|x m IH]; intro k; [reflexivity|].
+  cbn [length seq combine map fst snd]. rewrite Nat.sub_diag. cbn [nth]. f_equal. rewrite IH.
+  apply map_ext_in. intros j Hj. apply in_seq in Hj. replace (j - k) with (S (j - S k)) by lia. reflexivity.
+Qed.
+
+Lemma nodup_concat_map : forall (T : Type) (f : nat -> list T) l, NoDup l -> (forall j, In j l -> NoDup (f j)) ->
+  (forall j j' x, In j l -> In j' l -> j <> j' -> In x (f j) -> In x (f j') -> False) -> NoDup (concat (map f l)).
+Proof.
+  intros T f l. induction l as [|j l IH]; intros Hnd Hf Hdis; [constructor|].
+  inversion Hnd as [|? ? Hni Hnd']; subst. cbn [map concat].
+  apply NoDup_app; [apply Hf; left; reflexivity | apply IH; [exact Hnd' | intros; apply Hf; right; assumption |] |].
+  - intros a b x Ha Hb Hab. apply (Hdis a b x); [right; exact Ha | right; exact Hb | exact Hab].
+  - intros x Hx1 Hx2. apply in_concat in Hx2 as (y & Hy & Hx2). apply in_map_iff in Hy as (j' & <- & Hj').
+    apply (Hdis j j' x); [left; reflexivity | right; exact Hj' | intro E; apply Hni; subst; exact Hj' | exact Hx1 | exact Hx2].
+Qed.
+
+Lemma nodup_map_seq : forall (f : nat -> nat) k N, (forall i j, k <= i < k + N -> k <= j < k + N -> f i = f j -> i = j) ->
+  NoDup (map f (seq k N)).
+Proof.
+  intros f k N H. apply NoDup_map_NoDup_ForallPairs; [|apply seq_NoDup].
+  intros i j Hi Hj E. apply in_seq in Hi, Hj. exact (H i j Hi Hj E).
+Qed.
+
+Lemma nodup_app_sep : forall (P : nat -> Prop) l1 l2, NoDup l1 -> NoDup l2 ->
+  (forall x, In x l1 -> P x) -> (forall x, In x l2 -> ~ P x) -> NoDup (l1 ++ l2).
+Proof.
+  intros P l1 l2 H1 H2 Hp Hn. apply NoDup_app; [exact H1 | exact H2 |].
+  intros x Hx1 Hx2. exact (Hn x Hx2 (Hp x Hx1)).
+Qed.
+
+Section Boot.
+Variables (A w W Lb L : nat) (m : list nat).
+Hypotheses (HA : 3 <= A) (Hm : length m = SW A).
+Local Notation n := (nH A).
+Hypothesis HW : 15 + 2 * w + n <= W.
+
+(* the initial state of the host with memory m *)
+Definition x0m : hst := mkH 0 false m.
+
+Definition mem_recs : list rec := concat (map (fun j => boot_word A w j (nth j m 0)) (seq 0 (SW A))).
+Definition pc_recs : list rec := map (fun t => gAND (ST w (A - 1 - t), true) (BOOT, true) (ST w (A - 1 - t))) (seq 0 A).
+Definition reg_recs : list rec :=
+  concat (map (fun i => [gAND (CNT i, true) (BOOT, true) (CNT i); gAND (LIM w i, true) (BOOT, true) (LIM w i)]) (seq 0 w)).
+Definition wpart : list rec :=
+  mem_recs ++ pc_recs ++ [gAND (ST w A, true) (BOOT, true) (ST w A)] ++ reg_recs ++ [gAND (DEST w, true) (BOOT, true) (DEST w)].
+Definition req_recs : list rec := map (fun c => gCOPY (BOOT, false) c) [RR; CB; RA; CT; RC].
+
+Lemma startup_split : startup A w m = wpart ++ req_recs ++ [gCONST true BOOT].
+Proof.
+  unfold startup, wpart, mem_recs, req_recs, reg_recs, pc_recs.
+  assert (E : map (fun p => boot_word A w (fst p) (snd p)) (combine (seq 0 (SW A)) m)
+              = map (fun j => boot_word A w j (nth j m 0)) (seq 0 (SW A))).
+  { rewrite <- Hm. rewrite (map_combine_seq _ (boot_word A w) m 0).
+    apply map_ext_in. intros j _. rewrite Nat.sub_0_r. reflexivity. }
+  rewrite E. rewrite <- !app_assoc. reflexivity.
+Qed.
+
+Lemma SW_pos : 1 <= SW A.
+Proof. unfold SW. pose proof (Nat.pow_nonzero 2 A ltac:(lia)). lia. Qed.
+
+Lemma MB_ST : forall j t, j < SW A -> t < A -> MB A w j t = ST w (A + 1 + j * A + (A - 1 - t)) /\ A + 1 + j * A + (A - 1 - t) < n.
+Proof.
+  intros j t Hj Ht. unfold MB. split; [f_equal; lia|]. unfold nH. nia.
+Qed.
+
+Lemma cells_mem : map ao_of mem_recs = concat (map (fun j => map (fun t => MB A w j t) (seq 0 A)) (seq 0 (SW A))).
+Proof.
+  unfold mem_recs. rewrite concat_map, map_map. f_equal. apply map_ext. intro j. unfold boot_word.
+  rewrite map_map. apply map_ext. intro t. destruct (Nat.testbit _ t); reflexivity.
+Qed.
+
+Lemma cells_regs : map ao_of reg_recs = concat (map (fun i => [CNT i; LIM w i]) (seq 0 w)).
+Proof. unfold reg_recs. rewrite concat_map, map_map. reflexivity. Qed.
+
+Lemma nodup_wpart : NoDup (map ao_of wpart).
+Proof.
+  unfold wpart. rewrite !map_app, cells_mem, cells_regs. unfold pc_recs. rewrite map_map. cbn [map ao_of gAND].
+  assert (Nmem : NoDup (concat (map (fun j => map (fun t => MB A w j t) (seq 0 A)) (seq 0 (SW A))))).
+  { apply nodup_concat_map; [apply seq_NoDup | |].
+    - intros j Hj. apply in_seq in Hj. apply nodup_map_seq. intros t t' Ht Ht' E. unfold MB, ST in E. lia.
+    - intros j j' x Hj Hj' Hne Hx Hx'. apply in_seq in Hj, Hj'.
+      apply in_map_iff in Hx as (t & <- & Ht). apply in_map_iff in Hx' as (t' & E & Ht').
+      apply in_seq in Ht, Ht'. unfold MB, ST in E. apply Hne. nia. }
+  assert (Npc : NoDup (map (fun t => ST w (A - 1 - t)) (seq 0 A)))
+    by (apply nodup_map_seq; intros i j Hi Hj E; unfold ST in E; lia).
+  assert (Nreg : NoDup (concat (map (fun i => [CNT i; LIM w i]) (seq 0 w)))).
+  { apply nodup_concat_map; [apply seq_NoDup | |].
+    - intros i Hi. apply in_seq in Hi. constructor; [intros [E|[]]; unfold CNT, LIM in E; lia | constructor; [intros []|constructor]].
+    - intros i i' x Hi Hi' Hne Hx Hx'. apply in_seq in Hi, Hi'.
+      cbn [In] in Hx, Hx'. unfold CNT, LIM in *. lia. }
+  apply (nodup_app_sep (fun x => ST w (A + 1) <= x)); [exact Nmem | | |].
+  2:{ intros x Hx. apply in_concat in Hx as (y & Hy & Hx). apply in_map_iff in Hy as (j & <- & Hj).
+      apply in_map_iff in Hx as (t & <- & Ht). apply in_seq in Hj, Ht. unfold MB, ST. lia. }
+  2:{ intros x Hx. apply in_app_or in Hx as [Hx|Hx].
+      - apply in_map_iff in Hx as (t & <- & Ht). apply in_seq in Ht. unfold ST. lia.
+      - cbn [app In] in Hx. destruct Hx as [<-|Hx]; [unfold ST; lia|].
+        apply in_app_or in Hx as [Hx|[<-|[]]]; [|unfold DEST, ST; lia].
+        apply in_concat in Hx as (y & Hy & Hx). apply in_map_iff in Hy as (i & <- & Hi). apply in_seq in Hi.
+        cbn [In] in Hx. unfold CNT, LIM, ST in *. lia. }
+  apply (nodup_app_sep (fun x => ST w 0 <= x < ST w A)); [exact Npc | | |].
+  2:{ intros x Hx. apply in_map_iff in Hx as (t & <- & Ht). apply in_seq in Ht. unfold ST. lia. }
+  2:{ intros x Hx. cbn [app In] in Hx. destruct Hx as [<-|Hx]; [unfold ST; lia|].
+      apply in_app_or in Hx as [Hx|[<-|[]]]; [|unfold DEST, ST; lia].
+      apply in_concat in Hx as (y & Hy & Hx). apply in_map_iff in Hy as (i & <- & Hi). apply in_seq in Hi.
+      cbn [In] in Hx. unfold CNT, LIM, ST in *. lia. }
+  cbn [app]. constructor.
+  - intro Hx. apply in_app_or in Hx as [Hx|[E|[]]]; [|unfold DEST, ST in E; lia].
+    apply in_concat in Hx as (y & Hy & Hx). apply in_map_iff in Hy as (i & <- & Hi). apply in_seq in Hi.
+    cbn [In] in Hx. unfold CNT, LIM, ST in *. lia.
+  - apply NoDup_app; [exact Nreg | constructor; [intros []|constructor] |].
+    intros x Hx [<-|[]]. apply in_concat in Hx as (y & Hy & Hx). apply in_map_iff in Hy as (i & <- & Hi).
+    apply in_seq in Hi. cbn [In] in Hx. unfold CNT, LIM, DEST in *. lia.
+Qed.
+
+Lemma self_wpart : Forall self_rec wpart.
+Proof.
+  unfold wpart, mem_recs, pc_recs, reg_recs. rewrite !Forall_app. repeat split.
+  - apply Forall_concat. apply Forall_map, Forall_forall. intros j Hj. apply in_seq in Hj.
+    unfold boot_word. apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht.
+    destruct (Nat.testbit (nth j m 0) t); [apply self_or | apply self_and]; unfold MB, ST, BOOT, HO; lia.
+  - apply Forall_map, Forall_forall. intros t Ht. apply self_and; unfold ST, BOOT, HO; lia.
+  - constructor; [apply self_and; unfold ST, BOOT, HO; lia | constructor].
+  - apply Forall_concat. apply Forall_map, Forall_forall. intros i Hi.
+    constructor; [apply self_and; unfold CNT, BOOT, HO; lia | constructor; [apply self_and; unfold LIM, BOOT, HO; lia | constructor]].
+  - constructor; [apply self_and; unfold DEST, BOOT, HO; lia | constructor].
+Qed.
+
+Lemma wrec_wpart : Forall wrec wpart.
+Proof.
+  apply Forall_forall. intros r Hr. pose proof self_wpart as Hs. rewrite Forall_forall in Hs.
+  unfold wpart, mem_recs, pc_recs, reg_recs in Hr.
+  repeat (apply in_app_or in Hr as [Hr|Hr]).
+  - apply in_concat in Hr as (y & Hy & Hr). apply in_map_iff in Hy as (j & <- & _). unfold boot_word in Hr.
+    apply in_map_iff in Hr as (t & <- & _).
+    destruct (Nat.testbit (nth j m 0) t); [apply wrec_or | apply wrec_and];
+      unfold rd_ok, MB, ST, BOOT, CPY, HO; cbn [fst]; lia.
+  - apply in_map_iff in Hr as (t & <- & _). apply wrec_and; unfold rd_ok, ST, BOOT, CPY, HO; cbn [fst]; lia.
+  - destruct Hr as [<-|[]]. apply wrec_and; unfold rd_ok, ST, BOOT, CPY, HO; cbn [fst]; lia.
+  - apply in_concat in Hr as (y & Hy & Hr). apply in_map_iff in Hy as (i & <- & _).
+    destruct Hr as [<-|[<-|[]]]; apply wrec_and; unfold rd_ok, CNT, LIM, BOOT, CPY, HO; cbn [fst]; lia.
+  - destruct Hr as [<-|[]]. apply wrec_and; unfold rd_ok, DEST, BOOT, CPY, HO; cbn [fst]; lia.
+Qed.
+
+Lemma wpart_ao_range : forall r, In r wpart -> 14 <= ao_of r < 15 + 2 * w + n.
+Proof.
+  intros r Hr. unfold wpart, mem_recs, pc_recs, reg_recs in Hr.
+  repeat (apply in_app_or in Hr as [Hr|Hr]).
+  - apply in_concat in Hr as (y & Hy & Hr). apply in_map_iff in Hy as (j & <- & Hj). apply in_seq in Hj.
+    unfold boot_word in Hr. apply in_map_iff in Hr as (t & <- & Ht). apply in_seq in Ht.
+    destruct (MB_ST j t ltac:(lia) ltac:(lia)) as [E1 E2].
+    destruct (Nat.testbit (nth j m 0) t); cbn [ao_of gOR gAND]; rewrite E1; unfold ST; lia.
+  - apply in_map_iff in Hr as (t & <- & Ht). apply in_seq in Ht. cbn [ao_of gAND]. unfold ST, nH. nia.
+  - destruct Hr as [<-|[]]. cbn [ao_of gAND]. unfold ST, nH. nia.
+  - apply in_concat in Hr as (y & Hy & Hr). apply in_map_iff in Hy as (i & <- & Hi). apply in_seq in Hi.
+    destruct Hr as [<-|[<-|[]]]; cbn [ao_of gAND]; unfold CNT, LIM, nH; nia.
+  - destruct Hr as [<-|[]]. cbn [ao_of gAND]. unfold DEST, nH. nia.
+Qed.
+
+Theorem wpart_run : forall ww, length ww = W ->
+  let b := wget ww BOOT in
+  let ww' := wrun wpart ww in
+  length ww' = W
+  /\ (forall i, i < n -> wget ww' (ST w i) = if b then wget ww (ST w i) else nth i (encodeH A x0m) false)
+  /\ (forall i, i < w -> wget ww' (CNT i) = wget ww (CNT i) && b /\ wget ww' (LIM w i) = wget ww (LIM w i) && b)
+  /\ wget ww' (DEST w) = wget ww (DEST w) && b
+  /\ (forall c, (c <= BOOT \/ 15 + 2 * w + n <= c) -> wget ww' c = wget ww c).
+Proof.
+  intros ww Hl b ww'.
+  assert (Hlen : forall r, In r wpart -> ao_of r < length ww)
+    by (intros r Hr; rewrite Hl; pose proof (wpart_ao_range r Hr); lia).
+  destruct (wrun_self wpart ww nodup_wpart self_wpart Hlen) as [S1 S2].
+  assert (Hin : forall r, In r wpart -> wget ww' (ao_of r) = wval ww r) by exact S1.
+  refine (conj (eq_trans (length_wrun _ _) Hl) (conj _ (conj _ (conj _ _)))).
+  - intros i Hi. destruct (Nat.lt_ge_cases i A) as [Hia|Hia]; [|destruct (Nat.eq_dec i A) as [->|Hne]].
+    + (* a bit of the counter *)
+      set (t := A - 1 - i).
+      assert (Hr : In (gAND (ST w (A - 1 - t), true) (BOOT, true) (ST w (A - 1 - t))) wpart).
+      { unfold wpart. apply in_or_app. right. apply in_or_app. left. unfold pc_recs. apply in_map_iff.
+        exists t. split; [reflexivity | apply in_seq; unfold t; lia]. }
+      pose proof (Hin _ Hr) as E. cbn [ao_of gAND] in E. replace (A - 1 - t) with i in E by (unfold t; lia).
+      rewrite E, wval_and_boot by (unfold ST, HO; lia). fold b.
+      rewrite nth_encodeH_pc by exact Hia. cbn [hpc x0m]. unfold bitof. rewrite Nat.bits_0.
+      destruct b; [rewrite andb_true_r | rewrite andb_false_r]; reflexivity.
+    + (* the halt bit *)
+      assert (Hr : In (gAND (ST w A, true) (BOOT, true) (ST w A)) wpart).
+      { unfold wpart. apply in_or_app. right. apply in_or_app. right. left. reflexivity. }
+      pose proof (Hin _ Hr) as E. cbn [ao_of gAND] in E. rewrite E, wval_and_boot by (unfold ST, HO; lia). fold b.
+      rewrite nth_encodeH_halt. cbn [hhalt x0m]. destruct b; [rewrite andb_true_r | rewrite andb_false_r]; reflexivity.
+    + (* a bit of memory *)
+      set (j := (i - A - 1) / A). set (k := (i - A - 1) mod A). set (t := A - 1 - k).
+      assert (Hk : k < A) by (unfold k; apply Nat.mod_upper_bound; lia).
+      assert (Hji : i = A + 1 + j * A + k) by (unfold j, k; pose proof (Nat.div_mod_eq (i - A - 1) A); lia).
+      assert (Hj : j < SW A) by (unfold nH in Hi; nia).
+      assert (Ht : t < A) by (unfold t; lia).
+      destruct (MB_ST j t Hj Ht) as [EM _]. replace (A - 1 - t) with k in EM by (unfold t; lia).
+      rewrite <- Hji in EM.
+      set (rj := if Nat.testbit (nth j m 0) t then gOR (MB A w j t, true) (BOOT, false) (MB A w j t)
+                 else gAND (MB A w j t, true) (BOOT, true) (MB A w j t)).
+      assert (Hr : In rj wpart).
+      { unfold wpart. apply in_or_app. left. unfold mem_recs. apply in_concat.
+        exists (boot_word A w j (nth j m 0)).
+        split; [apply in_map_iff; exists j; split; [reflexivity | apply in_seq; lia]|].
+        unfold boot_word. apply in_map_iff. exists t. split; [reflexivity | apply in_seq; lia]. }
+      pose proof (Hin _ Hr) as E.
+      assert (Ea : ao_of rj = ST w i) by (unfold rj; destruct (Nat.testbit (nth j m 0) t); cbn [ao_of gOR gAND]; exact EM).
+      rewrite Ea in E. rewrite E. rewrite Hji at 2.
+      rewrite nth_encodeH_mem by (cbn [hmem x0m]; assumption). cbn [x0m]. unfold memv. cbn [hmem]. unfold bitof.
+      replace (A - 1 - k) with t by (unfold t; lia).
+      unfold rj. destruct (Nat.testbit (nth j m 0) t) eqn:Eb.
+      * rewrite wval_or_boot by (rewrite EM; unfold ST, HO; lia). rewrite EM. fold b.
+        destruct b; cbn [negb]; [rewrite orb_false_r; reflexivity | rewrite orb_true_r; symmetry; exact Eb].
+      * rewrite wval_and_boot by (rewrite EM; unfold ST, HO; lia). rewrite EM. fold b.
+        destruct b; [rewrite andb_true_r; reflexivity | rewrite andb_false_r; symmetry; exact Eb].
+  - intros i Hi. split.
+    + assert (Hr : In (gAND (CNT i, true) (BOOT, true) (CNT i)) wpart).
+      { unfold wpart. do 3 (apply in_or_app; right). apply in_or_app; left. unfold reg_recs. apply in_concat.
+        exists [gAND (CNT i, true) (BOOT, true) (CNT i); gAND (LIM w i, true) (BOOT, true) (LIM w i)].
+        split; [apply in_map_iff; exists i; split; [reflexivity | apply in_seq; lia] | left; reflexivity]. }
+      pose proof (Hin _ Hr) as E. cbn [ao_of gAND] in E. rewrite E, wval_and_boot by (unfold CNT, HO; lia). reflexivity.
+    + assert (Hr : In (gAND (LIM w i, true) (BOOT, true) (LIM w i)) wpart).
+      { unfold wpart. do 3 (apply in_or_app; right). apply in_or_app; left. unfold reg_recs. apply in_concat.
+        exists [gAND (CNT i, true) (BOOT, true) (CNT i); gAND (LIM w i, true) (BOOT, true) (LIM w i)].
+        split; [apply in_map_iff; exists i; split; [reflexivity | apply in_seq; lia] | right; left; reflexivity]. }
+      pose proof (Hin _ Hr) as E. cbn [ao_of gAND] in E. rewrite E, wval_and_boot by (unfold LIM, HO; lia). reflexivity.
+  - assert (Hr : In (gAND (DEST w, true) (BOOT, true) (DEST w)) wpart).
+    { unfold wpart. do 4 (apply in_or_app; right). left. reflexivity. }
+    pose proof (Hin _ Hr) as E. cbn [ao_of gAND] in E. rewrite E, wval_and_boot by (unfold DEST, HO; lia). reflexivity.
+  - intros c Hc. apply S2. intro Hx. apply in_map_iff in Hx as (r & Er & Hr).
+    pose proof (wpart_ao_range r Hr). unfold BOOT in Hc. lia.
+Qed.
+
+(* ---- the startup on a view ------------------------------------------------------------------------- *)
+Theorem startup_run : forall v, reqclear (vw v) -> length (vw v) = W ->
+  let b := wget (vw v) BOOT in
+  let v' := vrun Lb L (startup A w m) v in
+  reqclear (vw v') /\ length (vw v') = W /\ wget (vw v') BOOT = true
+  /\ (forall i, i < n -> wget (vw v') (ST w i) = if b then wget (vw v) (ST w i) else nth i (encodeH A x0m) false)
+  /\ (forall i, i < w -> wget (vw v') (CNT i) = wget (vw v) (CNT i) && b /\ wget (vw v') (LIM w i) = wget (vw v) (LIM w i) && b)
+  /\ wget (vw v') (DEST w) = wget (vw v) (DEST w) && b
+  /\ (forall c, (c < BOOT \/ 15 + 2 * w + n <= c) -> wget (vw v') c = wget (vw v) c)
+  /\ vr v' = (if b then vr v else mkT (td (vr v)) 0)
+  /\ va v' = (if b then va v else mkT (repeat false Lb) 0)
+  /\ vc v' = (if b then vc v else mkT (repeat false L) 0)
+  /\ vho v' = vho v.
+Proof.
+  intros v Hq Hl b v'. unfold v'. rewrite startup_split, !vrun_app.
+  rewrite (vrun_wrun Lb L wpart v wrec_wpart Hq). set (ww := wrun wpart (vw v)).
+  destruct (wpart_run (vw v) Hl) as (L1 & S1 & R1 & D1 & U1). fold b ww in L1, S1, R1, D1, U1.
+  assert (Hq1 : reqclear ww) by (intros c Hc; unfold ww; rewrite U1 by (unfold BOOT, AR, HO in *; lia); apply Hq; exact Hc).
+  assert (Hb1 : wget ww BOOT = b) by (unfold ww; rewrite U1 by (left; reflexivity); reflexivity).
+  (* the five requests, each holding not booted *)
+  assert (Hreq : forall c v1, AR <= c <= HO -> reqclear (vw v1) -> length (vw v1) = W -> wget (vw v1) BOOT = b ->
+                 vexec Lb L (gCOPY (BOOT, false) c) v1 = if b then v1 else vact Lb L c v1).
+  { intros c v1 Hc Hq' Hl' Hb'. rewrite (vexec_req Lb L _ v1 Hq') by (cbn [ao_of gCOPY]; unfold AR, HO in *; lia).
+    rewrite rval_copy. unfold lv. cbn [fst snd]. rewrite vcell_win by (unfold BOOT, CPY; lia). rewrite Hb'.
+    destruct b; reflexivity. }
+  unfold req_recs. cbn [map vrun].
+  set (v1 := mkV ww (vr v) (va v) (vc v) (vho v)).
+  assert (Hv1 : reqclear (vw v1) /\ length (vw v1) = W /\ wget (vw v1) BOOT = b) by (cbn [vw v1]; auto).
+  destruct Hv1 as (Q1 & L1' & B1).
+  rewrite (Hreq RR v1) by (unfold AR, RR, HO; lia || assumption).
+  destruct b eqn:Eb.
+  - rewrite !(Hreq _ v1) by (unfold AR, CB, RA, CT, RC, HO; lia || assumption).
+    rewrite (vexec_cell Lb L _ v1 Q1) by (cbn [ao_of gCONST gOR]; unfold BOOT, HO; lia).
+    rewrite rval_const. cbn [vw vr va vc vho v1 ao_of gCONST gOR].
+    refine (conj (reqclear_upd _ BOOT _ ltac:(unfold BOOT, HO; lia) Hq1) (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ _))))))).
+    + rewrite upd_length. exact L1.
+    + rewrite wget_upd, Nat.eqb_refl, (proj2 (Nat.ltb_lt _ _)) by (rewrite L1; unfold BOOT; lia). reflexivity.
+    + intros i Hi. rewrite wget_upd_other by (unfold BOOT, ST; lia). apply S1. exact Hi.
+    + intros i Hi. rewrite !wget_upd_other by (unfold BOOT, CNT, LIM; lia). apply R1. exact Hi.
+    + rewrite wget_upd_other by (unfold BOOT, DEST; lia). exact D1.
+    + intros c Hc. rewrite wget_upd_other by (unfold BOOT in *; lia). apply U1. unfold BOOT in *. lia.
+    + split; [reflexivity | split; [reflexivity | split; reflexivity]].
+  - (* not booted: the read head home, the idle bank cleared and the arm home, the copy tape cleared and its head home *)
+    set (v2 := vact Lb L RR v1).
+    assert (Hv2 : vw v2 = ww) by reflexivity.
+    rewrite (Hreq CB v2) by (unfold AR, CB, HO; lia || (rewrite Hv2; assumption)).
+    set (v3 := vact Lb L CB v2).
+    rewrite (Hreq RA v3) by (unfold AR, RA, HO; lia || (cbn [vact vw v3 v2 v1]; assumption)).
+    set (v4 := vact Lb L RA v3).
+    rewrite (Hreq CT v4) by (unfold AR, CT, HO; lia || (cbn [vact vw v4 v3 v2 v1]; assumption)).
+    set (v5 := vact Lb L CT v4).
+    rewrite (Hreq RC v5) by (unfold AR, RC, HO; lia || (cbn [vact vw v5 v4 v3 v2 v1]; assumption)).
+    set (v6 := vact Lb L RC v5).
+    assert (Q6 : reqclear (vw v6)) by (cbn [vact vw v6 v5 v4 v3 v2 v1]; exact Hq1).
+    rewrite (vexec_cell Lb L _ v6 Q6) by (cbn [ao_of gCONST gOR]; unfold BOOT, HO; lia).
+    rewrite rval_const. cbn [vact vw vr va vc vho v6 v5 v4 v3 v2 v1 ao_of gCONST gOR td th RR CB RA CT RC].
+    refine (conj (reqclear_upd _ BOOT _ ltac:(unfold BOOT, HO; lia) Hq1) (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ _))))))).
+    + rewrite upd_length. exact L1.
+    + rewrite wget_upd, Nat.eqb_refl, (proj2 (Nat.ltb_lt _ _)) by (rewrite L1; unfold BOOT; lia). reflexivity.
+    + intros i Hi. rewrite wget_upd_other by (unfold BOOT, ST; lia). apply S1. exact Hi.
+    + intros i Hi. rewrite !wget_upd_other by (unfold BOOT, CNT, LIM; lia). apply R1. exact Hi.
+    + rewrite wget_upd_other by (unfold BOOT, DEST; lia). exact D1.
+    + intros c Hc. rewrite wget_upd_other by (unfold BOOT in *; lia). apply U1. unfold BOOT in *. lia.
+    + split; [reflexivity | split; [reflexivity | split; reflexivity]].
+Qed.
+
+End Boot.
+
+(* ---- the padding and the hand-over ----------------------------------------------------------------- *)
+Lemma pad_run : forall Lb L p v, reqclear (vw v) -> vrun Lb L (repeat EMPTY p) v = v.
+Proof.
+  intros Lb L p. induction p as [|p IH]; intros v Hq; [reflexivity|].
+  cbn [repeat vrun]. rewrite (vexec_sink Lb L EMPTY v Hq eq_refl). apply IH. exact Hq.
+Qed.
+
+Section Hand.
+Variables (A w W Lb L : nat).
+Hypothesis HW : 15 + 2 * w + A < W.
+
+Theorem handover_run : forall v, reqclear (vw v) -> length (vw v) = W ->
+  let h := wget (vw v) (ST w A) in
+  let v' := vrun Lb L (handover A w) v in
+  reqclear (vw v') /\ length (vw v') = W
+  /\ (forall c, wget (vw v') c = if Nat.eqb c BOOT then wget (vw v) BOOT && negb h else wget (vw v) c)
+  /\ vr v' = vr v /\ va v' = (if h then mkT (td (va v)) 0 else va v)
+  /\ vc v' = (if h then mkT (td (vc v)) 0 else vc v) /\ vho v' = (vho v || h).
+Proof.
+  intros v Hq Hl h v'. unfold v', handover. cbn [vrun].
+  rewrite (vexec_cell Lb L _ v Hq) by (cbn [ao_of gAND]; unfold BOOT, HO; lia).
+  rewrite rval_and. unfold lv. cbn [fst snd ao_of gAND]. rewrite !vcell_win by (unfold BOOT, ST, CPY; lia). fold h.
+  set (x := wget (vw v) BOOT && negb h).
+  set (v1 := mkV (upd (vw v) BOOT x) (vr v) (va v) (vc v) (vho v)).
+  assert (Q1 : reqclear (vw v1)) by (apply reqclear_upd; [unfold BOOT, HO; lia | exact Hq]).
+  assert (Hh1 : vcell v1 (ST w A) = h)
+    by (rewrite vcell_win by (unfold ST, CPY; lia); cbn [vw v1]; rewrite wget_upd_other by (unfold BOOT, ST; lia); reflexivity).
+  assert (Hreq : forall c v2, AR <= c <= HO -> reqclear (vw v2) -> length (vw v2) = W -> vcell v2 (ST w A) = h ->
+                 vexec Lb L (gCOPY (ST w A, true) c) v2 = if h then vact Lb L c v2 else v2).
+  { intros c v2 Hc Hq2 Hl2 Hh2. rewrite (vexec_req Lb L _ v2 Hq2) by (cbn [ao_of gCOPY]; unfold AR, HO in *; lia).
+    rewrite rval_copy. unfold lv. cbn [fst snd]. rewrite Hh2. reflexivity. }
+  assert (L1 : length (vw v1) = W) by (cbn [vw v1]; rewrite upd_length; exact Hl).
+  rewrite (Hreq RA v1) by (unfold AR, RA, HO; lia || assumption).
+  destruct h eqn:Eh.
+  - set (v2 := vact Lb L RA v1).
+    assert (Hh2 : vcell v2 (ST w A) = true) by (rewrite <- Hh1; reflexivity).
+    rewrite (Hreq RC v2) by (unfold AR, RC, HO; lia || assumption).
+    set (v3 := vact Lb L RC v2).
+    assert (Hh3 : vcell v3 (ST w A) = true) by (rewrite <- Hh1; reflexivity).
+    rewrite (Hreq HO v3) by (unfold AR, HO; lia || assumption).
+    cbn [vact vw vr va vc vho v3 v2 v1 RA RC HO td th].
+    refine (conj Q1 (conj L1 (conj _ (conj eq_refl (conj eq_refl (conj eq_refl (eq_sym (orb_true_r _)))))))).
+    intros c. rewrite wget_upd. destruct (Nat.eqb_spec c BOOT) as [->|Hc]; [|reflexivity].
+    rewrite (proj2 (Nat.ltb_lt _ _)) by (rewrite Hl; unfold BOOT, ST in *; lia). reflexivity.
+  - rewrite (Hreq RC v1) by (unfold AR, RC, HO; lia || assumption).
+    rewrite (Hreq HO v1) by (unfold AR, HO; lia || assumption).
+    cbn [vw vr va vc vho v1]. rewrite orb_false_r.
+    refine (conj Q1 (conj L1 (conj _ (conj eq_refl (conj eq_refl (conj eq_refl eq_refl)))))).
+    intros c. rewrite wget_upd. destruct (Nat.eqb_spec c BOOT) as [->|Hc]; [|reflexivity].
+    rewrite (proj2 (Nat.ltb_lt _ _)) by (rewrite Hl; unfold BOOT, ST in *; lia). reflexivity.
+Qed.
+
+End Hand.

rocq/StoredDev.v

@@ -0,0 +1,1333 @@
+(* The device records of the stored host carry out Definition 8.4 on the state the step leaves: a write
+   of the low byte of R_out under the arm or the copy head, a read of a byte under the read head into
+   R_in with its sign copied, the end of the recipe after the rewind at cnt = lim, the count of reads, the
+   rewind, and the request words cleared. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run View Stored WinRun WinPar ViewOps Host Device.
+
+(* a bit written under a head, which then moves on *)
+Definition wstep (Lt : nat) (b : bool) (t : tape) : tape := mkT (upd (td t) (th t) b) (succ_mod Lt (th t)).
+Definition wseq (Lt : nat) (bs : list bool) (t : tape) : tape := fold_left (fun t b => wstep Lt b t) bs t.
+
+(* the position after k moves *)
+Fixpoint adv (Lt k x : nat) : nat := match k with O => x | S k' => succ_mod Lt (adv Lt k' x) end.
+
+Lemma forallb_map' : forall (T U : Type) (f : U -> bool) (g : T -> U) l, forallb f (map g l) = forallb (fun x => f (g x)) l.
+Proof. intros T U f g l. induction l as [|x l IH]; [reflexivity|]. cbn [map forallb]. rewrite IH. reflexivity. Qed.
+
+Lemma nodup_map_seq_inj : forall (f : nat -> nat) k N, (forall i j, k <= i < k + N -> k <= j < k + N -> f i = f j -> i = j) ->
+  NoDup (map f (seq k N)).
+Proof.
+  intros f k N H. apply NoDup_map_NoDup_ForallPairs; [|apply seq_NoDup].
+  intros i j Hi Hj E. apply in_seq in Hi, Hj. exact (H i j Hi Hj E).
+Qed.
+
+Lemma forallb_ext_in' : forall (T : Type) (f g : T -> bool) l, (forall x, In x l -> f x = g x) -> forallb f l = forallb g l.
+Proof.
+  intros T f g l. induction l as [|x l IH]; intro H; [reflexivity|]. cbn [forallb].
+  rewrite (H x (or_introl eq_refl)), IH by (intros y Hy; apply H; right; exact Hy). reflexivity.
+Qed.
+
+Section Dev.
+Variables (A w W Lb L : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w).
+
+Local Notation nu := (length (host_units A)).
+Local Notation lvs := (levels (host_units A)).
+Local Notation n := (nH A).
+Hypothesis HW : ncells A w nu lvs <= W.
+
+Local Notation MBc := (MB A w).
+Local Notation cWR := (dWR A w nu lvs).
+Local Notation cRD := (dRD A w nu lvs).
+Local Notation cRW := (dRW A w nu lvs).
+Local Notation cE := (dE A w nu lvs).
+Local Notation cEQ := (dEQ A w nu lvs).
+Local Notation cEOT := (dEOT A w nu lvs).
+Local Notation cCA := (dCA A w nu lvs).
+Local Notation cCC := (dCC A w nu lvs).
+Local Notation cG := (dG A w nu lvs).
+Local Notation cCAR := (dCAR A w nu lvs).
+Local Notation m0 := (M0 A w nu lvs).
+Local Notation m1 := (M1 A w nu lvs).
+
+(* ---- the segments of the device ----------------------------------------------------------------------- *)
+Definition segA : list rec := word1 A w (cwr A) cWR ++ word1 A w (crd A) cRD ++ word1 A w (crw A) cRW.
+Definition segB : list rec :=
+  concat (map (fun i => [gAND (CNT i, true) (LIM w i, true) m0; gAND (CNT i, false) (LIM w i, false) m1;
+                         gOR (m0, true) (m1, true) (cE i)]) (seq 0 w)).
+Definition segC : list rec := chain gAND (map (fun i => (cE i, true)) (seq 0 w)) cEQ cEQ.
+Definition segD : list rec := [gAND (cEQ, true) (DEST w, true) cEOT; gAND (cWR, true) (DEST w, false) cCA;
+                               gAND (cWR, true) (DEST w, true) cCC].
+Definition segE : list rec :=
+  concat (map (fun k => gMUX A w nu lvs cCA (MBc (rout A) (7 - k), true) (ARM, true) ARM ++ [gCOPY (cCA, true) AA]
+                        ++ gMUX A w nu lvs cCC (MBc (rout A) (7 - k), true) (CPY, true) CPY ++ [gCOPY (cCC, true) AC])
+              (seq 0 8)).
+Definition segF : list rec := map (fun t => gAND (MBc (rout A) t, true) (cWR, false) (MBc (rout A) t)) (seq 0 A).
+Definition segG : list rec := [gAND (cRD, true) (cEOT, false) cG].
+Definition segH : list rec :=
+  concat (map (fun k => gMUX A w nu lvs cG (RD, true) (MBc (rin A) (7 - k), true) (MBc (rin A) (7 - k))
+                        ++ [gCOPY (cG, true) AR]) (seq 0 8)).
+Definition segI : list rec :=
+  concat (map (fun t => gMUX A w nu lvs cG (MBc (rin A) 7, true) (MBc (rin A) t, true) (MBc (rin A) t)) (seq 8 (A - 8))).
+Definition segJ : list rec := gMUX A w nu lvs cRD (cEOT, true) (MBc (ceot A) 0, true) (MBc (ceot A) 0).
+Definition segK : list rec := map (fun t => gAND (MBc (ceot A) t, true) (cRD, false) (MBc (ceot A) t)) (seq 1 (A - 1)).
+Definition segL : list rec := map (fun i => gAND (carry A w nu lvs i, true) (CNT i, true) (cCAR (S i))) (seq 0 (w - 1)).
+Definition segM : list rec := concat (map (fun i => gXOR A w nu lvs (CNT i, true) (carry A w nu lvs i, true) (CNT i)) (seq 0 w)).
+Definition segN : list rec := [gCOPY (cRW, true) RR].
+Definition segO : list rec :=
+  concat (map (fun i => gMUX A w nu lvs cRW (CNT i, true) (LIM w i, true) (LIM w i) ++ [gAND (CNT i, true) (cRW, false) (CNT i)])
+              (seq 0 w)).
+Definition segP : list rec := [gOR (DEST w, true) (cRW, true) (DEST w)].
+Definition segQ : list rec := concat (map (fun c => map (fun t => gCONST false (MBc c t)) (seq 0 A)) [cwr A; crd A; crw A]).
+
+Lemma device_split : Stored.device A w nu lvs =
+  (segA ++ segB ++ segC ++ segD) ++ segE ++ (segF ++ segG) ++ segH ++ (segI ++ segJ ++ segK ++ segL ++ segM)
+  ++ segN ++ (segO ++ segP ++ segQ).
+Proof.
+  unfold Stored.device, segA, segB, segC, segD, segE, segF, segG, segH, segI, segJ, segK, segL, segM, segN, segO, segP, segQ.
+  rewrite <- !app_assoc. reflexivity.
+Qed.
+
+(* ---- the cells ---------------------------------------------------------------------------------------- *)
+Lemma SW8 : 256 <= SW A.
+Proof. unfold SW. replace A with (8 + (A - 8)) by lia. rewrite Nat.pow_add_r. pose proof (Nat.pow_nonzero 2 (A - 8)). cbn. lia. Qed.
+
+Lemma n_eq : n = A + 1 + SW A * A.
+Proof. reflexivity. Qed.
+
+Ltac cells := pose proof SW8; pose proof n_eq; pose proof (Nat.mul_le_mono_l 256 (SW A) A SW8);
+  unfold carry, dCAR, dG, dCC, dCA, dEOT, dEQ, dE, dRW, dRD, dWR, M0, M1, ncells in *;
+  unfold DB, XC, UC, MB in *; unfold ST, CNT, LIM, DEST, BOOT, nh in *;
+  unfold HO, CPY, AR, AA, AC, RR, RA, RC, CB, CT, ARM, RD, SINK, cwr, crd, crw, ceot, rin, rout in *;
+  rewrite ?Nat.mul_sub_distr_l in *; first [lia | nia].
+
+Lemma MB_range : forall j t, j < SW A -> t < A -> 15 + 2 * w + A < MBc j t < 15 + 2 * w + n.
+Proof. intros j t Hj Ht. unfold MB, ST. rewrite n_eq. nia. Qed.
+
+Lemma MB_inj : forall j t j' t', j < SW A -> j' < SW A -> t < A -> t' < A -> MBc j t = MBc j' t' -> j = j' /\ t = t'.
+Proof.
+  intros j t j' t' Hj Hj' Ht Ht' E. unfold MB, ST in E.
+  assert (Ej : j = j').
+  { destruct (Nat.lt_trichotomy j j') as [L1|[L1|L1]]; [|exact L1|]; exfalso.
+    - assert (A * j + A <= A * j') by nia. lia.
+    - assert (A * j' + A <= A * j) by nia. lia. }
+  subst j'. split; [reflexivity | lia].
+Qed.
+
+Lemma DB_gt : forall j t, j < SW A -> t < A -> MBc j t < DB A w nu lvs.
+Proof. intros j t Hj Ht. pose proof (MB_range j t Hj Ht). unfold DB, nh. lia. Qed.
+
+Lemma io_lt : cwr A < SW A /\ ceot A < SW A /\ crw A < SW A /\ crd A < SW A /\ rin A < SW A /\ rout A < SW A.
+Proof. pose proof SW8. unfold cwr, ceot, crw, crd, rin, rout. lia. Qed.
+
+Lemma io_ne : cwr A <> crd A /\ cwr A <> crw A /\ crd A <> crw A /\ rout A <> rin A /\ rout A <> ceot A
+  /\ rin A <> ceot A /\ cwr A <> rout A /\ crd A <> rout A /\ crw A <> rout A /\ cwr A <> rin A /\ crd A <> rin A
+  /\ crw A <> rin A /\ cwr A <> ceot A /\ crd A <> ceot A /\ crw A <> ceot A.
+Proof. pose proof SW8. unfold cwr, ceot, crw, crd, rin, rout. lia. Qed.
+
+(* ---- the values the device computes from the window w0 it starts from --------------------------------- *)
+Section Vals.
+Variable w0 : list bool.
+
+Definition word1v (j : nat) : bool := wget w0 (MBc j 0) && forallb (fun t => negb (wget w0 (MBc j t))) (seq 1 (A - 1)).
+Definition wrv : bool := word1v (cwr A).
+Definition rdv : bool := word1v (crd A).
+Definition rwv : bool := word1v (crw A).
+Definition eqv : bool := forallb (fun i => Bool.eqb (wget w0 (CNT i)) (wget w0 (LIM w i))) (seq 0 w).
+Definition destv : bool := wget w0 (DEST w).
+Definition eotv : bool := eqv && destv.
+Definition cav : bool := wrv && negb destv.
+Definition ccv : bool := wrv && destv.
+Definition gv : bool := rdv && negb eotv.
+Definition carryv (i : nat) : bool := gv && forallb (fun k => wget w0 (CNT k)) (seq 0 i).
+Definition cntv (i : nat) : bool := xorb (wget w0 (CNT i)) (carryv i).
+
+End Vals.
+
+(* ---- the first window records: the three requests, cnt = lim, the end of the recipe, where a write goes *)
+Lemma wl_neg : forall ww c, HO < c -> wl ww (c, false) = negb (wget ww c).
+Proof.
+  intros ww c H. unfold wl, wcell. cbn [fst snd].
+  replace (Nat.eqb c SINK) with false by (symmetry; apply Nat.eqb_neq; unfold SINK, HO in *; lia). reflexivity.
+Qed.
+
+Lemma word1_run : forall j d ww, j < SW A -> length ww = W -> DB A w nu lvs <= d < ncells A w nu lvs ->
+  let ww' := wrun (word1 A w j d) ww in
+  length ww' = W /\ wget ww' d = word1v ww j /\ (forall c, c <> d -> wget ww' c = wget ww c).
+Proof.
+  intros j d ww Hj Hl Hd. cbv zeta. unfold word1.
+  assert (Hdo : ok_cell W d) by (split; [unfold DB, HO in *; lia | lia]).
+  destruct (chain_run W gAND andb (fun x y d' w' => wval_and w' x y d') (fun x y d' => proj1 (ao_gates x y d' true))
+              ((MBc j 0, true) :: map (fun t => (MBc j t, false)) (seq 1 (A - 1))) d d ww ltac:(discriminate) Hl Hdo Hdo)
+    as (L1 & V1 & U1).
+  { intros l Hin. destruct Hin as [<-|Hin]; [cbn [fst]; pose proof (DB_gt j 0 Hj ltac:(lia)); lia|].
+    apply in_map_iff in Hin as (t & <- & Ht). apply in_seq in Ht. cbn [fst]. pose proof (DB_gt j t Hj ltac:(lia)). lia. }
+  split; [exact L1|]. split; [|intros c Hc; exact (U1 c Hc Hc)].
+  rewrite V1. cbn [hd tl]. rewrite fold_and. unfold word1v. rewrite wl_cell by (pose proof (MB_range j 0 Hj ltac:(lia)); unfold HO; lia).
+  f_equal. rewrite forallb_map'. apply forallb_ext_in'. intros t Ht. apply in_seq in Ht.
+  apply wl_neg. pose proof (MB_range j t Hj ltac:(lia)). unfold HO. lia.
+Qed.
+
+(* one record on the window, written out *)
+Lemma wrun1 : forall r ww, wrun [r] ww = wnext ww (ao_of r) (wval ww r).
+Proof. reflexivity. Qed.
+
+Lemma wget_set : forall ww d x c, HO < d -> d < length ww -> wget (wnext ww d x) c = if Nat.eqb c d then x else wget ww c.
+Proof. intros. apply wget_wnext; assumption. Qed.
+
+Lemma eq_body_run : forall c l d ww, HO < c -> HO < l -> c <> m0 -> c <> m1 -> l <> m0 -> l <> m1 -> length ww = W ->
+  HO < d -> d < W -> d <> m0 -> d <> m1 ->
+  let ww' := wrun [gAND (c, true) (l, true) m0; gAND (c, false) (l, false) m1; gOR (m0, true) (m1, true) d] ww in
+  length ww' = W /\ wget ww' d = Bool.eqb (wget ww c) (wget ww l)
+  /\ (forall x, x <> m0 -> x <> m1 -> x <> d -> wget ww' x = wget ww x).
+Proof.
+  intros c l d ww Hc Hl C0 C1 L0 L1 Hlen Hd HdW D0 D1. cbv zeta. cbn [wrun]. unfold wexec. cbn [ao_of gAND gOR].
+  assert (H0 : HO < m0 /\ m0 < W) by (split; cells). assert (H1 : HO < m1 /\ m1 < W) by (split; cells).
+  assert (N01 : m0 <> m1) by cells.
+  rewrite !wval_and, wval_or.
+  set (w1 := wnext ww m0 (wl ww (c, true) && wl ww (l, true))).
+  assert (Lw1 : length w1 = W) by (unfold w1; rewrite length_wnext; exact Hlen).
+  set (w2 := wnext w1 m1 (wl w1 (c, false) && wl w1 (l, false))).
+  assert (Lw2 : length w2 = W) by (unfold w2; rewrite length_wnext; exact Lw1).
+  assert (E1 : forall x, x <> m0 -> wget w1 x = wget ww x)
+    by (intros x Hx; unfold w1; rewrite wget_set by (lia || (rewrite Hlen; lia)); rewrite (proj2 (Nat.eqb_neq _ _) Hx); reflexivity).
+  assert (E2 : forall x, x <> m1 -> wget w2 x = wget w1 x)
+    by (intros x Hx; unfold w2; rewrite wget_set by (lia || (rewrite Lw1; lia)); rewrite (proj2 (Nat.eqb_neq _ _) Hx); reflexivity).
+  assert (V0 : wget w2 m0 = wget ww c && wget ww l).
+  { rewrite E2 by exact N01. unfold w1. rewrite wget_set by (lia || (rewrite Hlen; lia)). rewrite Nat.eqb_refl.
+    rewrite !wl_cell by assumption. reflexivity. }
+  assert (V1 : wget w2 m1 = negb (wget ww c) && negb (wget ww l)).
+  { unfold w2. rewrite wget_set by (lia || (rewrite Lw1; lia)). rewrite Nat.eqb_refl.
+    rewrite !wl_neg by assumption. rewrite (E1 c C0), (E1 l L0). reflexivity. }
+  rewrite !wl_cell by lia. rewrite V0, V1.
+  split; [rewrite length_wnext; exact Lw2|]. split.
+  - rewrite wget_set by (lia || (rewrite Lw2; lia)). rewrite Nat.eqb_refl. destruct (wget ww c), (wget ww l); reflexivity.
+  - intros x X0 X1 Xd. rewrite wget_set by (lia || (rewrite Lw2; lia)). rewrite (proj2 (Nat.eqb_neq _ _) Xd).
+    rewrite (E2 x X1), (E1 x X0). reflexivity.
+Qed.
+
+Definition eq_body (i : nat) : list rec :=
+  [gAND (CNT i, true) (LIM w i, true) m0; gAND (CNT i, false) (LIM w i, false) m1; gOR (m0, true) (m1, true) (cE i)].
+
+Lemma segB_prefix : forall k ww, k <= w -> length ww = W ->
+  let ww' := wrun (concat (map eq_body (seq 0 k))) ww in
+  length ww' = W /\ (forall i, i < k -> wget ww' (cE i) = Bool.eqb (wget ww (CNT i)) (wget ww (LIM w i)))
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall i, i < k -> x <> cE i) -> wget ww' x = wget ww x).
+Proof.
+  induction k as [|k IH]; intros ww Hk Hlen; cbv zeta.
+  - split; [exact Hlen|]. split; [intros; lia | intros; reflexivity].
+  - rewrite seq_S, map_app, concat_app. cbn [map concat]. rewrite app_nil_r, wrun_app, Nat.add_0_l.
+    destruct (IH ww ltac:(lia) Hlen) as (L1 & V1 & U1). cbv zeta in L1, V1, U1.
+    set (w1 := wrun (concat (map eq_body (seq 0 k))) ww) in *.
+    destruct (eq_body_run (CNT k) (LIM w k) (cE k) w1 ltac:(cells) ltac:(cells) ltac:(cells) ltac:(cells) ltac:(cells)
+                ltac:(cells) L1 ltac:(cells) ltac:(cells) ltac:(cells) ltac:(cells)) as (L2 & V2 & U2).
+    cbv zeta in L2, V2, U2. unfold eq_body.
+    split; [exact L2|]. split.
+    + intros i Hi. destruct (Nat.eq_dec i k) as [->|Hik].
+      * rewrite V2, !U1 by (try (intros i Hi'; cells); cells). reflexivity.
+      * rewrite U2 by cells. apply V1. lia.
+    + intros x X0 X1 Xi. rewrite U2 by (try exact X0; try exact X1; apply Xi; lia). apply U1; [exact X0 | exact X1 |].
+      intros i Hi. apply Xi. lia.
+Qed.
+
+Theorem chunk1_run : forall ww, length ww = W ->
+  let ww' := wrun (segA ++ segB ++ segC ++ segD) ww in
+  length ww' = W
+  /\ wget ww' cWR = wrv ww /\ wget ww' cRD = rdv ww /\ wget ww' cRW = rwv ww
+  /\ wget ww' cEOT = eotv ww /\ wget ww' cCA = cav ww /\ wget ww' cCC = ccv ww
+  /\ (forall x, x < DB A w nu lvs \/ ncells A w nu lvs <= x -> wget ww' x = wget ww x).
+Proof.
+  intros ww Hlen. cbv zeta. rewrite !wrun_app. unfold segA. rewrite !wrun_app.
+  pose proof io_lt as (I1 & I2 & I3 & I4 & I5 & I6).
+  destruct (word1_run (cwr A) cWR ww I1 Hlen ltac:(cells)) as (La & Va & Ua). cbv zeta in La, Va, Ua.
+  set (wa := wrun (word1 A w (cwr A) cWR) ww) in *.
+  destruct (word1_run (crd A) cRD wa I4 La ltac:(cells)) as (Lb' & Vb & Ub). cbv zeta in Lb', Vb, Ub.
+  set (wb := wrun (word1 A w (crd A) cRD) wa) in *.
+  destruct (word1_run (crw A) cRW wb I3 Lb' ltac:(cells)) as (Lc & Vc & Uc). cbv zeta in Lc, Vc, Uc.
+  set (wc := wrun (word1 A w (crw A) cRW) wb) in *.
+  assert (Wb : word1v wa (crd A) = rdv ww).
+  { unfold word1v, rdv, word1v. rewrite !Ua by (pose proof (DB_gt (crd A) 0 I4 ltac:(lia)); cells). f_equal.
+    apply forallb_ext_in'. intros t Ht. apply in_seq in Ht. rewrite Ua by (pose proof (DB_gt (crd A) t I4 ltac:(lia)); cells).
+    reflexivity. }
+  assert (Wc : word1v wb (crw A) = rwv ww).
+  { unfold word1v, rwv, word1v. rewrite !Ub, !Ua by (pose proof (DB_gt (crw A) 0 I3 ltac:(lia)); cells). f_equal.
+    apply forallb_ext_in'. intros t Ht. apply in_seq in Ht.
+    rewrite Ub, Ua by (pose proof (DB_gt (crw A) t I3 ltac:(lia)); cells). reflexivity. }
+  rewrite Wb in Vb. rewrite Wc in Vc. fold (wrv ww) in Va.
+  assert (Uabc : forall x, x <> cWR -> x <> cRD -> x <> cRW -> wget wc x = wget ww x)
+    by (intros x H1 H2 H3; rewrite (Uc x H3), (Ub x H2), (Ua x H1); reflexivity).
+  (* cnt = lim, bit by bit *)
+  destruct (segB_prefix w wc ltac:(lia) Lc) as (Ld & Vd & Ud). cbv zeta in Ld, Vd, Ud.
+  assert (EB : segB = concat (map eq_body (seq 0 w))) by reflexivity. rewrite EB.
+  set (wd := wrun (concat (map eq_body (seq 0 w))) wc) in *.
+  (* their conjunction *)
+  assert (HEQ : ok_cell W cEQ) by (split; cells).
+  destruct (chain_run W gAND andb (fun x y d' w' => wval_and w' x y d') (fun x y d' => proj1 (ao_gates x y d' true))
+              (map (fun i => (cE i, true)) (seq 0 w)) cEQ cEQ wd ltac:(destruct w; [lia | discriminate]) Ld HEQ HEQ)
+    as (Le & Ve & Ue).
+  { intros l Hin. apply in_map_iff in Hin as (i & <- & Hi). apply in_seq in Hi. cbn [fst]. cells. }
+  unfold segC. set (we := wrun (chain gAND (map (fun i => (cE i, true)) (seq 0 w)) cEQ cEQ) wd) in *.
+  assert (Veq : wget we cEQ = eqv ww).
+  { assert (Ew : seq 0 w = 0 :: seq 1 (w - 1)) by (replace w with (S (w - 1)) at 1 by lia; reflexivity).
+    rewrite Ve, Ew. cbn [map hd tl]. rewrite fold_and.
+    unfold eqv. rewrite Ew. cbn [forallb]. rewrite wl_cell by cells. rewrite (Vd 0) by lia.
+    rewrite !Uabc by cells. f_equal. rewrite forallb_map'. apply forallb_ext_in'.
+    intros i Hi. apply in_seq in Hi. rewrite wl_cell by cells. rewrite (Vd i) by lia. rewrite !Uabc by cells. reflexivity. }
+  (* the end of the recipe and where a write goes *)
+  unfold segD. cbn [wrun]. unfold wexec. cbn [ao_of gAND]. rewrite !wval_and.
+  assert (Rd : forall x, x <> cEQ -> (forall i, i < w -> x <> cE i) -> x <> m0 -> x <> m1 -> wget we x = wget wc x).
+  { intros x H1 H2 H3 H4. rewrite (Ue x H1 H1). apply Ud; assumption. }
+  assert (Dst : wget we (DEST w) = destv ww).
+  { unfold destv. rewrite Rd by (try (intros; cells); cells). apply Uabc; cells. }
+  assert (Wr : wget we cWR = wrv ww).
+  { rewrite Rd by (try (intros; cells); cells). rewrite Uc by cells. rewrite Ub by cells. exact Va. }
+  rewrite !wl_cell by cells. rewrite !wl_neg by cells.
+  set (f1 := wnext we cEOT (wget we cEQ && wget we (DEST w))).
+  assert (Lf1 : length f1 = W) by (unfold f1; rewrite length_wnext; exact Le).
+  assert (F1 : forall x, wget f1 x = if Nat.eqb x cEOT then eotv ww else wget we x).
+  { intro x. unfold f1. rewrite wget_set by (cells || (rewrite Le; cells)). rewrite Veq, Dst. reflexivity. }
+  rewrite !(F1 cWR), !(F1 (DEST w)), (proj2 (Nat.eqb_neq cWR cEOT)), (proj2 (Nat.eqb_neq (DEST w) cEOT)) by cells.
+  rewrite Wr, Dst.
+  set (f2 := wnext f1 cCA (wrv ww && negb (destv ww))).
+  assert (Lf2 : length f2 = W) by (unfold f2; rewrite length_wnext; exact Lf1).
+  assert (F2 : forall x, wget f2 x = if Nat.eqb x cCA then cav ww else wget f1 x).
+  { intro x. unfold f2. rewrite wget_set by (cells || (rewrite Lf1; cells)). reflexivity. }
+  assert (G1 : wget f2 cWR = wrv ww).
+  { rewrite F2, F1, (proj2 (Nat.eqb_neq cWR cCA)), (proj2 (Nat.eqb_neq cWR cEOT)) by cells. exact Wr. }
+  assert (G2 : wget f2 (DEST w) = destv ww).
+  { rewrite F2, F1, (proj2 (Nat.eqb_neq (DEST w) cCA)), (proj2 (Nat.eqb_neq (DEST w) cEOT)) by cells. exact Dst. }
+  rewrite G1, G2.
+  set (f3 := wnext f2 cCC (wrv ww && destv ww)).
+  assert (F3 : forall x, wget f3 x = if Nat.eqb x cCC then ccv ww else wget f2 x).
+  { intro x. unfold f3. rewrite wget_set by (cells || (rewrite Lf2; cells)). reflexivity. }
+  split; [unfold f3; rewrite length_wnext; exact Lf2|].
+  assert (Old : forall x, x <> cCC -> x <> cCA -> x <> cEOT -> wget f3 x = wget we x).
+  { intros x H1 H2 H3. rewrite F3, F2, F1. rewrite (proj2 (Nat.eqb_neq _ _) H1), (proj2 (Nat.eqb_neq _ _) H2),
+      (proj2 (Nat.eqb_neq _ _) H3). reflexivity. }
+  split; [rewrite Old by cells; exact Wr|].
+  split; [rewrite Old by cells; rewrite Rd by (try (intros; cells); cells); rewrite Uc by cells; exact Vb|].
+  split; [rewrite Old by cells; rewrite Rd by (try (intros; cells); cells); exact Vc|].
+  split; [rewrite F3, F2, F1, (proj2 (Nat.eqb_neq cEOT cCC)), (proj2 (Nat.eqb_neq cEOT cCA)), Nat.eqb_refl by cells; reflexivity|].
+  split; [rewrite F3, F2, (proj2 (Nat.eqb_neq cCA cCC)), Nat.eqb_refl by cells; reflexivity|].
+  split; [rewrite F3, Nat.eqb_refl; reflexivity|].
+  intros x Hx. rewrite Old by cells. rewrite Rd by (try (intros; cells); cells). apply Uabc; cells.
+Qed.
+
+(* ---- the low byte of R_out under the arm or under the copy head --------------------------------------- *)
+Definition Ebody (k : nat) : list rec :=
+  gMUX A w nu lvs cCA (MBc (rout A) (7 - k), true) (ARM, true) ARM ++ [gCOPY (cCA, true) AA]
+  ++ gMUX A w nu lvs cCC (MBc (rout A) (7 - k), true) (CPY, true) CPY ++ [gCOPY (cCC, true) AC].
+
+Lemma tape_same : forall t, mkT (upd (td t) (th t) (tget t)) (th t) = t.
+Proof. intros [d h]. unfold tget. cbn [td th]. rewrite upd_same. reflexivity. Qed.
+
+Lemma win_set : forall v x c b, HO < c -> c < length (vw v) -> wget (upd (vw v) c b) x = if Nat.eqb x c then b else wget (vw v) x.
+Proof. intros v x c b H1 H2. rewrite wget_upd, (proj2 (Nat.ltb_lt _ _) H2), andb_true_r. reflexivity. Qed.
+
+Lemma Ebody_run : forall k v, k < 8 -> reqclear (vw v) -> length (vw v) = W ->
+  let ca := wget (vw v) cCA in let cc := wget (vw v) cCC in let b := wget (vw v) (MBc (rout A) (7 - k)) in
+  let v' := vrun Lb L (Ebody k) v in
+  reqclear (vw v') /\ length (vw v') = W /\ (forall x, x <> m0 -> x <> m1 -> wget (vw v') x = wget (vw v) x)
+  /\ vr v' = vr v /\ va v' = (if ca then wstep Lb b (va v) else va v)
+  /\ vc v' = (if cc then wstep L b (vc v) else vc v) /\ vho v' = vho v.
+Proof.
+  intros k v Hk Hq Hl ca cc b. cbv zeta. unfold Ebody, gMUX. cbn [app vrun].
+  pose proof (io_lt) as (_ & _ & _ & _ & _ & Hro).
+  assert (Hrt : HO < MBc (rout A) (7 - k) /\ MBc (rout A) (7 - k) < DB A w nu lvs)
+    by (pose proof (MB_range (rout A) (7 - k) Hro ltac:(lia)); pose proof (DB_gt (rout A) (7 - k) Hro ltac:(lia)); split; cells).
+  (* the arm *)
+  rewrite (vexec_cell Lb L _ v Hq) by (cbn [ao_of gAND]; cells).
+  rewrite rval_and, !lv_win by (cbn [fst]; cells || lia). cbn [ao_of gAND]. fold ca b.
+  set (v1 := mkV (upd (vw v) m0 (ca && b)) (vr v) (va v) (vc v) (vho v)).
+  assert (Q1 : reqclear (vw v1)) by (apply reqclear_upd; [cells | exact Hq]).
+  assert (L1 : length (vw v1) = W) by (cbn [vw v1]; rewrite upd_length; exact Hl).
+  assert (W1 : forall x, wget (vw v1) x = if Nat.eqb x m0 then ca && b else wget (vw v) x)
+    by (intro x; cbn [vw v1]; apply win_set; [cells | rewrite Hl; cells]).
+  rewrite (vexec_cell Lb L _ v1 Q1) by (cbn [ao_of gAND]; cells).
+  rewrite rval_and. unfold lv. cbn [fst snd]. rewrite (vcell_win v1 cCA) by cells.
+  rewrite W1, (proj2 (Nat.eqb_neq cCA m0)) by cells. fold ca.
+  assert (Ha1 : vcell v1 ARM = tget (va v)) by reflexivity. rewrite Ha1. cbn [ao_of gAND].
+  set (v2 := mkV (upd (vw v1) m1 (negb ca && tget (va v))) (vr v1) (va v1) (vc v1) (vho v1)).
+  assert (Q2 : reqclear (vw v2)) by (apply reqclear_upd; [cells | exact Q1]).
+  assert (L2 : length (vw v2) = W) by (cbn [vw v2]; rewrite upd_length; exact L1).
+  assert (W2 : forall x, wget (vw v2) x = if Nat.eqb x m1 then negb ca && tget (va v) else wget (vw v1) x)
+    by (intro x; cbn [vw v2]; apply win_set; [cells | rewrite L1; cells]).
+  rewrite (vexec_arm Lb L _ v2 Q2) by reflexivity.
+  rewrite rval_or. unfold lv. cbn [fst snd]. rewrite !vcell_win by cells.
+  rewrite (W2 m0), (proj2 (Nat.eqb_neq m0 m1)), W1, Nat.eqb_refl, W2, Nat.eqb_refl by cells.
+  cbn [va v2 v1 vw vr vc vho].
+  set (xa := ca && b || negb ca && tget (va v)).
+  set (v3 := mkV (vw v2) (vr v) (mkT (upd (td (va v)) (th (va v)) xa) (th (va v))) (vc v) (vho v)).
+  assert (Q3 : reqclear (vw v3)) by exact Q2.
+  rewrite (vexec_req Lb L _ v3 Q3) by (cbn [ao_of gCOPY]; unfold AR, AA, HO; lia || (cbn [vw v3]; rewrite L2; unfold AA; cells)).
+  rewrite rval_copy. unfold lv. cbn [fst snd]. rewrite vcell_win by cells. cbn [vw v3].
+  rewrite W2, (proj2 (Nat.eqb_neq cCA m1)), W1, (proj2 (Nat.eqb_neq cCA m0)) by cells. fold ca.
+  set (v4 := if ca then vact Lb L (ao_of (gCOPY (cCA, true) AA)) v3 else v3).
+  assert (V4 : vw v4 = vw v2 /\ vr v4 = vr v /\ va v4 = (if ca then wstep Lb b (va v) else va v) /\ vc v4 = vc v
+               /\ vho v4 = vho v).
+  { unfold v4, v3, xa. destruct ca; cbn [ao_of gCOPY AA vact vw vr va vc vho negb andb orb].
+    - rewrite orb_false_r. unfold wstep. repeat split.
+    - repeat split. apply tape_same. }
+  destruct V4 as (V4w & V4r & V4a & V4c & V4h).
+  assert (Q4 : reqclear (vw v4)) by (rewrite V4w; exact Q2).
+  (* the copy head *)
+  rewrite (vexec_cell Lb L _ v4 Q4) by (cbn [ao_of gAND]; cells).
+  rewrite rval_and, !lv_win by (cbn [fst]; cells || lia). cbn [ao_of gAND]. rewrite V4w.
+  rewrite W2, (proj2 (Nat.eqb_neq cCC m1)), W1, (proj2 (Nat.eqb_neq cCC m0)) by cells. fold cc.
+  rewrite W2, (proj2 (Nat.eqb_neq (MBc (rout A) (7 - k)) m1)), W1, (proj2 (Nat.eqb_neq (MBc (rout A) (7 - k)) m0)) by cells.
+  fold b.
+  set (v5 := mkV (upd (vw v2) m0 (cc && b)) (vr v4) (va v4) (vc v4) (vho v4)).
+  assert (Q5 : reqclear (vw v5)) by (apply reqclear_upd; [cells | exact Q2]).
+  assert (L5 : length (vw v5) = W) by (cbn [vw v5]; rewrite upd_length; exact L2).
+  assert (W5 : forall x, wget (vw v5) x = if Nat.eqb x m0 then cc && b else wget (vw v2) x)
+    by (intro x; cbn [vw v5]; apply win_set; [cells | rewrite L2; cells]).
+  rewrite (vexec_cell Lb L _ v5 Q5) by (cbn [ao_of gAND]; cells).
+  rewrite rval_and. unfold lv. cbn [fst snd]. rewrite (vcell_win v5 cCC) by cells.
+  rewrite W5, (proj2 (Nat.eqb_neq cCC m0)), W2, (proj2 (Nat.eqb_neq cCC m1)), W1, (proj2 (Nat.eqb_neq cCC m0)) by cells.
+  fold cc.
+  assert (Hc5 : vcell v5 CPY = tget (vc v)) by (change (vcell v5 CPY) with (tget (vc v4)); rewrite V4c; reflexivity).
+  rewrite Hc5. cbn [ao_of gAND].
+  set (v6 := mkV (upd (vw v5) m1 (negb cc && tget (vc v))) (vr v5) (va v5) (vc v5) (vho v5)).
+  assert (Q6 : reqclear (vw v6)) by (apply reqclear_upd; [cells | exact Q5]).
+  assert (L6 : length (vw v6) = W) by (cbn [vw v6]; rewrite upd_length; exact L5).
+  assert (W6 : forall x, wget (vw v6) x = if Nat.eqb x m1 then negb cc && tget (vc v) else wget (vw v5) x)
+    by (intro x; cbn [vw v6]; apply win_set; [cells | rewrite L5; cells]).
+  rewrite (vexec_cpy Lb L _ v6 Q6) by reflexivity.
+  rewrite rval_or. unfold lv. cbn [fst snd]. rewrite !vcell_win by cells.
+  rewrite (W6 m0), (proj2 (Nat.eqb_neq m0 m1)), W5, Nat.eqb_refl, W6, Nat.eqb_refl by cells.
+  cbn [vc v6 v5 vw vr va vho]. rewrite V4c.
+  set (xc := cc && b || negb cc && tget (vc v)).
+  set (v7 := mkV (vw v6) (vr v4) (va v4) (mkT (upd (td (vc v)) (th (vc v)) xc) (th (vc v))) (vho v4)).
+  assert (Q7 : reqclear (vw v7)) by exact Q6.
+  rewrite (vexec_req Lb L _ v7 Q7) by (cbn [ao_of gCOPY]; unfold AR, AC, HO; lia || (cbn [vw v7]; rewrite L6; unfold AC; cells)).
+  rewrite rval_copy. unfold lv. cbn [fst snd]. rewrite vcell_win by cells. cbn [vw v7].
+  rewrite W6, (proj2 (Nat.eqb_neq cCC m1)), W5, (proj2 (Nat.eqb_neq cCC m0)), W2, (proj2 (Nat.eqb_neq cCC m1)), W1,
+    (proj2 (Nat.eqb_neq cCC m0)) by cells. fold cc.
+  assert (Fin : forall x, x <> m0 -> x <> m1 -> wget (vw v7) x = wget (vw v) x).
+  { intros x X0 X1. cbn [vw v7]. rewrite W6, (proj2 (Nat.eqb_neq x m1) X1), W5, (proj2 (Nat.eqb_neq x m0) X0), W2,
+      (proj2 (Nat.eqb_neq x m1) X1), W1, (proj2 (Nat.eqb_neq x m0) X0). reflexivity. }
+  destruct cc eqn:Ecc; cbn [ao_of gCOPY AC vact vw vr va vc vho v7 negb andb orb].
+  - refine (conj Q6 (conj L6 (conj Fin (conj V4r (conj V4a (conj _ V4h)))))). unfold xc, wstep.
+    rewrite orb_false_r. reflexivity.
+  - refine (conj Q6 (conj L6 (conj Fin (conj V4r (conj V4a (conj _ V4h)))))). unfold xc. apply tape_same.
+Qed.
+
+Lemma wseq_snoc : forall Lt bs b t, wseq Lt (bs ++ [b]) t = wstep Lt b (wseq Lt bs t).
+Proof. intros. unfold wseq. rewrite fold_left_app. reflexivity. Qed.
+
+Theorem segE_run : forall k v, k <= 8 -> reqclear (vw v) -> length (vw v) = W ->
+  let ca := wget (vw v) cCA in let cc := wget (vw v) cCC in
+  let bits := map (fun k' => wget (vw v) (MBc (rout A) (7 - k'))) (seq 0 k) in
+  let v' := vrun Lb L (concat (map Ebody (seq 0 k))) v in
+  reqclear (vw v') /\ length (vw v') = W /\ (forall x, x <> m0 -> x <> m1 -> wget (vw v') x = wget (vw v) x)
+  /\ vr v' = vr v /\ va v' = (if ca then wseq Lb bits (va v) else va v)
+  /\ vc v' = (if cc then wseq L bits (vc v) else vc v) /\ vho v' = vho v.
+Proof.
+  induction k as [|k IH]; intros v Hk Hq Hl; cbv zeta.
+  - cbn [seq map concat vrun]. refine (conj Hq (conj Hl (conj (fun _ _ _ => eq_refl) (conj eq_refl (conj _ (conj _ eq_refl)))))).
+    + destruct (wget (vw v) cCA); reflexivity.
+    + destruct (wget (vw v) cCC); reflexivity.
+  - rewrite seq_S, map_app, concat_app, vrun_app, map_app. cbn [map concat]. rewrite app_nil_r, Nat.add_0_l.
+    destruct (IH v ltac:(lia) Hq Hl) as (Q1 & L1 & U1 & R1 & A1 & C1 & H1). cbv zeta in Q1, L1, U1, R1, A1, C1, H1.
+    set (v1 := vrun Lb L (concat (map Ebody (seq 0 k))) v) in *.
+    destruct (Ebody_run k v1 ltac:(lia) Q1 L1) as (Q2 & L2 & U2 & R2 & A2 & C2 & H2). cbv zeta in Q2, L2, U2, R2, A2, C2, H2.
+    pose proof io_lt as (_ & _ & _ & _ & _ & Hro).
+    assert (Eca : wget (vw v1) cCA = wget (vw v) cCA) by (apply U1; cells).
+    assert (Ecc : wget (vw v1) cCC = wget (vw v) cCC) by (apply U1; cells).
+    assert (Eb : wget (vw v1) (MBc (rout A) (7 - k)) = wget (vw v) (MBc (rout A) (7 - k)))
+      by (pose proof (DB_gt (rout A) (7 - k) Hro ltac:(lia)); apply U1; cells).
+    rewrite Eca, Ecc, Eb in *.
+    refine (conj Q2 (conj L2 (conj _ (conj _ (conj _ (conj _ _)))))).
+    + intros x X0 X1. rewrite (U2 x X0 X1). apply U1; assumption.
+    + rewrite R2. exact R1.
+    + rewrite A2, A1. destruct (wget (vw v) cCA); [rewrite wseq_snoc; reflexivity | reflexivity].
+    + rewrite C2, C1. destruct (wget (vw v) cCC); [rewrite wseq_snoc; reflexivity | reflexivity].
+    + rewrite H2. exact H1.
+Qed.
+
+(* ---- the byte under the read head into R_in -------------------------------------------------------------- *)
+Definition Hbody (k : nat) : list rec :=
+  gMUX A w nu lvs cG (RD, true) (MBc (rin A) (7 - k), true) (MBc (rin A) (7 - k)) ++ [gCOPY (cG, true) AR].
+
+Lemma Hbody_run : forall k v, k < 8 -> reqclear (vw v) -> length (vw v) = W ->
+  let g := wget (vw v) cG in
+  let v' := vrun Lb L (Hbody k) v in
+  reqclear (vw v') /\ length (vw v') = W
+  /\ wget (vw v') (MBc (rin A) (7 - k)) = (if g then tget (vr v) else wget (vw v) (MBc (rin A) (7 - k)))
+  /\ (forall x, x <> m0 -> x <> m1 -> x <> MBc (rin A) (7 - k) -> wget (vw v') x = wget (vw v) x)
+  /\ vr v' = (if g then mkT (td (vr v)) (succ_mod L (th (vr v))) else vr v) /\ va v' = va v /\ vc v' = vc v
+  /\ vho v' = vho v.
+Proof.
+  intros k v Hk Hq Hl g. cbv zeta. unfold Hbody, gMUX. cbn [app vrun].
+  pose proof io_lt as (_ & _ & _ & _ & Hri & _).
+  set (c := MBc (rin A) (7 - k)).
+  assert (Hc : HO < c /\ c < DB A w nu lvs)
+    by (unfold c; pose proof (MB_range (rin A) (7 - k) Hri ltac:(lia)); pose proof (DB_gt (rin A) (7 - k) Hri ltac:(lia)); split; cells).
+  rewrite (vexec_cell Lb L _ v Hq) by (cbn [ao_of gAND]; cells).
+  rewrite rval_and. rewrite (lv_win v cG true) by cells.
+  assert (Hrd : ViewOps.lv v (RD, true) = tget (vr v)) by reflexivity. rewrite Hrd. cbn [ao_of gAND]. fold g.
+  set (v1 := mkV (upd (vw v) m0 (g && tget (vr v))) (vr v) (va v) (vc v) (vho v)).
+  assert (Q1 : reqclear (vw v1)) by (apply reqclear_upd; [cells | exact Hq]).
+  assert (L1 : length (vw v1) = W) by (cbn [vw v1]; rewrite upd_length; exact Hl).
+  assert (W1 : forall x, wget (vw v1) x = if Nat.eqb x m0 then g && tget (vr v) else wget (vw v) x)
+    by (intro x; cbn [vw v1]; apply win_set; [cells | rewrite Hl; cells]).
+  rewrite (vexec_cell Lb L _ v1 Q1) by (cbn [ao_of gAND]; cells).
+  rewrite rval_and, (lv_win v1 cG false), (lv_win v1 c true) by cells.
+  rewrite !W1, (proj2 (Nat.eqb_neq cG m0)), (proj2 (Nat.eqb_neq c m0)) by cells. fold g. cbn [ao_of gAND].
+  set (v2 := mkV (upd (vw v1) m1 (negb g && wget (vw v) c)) (vr v1) (va v1) (vc v1) (vho v1)).
+  assert (Q2 : reqclear (vw v2)) by (apply reqclear_upd; [cells | exact Q1]).
+  assert (L2 : length (vw v2) = W) by (cbn [vw v2]; rewrite upd_length; exact L1).
+  assert (W2 : forall x, wget (vw v2) x = if Nat.eqb x m1 then negb g && wget (vw v) c else wget (vw v1) x)
+    by (intro x; cbn [vw v2]; apply win_set; [cells | rewrite L1; cells]).
+  rewrite (vexec_cell Lb L _ v2 Q2) by (cbn [ao_of gOR]; cells).
+  rewrite rval_or, (lv_win v2 m0 true), (lv_win v2 m1 true) by cells.
+  rewrite (W2 m0), (proj2 (Nat.eqb_neq m0 m1)), W1, Nat.eqb_refl, W2, Nat.eqb_refl by cells. cbn [ao_of gOR].
+  set (x3 := g && tget (vr v) || negb g && wget (vw v) c).
+  set (v3 := mkV (upd (vw v2) c x3) (vr v2) (va v2) (vc v2) (vho v2)).
+  assert (Q3 : reqclear (vw v3)) by (apply reqclear_upd; [cells | exact Q2]).
+  assert (L3 : length (vw v3) = W) by (cbn [vw v3]; rewrite upd_length; exact L2).
+  assert (W3 : forall x, wget (vw v3) x = if Nat.eqb x c then x3 else wget (vw v2) x)
+    by (intro x; cbn [vw v3]; apply win_set; [cells | rewrite L2; cells]).
+  rewrite (vexec_req Lb L _ v3 Q3) by (cbn [ao_of gCOPY]; unfold AR, HO; lia || (rewrite L3; unfold AR; cells)).
+  rewrite rval_copy, (lv_win v3 cG true) by cells.
+  rewrite W3, (proj2 (Nat.eqb_neq cG c)), W2, (proj2 (Nat.eqb_neq cG m1)), W1, (proj2 (Nat.eqb_neq cG m0)) by cells. fold g.
+  assert (Fx3 : x3 = if g then tget (vr v) else wget (vw v) c) by (unfold x3; destruct g; cbn [andb orb negb]; [rewrite orb_false_r|]; reflexivity).
+  assert (Fin : forall x, x <> m0 -> x <> m1 -> x <> c -> wget (vw v3) x = wget (vw v) x).
+  { intros x X0 X1 Xc. rewrite W3, (proj2 (Nat.eqb_neq x c) Xc), W2, (proj2 (Nat.eqb_neq x m1) X1), W1,
+      (proj2 (Nat.eqb_neq x m0) X0). reflexivity. }
+  assert (Vc : wget (vw v3) c = if g then tget (vr v) else wget (vw v) c) by (rewrite W3, Nat.eqb_refl; exact Fx3).
+  destruct g eqn:Eg; cbn [ao_of gCOPY AR vact vw vr va vc vho v3 v2 v1].
+  - refine (conj Q3 (conj L3 (conj Vc (conj Fin (conj eq_refl (conj eq_refl (conj eq_refl eq_refl))))))).
+  - refine (conj Q3 (conj L3 (conj Vc (conj Fin (conj eq_refl (conj eq_refl (conj eq_refl eq_refl))))))).
+Qed.
+
+Theorem segH_run : forall k v, k <= 8 -> reqclear (vw v) -> length (vw v) = W ->
+  let g := wget (vw v) cG in
+  let v' := vrun Lb L (concat (map Hbody (seq 0 k))) v in
+  reqclear (vw v') /\ length (vw v') = W
+  /\ (forall i, i < k -> wget (vw v') (MBc (rin A) (7 - i))
+                         = (if g then nth (adv L i (th (vr v))) (td (vr v)) false else wget (vw v) (MBc (rin A) (7 - i))))
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall i, i < k -> x <> MBc (rin A) (7 - i)) -> wget (vw v') x = wget (vw v) x)
+  /\ vr v' = (if g then mkT (td (vr v)) (adv L k (th (vr v))) else vr v) /\ va v' = va v /\ vc v' = vc v
+  /\ vho v' = vho v.
+Proof.
+  induction k as [|k IH]; intros v Hk Hq Hl; cbv zeta.
+  - cbn [seq map concat vrun]. refine (conj Hq (conj Hl (conj _ (conj (fun _ _ _ _ => eq_refl) (conj _ (conj eq_refl (conj eq_refl eq_refl))))))).
+    + intros; lia.
+    + destruct (wget (vw v) cG); [destruct (vr v); reflexivity | reflexivity].
+  - rewrite seq_S, map_app, concat_app, vrun_app. cbn [map concat]. rewrite app_nil_r, Nat.add_0_l.
+    destruct (IH v ltac:(lia) Hq Hl) as (Q1 & L1 & V1 & U1 & R1 & A1 & C1 & H1). cbv zeta in Q1, L1, V1, U1, R1, A1, C1, H1.
+    set (v1 := vrun Lb L (concat (map Hbody (seq 0 k))) v) in *.
+    destruct (Hbody_run k v1 ltac:(lia) Q1 L1) as (Q2 & L2 & V2 & U2 & R2 & A2 & C2 & H2). cbv zeta in Q2, L2, V2, U2, R2, A2, C2, H2.
+    pose proof io_lt as (_ & _ & _ & _ & Hri & _).
+    assert (Eg : wget (vw v1) cG = wget (vw v) cG).
+    { apply U1; [cells | cells |]. intros i Hi. pose proof (DB_gt (rin A) (7 - i) Hri ltac:(lia)). cells. }
+    rewrite Eg in *.
+    assert (Neq : forall i j, i < 8 -> j < 8 -> i <> j -> MBc (rin A) (7 - i) <> MBc (rin A) (7 - j)).
+    { intros i j Hi Hj Hij E. apply MB_inj in E as [_ E]; [lia | exact Hri | exact Hri | lia | lia]. }
+    refine (conj Q2 (conj L2 (conj _ (conj _ (conj _ (conj _ (conj _ _))))))).
+    + intros i Hi. destruct (Nat.eq_dec i k) as [->|Hik].
+      * rewrite V2. destruct (wget (vw v) cG); [|rewrite U1 by (try (intros j Hj; apply Neq; lia); cells); reflexivity].
+        rewrite R1. unfold tget. reflexivity.
+      * rewrite U2 by (try (apply Neq; lia); cells). apply V1. lia.
+    + intros x X0 X1 Xi. rewrite U2 by (try exact X0; try exact X1; apply Xi; lia). apply U1; [exact X0 | exact X1 |].
+      intros i Hi. apply Xi. lia.
+    + rewrite R2, R1. destruct (wget (vw v) cG); reflexivity.
+    + rewrite A2. exact A1.
+    + rewrite C2. exact C1.
+    + rewrite H2. exact H1.
+Qed.
+
+(* ---- R_out cleared on a write, and whether a byte is read ---------------------------------------------- *)
+Lemma reads_gate : forall x y d, reads_of (gAND x y d) = [fst x; fst y] /\ reads_of (gOR x y d) = [fst x; fst y].
+Proof. intros [a p] [c q] d. unfold reads_of, gAND, gOR, pm. cbn [fst snd]. destruct p, q; split; reflexivity. Qed.
+
+Theorem chunk2_run : forall ww, length ww = W ->
+  let ww' := wrun (segF ++ segG) ww in
+  length ww' = W
+  /\ (forall t, t < A -> wget ww' (MBc (rout A) t) = wget ww (MBc (rout A) t) && negb (wget ww cWR))
+  /\ wget ww' cG = wget ww cRD && negb (wget ww cEOT)
+  /\ (forall x, x <> cG -> (forall t, t < A -> x <> MBc (rout A) t) -> wget ww' x = wget ww x).
+Proof.
+  intros ww Hl. cbv zeta. rewrite wrun_app.
+  pose proof io_lt as (_ & _ & _ & _ & _ & Hro).
+  assert (Hcell : forall t, t < A -> HO < MBc (rout A) t /\ MBc (rout A) t < DB A w nu lvs)
+    by (intros t Ht; pose proof (MB_range (rout A) t Hro Ht); pose proof (DB_gt (rout A) t Hro Ht); split; cells).
+  destruct (wrun_par segF ww) as [P1 P2].
+  - unfold segF. rewrite map_map. cbn [ao_of gAND]. apply nodup_map_seq_inj.
+    intros i j Hi Hj E. apply MB_inj in E as [_ E]; [lia | exact Hro | exact Hro | lia | lia].
+  - intros r Hr. unfold segF in Hr. apply in_map_iff in Hr as (t & <- & Ht). apply in_seq in Ht. cbn [ao_of gAND].
+    destruct (Hcell t ltac:(lia)). split; [lia | rewrite Hl; cells].
+  - intros r r' Hr Hr' Hin. unfold segF in Hr, Hr'. apply in_map_iff in Hr as (t & <- & Ht). apply in_map_iff in Hr' as (t' & <- & Ht').
+    apply in_seq in Ht, Ht'. rewrite (proj1 (reads_gate _ _ _)) in Hin. cbn [ao_of gAND fst] in *.
+    destruct Hin as [E|[E|[]]]; [exact (eq_sym E)|]. exfalso. pose proof (DB_gt (rout A) t' Hro ltac:(lia)). cells.
+  - set (w1 := wrun segF ww) in *.
+    assert (Lw1 : length w1 = W) by (unfold w1; rewrite length_wrun; exact Hl).
+    assert (R1 : forall t, t < A -> wget w1 (MBc (rout A) t) = wget ww (MBc (rout A) t) && negb (wget ww cWR)).
+    { intros t Ht. assert (Hr : In (gAND (MBc (rout A) t, true) (cWR, false) (MBc (rout A) t)) segF)
+        by (unfold segF; apply in_map_iff; exists t; split; [reflexivity | apply in_seq; lia]).
+      pose proof (P1 _ Hr) as E. cbn [ao_of gAND] in E. rewrite E, wval_and.
+      destruct (Hcell t Ht). rewrite wl_cell, wl_neg by cells. reflexivity. }
+    assert (U1 : forall x, (forall t, t < A -> x <> MBc (rout A) t) -> wget w1 x = wget ww x).
+    { intros x Hx. apply P2. intro Hin. unfold segF in Hin. rewrite map_map in Hin. apply in_map_iff in Hin as (t & E & Ht).
+      apply in_seq in Ht. cbn [ao_of gAND] in E. apply (Hx t); [lia | symmetry; exact E]. }
+    unfold segG. cbn [wrun]. unfold wexec. cbn [ao_of gAND]. rewrite wval_and, wl_cell, wl_neg by cells.
+    assert (Hd : forall t, t < A -> cRD <> MBc (rout A) t /\ cEOT <> MBc (rout A) t /\ cWR <> MBc (rout A) t /\ cG <> MBc (rout A) t)
+      by (intros t Ht; destruct (Hcell t Ht); repeat split; cells).
+    rewrite !U1 by (intros t Ht; apply Hd; exact Ht).
+    split; [rewrite length_wnext; exact Lw1|]. split.
+    + intros t Ht. rewrite wget_set by (cells || (rewrite Lw1; cells)).
+      rewrite (proj2 (Nat.eqb_neq (MBc (rout A) t) cG)) by (intro E; apply (proj2 (proj2 (proj2 (Hd t Ht)))); auto).
+      apply R1. exact Ht.
+    + split.
+      * rewrite wget_set by (cells || (rewrite Lw1; cells)). rewrite Nat.eqb_refl. reflexivity.
+      * intros x Xg Xr. rewrite wget_set by (cells || (rewrite Lw1; cells)). rewrite (proj2 (Nat.eqb_neq _ _) Xg).
+        apply U1. exact Xr.
+Qed.
+
+(* ---- the sign of R_in, the end of the tape, the carries and the count ------------------------------------ *)
+Lemma m01 : HO < m0 /\ HO < m1 /\ m0 <> m1 /\ m0 < W /\ m1 < W.
+Proof. repeat split; cells. Qed.
+
+Lemma mux_win : forall s a b d ww, length ww = W -> HO < d -> d < m0 -> HO < s -> s < m0 ->
+  HO < fst a -> fst a < m0 -> HO < fst b -> fst b < m0 ->
+  let ww' := wrun (gMUX A w nu lvs s a b d) ww in
+  length ww' = W /\ wget ww' d = (if wget ww s then wl ww a else wl ww b)
+  /\ (forall c, c <> m0 -> c <> m1 -> c <> d -> wget ww' c = wget ww c).
+Proof.
+  intros s a b d ww Hl Hd1 Hd2 Hs1 Hs2 Ha1 Ha2 Hb1 Hb2. cbv zeta. unfold gMUX.
+  pose proof m01 as (H0 & H1 & H01 & L0 & L1).
+  destruct (wrun_mux m0 m1 s a b d ww H0 H1 H01 ltac:(rewrite Hl; exact L0) ltac:(rewrite Hl; exact L1) Hd1
+              ltac:(rewrite Hl; lia) Hs1 ltac:(lia) ltac:(lia) ltac:(lia) ltac:(cells))
+    as (LL & VV & UU).
+  split; [rewrite LL; exact Hl | split; [exact VV | exact UU]].
+Qed.
+
+Lemma xor_win : forall x y d ww, length ww = W -> HO < d -> d < DB A w nu lvs ->
+  HO < fst x -> fst x < DB A w nu lvs -> HO < fst y -> fst y < DB A w nu lvs + 7 + 2 * w ->
+  let ww' := wrun (gXOR A w nu lvs x y d) ww in
+  length ww' = W /\ wget ww' d = xorb (wl ww x) (wl ww y)
+  /\ (forall c, c <> m0 -> c <> m1 -> c <> d -> wget ww' c = wget ww c).
+Proof.
+  intros x y d ww Hl Hd1 Hd2 Hx1 Hx2 Hy1 Hy2. cbv zeta. unfold gXOR.
+  pose proof m01 as (H0 & H1 & H01 & L0 & L1).
+  destruct (wrun_xor m0 m1 x y d ww H0 H1 H01 ltac:(rewrite Hl; exact L0) ltac:(rewrite Hl; exact L1) Hd1
+              ltac:(rewrite Hl; pose proof HW; unfold ncells in *; lia) ltac:(cells) ltac:(cells) ltac:(cells) ltac:(cells))
+    as (LL & VV & UU).
+  split; [rewrite LL; exact Hl | split; [exact VV | exact UU]].
+Qed.
+
+Lemma rin_cell : forall t, t < A -> HO < MBc (rin A) t /\ MBc (rin A) t < DB A w nu lvs.
+Proof.
+  intros t Ht. pose proof io_lt as (_ & _ & _ & _ & Hri & _).
+  pose proof (MB_range (rin A) t Hri Ht). pose proof (DB_gt (rin A) t Hri Ht). split; cells.
+Qed.
+
+Lemma ceot_cell : forall t, t < A -> HO < MBc (ceot A) t /\ MBc (ceot A) t < DB A w nu lvs.
+Proof.
+  intros t Ht. pose proof io_lt as (_ & Hce & _).
+  pose proof (MB_range (ceot A) t Hce Ht). pose proof (DB_gt (ceot A) t Hce Ht). split; cells.
+Qed.
+
+Theorem segI_run : forall k ww, k <= A - 8 -> length ww = W ->
+  let ww' := wrun (concat (map (fun t => gMUX A w nu lvs cG (MBc (rin A) 7, true) (MBc (rin A) t, true) (MBc (rin A) t))
+                               (seq 8 k))) ww in
+  length ww' = W
+  /\ (forall t, 8 <= t < 8 + k -> wget ww' (MBc (rin A) t)
+                                  = if wget ww cG then wget ww (MBc (rin A) 7) else wget ww (MBc (rin A) t))
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall t, 8 <= t < 8 + k -> x <> MBc (rin A) t) -> wget ww' x = wget ww x).
+Proof.
+  pose proof io_lt as (_ & _ & _ & _ & Hri & _).
+  induction k as [|k IH]; intros ww Hk Hl; cbv zeta.
+  - split; [exact Hl | split; [intros; lia | intros; reflexivity]].
+  - rewrite seq_S, map_app, concat_app, wrun_app. cbn [map concat]. rewrite app_nil_r.
+    destruct (IH ww ltac:(lia) Hl) as (L1 & V1 & U1). cbv zeta in L1, V1, U1.
+    set (w1 := wrun (concat (map (fun t => gMUX A w nu lvs cG (MBc (rin A) 7, true) (MBc (rin A) t, true) (MBc (rin A) t))
+                                 (seq 8 k))) ww) in *.
+    destruct (rin_cell (8 + k) ltac:(lia)) as [Ht1 Ht2]. destruct (rin_cell 7 ltac:(lia)) as [H71 H72].
+    destruct (mux_win cG (MBc (rin A) 7, true) (MBc (rin A) (8 + k), true) (MBc (rin A) (8 + k)) w1 L1 Ht1
+                ltac:(cells) ltac:(cells) ltac:(cells) H71 ltac:(cbn [fst]; cells) Ht1 ltac:(cbn [fst]; cells))
+      as (L2 & V2 & U2).
+    cbv zeta in L2, V2, U2.
+    assert (Ne : forall t t', t < A -> t' < A -> t <> t' -> MBc (rin A) t <> MBc (rin A) t')
+      by (intros t t' Ht Ht' Htt E; apply MB_inj in E as [_ E]; [lia | exact Hri | exact Hri | lia | lia]).
+    assert (Eg : wget w1 cG = wget ww cG) by (apply U1; [cells | cells | intros t Ht; pose proof (rin_cell t ltac:(lia)); cells]).
+    assert (E7 : wget w1 (MBc (rin A) 7) = wget ww (MBc (rin A) 7))
+      by (apply U1; [cells | cells | intros t Ht; apply Ne; lia]).
+    split; [exact L2|]. split.
+    + intros t Ht. destruct (Nat.eq_dec t (8 + k)) as [->|Htk].
+      * rewrite V2, Eg. rewrite !wl_cell by lia. rewrite E7.
+        rewrite U1 by (try (intros t' Ht'; apply Ne; lia); cells). reflexivity.
+      * rewrite U2 by (try (apply Ne; lia); cells). apply V1. lia.
+    + intros x X0 X1 Xt. rewrite U2 by (try exact X0; try exact X1; apply Xt; lia). apply U1; [exact X0 | exact X1|].
+      intros t Ht. apply Xt. lia.
+Qed.
+
+Theorem segL_run : forall k ww, k <= w - 1 -> length ww = W ->
+  let ww' := wrun (map (fun i => gAND (carry A w nu lvs i, true) (CNT i, true) (cCAR (S i))) (seq 0 k)) ww in
+  length ww' = W
+  /\ (forall j, j <= k -> wget ww' (carry A w nu lvs j) = wget ww cG && forallb (fun i => wget ww (CNT i)) (seq 0 j))
+  /\ (forall x, (forall j, 1 <= j <= k -> x <> cCAR j) -> wget ww' x = wget ww x).
+Proof.
+  induction k as [|k IH]; intros ww Hk Hl; cbv zeta.
+  - split; [exact Hl|]. split; [|intros; reflexivity].
+    intros j Hj. replace j with 0 by lia. cbn [seq forallb]. rewrite andb_true_r. reflexivity.
+  - rewrite seq_S, map_app, wrun_app. cbn [map]. rewrite Nat.add_0_l.
+    destruct (IH ww ltac:(lia) Hl) as (L1 & V1 & U1). cbv zeta in L1, V1, U1.
+    set (w1 := wrun (map (fun i => gAND (carry A w nu lvs i, true) (CNT i, true) (cCAR (S i))) (seq 0 k)) ww) in *.
+    cbn [wrun]. unfold wexec. cbn [ao_of gAND]. rewrite wval_and.
+    assert (Hck : HO < carry A w nu lvs k /\ carry A w nu lvs k < DB A w nu lvs + 7 + 2 * w).
+    { unfold carry. destruct (Nat.eqb k 0); split; cells. }
+    rewrite wl_cell by (destruct Hck; lia). rewrite wl_cell by cells.
+    rewrite (V1 k) by lia. rewrite (U1 (CNT k)) by (intros j Hj; cells).
+    set (x := wget ww cG && forallb (fun i => wget ww (CNT i)) (seq 0 k) && wget ww (CNT k)).
+    split; [rewrite length_wnext; exact L1|]. split.
+    + intros j Hj. rewrite wget_set by (cells || (rewrite L1; cells)).
+      destruct (Nat.eq_dec j (S k)) as [->|Hjk].
+      * unfold carry at 1. rewrite (proj2 (Nat.eqb_neq (S k) 0)) by lia. rewrite Nat.eqb_refl.
+        unfold x. rewrite seq_S, forallb_app. cbn [forallb]. rewrite andb_true_r, andb_assoc. reflexivity.
+      * replace (Nat.eqb (carry A w nu lvs j) (cCAR (S k))) with false.
+        { apply V1. lia. }
+        symmetry. apply Nat.eqb_neq. unfold carry. destruct (Nat.eqb_spec j 0); cells.
+    + intros y Hy. rewrite wget_set by (cells || (rewrite L1; cells)).
+      rewrite (proj2 (Nat.eqb_neq y (cCAR (S k)))) by (apply Hy; lia).
+      apply U1. intros j Hj. apply Hy. lia.
+Qed.
+
+Theorem segM_run : forall k ww, k <= w -> length ww = W ->
+  let ww' := wrun (concat (map (fun i => gXOR A w nu lvs (CNT i, true) (carry A w nu lvs i, true) (CNT i)) (seq 0 k))) ww in
+  length ww' = W
+  /\ (forall i, i < k -> wget ww' (CNT i) = xorb (wget ww (CNT i)) (wget ww (carry A w nu lvs i)))
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall i, i < k -> x <> CNT i) -> wget ww' x = wget ww x).
+Proof.
+  induction k as [|k IH]; intros ww Hk Hl; cbv zeta.
+  - split; [exact Hl | split; [intros; lia | intros; reflexivity]].
+  - rewrite seq_S, map_app, concat_app, wrun_app. cbn [map concat]. rewrite app_nil_r, Nat.add_0_l.
+    destruct (IH ww ltac:(lia) Hl) as (L1 & V1 & U1). cbv zeta in L1, V1, U1.
+    set (w1 := wrun (concat (map (fun i => gXOR A w nu lvs (CNT i, true) (carry A w nu lvs i, true) (CNT i)) (seq 0 k))) ww) in *.
+    assert (Hck : HO < carry A w nu lvs k /\ carry A w nu lvs k < DB A w nu lvs + 7 + 2 * w /\ carry A w nu lvs k <> m0
+                  /\ carry A w nu lvs k <> m1 /\ forall i, i < w -> carry A w nu lvs k <> CNT i).
+    { unfold carry. destruct (Nat.eqb k 0); repeat split; try (intros i Hi); cells. }
+    destruct Hck as (C1 & C2 & C3 & C4 & C5).
+    destruct (xor_win (CNT k, true) (carry A w nu lvs k, true) (CNT k) w1 L1 ltac:(cells) ltac:(cells)
+                ltac:(cbn [fst]; cells) ltac:(cbn [fst]; cells) ltac:(cbn [fst]; exact C1) ltac:(cbn [fst]; exact C2))
+      as (L2 & V2 & U2). cbv zeta in L2, V2, U2.
+    split; [exact L2|]. split.
+    + intros i Hi. destruct (Nat.eq_dec i k) as [->|Hik].
+      * rewrite V2, !wl_cell by (cells || lia). rewrite !U1 by (try (intros i' Hi'; cells); try (intros i' Hi'; apply C5; lia); cells).
+        reflexivity.
+      * rewrite U2 by cells. apply V1. lia.
+    + intros x X0 X1 Xi. rewrite U2 by (try exact X0; try exact X1; apply Xi; lia). apply U1; [exact X0 | exact X1|].
+      intros i Hi. apply Xi. lia.
+Qed.
+
+Theorem segJK_run : forall ww, length ww = W ->
+  let ww' := wrun (segJ ++ segK) ww in
+  length ww' = W
+  /\ wget ww' (MBc (ceot A) 0) = (if wget ww cRD then wget ww cEOT else wget ww (MBc (ceot A) 0))
+  /\ (forall t, 1 <= t < A -> wget ww' (MBc (ceot A) t) = wget ww (MBc (ceot A) t) && negb (wget ww cRD))
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall t, t < A -> x <> MBc (ceot A) t) -> wget ww' x = wget ww x).
+Proof.
+  intros ww Hl. cbv zeta. rewrite wrun_app.
+  pose proof io_lt as (_ & Hce & _).
+  assert (Ne : forall t t', t < A -> t' < A -> t <> t' -> MBc (ceot A) t <> MBc (ceot A) t')
+    by (intros t t' Ht Ht' Htt E; apply MB_inj in E as [_ E]; [lia | exact Hce | exact Hce | lia | lia]).
+  destruct (ceot_cell 0 ltac:(lia)) as [C01 C02].
+  destruct (mux_win cRD (cEOT, true) (MBc (ceot A) 0, true) (MBc (ceot A) 0) ww Hl C01 ltac:(cells) ltac:(cells)
+              ltac:(cells) ltac:(cbn [fst]; cells) ltac:(cbn [fst]; cells) ltac:(cbn [fst]; cells) ltac:(cbn [fst]; cells))
+    as (L1 & V1 & U1). cbv zeta in L1, V1, U1. fold segJ in L1, V1, U1.
+  set (w1 := wrun segJ ww) in *.
+  rewrite !wl_cell in V1 by cells.
+  destruct (wrun_par segK w1) as [P1 P2].
+  - unfold segK. rewrite map_map. cbn [ao_of gAND]. apply nodup_map_seq_inj.
+    intros i j Hi Hj E. apply MB_inj in E as [_ E]; [lia | exact Hce | exact Hce | lia | lia].
+  - intros r Hr. unfold segK in Hr. apply in_map_iff in Hr as (t & <- & Ht). apply in_seq in Ht. cbn [ao_of gAND].
+    destruct (ceot_cell t ltac:(lia)). split; [lia | rewrite L1; cells].
+  - intros r r' Hr Hr' Hin. unfold segK in Hr, Hr'. apply in_map_iff in Hr as (t & <- & Ht). apply in_map_iff in Hr' as (t' & <- & Ht').
+    apply in_seq in Ht, Ht'. rewrite (proj1 (reads_gate _ _ _)) in Hin. cbn [ao_of gAND fst] in *.
+    destruct Hin as [E|[E|[]]]; [exact (eq_sym E)|]. exfalso. destruct (ceot_cell t' ltac:(lia)). cells.
+  - assert (Rk : forall t, 1 <= t < A -> wget (wrun segK w1) (MBc (ceot A) t) = wget w1 (MBc (ceot A) t) && negb (wget w1 cRD)).
+    { intros t Ht. assert (Hr : In (gAND (MBc (ceot A) t, true) (cRD, false) (MBc (ceot A) t)) segK)
+        by (unfold segK; apply in_map_iff; exists t; split; [reflexivity | apply in_seq; lia]).
+      pose proof (P1 _ Hr) as E. cbn [ao_of gAND] in E. rewrite E, wval_and.
+      destruct (ceot_cell t ltac:(lia)). rewrite wl_cell, wl_neg by cells. reflexivity. }
+    assert (Uk : forall x, (forall t, 1 <= t < A -> x <> MBc (ceot A) t) -> wget (wrun segK w1) x = wget w1 x).
+    { intros x Hx. apply P2. intro Hin. unfold segK in Hin. rewrite map_map in Hin. apply in_map_iff in Hin as (t & E & Ht).
+      apply in_seq in Ht. cbn [ao_of gAND] in E. apply (Hx t); [lia | symmetry; exact E]. }
+    assert (Erd : wget w1 cRD = wget ww cRD) by (apply U1; cells).
+    split; [rewrite length_wrun; exact L1|]. split.
+    + rewrite Uk by (intros t Ht; apply Ne; lia). rewrite V1. reflexivity.
+    + split.
+      * intros t Ht. rewrite Rk by exact Ht. rewrite Erd. rewrite U1 by (try (apply Ne; lia); destruct (ceot_cell t ltac:(lia)); cells).
+        reflexivity.
+      * intros x X0 X1 Xt. rewrite Uk by (intros t Ht; apply Xt; lia). apply U1; [exact X0 | exact X1 | apply Xt; lia].
+Qed.
+
+Definition Obody (i : nat) : list rec :=
+  gMUX A w nu lvs cRW (CNT i, true) (LIM w i, true) (LIM w i) ++ [gAND (CNT i, true) (cRW, false) (CNT i)].
+
+Theorem segO_run : forall k ww, k <= w -> length ww = W ->
+  let rw := wget ww cRW in
+  let ww' := wrun (concat (map Obody (seq 0 k))) ww in
+  length ww' = W
+  /\ (forall i, i < k -> wget ww' (LIM w i) = (if rw then wget ww (CNT i) else wget ww (LIM w i))
+                         /\ wget ww' (CNT i) = wget ww (CNT i) && negb rw)
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall i, i < k -> x <> LIM w i /\ x <> CNT i) -> wget ww' x = wget ww x).
+Proof.
+  induction k as [|k IH]; intros ww Hk Hl; cbv zeta.
+  - split; [exact Hl | split; [intros; lia | intros; reflexivity]].
+  - rewrite seq_S, map_app, concat_app, wrun_app. cbn [map concat]. rewrite app_nil_r, Nat.add_0_l.
+    destruct (IH ww ltac:(lia) Hl) as (L1 & V1 & U1). cbv zeta in L1, V1, U1.
+    set (w1 := wrun (concat (map Obody (seq 0 k))) ww) in *.
+    unfold Obody. rewrite wrun_app.
+    destruct (mux_win cRW (CNT k, true) (LIM w k, true) (LIM w k) w1 L1 ltac:(cells) ltac:(cells) ltac:(cells)
+                ltac:(cells) ltac:(cbn [fst]; cells) ltac:(cbn [fst]; cells) ltac:(cbn [fst]; cells) ltac:(cbn [fst]; cells))
+      as (L2 & V2 & U2). cbv zeta in L2, V2, U2.
+    set (w2 := wrun (gMUX A w nu lvs cRW (CNT k, true) (LIM w k, true) (LIM w k)) w1) in *.
+    cbn [wrun]. unfold wexec. cbn [ao_of gAND]. rewrite wval_and, wl_cell, wl_neg by cells.
+    assert (Erw1 : wget w1 cRW = wget ww cRW) by (apply U1; [cells | cells | intros i Hi; split; cells]).
+    assert (Erw2 : wget w2 cRW = wget ww cRW) by (rewrite U2 by cells; exact Erw1).
+    assert (Ec2 : wget w2 (CNT k) = wget ww (CNT k))
+      by (rewrite U2 by cells; apply U1; [cells | cells | intros i Hi; split; cells]).
+    rewrite Erw2, Ec2.
+    split; [rewrite length_wnext; exact L2|]. split.
+    + intros i Hi. destruct (Nat.eq_dec i k) as [->|Hik].
+      * split.
+        -- rewrite wget_set by (cells || (rewrite L2; cells)). rewrite (proj2 (Nat.eqb_neq (LIM w k) (CNT k))) by cells.
+           rewrite V2, Erw1, !wl_cell by cells. rewrite !U1 by (try (intros i' Hi'; split; cells); cells). reflexivity.
+        -- rewrite wget_set by (cells || (rewrite L2; cells)). rewrite Nat.eqb_refl. reflexivity.
+      * rewrite !wget_set by (cells || (rewrite L2; cells)).
+        rewrite (proj2 (Nat.eqb_neq (LIM w i) (CNT k))), (proj2 (Nat.eqb_neq (CNT i) (CNT k))) by cells.
+        rewrite !U2 by cells. apply V1. lia.
+    + intros x X0 X1 Xi. rewrite wget_set by (cells || (rewrite L2; cells)).
+      rewrite (proj2 (Nat.eqb_neq x (CNT k))) by exact (proj2 (Xi k ltac:(lia))).
+      rewrite U2 by (try exact X0; try exact X1; exact (proj1 (Xi k ltac:(lia)))). apply U1; [exact X0 | exact X1|].
+      intros i Hi. apply Xi. lia.
+Qed.
+
+Lemma req_word_cell : forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A ->
+  HO < MBc c t /\ MBc c t < DB A w nu lvs.
+Proof.
+  intros c t Hc Ht. pose proof io_lt as (I1 & _ & I3 & I4 & _).
+  assert (Hcl : c < SW A) by (destruct Hc as [->|[->| ->]]; assumption).
+  pose proof (MB_range c t Hcl Ht). pose proof (DB_gt c t Hcl Ht). split; cells.
+Qed.
+
+Theorem segQ_run : forall ww, length ww = W ->
+  let ww' := wrun segQ ww in
+  length ww' = W
+  /\ (forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A -> wget ww' (MBc c t) = false)
+  /\ (forall x, (forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A -> x <> MBc c t) -> wget ww' x = wget ww x).
+Proof.
+  intros ww Hl. cbv zeta. pose proof io_lt as (I1 & _ & I3 & I4 & _). pose proof io_ne as (N1 & N2 & N3 & _).
+  assert (Hin : forall r, In r segQ -> exists c t, (c = cwr A \/ c = crd A \/ c = crw A) /\ t < A /\ r = gCONST false (MBc c t)).
+  { intros r Hr. unfold segQ in Hr. apply in_concat in Hr as (l & Hl' & Hr). apply in_map_iff in Hl' as (c & <- & Hc).
+    apply in_map_iff in Hr as (t & <- & Ht). apply in_seq in Ht. exists c, t. split; [|split; [lia | reflexivity]].
+    destruct Hc as [<-|[<-|[<-|[]]]]; auto. }
+  destruct (wrun_par segQ ww) as [P1 P2].
+  - unfold segQ. rewrite concat_map. cbn [map concat]. rewrite !map_map. cbn [ao_of gCONST gAND]. rewrite app_nil_r.
+    assert (Nd : forall c, c < SW A -> NoDup (map (fun t => MBc c t) (seq 0 A))).
+    { intros c Hc. apply nodup_map_seq_inj. intros i j Hi Hj E. apply MB_inj in E as [_ E]; [lia | exact Hc | exact Hc | lia | lia]. }
+    assert (Dj : forall c c' t t', c < SW A -> c' < SW A -> c <> c' -> t < A -> t' < A -> MBc c t <> MBc c' t')
+      by (intros c c' t t' Hc Hc' Hcc Ht Ht' E; apply MB_inj in E as [E _]; [lia | exact Hc | exact Hc' | exact Ht | exact Ht']).
+    apply NoDup_app; [apply Nd; exact I1 | apply NoDup_app; [apply Nd; exact I4 | apply Nd; exact I3 |] |].
+    + intros x Hx1 Hx2. apply in_map_iff in Hx1 as (t & <- & Ht). apply in_map_iff in Hx2 as (t' & E & Ht').
+      apply in_seq in Ht, Ht'. exact (Dj (crd A) (crw A) t t' I4 I3 N3 ltac:(lia) ltac:(lia) (eq_sym E)).
+    + intros x Hx1 Hx2. apply in_map_iff in Hx1 as (t & <- & Ht). apply in_seq in Ht.
+      apply in_app_or in Hx2 as [Hx2|Hx2]; apply in_map_iff in Hx2 as (t' & E & Ht'); apply in_seq in Ht'.
+      * exact (Dj (cwr A) (crd A) t t' I1 I4 N1 ltac:(lia) ltac:(lia) (eq_sym E)).
+      * exact (Dj (cwr A) (crw A) t t' I1 I3 N2 ltac:(lia) ltac:(lia) (eq_sym E)).
+  - intros r Hr. destruct (Hin r Hr) as (c & t & Hc & Ht & ->). cbn [ao_of gCONST gAND].
+    destruct (req_word_cell c t Hc Ht). split; [lia | rewrite Hl; cells].
+  - intros r r' Hr Hr' Hx. destruct (Hin r Hr) as (c & t & Hc & Ht & ->). destruct (Hin r' Hr') as (c' & t' & Hc' & Ht' & ->).
+    cbn [gCONST reads_of gAND pm fst snd Z.eqb] in Hx. cbn [ao_of gCONST gAND] in *.
+    destruct (req_word_cell c' t' Hc' Ht'). unfold SINK in Hx. destruct Hx as [E|[E|[]]]; exfalso; cells.
+  - split; [rewrite length_wrun; exact Hl|]. split.
+    + intros c t Hc Ht. assert (Hr : In (gCONST false (MBc c t)) segQ).
+      { unfold segQ. apply in_concat. exists (map (fun t => gCONST false (MBc c t)) (seq 0 A)).
+        split; [apply in_map_iff; exists c; split; [reflexivity | destruct Hc as [->|[->| ->]]; cbn [In]; tauto]
+               | apply in_map_iff; exists t; split; [reflexivity | apply in_seq; lia]]. }
+      pose proof (P1 _ Hr) as E. cbn [ao_of gCONST gAND] in E. rewrite E. reflexivity.
+    + intros x Hx. apply P2. intro Hin'. apply in_map_iff in Hin' as (r & E & Hr). destruct (Hin r Hr) as (c & t & Hc & Ht & ->).
+      cbn [ao_of gCONST gAND] in E. exact (Hx c t Hc Ht (eq_sym E)).
+Qed.
+
+Lemma MB_ne : forall j t j' t', j < SW A -> j' < SW A -> t < A -> t' < A -> j <> j' -> MBc j t <> MBc j' t'.
+Proof. intros j t j' t' Hj Hj' Ht Ht' Hne E. apply MB_inj in E as [E _]; auto. Qed.
+
+Lemma wrun_reqclear : forall rs ww, Forall wrec rs -> reqclear ww -> reqclear (wrun rs ww).
+Proof.
+  induction rs as [|r rs IH]; intros ww Hf Hq; [exact Hq|].
+  apply Forall_cons_iff in Hf as [Hr Hf]. cbn [wrun]. apply IH; [exact Hf|]. unfold wexec.
+  apply reqclear_wnext; [exact Hq|]. destruct r as [a0 x0 a1 x1 beta ao]. apply Hr.
+Qed.
+
+(* ---- the rewind returns the read head --------------------------------------------------------------- *)
+Lemma segN_run : forall v, reqclear (vw v) -> length (vw v) = W ->
+  vrun Lb L segN v = mkV (vw v) (if wget (vw v) cRW then mkT (td (vr v)) 0 else vr v) (va v) (vc v) (vho v).
+Proof.
+  intros v Hq Hl. unfold segN. cbn [vrun].
+  rewrite (vexec_req Lb L _ v Hq) by (cbn [ao_of gCOPY]; unfold AR, RR, HO; lia || (rewrite Hl; unfold RR; cells)).
+  rewrite rval_copy, (lv_win v cRW true) by cells. cbn [ao_of gCOPY RR].
+  destruct (wget (vw v) cRW); cbn [vact]; [reflexivity | destruct v; reflexivity].
+Qed.
+
+(* ---- the sign of R_in, c_eot, the carries and the count, in one run ------------------------------------- *)
+Theorem chunk3_run : forall ww, length ww = W ->
+  let ww' := wrun (segI ++ segJ ++ segK ++ segL ++ segM) ww in
+  length ww' = W
+  /\ (forall t, 8 <= t < A -> wget ww' (MBc (rin A) t)
+                              = if wget ww cG then wget ww (MBc (rin A) 7) else wget ww (MBc (rin A) t))
+  /\ wget ww' (MBc (ceot A) 0) = (if wget ww cRD then wget ww cEOT else wget ww (MBc (ceot A) 0))
+  /\ (forall t, 1 <= t < A -> wget ww' (MBc (ceot A) t) = wget ww (MBc (ceot A) t) && negb (wget ww cRD))
+  /\ (forall i, i < w -> wget ww' (CNT i)
+                         = xorb (wget ww (CNT i)) (wget ww cG && forallb (fun k => wget ww (CNT k)) (seq 0 i)))
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall t, 8 <= t < A -> x <> MBc (rin A) t)
+        -> (forall t, t < A -> x <> MBc (ceot A) t) -> (forall j, 1 <= j < w -> x <> cCAR j)
+        -> (forall i, i < w -> x <> CNT i) -> wget ww' x = wget ww x).
+Proof.
+  intros ww Hl. cbv zeta.
+  pose proof io_lt as (_ & Hce & _ & _ & Hri & _). pose proof io_ne as (_ & _ & _ & _ & _ & N6 & _).
+  assert (E : wrun (segI ++ segJ ++ segK ++ segL ++ segM) ww = wrun segM (wrun segL (wrun (segJ ++ segK) (wrun segI ww))))
+    by (rewrite !wrun_app; reflexivity).
+  rewrite E.
+  destruct (segI_run (A - 8) ww ltac:(lia) Hl) as (L1 & V1 & U1). cbv zeta in L1, V1, U1. fold segI in L1, V1, U1.
+  set (w1 := wrun segI ww) in *.
+  destruct (segJK_run w1 L1) as (L2 & C0 & Ct & U2). cbv zeta in L2, C0, Ct, U2.
+  set (w2 := wrun (segJ ++ segK) w1) in *.
+  destruct (segL_run (w - 1) w2 ltac:(lia) L2) as (L3 & V3 & U3). cbv zeta in L3, V3, U3. fold segL in L3, V3, U3.
+  set (w3 := wrun segL w2) in *.
+  destruct (segM_run w w3 ltac:(lia) L3) as (L4 & V4 & U4). cbv zeta in L4, V4, U4. fold segM in L4, V4, U4.
+  assert (Rin : forall t t', t < A -> t' < A -> t <> t' -> MBc (rin A) t <> MBc (rin A) t')
+    by (intros t t' Ht Ht' Htt E'; apply MB_inj in E' as [_ E']; [lia | exact Hri | exact Hri | lia | lia]).
+  assert (Rc : forall t t', t < A -> t' < A -> MBc (rin A) t <> MBc (ceot A) t')
+    by (intros t t' Ht Ht'; apply MB_ne; auto).
+  (* the cells the later parts read, over the earlier parts *)
+  assert (F12 : forall x, x <> m0 -> x <> m1 -> (forall t, 8 <= t < A -> x <> MBc (rin A) t)
+                -> (forall t, t < A -> x <> MBc (ceot A) t) -> wget w2 x = wget ww x).
+  { intros x X0 X1 Xr Xc. rewrite U2 by assumption. apply U1; [exact X0 | exact X1 | intros t Ht; apply Xr; lia]. }
+  assert (F3 : forall x, x <> m0 -> x <> m1 -> (forall t, 8 <= t < A -> x <> MBc (rin A) t)
+                -> (forall t, t < A -> x <> MBc (ceot A) t) -> (forall j, 1 <= j < w -> x <> cCAR j) -> wget w3 x = wget ww x).
+  { intros x X0 X1 Xr Xc Xj. rewrite U3 by (intros j Hj; apply Xj; lia). apply F12; assumption. }
+  assert (Hrin : forall t, t < A -> HO < MBc (rin A) t /\ MBc (rin A) t < DB A w nu lvs) by exact rin_cell.
+  assert (Hcet : forall t, t < A -> HO < MBc (ceot A) t /\ MBc (ceot A) t < DB A w nu lvs) by exact ceot_cell.
+  split; [exact L4|]. split; [|split; [|split; [|split]]].
+  - intros t Ht. destruct (Hrin t ltac:(lia)) as [T1 T2].
+    rewrite U4 by (try (intros i Hi); cells). rewrite U3 by (intros j Hj; cells).
+    rewrite U2 by (try (intros t' Ht'; apply Rc; lia); cells). apply V1. lia.
+  - destruct (Hcet 0 ltac:(lia)) as [T1 T2].
+    rewrite U4 by (try (intros i Hi); cells). rewrite U3 by (intros j Hj; cells). rewrite C0.
+    rewrite !U1 by (try (intros t Ht; first [apply not_eq_sym, Rc | destruct (Hrin t ltac:(lia))]); try lia; cells).
+    reflexivity.
+  - intros t Ht. destruct (Hcet t ltac:(lia)) as [T1 T2].
+    rewrite U4 by (try (intros i Hi); cells). rewrite U3 by (intros j Hj; cells). rewrite Ct by exact Ht.
+    rewrite !U1 by (try (intros t' Ht'; first [apply not_eq_sym, Rc | destruct (Hrin t' ltac:(lia))]); try lia; cells).
+    reflexivity.
+  - intros i Hi. rewrite V4 by exact Hi.
+    rewrite (F3 (CNT i)) by (try (intros t Ht; destruct (Hrin t ltac:(lia)) || destruct (Hcet t ltac:(lia))); try (intros j Hj); cells).
+    rewrite (V3 i) by lia.
+    assert (Eg : wget w2 cG = wget ww cG).
+    { apply F12; [cells | cells | intros t Ht; destruct (Hrin t ltac:(lia)); cells | intros t Ht; destruct (Hcet t Ht); cells]. }
+    rewrite Eg. f_equal. f_equal. apply forallb_ext_in'. intros k Hk. apply in_seq in Hk.
+    apply F12; [cells | cells | intros t Ht; destruct (Hrin t ltac:(lia)); cells | intros t Ht; destruct (Hcet t Ht); cells].
+  - intros x X0 X1 Xr Xc Xj Xi. rewrite U4 by assumption. apply F3; assumption.
+Qed.
+
+(* ---- the rewind on the registers and dest, and the request words cleared ----------------------------- *)
+Theorem chunk4_run : forall ww, length ww = W ->
+  let rw := wget ww cRW in
+  let ww' := wrun (segO ++ segP ++ segQ) ww in
+  length ww' = W
+  /\ (forall i, i < w -> wget ww' (LIM w i) = (if rw then wget ww (CNT i) else wget ww (LIM w i))
+                         /\ wget ww' (CNT i) = wget ww (CNT i) && negb rw)
+  /\ wget ww' (DEST w) = wget ww (DEST w) || rw
+  /\ (forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A -> wget ww' (MBc c t) = false)
+  /\ (forall x, x <> m0 -> x <> m1 -> (forall i, i < w -> x <> LIM w i /\ x <> CNT i) -> x <> DEST w ->
+        (forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A -> x <> MBc c t) -> wget ww' x = wget ww x).
+Proof.
+  intros ww Hl. cbv zeta.
+  assert (E : wrun (segO ++ segP ++ segQ) ww = wrun segQ (wrun segP (wrun segO ww))) by (rewrite !wrun_app; reflexivity).
+  rewrite E.
+  destruct (segO_run w ww ltac:(lia) Hl) as (L1 & V1 & U1). cbv zeta in L1, V1, U1.
+  assert (EO : segO = concat (map Obody (seq 0 w))) by reflexivity. rewrite <- EO in L1, V1, U1.
+  set (w1 := wrun segO ww) in *.
+  assert (W2 : forall x, wget (wrun segP w1) x = if Nat.eqb x (DEST w) then wget w1 (DEST w) || wget w1 cRW else wget w1 x).
+  { intro x. unfold segP. rewrite wrun1. cbn [ao_of gOR]. rewrite wval_or, !wl_cell by cells.
+    apply wget_set; [cells | rewrite L1; cells]. }
+  assert (L2 : length (wrun segP w1) = W) by (rewrite length_wrun; exact L1).
+  set (w2 := wrun segP w1) in *.
+  destruct (segQ_run w2 L2) as (L3 & V3 & U3). cbv zeta in L3, V3, U3.
+  assert (Hreq : forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A -> HO < MBc c t /\ MBc c t < DB A w nu lvs)
+    by exact req_word_cell.
+  assert (Rw1 : wget w1 cRW = wget ww cRW) by (apply U1; [cells | cells | intros i Hi; split; cells]).
+  split; [exact L3|]. split; [|split; [|split]].
+  - intros i Hi. rewrite !U3 by (intros c t Hc Ht; destruct (Hreq c t Hc Ht); cells).
+    rewrite !W2. rewrite (proj2 (Nat.eqb_neq (LIM w i) (DEST w))), (proj2 (Nat.eqb_neq (CNT i) (DEST w))) by cells.
+    apply V1. exact Hi.
+  - rewrite U3 by (intros c t Hc Ht; destruct (Hreq c t Hc Ht); cells). rewrite W2, Nat.eqb_refl, Rw1.
+    rewrite U1 by (try (intros i Hi; split); cells). reflexivity.
+  - exact V3.
+  - intros x X0 X1 Xi Xd Xc. rewrite U3 by exact Xc. rewrite W2, (proj2 (Nat.eqb_neq x (DEST w)) Xd).
+    apply U1; assumption.
+Qed.
+
+(* ---- the window records of the device read and write the window alone, above the requests ------------ *)
+Ltac wg := first [ apply wrec_const; right; cells
+                 | apply wrec_copy; unfold rd_ok; cbn [fst]; right; cells
+                 | apply wrec_and; unfold rd_ok; cbn [fst]; right; cells
+                 | apply wrec_or; unfold rd_ok; cbn [fst]; right; cells ].
+Ltac fwg := repeat (apply Forall_cons; [wg|]); apply Forall_nil.
+
+Lemma chunk1_wrec : Forall wrec (segA ++ segB ++ segC ++ segD).
+Proof.
+  assert (Hw1 : forall j d, HO < d -> Forall wrec (word1 A w j d)).
+  { intros j d Hd. unfold word1. apply chain_wrec; [exact wrec_and | | exact Hd | exact Hd].
+    intros l [<-|Hl]; [cbn [fst]; right; cells|].
+    apply in_map_iff in Hl as (t & <- & Ht). apply in_seq in Ht. cbn [fst]. right. cells. }
+  unfold segA. rewrite !Forall_app. repeat split.
+  - apply Hw1. cells.
+  - apply Hw1. cells.
+  - apply Hw1. cells.
+  - unfold segB. apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. fwg.
+  - unfold segC. apply chain_wrec; [exact wrec_and | | cells | cells].
+    intros l Hl. apply in_map_iff in Hl as (i & <- & Hi). apply in_seq in Hi. cbn [fst]. right. cells.
+  - unfold segD. fwg.
+Qed.
+
+Lemma chunk2_wrec : Forall wrec (segF ++ segG).
+Proof.
+  rewrite Forall_app. split.
+  - unfold segF. apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. wg.
+  - unfold segG. fwg.
+Qed.
+
+Lemma chunk3_wrec : Forall wrec (segI ++ segJ ++ segK ++ segL ++ segM).
+Proof.
+  rewrite !Forall_app. repeat split.
+  - unfold segI. apply Forall_concat, Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. unfold gMUX. fwg.
+  - unfold segJ, gMUX. fwg.
+  - unfold segK. apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. wg.
+  - unfold segL. apply Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. unfold carry.
+    destruct (Nat.eqb i 0); wg.
+  - unfold segM. apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. unfold gXOR, carry.
+    destruct (Nat.eqb i 0); fwg.
+Qed.
+
+Lemma chunk4_wrec : Forall wrec (segO ++ segP ++ segQ).
+Proof.
+  rewrite !Forall_app. repeat split.
+  - unfold segO. apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. unfold gMUX. cbn [app]. fwg.
+  - unfold segP. fwg.
+  - unfold segQ. apply Forall_concat, Forall_map, Forall_forall. intros c _.
+    apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. wg.
+Qed.
+
+(* ---- the device on a view ------------------------------------------------------------------------------ *)
+(* the low byte of R_out, most significant bit first *)
+Definition outbits (ww : list bool) : list bool := map (fun k => wget ww (MBc (rout A) (7 - k))) (seq 0 8).
+
+(* the cells the device writes *)
+Definition devw (x : nat) : Prop :=
+  (DB A w nu lvs <= x < ncells A w nu lvs)
+  \/ (exists i, i < w /\ (x = CNT i \/ x = LIM w i)) \/ x = DEST w
+  \/ (exists c t, (c = cwr A \/ c = crd A \/ c = crw A \/ c = rout A \/ c = rin A \/ c = ceot A) /\ t < A /\ x = MBc c t).
+
+Lemma ndevw : forall x, ~ devw x ->
+  (x < DB A w nu lvs \/ ncells A w nu lvs <= x) /\ (forall i, i < w -> x <> CNT i /\ x <> LIM w i) /\ x <> DEST w
+  /\ (forall c t, (c = cwr A \/ c = crd A \/ c = crw A \/ c = rout A \/ c = rin A \/ c = ceot A) -> t < A -> x <> MBc c t).
+Proof.
+  intros x H. split; [|split; [|split]].
+  - destruct (Nat.lt_ge_cases x (DB A w nu lvs)) as [H1|H1]; [left; exact H1|].
+    destruct (Nat.lt_ge_cases x (ncells A w nu lvs)) as [H2|H2]; [|right; exact H2].
+    exfalso. apply H. left. split; assumption.
+  - intros i Hi. split.
+    + intro E. apply H. right. left. exists i. split; [exact Hi | left; exact E].
+    + intro E. apply H. right. left. exists i. split; [exact Hi | right; exact E].
+  - intro E. apply H. right. right. left. exact E.
+  - intros c t Hc Ht E. apply H. right. right. right. exists c, t. auto.
+Qed.
+
+Ltac mbne := first
+  [ apply MB_ne; first [assumption | lia | (pose proof SW8; unfold cwr, ceot, crw, crd, rin, rout; lia)]
+  | let E := fresh "E" in intro E; apply MB_inj in E as [_ E];
+      first [assumption | lia | (pose proof SW8; unfold cwr, ceot, crw, crd, rin, rout; lia)] ].
+
+Lemma rout_cell : forall t, t < A -> HO < MBc (rout A) t /\ MBc (rout A) t < DB A w nu lvs.
+Proof.
+  intros t Ht. pose proof io_lt as (_ & _ & _ & _ & _ & I6).
+  pose proof (MB_range (rout A) t I6 Ht). pose proof (DB_gt (rout A) t I6 Ht). split; cells.
+Qed.
+
+(* the window parts of the device as maps of views; the last also returns the read head on a rewind *)
+Definition dv1 (u : view) : view := mkV (wrun (segA ++ segB ++ segC ++ segD) (vw u)) (vr u) (va u) (vc u) (vho u).
+Definition dv3 (u : view) : view := mkV (wrun (segF ++ segG) (vw u)) (vr u) (va u) (vc u) (vho u).
+Definition dv5 (u : view) : view := mkV (wrun (segI ++ segJ ++ segK ++ segL ++ segM) (vw u)) (vr u) (va u) (vc u) (vho u).
+Definition dv6 (u : view) : view :=
+  mkV (wrun (segO ++ segP ++ segQ) (vw u)) (if wget (vw u) cRW then mkT (td (vr u)) 0 else vr u) (va u) (vc u) (vho u).
+
+(* the view v the device starts from, and the views u2 and u4 after the parts that move heads *)
+Section Parts.
+Variables (v u2 u4 : view).
+Hypotheses (Hq : reqclear (vw v)) (Hl : length (vw v) = W)
+  (E2 : u2 = vrun Lb L (concat (map Ebody (seq 0 8))) (dv1 v))
+  (E4 : u4 = vrun Lb L (concat (map Hbody (seq 0 8))) (dv3 u2)).
+
+(* the requests, cnt = lim, the end of the recipe and where a write goes *)
+Lemma part1 : reqclear (vw (dv1 v)) /\ length (vw (dv1 v)) = W
+  /\ wget (vw (dv1 v)) cWR = wrv (vw v) /\ wget (vw (dv1 v)) cRD = rdv (vw v) /\ wget (vw (dv1 v)) cRW = rwv (vw v)
+  /\ wget (vw (dv1 v)) cEOT = eotv (vw v) /\ wget (vw (dv1 v)) cCA = cav (vw v) /\ wget (vw (dv1 v)) cCC = ccv (vw v)
+  /\ (forall x, x < DB A w nu lvs \/ ncells A w nu lvs <= x -> wget (vw (dv1 v)) x = wget (vw v) x).
+Proof.
+  destruct (chunk1_run (vw v) Hl) as (L1 & H1 & H2 & H3 & H4 & H5 & H6 & U1).
+  exact (conj (wrun_reqclear _ _ chunk1_wrec Hq) (conj L1 (conj H1 (conj H2 (conj H3 (conj H4 (conj H5 (conj H6 U1)))))))).
+Qed.
+
+(* the low byte of R_out under the arm or under the copy head *)
+Lemma part2 : reqclear (vw u2) /\ length (vw u2) = W
+  /\ (forall x, x <> m0 -> x <> m1 -> wget (vw u2) x = wget (vw (dv1 v)) x)
+  /\ vr u2 = vr v /\ va u2 = (if cav (vw v) then wseq Lb (outbits (vw v)) (va v) else va v)
+  /\ vc u2 = (if ccv (vw v) then wseq L (outbits (vw v)) (vc v) else vc v) /\ vho u2 = vho v.
+Proof.
+  rewrite E2.
+  destruct part1 as (Q1 & L1 & _ & _ & _ & _ & CA1 & CC1 & U1).
+  destruct (segE_run 8 (dv1 v) ltac:(lia) Q1 L1) as (Q2 & L2 & U2 & R2 & A2 & C2 & H2).
+  rewrite CA1 in A2. rewrite CC1 in C2.
+  assert (Eb : map (fun k' => wget (vw (dv1 v)) (MBc (rout A) (7 - k'))) (seq 0 8) = outbits (vw v)).
+  { unfold outbits. apply map_ext_in. intros k Hk. apply in_seq in Hk. apply U1. left.
+    destruct (rout_cell (7 - k) ltac:(lia)). lia. }
+  rewrite Eb in A2, C2.
+  exact (conj Q2 (conj L2 (conj U2 (conj R2 (conj A2 (conj C2 H2)))))).
+Qed.
+
+(* R_out cleared on a write, and whether a byte is read *)
+Lemma part3 : reqclear (vw (dv3 u2)) /\ length (vw (dv3 u2)) = W
+  /\ (forall t, t < A -> wget (vw (dv3 u2)) (MBc (rout A) t) = wget (vw v) (MBc (rout A) t) && negb (wrv (vw v)))
+  /\ wget (vw (dv3 u2)) cG = gv (vw v) /\ wget (vw (dv3 u2)) cRD = rdv (vw v) /\ wget (vw (dv3 u2)) cEOT = eotv (vw v)
+  /\ wget (vw (dv3 u2)) cRW = rwv (vw v)
+  /\ (forall x, x < DB A w nu lvs \/ ncells A w nu lvs <= x -> (forall t, t < A -> x <> MBc (rout A) t) ->
+        wget (vw (dv3 u2)) x = wget (vw v) x).
+Proof.
+  destruct part1 as (_ & _ & WR1 & RD1 & RW1 & EOT1 & _ & _ & U1).
+  destruct part2 as (Q2 & L2 & U2 & _).
+  destruct (chunk2_run (vw u2) L2) as (L3 & R3 & G3 & U3).
+  change (wrun (segF ++ segG) (vw u2)) with (vw (dv3 u2)) in L3, R3, G3, U3.
+  assert (F2 : forall x, x < DB A w nu lvs \/ ncells A w nu lvs <= x -> wget (vw u2) x = wget (vw v) x).
+  { intros x Hx. rewrite U2 by cells. apply U1. exact Hx. }
+  assert (D3 : forall c, DB A w nu lvs <= c < ncells A w nu lvs -> c <> m0 -> c <> m1 -> c <> cG ->
+               wget (vw (dv3 u2)) c = wget (vw (dv1 v)) c).
+  { intros c Hc H0 H1 Hg. rewrite U3; [apply U2; assumption | exact Hg |].
+    intros t Ht. destruct (rout_cell t Ht). lia. }
+  refine (conj (wrun_reqclear _ _ chunk2_wrec Q2) (conj L3 (conj _ (conj _ (conj _ (conj _ (conj _ _))))))).
+  - intros t Ht. destruct (rout_cell t Ht). rewrite R3 by exact Ht. rewrite F2 by (left; lia). rewrite U2 by cells.
+    rewrite WR1. reflexivity.
+  - rewrite G3, !U2 by cells. rewrite RD1, EOT1. reflexivity.
+  - rewrite D3 by cells. exact RD1.
+  - rewrite D3 by cells. exact EOT1.
+  - rewrite D3 by cells. exact RW1.
+  - intros x Hx Ht. rewrite U3 by (try exact Ht; cells). apply F2. exact Hx.
+Qed.
+
+(* the byte under the read head into R_in *)
+Lemma part4 : reqclear (vw u4) /\ length (vw u4) = W
+  /\ (forall t, t < 8 -> wget (vw u4) (MBc (rin A) t)
+                         = if gv (vw v) then nth (adv L (7 - t) (th (vr v))) (td (vr v)) false else wget (vw v) (MBc (rin A) t))
+  /\ wget (vw u4) cG = gv (vw v) /\ wget (vw u4) cRD = rdv (vw v) /\ wget (vw u4) cEOT = eotv (vw v)
+  /\ wget (vw u4) cRW = rwv (vw v)
+  /\ (forall t, t < A -> wget (vw u4) (MBc (rout A) t) = wget (vw v) (MBc (rout A) t) && negb (wrv (vw v)))
+  /\ (forall x, x < DB A w nu lvs \/ ncells A w nu lvs <= x -> (forall t, t < A -> x <> MBc (rout A) t) ->
+        (forall i, i < 8 -> x <> MBc (rin A) (7 - i)) -> wget (vw u4) x = wget (vw v) x)
+  /\ vr u4 = (if gv (vw v) then mkT (td (vr v)) (adv L 8 (th (vr v))) else vr v)
+  /\ va u4 = va u2 /\ vc u4 = vc u2 /\ vho u4 = vho v.
+Proof.
+  destruct part2 as (_ & _ & _ & R2 & _ & _ & H2).
+  destruct part3 as (Q3 & L3 & RO3 & G3 & RD3 & EOT3 & RW3 & F3).
+  rewrite E4.
+  destruct (segH_run 8 (dv3 u2) ltac:(lia) Q3 L3) as (Q4 & L4 & V4 & U4 & R4 & A4 & C4 & H4).
+  rewrite G3 in V4, R4. change (vr (dv3 u2)) with (vr u2) in V4, R4. rewrite R2 in V4, R4.
+  assert (D4 : forall c, DB A w nu lvs <= c < ncells A w nu lvs -> c <> m0 -> c <> m1 ->
+               wget (vw (vrun Lb L (concat (map Hbody (seq 0 8))) (dv3 u2))) c = wget (vw (dv3 u2)) c).
+  { intros c Hc H0 H1. apply U4; [exact H0 | exact H1 |]. intros i Hi. destruct (rin_cell (7 - i) ltac:(lia)). lia. }
+  refine (conj Q4 (conj L4 (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ (conj R4 (conj A4 (conj C4 _)))))))))))).
+  - intros t Ht. pose proof (V4 (7 - t) ltac:(lia)) as V. replace (7 - (7 - t)) with t in V by lia. rewrite V.
+    destruct (rin_cell t ltac:(lia)). rewrite F3 by (first [left; lia | intros t' Ht'; mbne]). reflexivity.
+  - rewrite D4 by cells. exact G3.
+  - rewrite D4 by cells. exact RD3.
+  - rewrite D4 by cells. exact EOT3.
+  - rewrite D4 by cells. exact RW3.
+  - intros t Ht. destruct (rout_cell t Ht). rewrite U4 by (first [cells | intros i Hi; mbne]). apply RO3. exact Ht.
+  - intros x Hx Ho Hr. rewrite U4 by (first [cells | exact Hr]). apply F3; assumption.
+  - rewrite H4. exact H2.
+Qed.
+
+(* the sign of R_in, c_eot, and the count *)
+Lemma part5 : reqclear (vw (dv5 u4)) /\ length (vw (dv5 u4)) = W
+  /\ (forall t, t < A -> wget (vw (dv5 u4)) (MBc (rin A) t)
+                         = if gv (vw v) then nth (adv L (7 - t) (th (vr v))) (td (vr v)) false else wget (vw v) (MBc (rin A) t))
+  /\ wget (vw (dv5 u4)) (MBc (ceot A) 0) = (if rdv (vw v) then eotv (vw v) else wget (vw v) (MBc (ceot A) 0))
+  /\ (forall t, 1 <= t < A -> wget (vw (dv5 u4)) (MBc (ceot A) t) = wget (vw v) (MBc (ceot A) t) && negb (rdv (vw v)))
+  /\ (forall i, i < w -> wget (vw (dv5 u4)) (CNT i) = cntv (vw v) i)
+  /\ (forall t, t < A -> wget (vw (dv5 u4)) (MBc (rout A) t) = wget (vw v) (MBc (rout A) t) && negb (wrv (vw v)))
+  /\ wget (vw (dv5 u4)) cRW = rwv (vw v)
+  /\ (forall x, x < DB A w nu lvs \/ ncells A w nu lvs <= x -> (forall t, t < A -> x <> MBc (rout A) t) ->
+        (forall t, t < A -> x <> MBc (rin A) t) -> (forall t, t < A -> x <> MBc (ceot A) t) ->
+        (forall i, i < w -> x <> CNT i) -> wget (vw (dv5 u4)) x = wget (vw v) x).
+Proof.
+  destruct part4 as (Q4 & L4 & V4 & G4 & RD4 & EOT4 & RW4 & RO4 & F4 & _).
+  destruct (chunk3_run (vw u4) L4) as (L5 & I5 & E5 & T5 & C5 & U5).
+  change (wrun (segI ++ segJ ++ segK ++ segL ++ segM) (vw u4)) with (vw (dv5 u4)) in L5, I5, E5, T5, C5, U5.
+  refine (conj (wrun_reqclear _ _ chunk3_wrec Q4) (conj L5 (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ _)))))))).
+  - intros t Ht. destruct (rin_cell t Ht) as [T1 T2]. destruct (Nat.lt_ge_cases t 8) as [Hlo|Hhi].
+    + rewrite U5 by (first [cells | intros t' Ht'; mbne | intros j Hj; cells | intros i Hi; cells]). apply V4. exact Hlo.
+    + rewrite I5 by lia. rewrite G4. rewrite (V4 7) by lia.
+      rewrite (F4 (MBc (rin A) t)) by (first [left; exact T2 | intros t' Ht'; mbne]).
+      replace (7 - 7) with 0 by reflexivity. replace (7 - t) with 0 by lia. destruct (gv (vw v)); reflexivity.
+  - destruct (ceot_cell 0 ltac:(lia)) as [T1 T2]. rewrite E5, RD4, EOT4.
+    rewrite F4 by (first [left; exact T2 | intros t' Ht'; mbne]). reflexivity.
+  - intros t Ht. destruct (ceot_cell t ltac:(lia)) as [T1 T2]. rewrite T5 by exact Ht. rewrite RD4.
+    rewrite F4 by (first [left; exact T2 | intros t' Ht'; mbne]). reflexivity.
+  - intros i Hi. rewrite C5 by exact Hi. unfold cntv, carryv. rewrite G4.
+    rewrite (F4 (CNT i)) by (first [left; cells | intros t Ht; cells]). f_equal. f_equal.
+    apply forallb_ext_in'. intros k Hk. apply in_seq in Hk. apply F4; [left; cells | intros t Ht; cells | intros t Ht; cells].
+  - intros t Ht. destruct (rout_cell t Ht) as [T1 T2].
+    rewrite U5 by (first [cells | intros t' Ht'; mbne | intros j Hj; cells | intros i Hi; cells]). apply RO4. exact Ht.
+  - rewrite U5 by (first [cells | intros t Ht; destruct (rin_cell t ltac:(lia)); cells | intros t Ht; destruct (ceot_cell t Ht); cells
+                         | intros j Hj; cells | intros i Hi; cells]). exact RW4.
+  - intros x Hx Ho Hr Hc Hi.
+    rewrite U5 by (first [cells | intros t Ht; apply Hr; lia | exact Hc | intros j Hj; cells | exact Hi]).
+    apply F4; [exact Hx | exact Ho | intros i' Hi'; apply Hr; lia].
+Qed.
+
+(* the rewind, the registers, dest and the request words *)
+Lemma part6 : reqclear (vw (dv6 (dv5 u4))) /\ length (vw (dv6 (dv5 u4))) = W /\ vho (dv6 (dv5 u4)) = vho v
+  /\ va (dv6 (dv5 u4)) = (if cav (vw v) then wseq Lb (outbits (vw v)) (va v) else va v)
+  /\ vc (dv6 (dv5 u4)) = (if ccv (vw v) then wseq L (outbits (vw v)) (vc v) else vc v)
+  /\ vr (dv6 (dv5 u4)) = mkT (td (vr v)) (if rwv (vw v) then 0 else if gv (vw v) then adv L 8 (th (vr v)) else th (vr v))
+  /\ (forall t, t < A -> wget (vw (dv6 (dv5 u4))) (MBc (rout A) t) = wget (vw v) (MBc (rout A) t) && negb (wrv (vw v)))
+  /\ (forall t, t < A -> wget (vw (dv6 (dv5 u4))) (MBc (rin A) t)
+                         = if gv (vw v) then nth (adv L (7 - t) (th (vr v))) (td (vr v)) false else wget (vw v) (MBc (rin A) t))
+  /\ wget (vw (dv6 (dv5 u4))) (MBc (ceot A) 0) = (if rdv (vw v) then eotv (vw v) else wget (vw v) (MBc (ceot A) 0))
+  /\ (forall t, 1 <= t < A -> wget (vw (dv6 (dv5 u4))) (MBc (ceot A) t) = wget (vw v) (MBc (ceot A) t) && negb (rdv (vw v)))
+  /\ (forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A -> wget (vw (dv6 (dv5 u4))) (MBc c t) = false)
+  /\ (forall i, i < w -> wget (vw (dv6 (dv5 u4))) (CNT i) = cntv (vw v) i && negb (rwv (vw v))
+                       /\ wget (vw (dv6 (dv5 u4))) (LIM w i) = (if rwv (vw v) then cntv (vw v) i else wget (vw v) (LIM w i)))
+  /\ wget (vw (dv6 (dv5 u4))) (DEST w) = destv (vw v) || rwv (vw v)
+  /\ (forall x, ~ devw x -> wget (vw (dv6 (dv5 u4))) x = wget (vw v) x).
+Proof.
+  destruct part2 as (_ & _ & _ & _ & A2 & C2 & _).
+  destruct part4 as (_ & _ & _ & _ & _ & _ & _ & _ & _ & R4 & A4 & C4 & H4).
+  destruct part5 as (Q5 & L5 & I5 & E5 & T5 & C5 & RO5 & RW5 & F5).
+  destruct (chunk4_run (vw (dv5 u4)) L5) as (L7 & O7 & D7 & Z7 & U7).
+  change (wrun (segO ++ segP ++ segQ) (vw (dv5 u4))) with (vw (dv6 (dv5 u4))) in L7, O7, D7, Z7, U7.
+  rewrite RW5 in O7, D7.
+  refine (conj (wrun_reqclear _ _ chunk4_wrec Q5) (conj L7 (conj H4 (conj _ (conj _ (conj _ (conj _ (conj _
+            (conj _ (conj _ (conj Z7 (conj _ (conj _ _))))))))))))).
+  - change (va (dv6 (dv5 u4))) with (va u4). rewrite A4. exact A2.
+  - change (vc (dv6 (dv5 u4))) with (vc u4). rewrite C4. exact C2.
+  - change (vr (dv6 (dv5 u4))) with (if wget (vw (dv5 u4)) cRW then mkT (td (vr u4)) 0 else vr u4).
+    rewrite RW5, R4. destruct (rwv (vw v)), (gv (vw v)); destruct (vr v); reflexivity.
+  - intros t Ht. destruct (rout_cell t Ht) as [T1 T2].
+    rewrite U7 by (first [cells | intros i Hi; split; cells | intros c t' Hc Ht'; destruct Hc as [->|[->| ->]]; mbne]).
+    apply RO5. exact Ht.
+  - intros t Ht. destruct (rin_cell t Ht) as [T1 T2].
+    rewrite U7 by (first [cells | intros i Hi; split; cells | intros c t' Hc Ht'; destruct Hc as [->|[->| ->]]; mbne]).
+    apply I5. exact Ht.
+  - destruct (ceot_cell 0 ltac:(lia)) as [T1 T2].
+    rewrite U7 by (first [cells | intros i Hi; split; cells | intros c t' Hc Ht'; destruct Hc as [->|[->| ->]]; mbne]).
+    exact E5.
+  - intros t Ht. destruct (ceot_cell t ltac:(lia)) as [T1 T2].
+    rewrite U7 by (first [cells | intros i Hi; split; cells | intros c t' Hc Ht'; destruct Hc as [->|[->| ->]]; mbne]).
+    apply T5. exact Ht.
+  - intros i Hi. destruct (O7 i Hi) as [OL OC]. rewrite OL, OC. rewrite C5 by exact Hi.
+    rewrite (F5 (LIM w i)) by (first [left; cells | intros t Ht; cells | intros i' Hi'; cells]). split; reflexivity.
+  - rewrite D7. rewrite F5 by (first [left; cells | intros t Ht; cells | intros i' Hi'; cells]). reflexivity.
+  - intros x Hx. destruct (ndevw x Hx) as (X1 & X2 & X3 & X4). rewrite U7.
+    + apply F5; [exact X1 | | | | intros i Hi; exact (proj1 (X2 i Hi))].
+      * intros t Ht. apply X4; [right; right; right; left; reflexivity | exact Ht].
+      * intros t Ht. apply X4; [right; right; right; right; left; reflexivity | exact Ht].
+      * intros t Ht. apply X4; [right; right; right; right; right; reflexivity | exact Ht].
+    + cells.
+    + cells.
+    + intros i Hi. destruct (X2 i Hi). split; assumption.
+    + exact X3.
+    + intros c t Hc Ht. apply X4; [destruct Hc as [->|[->| ->]]; auto | exact Ht].
+Qed.
+
+End Parts.
+
+(* the device is its parts in turn *)
+Lemma device_eq1 : forall v, reqclear (vw v) -> length (vw v) = W ->
+  vrun Lb L (Stored.device A w nu lvs) v
+  = vrun Lb L (segO ++ segP ++ segQ) (vrun Lb L segN (vrun Lb L (segI ++ segJ ++ segK ++ segL ++ segM)
+      (vrun Lb L segH (vrun Lb L (segF ++ segG) (vrun Lb L (concat (map Ebody (seq 0 8))) (dv1 v)))))).
+Proof.
+  intros v Hq Hl.
+  assert (E : vrun Lb L (Stored.device A w nu lvs) v
+              = vrun Lb L (segO ++ segP ++ segQ) (vrun Lb L segN (vrun Lb L (segI ++ segJ ++ segK ++ segL ++ segM)
+                  (vrun Lb L segH (vrun Lb L (segF ++ segG) (vrun Lb L segE (vrun Lb L (segA ++ segB ++ segC ++ segD) v)))))))
+    by (rewrite device_split, !vrun_app; reflexivity).
+  rewrite E. rewrite (vrun_wrun Lb L _ v chunk1_wrec Hq).
+  change (mkV (wrun (segA ++ segB ++ segC ++ segD) (vw v)) (vr v) (va v) (vc v) (vho v)) with (dv1 v).
+  reflexivity.
+Qed.
+
+Lemma device_eq2 : forall v, reqclear (vw v) -> length (vw v) = W ->
+  vrun Lb L (Stored.device A w nu lvs) v
+  = vrun Lb L (segO ++ segP ++ segQ) (vrun Lb L segN (vrun Lb L (segI ++ segJ ++ segK ++ segL ++ segM)
+      (vrun Lb L segH (dv3 (vrun Lb L (concat (map Ebody (seq 0 8))) (dv1 v)))))).
+Proof.
+  intros v Hq Hl. rewrite (device_eq1 v Hq Hl).
+  remember (vrun Lb L (concat (map Ebody (seq 0 8))) (dv1 v)) as X2 eqn:EX2.
+  destruct (part2 v X2 Hq Hl EX2) as (Q2 & _).
+  rewrite (vrun_wrun Lb L _ X2 chunk2_wrec Q2).
+  change (mkV (wrun (segF ++ segG) (vw X2)) (vr X2) (va X2) (vc X2) (vho X2)) with (dv3 X2).
+  reflexivity.
+Qed.
+
+Lemma device_eq3 : forall v X2 X4, reqclear (vw v) -> length (vw v) = W ->
+  X2 = vrun Lb L (concat (map Ebody (seq 0 8))) (dv1 v) -> X4 = vrun Lb L (concat (map Hbody (seq 0 8))) (dv3 X2) ->
+  vrun Lb L (segO ++ segP ++ segQ) (vrun Lb L segN (vrun Lb L (segI ++ segJ ++ segK ++ segL ++ segM) X4)) = dv6 (dv5 X4).
+Proof.
+  intros v X2 X4 Hq Hl EX2 EX4.
+  destruct (part4 v X2 X4 Hq Hl EX2 EX4) as (Q4 & _).
+  rewrite (vrun_wrun Lb L _ X4 chunk3_wrec Q4).
+  change (mkV (wrun (segI ++ segJ ++ segK ++ segL ++ segM) (vw X4)) (vr X4) (va X4) (vc X4) (vho X4)) with (dv5 X4).
+  destruct (part5 v X2 X4 Hq Hl EX2 EX4) as (Q5 & L5 & _).
+  rewrite (segN_run (dv5 X4) Q5 L5).
+  rewrite (vrun_wrun Lb L _ (mkV (vw (dv5 X4)) (if wget (vw (dv5 X4)) cRW then mkT (td (vr (dv5 X4))) 0 else vr (dv5 X4))
+                                  (va (dv5 X4)) (vc (dv5 X4)) (vho (dv5 X4))) chunk4_wrec Q5).
+  reflexivity.
+Qed.
+
+Lemma device_eq : forall v, reqclear (vw v) -> length (vw v) = W ->
+  vrun Lb L (Stored.device A w nu lvs) v
+  = dv6 (dv5 (vrun Lb L (concat (map Hbody (seq 0 8))) (dv3 (vrun Lb L (concat (map Ebody (seq 0 8))) (dv1 v))))).
+Proof.
+  intros v Hq Hl. rewrite (device_eq2 v Hq Hl).
+  assert (EH : segH = concat (map Hbody (seq 0 8))) by reflexivity. rewrite EH.
+  exact (device_eq3 v _ _ Hq Hl eq_refl eq_refl).
+Qed.
+
+Theorem device_run : forall v, reqclear (vw v) -> length (vw v) = W ->
+  let w0 := vw v in
+  let v' := vrun Lb L (Stored.device A w nu lvs) v in
+  reqclear (vw v') /\ length (vw v') = W /\ vho v' = vho v
+  /\ va v' = (if cav w0 then wseq Lb (outbits w0) (va v) else va v)
+  /\ vc v' = (if ccv w0 then wseq L (outbits w0) (vc v) else vc v)
+  /\ vr v' = mkT (td (vr v)) (if rwv w0 then 0 else if gv w0 then adv L 8 (th (vr v)) else th (vr v))
+  /\ (forall t, t < A -> wget (vw v') (MBc (rout A) t) = wget w0 (MBc (rout A) t) && negb (wrv w0))
+  /\ (forall t, t < A -> wget (vw v') (MBc (rin A) t)
+                         = if gv w0 then nth (adv L (7 - t) (th (vr v))) (td (vr v)) false else wget w0 (MBc (rin A) t))
+  /\ wget (vw v') (MBc (ceot A) 0) = (if rdv w0 then eotv w0 else wget w0 (MBc (ceot A) 0))
+  /\ (forall t, 1 <= t < A -> wget (vw v') (MBc (ceot A) t) = wget w0 (MBc (ceot A) t) && negb (rdv w0))
+  /\ (forall c t, (c = cwr A \/ c = crd A \/ c = crw A) -> t < A -> wget (vw v') (MBc c t) = false)
+  /\ (forall i, i < w -> wget (vw v') (CNT i) = cntv w0 i && negb (rwv w0)
+                       /\ wget (vw v') (LIM w i) = (if rwv w0 then cntv w0 i else wget w0 (LIM w i)))
+  /\ wget (vw v') (DEST w) = destv w0 || rwv w0
+  /\ (forall x, ~ devw x -> wget (vw v') x = wget w0 x).
+Proof.
+  intros v Hq Hl. cbv zeta. rewrite (device_eq v Hq Hl). exact (part6 v _ _ Hq Hl eq_refl eq_refl).
+Qed.
+
+End Dev.

rocq/StoredImage.v

@@ -0,0 +1,151 @@
+(* The image of the stored host as a byte string, and recipes of byte strings by literal tokens (Lemma 3.2): the
+   records of S_{A,w} fill whole bytes, and every byte string has a recipe of at most twice its length plus one. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run PhysSem View Stored Host Device Pstar StoredPass.
+
+(* ---- bits and bytes --------------------------------------------------------------------------------------- *)
+Lemma nat2bits_bits2nat : forall l, nat2bits (length l) (bits2nat l) = l.
+Proof.
+  intro l. apply (nth_ext _ _ false false); [apply length_nat2bits|]. intros t Ht. rewrite length_nat2bits in Ht.
+  rewrite nth_nat2bits by exact Ht. apply testbit_bits2nat. exact Ht.
+Qed.
+
+(* q bytes from 8 q bits, the most significant bit of each byte first *)
+Fixpoint bytes_of (q : nat) (l : list bool) : list nat :=
+  match q with O => [] | S q' => bits2nat (firstn 8 l) :: bytes_of q' (skipn 8 l) end.
+
+Lemma bbits_bytes : forall q l, length l = 8 * q -> bbits (bytes_of q l) = l.
+Proof.
+  induction q as [|q IH]; intros l Hl.
+  - destruct l; [reflexivity | cbn in Hl; lia].
+  - cbn [bytes_of]. unfold bbits. cbn [map concat]. fold (bbits (bytes_of q (skipn 8 l))).
+    rewrite IH by (rewrite length_skipn; lia).
+    assert (Hf : length (firstn 8 l) = 8) by (rewrite length_firstn; lia).
+    rewrite <- Hf at 1. rewrite nat2bits_bits2nat. apply firstn_skipn.
+Qed.
+
+Lemma bytes_lt : forall q l, Forall (fun x => x < 256) (bytes_of q l).
+Proof.
+  induction q as [|q IH]; intro l; cbn [bytes_of]; constructor; [|apply IH].
+  pose proof (bits2nat_lt (firstn 8 l)) as H. rewrite length_firstn in H.
+  assert (Hp : 2 ^ Nat.min 8 (length l) <= 2 ^ 8) by (apply Nat.pow_le_mono_r; lia).
+  change (2 ^ 8) with 256 in Hp. lia.
+Qed.
+
+Lemma length_bytes : forall q l, length (bytes_of q l) = q.
+Proof. induction q as [|q IH]; intro l; cbn [bytes_of length]; [reflexivity | rewrite IH; reflexivity]. Qed.
+
+(* ---- the image fills whole bytes --------------------------------------------------------------------------- *)
+Lemma padn_spec : forall al len, (recw al * (len + 4 + padn al len)) mod 8 = 0.
+Proof.
+  intros al len. unfold padn.
+  destruct (find (fun p => Nat.eqb ((recw al * (len + 4 + p)) mod 8) 0) (seq 0 8)) as [p|] eqn:E.
+  - apply find_some in E as [_ E]. apply Nat.eqb_eq in E. exact E.
+  - exfalso. pose proof (Nat.mod_upper_bound (len + 4) 8 ltac:(lia)) as Hr.
+    pose proof (Nat.div_mod_eq (len + 4) 8) as Hq.
+    set (r := (len + 4) mod 8) in *. set (q := (len + 4) / 8) in *.
+    set (p := (8 - r) mod 8).
+    assert (Hp8 : (len + 4 + p) mod 8 = 0).
+    { destruct (Nat.eq_dec r 0) as [E0|E0].
+      - unfold p. rewrite E0, Nat.sub_0_r, Nat.Div0.mod_same, Nat.add_0_r. fold r. exact E0.
+      - assert (Ep : p = 8 - r) by (unfold p; apply Nat.mod_small; lia). rewrite Ep.
+        replace (len + 4 + (8 - r)) with ((q + 1) * 8) by lia. apply Nat.Div0.mod_mul. }
+    assert (Hp : In p (seq 0 8)) by (apply in_seq; pose proof (Nat.mod_upper_bound (8 - r) 8 ltac:(lia)); unfold p; lia).
+    pose proof (find_none _ _ E p Hp) as F. cbv beta in F. apply Nat.eqb_neq in F. apply F.
+    rewrite Nat.Div0.mul_mod, Hp8, Nat.mul_0_r. reflexivity.
+Qed.
+
+Lemma image_whole : forall A w, (recw (alS A w) * length (stored A w)) mod 8 = 0.
+Proof.
+  intros A w. rewrite (stored_split A w), !length_app, repeat_length. unfold handover. cbn [length].
+  rewrite !Nat.add_assoc.
+  set (len := length (startup A w (image A (progPstar A)))
+                + length (step_go A w (length (host_units A)) 0 (host_units A)
+                     (next_tbl (nH A) (length (host_units A)) (host_next A)))
+                + length (Stored.device A w (length (host_units A)) (levels (host_units A)))).
+  pose proof (padn_spec (alS A w) len) as H.
+  replace (len + padn (alS A w) len + 4) with (len + 4 + padn (alS A w) len) by lia. exact H.
+Qed.
+
+(* the image of S_{A,w} as bytes *)
+Definition image_bytes (A w : nat) : list nat :=
+  bytes_of (recw (alS A w) * length (stored A w) / 8) (encA (alS A w) (stored A w)).
+
+Lemma bbits_image : forall A w, bbits (image_bytes A w) = encA (alS A w) (stored A w).
+Proof.
+  intros A w. unfold image_bytes. apply bbits_bytes. rewrite length_encA.
+  pose proof (image_whole A w) as H. pose proof (Nat.div_mod_eq (recw (alS A w) * length (stored A w)) 8). lia.
+Qed.
+
+Lemma image_bytes_lt : forall A w, Forall (fun x => x < 256) (image_bytes A w).
+Proof. intros A w. apply bytes_lt. Qed.
+
+Lemma length_image_bytes : forall A w, length (image_bytes A w) <= recw (alS A w) * length (stored A w).
+Proof. intros A w. unfold image_bytes. rewrite length_bytes. apply Nat.Div0.div_le_upper_bound. lia. Qed.
+
+(* ---- recipes of literal tokens: Lemma 3.2 ------------------------------------------------------------------- *)
+Fixpoint chunks (fuel : nat) (f : list nat) : list (list nat) :=
+  match fuel with
+  | O => []
+  | S k => match f with [] => [] | _ :: _ => firstn 127 f :: chunks k (skipn 127 f) end
+  end.
+
+Lemma chunks_concat : forall fuel f, length f <= 127 * fuel -> concat (chunks fuel f) = f.
+Proof.
+  induction fuel as [|k IH]; intros f Hf; [destruct f; [reflexivity | cbn in Hf; lia]|].
+  destruct f as [|x f']; [reflexivity|]. cbn [chunks concat]. rewrite IH by (rewrite length_skipn; cbn [length] in *; lia).
+  apply firstn_skipn.
+Qed.
+
+Lemma chunks_ok : forall fuel f c, In c (chunks fuel f) -> 1 <= length c <= 127 /\ (forall x, In x c -> In x f).
+Proof.
+  induction fuel as [|k IH]; intros f c Hc; [destruct Hc|].
+  destruct f as [|x f']; [destruct Hc|]. cbn [chunks In] in Hc. destruct Hc as [<-|Hc].
+  - rewrite length_firstn. cbn [length]. split; [lia|]. intros y Hy.
+    rewrite <- (firstn_skipn 127 (x :: f')). apply in_or_app. left. exact Hy.
+  - destruct (IH _ c Hc) as [Hl Hi]. split; [exact Hl|]. intros y Hy.
+    rewrite <- (firstn_skipn 127 (x :: f')). apply in_or_app. right. apply Hi. exact Hy.
+Qed.
+
+Lemma length_concat_chunks : forall fuel f, length (chunks fuel f) <= length (concat (chunks fuel f)).
+Proof.
+  induction fuel as [|k IH]; intro f; [reflexivity|]. destruct f as [|x f']; [reflexivity|].
+  cbn [chunks concat length]. rewrite length_app, length_firstn. cbn [length]. specialize (IH (skipn 127 (x :: f'))). lia.
+Qed.
+
+Definition lits (f : list nat) : list token := map (fun c => Lit (map nu c)) (chunks (length f) f).
+
+Lemma nu_nu : forall b, b < 256 -> nu (nu b) = b.
+Proof.
+  intros b Hb. unfold nu. destruct (Nat.eq_dec b 0) as [->|E]; [reflexivity|].
+  rewrite (Nat.mod_small (256 - b)) by lia. rewrite Nat.mod_small by lia. lia.
+Qed.
+
+Lemma nu_lt : forall b, nu b < 256.
+Proof. intro b. unfold nu. apply Nat.mod_upper_bound. lia. Qed.
+
+Lemma lits_ok : forall f, Forall tok_ok (lits f).
+Proof.
+  intro f. unfold lits. apply Forall_map, Forall_forall. intros c Hc. destruct (chunks_ok _ _ _ Hc) as [Hl _].
+  cbn [tok_ok]. rewrite length_map. split; [exact Hl|]. apply Forall_map, Forall_forall. intros x _. apply nu_lt.
+Qed.
+
+Lemma delta_lits : forall f, Forall (fun x => x < 256) f -> delta (lits f) = f.
+Proof.
+  intros f Hf. unfold delta, lits. rewrite map_map. cbn [dec].
+  transitivity (concat (chunks (length f) f)); [|apply chunks_concat; lia].
+  f_equal. rewrite <- (map_id (chunks (length f) f)) at 2. apply map_ext_in. intros c Hc.
+  rewrite map_map. rewrite <- (map_id c) at 2. apply map_ext_in. intros x Hx. apply nu_nu.
+  rewrite Forall_forall in Hf. apply Hf. exact (proj2 (chunks_ok _ _ _ Hc) x Hx).
+Qed.
+
+Lemma length_recipe_lits : forall f, length (recipe (lits f)) <= 2 * length f + 1.
+Proof.
+  intro f. unfold recipe, lits. rewrite length_app. cbn [length].
+  assert (E : length (concat (map enc (map (fun c => Lit (map nu c)) (chunks (length f) f))))
+              = length (chunks (length f) f) + length (concat (chunks (length f) f))).
+  { generalize (chunks (length f) f). induction l as [|c l IH]; [reflexivity|].
+    cbn [map concat enc]. rewrite !length_app. cbn [length]. rewrite length_map, IH. lia. }
+  rewrite E. pose proof (length_concat_chunks (length f) f) as H. rewrite chunks_concat in * by lia. lia.
+Qed.

rocq/StoredMain.v

@@ -0,0 +1,320 @@
+(* Theorem 8.7 for the stored host S_{A,w}, every A >= 8: run on a recipe of its own image it rebuilds itself in
+   the next bank and copies the recipe onto the next tape in every generation, the copies accumulate until every
+   bank holds one, and from the K-th generation on the state of the ring machine, and of the network, repeats
+   every K generations. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run PhysSem PhysMain View Stored WinRun ViewOps Host HostSem
+  Device Pstar StoredStep StoredBoot StoredPass StoredRun StoredWbr.
+
+Section Ring.
+Variables (A w K S0 L : nat) (ks : list token).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w) (HK : 2 <= K) (HS : length (stored A w) <= S0) (HL : 1 <= L)
+  (Hks : Forall tok_ok ks) (Ht1 : 8 * length (recipe ks) <= L) (Ht2 : length (recipe ks) < 2 ^ w)
+  (Hd : bbits (delta ks) = encA (alS A w) (stored A w)).
+
+Local Notation al := (alS A w).
+Local Notation rs := (stored A w).
+Local Notation G := (length (stored A w)).
+Local Notation Lb := (S0 * recw (alS A w)).
+Local Notation tau := (recipe ks).
+
+(* a generation, the tape that holds the recipe, the cells a pass reads or writes, and the other cells *)
+Definition T : nat := (NN ks - 1) * S0 + G.
+Definition dz : list bool := bbits tau ++ repeat false (L - 8 * length tau).
+Definition D1 (c : nat) : Prop := D0 A w c \/ wrt rs c.
+Definition outside (c : nat) : Prop := c <= CPY \/ ~ D1 c.
+
+(* a state from which a generation starts: Theorem 8.6's hypothesis *)
+Definition start (s : st) : Prop := ready A w K S0 L ks s.
+
+Lemma Hd8 : 8 * length (delta ks) <= Lb.
+Proof. rewrite <- length_bbits, Hd, length_encA. nia. Qed.
+
+Lemma new_img : bbits (delta ks) ++ repeat false (Lb - 8 * length (delta ks)) = img A w S0.
+Proof. unfold img. rewrite <- length_bbits, Hd, length_encA. do 2 f_equal. rewrite Nat.mul_sub_distr_r. lia. Qed.
+
+(* ---- two runs of a generation agree on the cells a pass reads or writes ------------------------------------- *)
+Lemma D1_req : forall c, AR <= c <= HO -> D1 c.
+Proof. intros c Hc. left. exact (req_D0 A w HA Hw c Hc). Qed.
+
+Lemma wbr_D1 : wbr D1 rs.
+Proof. apply (wbr_mono _ (D0 A w)); [intros c Hc; left; exact Hc | exact (wbr_stored A w HA Hw)]. Qed.
+
+Lemma pass_agree : forall v1 v2, vagree D1 v1 v2 -> vagree D1 (vrun Lb L rs v1) (vrun Lb L rs v2).
+Proof.
+  intros v1 v2 H. refine (vagree_mono _ _ _ _ _ (vrun_agree Lb L rs D1 v1 v2 D1_req wbr_D1 H)).
+  intros c Hc. left. exact Hc.
+Qed.
+
+(* the first pass loads the same state into every window with booted clear *)
+Lemma first_agree : forall v1 v2, reqclear (vw v1) -> reqclear (vw v2) -> length (vw v1) = 2 ^ al ->
+  length (vw v2) = 2 ^ al -> wget (vw v1) BOOT = false -> wget (vw v2) BOOT = false -> vho v1 = vho v2 ->
+  td (vr v1) = td (vr v2) -> vagree D1 (vrun Lb L rs v1) (vrun Lb L rs v2).
+Proof.
+  intros v1 v2 Q1 Q2 L1 L2 B1 B2 Hh Ht. rewrite (stored_rest A w), !vrun_app.
+  pose proof (startup_run A w (2 ^ al) Lb L (image A (progPstar A)) ltac:(lia) (length_image A) (HWs A w HA Hw)
+                v1 Q1 L1) as U1.
+  pose proof (startup_run A w (2 ^ al) Lb L (image A (progPstar A)) ltac:(lia) (length_image A) (HWs A w HA Hw)
+                v2 Q2 L2) as U2.
+  cbv zeta in U1, U2.
+  destruct U1 as (Q1' & L1' & BB1 & S1 & R1 & E1 & _ & VR1 & VA1 & VC1 & VH1).
+  destruct U2 as (Q2' & L2' & BB2 & S2 & R2 & E2 & _ & VR2 & VA2 & VC2 & VH2).
+  rewrite B1 in S1, R1, E1, VR1, VA1, VC1. rewrite B2 in S2, R2, E2, VR2, VA2, VC2.
+  set (u1 := vrun Lb L (startup A w (image A (progPstar A))) v1) in *.
+  set (u2 := vrun Lb L (startup A w (image A (progPstar A))) v2) in *.
+  assert (H0 : vagree (D0 A w) u1 u2).
+  { refine (conj _ (conj _ (conj _ (conj _ (conj _ _))))).
+    - rewrite VR1, VR2, Ht. reflexivity.
+    - rewrite VA1, VA2. reflexivity.
+    - rewrite VC1, VC2. reflexivity.
+    - rewrite VH1, VH2. exact Hh.
+    - rewrite L1', L2'. reflexivity.
+    - intros c Hc Hd0. unfold D0 in Hd0.
+      destruct (Nat.le_gt_cases c HO) as [H1|H1].
+      { rewrite (Q1' c), (Q2' c) by (unfold AR, CPY in *; lia). reflexivity. }
+      destruct (Nat.eq_dec c BOOT) as [->|H2]; [rewrite BB1, BB2; reflexivity|].
+      destruct (Nat.lt_ge_cases c (14 + w)) as [H3|H3].
+      { replace c with (CNT (c - 14)) by (unfold CNT, BOOT, HO in *; lia).
+        rewrite (proj1 (R1 (c - 14) ltac:(unfold BOOT, HO in *; lia))),
+                (proj1 (R2 (c - 14) ltac:(unfold BOOT, HO in *; lia))), !andb_false_r. reflexivity. }
+      destruct (Nat.eq_dec c (14 + w)) as [->|H4].
+      { change (14 + w) with (DEST w). rewrite E1, E2, !andb_false_r. reflexivity. }
+      destruct (Nat.lt_ge_cases c (15 + 2 * w)) as [H5|H5].
+      { replace c with (LIM w (c - 15 - w)) by (unfold LIM; lia).
+        rewrite (proj2 (R1 (c - 15 - w) ltac:(lia))), (proj2 (R2 (c - 15 - w) ltac:(lia))), !andb_false_r.
+        reflexivity. }
+      unfold ST in Hd0. replace c with (ST w (c - 15 - 2 * w)) by (unfold ST; lia).
+      rewrite (S1 (c - 15 - 2 * w) ltac:(lia)), (S2 (c - 15 - 2 * w) ltac:(lia)). reflexivity. }
+  pose proof (vrun_agree Lb L (rest A w) (D0 A w) u1 u2 (req_D0 A w HA Hw) (wbr_rest A w HA Hw) H0) as H1.
+  refine (vagree_mono _ _ _ _ _ H1). intros c [Hc|Hc]; [left; exact Hc|].
+  rewrite (stored_rest A w) in Hc. unfold wrt in Hc. rewrite map_app in Hc. apply in_app_or in Hc as [Hc|Hc].
+  - left. exact (wrt_startup A w HA Hw c Hc).
+  - right. exact Hc.
+Qed.
+
+Lemma vpass_agree : forall n v1 v2, 1 <= n -> reqclear (vw v1) -> reqclear (vw v2) -> length (vw v1) = 2 ^ al ->
+  length (vw v2) = 2 ^ al -> wget (vw v1) BOOT = false -> wget (vw v2) BOOT = false -> vho v1 = vho v2 ->
+  td (vr v1) = td (vr v2) -> vagree D1 (vpass A w S0 L n v1) (vpass A w S0 L n v2).
+Proof.
+  induction n as [|n IH]; intros v1 v2 Hn Q1 Q2 L1 L2 B1 B2 Hh Ht; [lia|]. cbn [vpass].
+  destruct n as [|n]; [apply first_agree; assumption|].
+  apply pass_agree. apply IH; [lia | assumption..].
+Qed.
+
+(* the cells outside D1 keep their values *)
+Lemma vpass_frame : forall n v c, outside c -> wget (vw (vpass A w S0 L n v)) c = wget (vw v) c.
+Proof.
+  induction n as [|n IH]; intros v c Hc; [reflexivity|]. cbn [vpass]. rewrite vrun_frame; [apply IH; exact Hc|].
+  destruct Hc as [Hc|Hc]; [left; exact Hc | right; split].
+  - assert (H0 : ~ D0 A w c) by (intro E; apply Hc; left; exact E). unfold D0, ST in H0. unfold HO. lia.
+  - intro E. apply Hc. right. exact E.
+Qed.
+
+(* ---- one generation --------------------------------------------------------------------------------------- *)
+Lemma gen : forall s, start s ->
+  let s' := itern al K S0 L T s in
+  start s' /\ kap s' = succ_mod K (kap s)
+  /\ nth (succ_mod K (kap s)) (banks s') bank0 = mkB (img A w S0) 0 0
+  /\ nth (succ_mod K (kap s)) (tapes s') tape0 = mkT dz 0
+  /\ nth (kap s) (banks s') bank0 = mkB (img A w S0) (G mod S0) (bj (nth (kap s) (banks s) bank0))
+  /\ nth (kap s) (tapes s') tape0 = mkT dz ((8 * length tau) mod L)
+  /\ (forall x, x < K -> x <> kap s -> x <> succ_mod K (kap s) ->
+        nth x (banks s') bank0 = nth x (banks s) bank0 /\ nth x (tapes s') tape0 = nth x (tapes s) tape0)
+  /\ (forall c, outside c -> wget (win s') c = wget (win s) c)
+  /\ win s' = vw (vpass A w S0 L (NN ks) (view0 al K s)).
+Proof.
+  intros s Hs s'. pose proof Hs as (Hf & Hb & Hsl & Hq & Hboot & Htd).
+  pose proof (stored_construct A w K S0 L ks HA Hw HK HS HL Hks Ht1 Ht2 Hd8 s Hs) as SC. cbv zeta in SC.
+  change (itern al K S0 L ((NN ks - 1) * S0 + G) s) with s' in SC.
+  destruct SC as (Hf' & Hk' & HI & HC & HA' & HR & Hq' & Hb' & Hw' & Ho).
+  rewrite new_img in HI.
+  refine (conj _ (conj Hk' (conj HI (conj HC (conj HA' (conj _ (conj Ho (conj _ Hw')))))))).
+  - unfold start, ready. rewrite Hk', HI, HC. cbn [bq bs td].
+    exact (conj Hf' (conj eq_refl (conj eq_refl (conj Hq' (conj Hb' eq_refl))))).
+  - rewrite HR, Htd. reflexivity.
+  - intros c Hc. rewrite Hw'. rewrite vpass_frame by exact Hc. reflexivity.
+Qed.
+
+(* the window after a generation depends only on the cells outside D1 of the window it started from *)
+Lemma gen_window : forall s1 s2, start s1 -> start s2 -> (forall c, outside c -> wget (win s1) c = wget (win s2) c) ->
+  win (itern al K S0 L T s1) = win (itern al K S0 L T s2).
+Proof.
+  intros s1 s2 H1 H2 Ho.
+  pose proof (gen s1 H1) as G1. pose proof (gen s2 H2) as G2. cbv zeta in G1, G2.
+  destruct G1 as (((Hl1' & _) & _) & _ & _ & _ & _ & _ & _ & Fx1 & W1).
+  destruct G2 as (((Hl2' & _) & _) & _ & _ & _ & _ & _ & _ & Fx2 & W2).
+  destruct H1 as ((Hl1 & _) & _ & _ & Q1 & B1 & T1). destruct H2 as ((Hl2 & _) & _ & _ & Q2 & B2 & T2).
+  assert (Ag : vagree D1 (vpass A w S0 L (NN ks) (view0 al K s1)) (vpass A w S0 L (NN ks) (view0 al K s2))).
+  { apply vpass_agree; [unfold NN; lia | exact Q1 | exact Q2 | exact Hl1 | exact Hl2 | exact B1 | exact B2
+                       | reflexivity | cbn [view0 vr]; rewrite T1, T2; reflexivity]. }
+  destruct Ag as (_ & _ & _ & _ & _ & Ag).
+  apply (nth_ext _ _ false false); [rewrite Hl1', Hl2'; reflexivity|]. intros c _.
+  change (wget (win (itern al K S0 L T s1)) c = wget (win (itern al K S0 L T s2)) c).
+  assert (Out : outside c -> wget (win (itern al K S0 L T s1)) c = wget (win (itern al K S0 L T s2)) c)
+    by (intro Hc; rewrite (Fx1 c Hc), (Fx2 c Hc); apply Ho; exact Hc).
+  destruct (Nat.le_gt_cases c CPY) as [Hc|Hc]; [apply Out; left; exact Hc|].
+  assert (In1 : D1 c -> wget (win (itern al K S0 L T s1)) c = wget (win (itern al K S0 L T s2)) c)
+    by (intro Hd1; rewrite W1, W2; exact (Ag c Hc Hd1)).
+  destruct (Nat.lt_ge_cases c (ST w (nH A))) as [Hd0|Hd0]; [apply In1; left; exact Hd0|].
+  destruct (in_dec Nat.eq_dec c (map ao_of rs)) as [Hr|Hr]; [apply In1; right; exact Hr|].
+  apply Out. right. intros [E|E]; [unfold D0 in E; lia | exact (Hr E)].
+Qed.
+
+(* ---- generations since a bank was active ------------------------------------------------------------------- *)
+Definition ago (k x : nat) : nat := if x <=? k then k - x else k + K - x.
+
+Lemma ago_zero : forall k x, k < K -> x < K -> ago k x = 0 -> x = k.
+Proof. intros k x Hk Hx. unfold ago. destruct (Nat.leb_spec x k); lia. Qed.
+
+Lemma ago_self : forall k, ago k k = 0.
+Proof. intro k. unfold ago. rewrite Nat.leb_refl. lia. Qed.
+
+Lemma ago_lt : forall k x, k < K -> x < K -> ago k x < K.
+Proof. intros k x Hk Hx. unfold ago. destruct (Nat.leb_spec x k); lia. Qed.
+
+Lemma ago_succ : forall k x, k < K -> x < K ->
+  ago (succ_mod K k) x = if Nat.eqb x (succ_mod K k) then 0 else S (ago k x).
+Proof.
+  intros k x Hk Hx. unfold ago, succ_mod.
+  destruct (Nat.eqb_spec (S k) K) as [E|E].
+  - destruct (Nat.eqb_spec x 0) as [->|E0]; [reflexivity|].
+    destruct (Nat.leb_spec x 0), (Nat.leb_spec x k); lia.
+  - destruct (Nat.eqb_spec x (S k)) as [->|E1]; [rewrite Nat.leb_refl; lia|].
+    destruct (Nat.leb_spec x (S k)), (Nat.leb_spec x k); lia.
+Qed.
+
+Lemma succ_plus : forall k0 g, succ_mod K ((k0 + g) mod K) = (k0 + S g) mod K.
+Proof. intros k0 g. rewrite succ_mod_mod by lia. f_equal. lia. Qed.
+
+Lemma kap_lt : forall s, start s -> kap s < K.
+Proof. intros s ((_ & H & _) & _). exact H. Qed.
+
+(* ---- the state after g generations -------------------------------------------------------------------------- *)
+(* After g >= 1 generations from x0: a start state again; the bank active for the last time a generations ago
+   holds the image, at slot G mod S0 if a > 0, and the tape read then the recipe; the banks and tapes not yet
+   reached are those of x0; the cells outside D1 are those of x0, and the window is the one after the first
+   generation. *)
+Definition after (x0 : st) (g : nat) (s : st) : Prop :=
+  start s /\ kap s = (kap x0 + g) mod K
+  /\ (forall c, outside c -> wget (win s) c = wget (win x0) c)
+  /\ win s = win (itern al K S0 L T x0)
+  /\ (forall x, x < K ->
+       (ago (kap s) x = 0 -> nth x (banks s) bank0 = mkB (img A w S0) 0 0 /\ nth x (tapes s) tape0 = mkT dz 0)
+    /\ (0 < ago (kap s) x < g -> nth x (banks s) bank0 = mkB (img A w S0) (G mod S0) 0
+                                 /\ nth x (tapes s) tape0 = mkT dz ((8 * length tau) mod L))
+    /\ (ago (kap s) x = g -> nth x (banks s) bank0 = mkB (img A w S0) (G mod S0) (bj (nth (kap x0) (banks x0) bank0))
+                             /\ nth x (tapes s) tape0 = mkT dz ((8 * length tau) mod L))
+    /\ (g < ago (kap s) x -> nth x (banks s) bank0 = nth x (banks x0) bank0
+                             /\ nth x (tapes s) tape0 = nth x (tapes x0) tape0)).
+
+Lemma after_1 : forall x0, start x0 -> after x0 1 (itern al K S0 L T x0).
+Proof.
+  intros x0 Hs. pose proof (gen x0 Hs) as G0. cbv zeta in G0.
+  destruct G0 as (Hs' & Hk & HI & HC & HA' & HR & Ho & Hfx & _).
+  pose proof (kap_lt x0 Hs) as Hk0.
+  set (s1 := itern al K S0 L T x0) in *.
+  refine (conj Hs' (conj _ (conj Hfx (conj eq_refl _)))).
+  - rewrite Hk, <- (Nat.mod_small (kap x0) K Hk0) at 1. rewrite succ_mod_mod by lia. f_equal. lia.
+  - intros x Hx. rewrite Hk, (ago_succ (kap x0) x Hk0 Hx).
+    destruct (Nat.eqb_spec x (succ_mod K (kap x0))) as [->|E1].
+    + refine (conj (fun _ => conj HI HC) (conj _ (conj _ _))); intros; lia.
+    + destruct (Nat.eq_dec x (kap x0)) as [->|E0].
+      * rewrite ago_self. refine (conj _ (conj _ (conj (fun _ => conj HA' HR) _))); intros; lia.
+      * pose proof (Ho x Hx E0 E1) as [B Tp].
+        assert (ago (kap x0) x <> 0) by (intro Z; apply E0; exact (ago_zero _ _ Hk0 Hx Z)).
+        refine (conj _ (conj _ (conj _ (fun _ => conj B Tp)))); intros; lia.
+Qed.
+
+Lemma after_S : forall x0 g s, start x0 -> 1 <= g -> after x0 g s -> after x0 (S g) (itern al K S0 L T s).
+Proof.
+  intros x0 g s Hs0 Hg (Hs & Hkap & Hfx0 & Hw0 & Hb0).
+  pose proof (gen s Hs) as G0. cbv zeta in G0.
+  destruct G0 as (Hs' & Hk & HI & HC & HA' & HR & Ho & Hfx & _).
+  pose proof (kap_lt s Hs) as Hkl.
+  refine (conj Hs' (conj _ (conj _ (conj _ _)))).
+  - rewrite Hk, Hkap. apply succ_plus.
+  - intros c Hc. rewrite (Hfx c Hc). exact (Hfx0 c Hc).
+  - apply gen_window; [exact Hs | exact Hs0 | exact Hfx0].
+  - intros x Hx. rewrite Hk, (ago_succ (kap s) x Hkl Hx).
+    destruct (Hb0 (kap s) Hkl) as (Hact & _). rewrite ago_self in Hact. destruct (Hact eq_refl) as [Bk Tk].
+    destruct (Nat.eqb_spec x (succ_mod K (kap s))) as [->|E1].
+    + refine (conj (fun _ => conj HI HC) (conj _ (conj _ _))); intros; lia.
+    + destruct (Nat.eq_dec x (kap s)) as [->|E0].
+      * rewrite ago_self. rewrite Bk in HA'. cbn [bj] in HA'.
+        refine (conj _ (conj (fun _ => conj HA' HR) (conj _ _))); intros; lia.
+      * pose proof (Ho x Hx E0 E1) as [B Tp]. rewrite B, Tp.
+        assert (Ha : ago (kap s) x <> 0) by (intro Z; apply E0; exact (ago_zero _ _ Hkl Hx Z)).
+        destruct (Hb0 x Hx) as (_ & Hmid & Heq & Hgt).
+        refine (conj _ (conj _ (conj _ _))); intros; [lia | apply Hmid; lia | apply Heq; lia | apply Hgt; lia].
+Qed.
+
+Theorem reproduces : forall x0, start x0 -> forall g, 1 <= g -> after x0 g (itern al K S0 L (g * T) x0).
+Proof.
+  intros x0 Hs g Hg. induction g as [|g IH]; [lia|].
+  destruct (Nat.eq_dec g 0) as [->|E].
+  - replace (1 * T) with T by lia. exact (after_1 x0 Hs).
+  - replace (S g * T) with (g * T + T) by lia. rewrite itern_add.
+    apply after_S; [exact Hs | lia | apply IH; lia].
+Qed.
+
+(* After g >= 1 generations, every bank active within the last g generations, and the one active now, holds the
+   image of the stored host, and its tape the recipe: min(g + 1, K) copies. *)
+Corollary copies : forall x0, start x0 -> forall g x, 1 <= g -> x < K ->
+  ago (kap (itern al K S0 L (g * T) x0)) x <= g ->
+  bq (nth x (banks (itern al K S0 L (g * T) x0)) bank0) = img A w S0
+  /\ td (nth x (tapes (itern al K S0 L (g * T) x0)) tape0) = dz.
+Proof.
+  intros x0 Hs g x Hg Hx Ha.
+  destruct (reproduces x0 Hs g Hg) as (_ & _ & _ & _ & Hb). destruct (Hb x Hx) as (H0 & Hmid & Heq & _).
+  destruct (Nat.eq_dec (ago (kap (itern al K S0 L (g * T) x0)) x) 0) as [Z|Z];
+    [destruct (H0 Z) as [B Tp] |
+     destruct (Nat.eq_dec (ago (kap (itern al K S0 L (g * T) x0)) x) g) as [Q|Q];
+       [destruct (Heq Q) as [B Tp] | destruct (Hmid ltac:(lia)) as [B Tp]]];
+    rewrite B, Tp; split; reflexivity.
+Qed.
+
+(* From the K-th generation on, the whole state of the machine repeats every K generations. *)
+Theorem periodic : forall x0, start x0 -> forall g, K <= g ->
+  itern al K S0 L ((g + K) * T) x0 = itern al K S0 L (g * T) x0.
+Proof.
+  intros x0 Hs g Hg.
+  destruct (reproduces x0 Hs g ltac:(lia)) as (Hs1 & Hk1 & _ & Hw1 & Hb1).
+  destruct (reproduces x0 Hs (g + K) ltac:(lia)) as (Hs2 & Hk2 & _ & Hw2 & Hb2).
+  set (s1 := itern al K S0 L (g * T) x0) in *. set (s2 := itern al K S0 L ((g + K) * T) x0) in *.
+  assert (Hk : kap s2 = kap s1).
+  { rewrite Hk1, Hk2. replace (kap x0 + (g + K)) with (kap x0 + g + 1 * K) by lia. apply Nat.Div0.mod_add. }
+  destruct Hs1 as ((_ & Hkl1 & HB1 & HT1 & _) & _). destruct Hs2 as ((_ & Hkl2 & HB2 & HT2 & _) & _).
+  assert (Hnth : forall x, x < K -> nth x (banks s2) bank0 = nth x (banks s1) bank0
+                                    /\ nth x (tapes s2) tape0 = nth x (tapes s1) tape0).
+  { intros x Hx. pose proof (ago_lt (kap s1) x Hkl1 Hx) as Ha.
+    destruct (Hb1 x Hx) as (A0 & A1 & _). destruct (Hb2 x Hx) as (B0 & B1 & _). rewrite Hk in B0, B1.
+    destruct (Nat.eq_dec (ago (kap s1) x) 0) as [Z|Z].
+    - destruct (A0 Z) as [P Q]. destruct (B0 Z) as [P' Q']. split; congruence.
+    - destruct (A1 ltac:(lia)) as [P Q]. destruct (B1 ltac:(lia)) as [P' Q']. split; congruence. }
+  assert (Hwin : win s2 = win s1) by (rewrite Hw1, Hw2; reflexivity).
+  destruct s1 as [w1 k1 b1 t1], s2 as [w2 k2 b2 t2]. cbn [win kap banks tapes] in *.
+  rewrite Hwin, Hk. f_equal.
+  - apply (nth_ext b2 b1 bank0 bank0); [congruence|]. intros x Hx. rewrite HB2 in Hx. exact (proj1 (Hnth x Hx)).
+  - apply (nth_ext t2 t1 tape0 tape0); [congruence|]. intros x Hx. rewrite HT2 in Hx. exact (proj2 (Hnth x Hx)).
+Qed.
+
+(* ---- the network ----------------------------------------------------------------------------------------- *)
+Theorem network_reproduces : forall x0, start x0 -> forall g, 1 <= g ->
+  netiter al K S0 L (g * T) (encode al K S0 L x0) = encode al K S0 L (itern al K S0 L (g * T) x0)
+  /\ after x0 g (itern al K S0 L (g * T) x0).
+Proof.
+  intros x0 Hs g Hg. split; [|exact (reproduces x0 Hs g Hg)].
+  destruct Hs as (Hf & _).
+  exact (network_orbit al K S0 L (g * T) x0 (al4 A w K S0 L HA Hw HK HS HL) HK (S0_pos A w K S0 L HA Hw HK HS HL) HL Hf).
+Qed.
+
+Theorem network_periodic : forall x0, start x0 -> forall g, K <= g ->
+  netiter al K S0 L ((g + K) * T) (encode al K S0 L x0) = netiter al K S0 L (g * T) (encode al K S0 L x0).
+Proof.
+  intros x0 Hs g Hg. pose proof Hs as (Hf & _).
+  rewrite !(network_orbit al K S0 L _ x0 (al4 A w K S0 L HA Hw HK HS HL) HK (S0_pos A w K S0 L HA Hw HK HS HL) HL Hf).
+  rewrite (periodic x0 Hs g Hg). reflexivity.
+Qed.
+
+End Ring.

rocq/StoredOk.v

@@ -0,0 +1,213 @@
+(* The records of the stored host fit their code: weights in {-1, 0, 1}, a bias in [-8, 7] and addresses
+   below the window of 2^alS cells, so a bank holding their codes holds them. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run View Stored WinRun Host HostIP Device StoredStep StoredDev StoredPass.
+
+(* ---- gates ---------------------------------------------------------------------------------------------- *)
+(* the record fits the code of a window of more than its addresses *)
+Definition rok (N : nat) (r : rec) : Prop :=
+  match r with
+  | Rec a0 w0 a1 w1 beta ao =>
+      (w0 = 1 \/ w0 = 0 \/ w0 = -1)%Z /\ (w1 = 1 \/ w1 = 0 \/ w1 = -1)%Z /\ (-8 <= beta <= 7)%Z
+      /\ a0 < N /\ a1 < N /\ ao < N
+  end.
+
+Lemma rok_rec_ok : forall al r, rok (2 ^ al) r -> rec_ok al r.
+Proof. intros al [a0 w0 a1 w1 beta ao] H. exact H. Qed.
+
+Lemma pm_ok : forall b, (pm b = 1 \/ pm b = 0 \/ pm b = -1)%Z.
+Proof. intros [|]; cbn; auto. Qed.
+
+Lemma rok_and : forall N x y d, fst x < N -> fst y < N -> d < N -> rok N (gAND x y d).
+Proof.
+  intros N [a p] [c q] d Ha Hc Hd. cbn [fst] in *. unfold rok, gAND. cbn [fst snd].
+  refine (conj (pm_ok p) (conj (pm_ok q) (conj _ (conj Ha (conj Hc Hd))))). destruct p, q; cbn; lia.
+Qed.
+
+Lemma rok_or : forall N x y d, fst x < N -> fst y < N -> d < N -> rok N (gOR x y d).
+Proof.
+  intros N [a p] [c q] d Ha Hc Hd. cbn [fst] in *. unfold rok, gOR. cbn [fst snd].
+  refine (conj (pm_ok p) (conj (pm_ok q) (conj _ (conj Ha (conj Hc Hd))))). destruct p, q; cbn; lia.
+Qed.
+
+Lemma rok_copy : forall N x d, 0 < N -> fst x < N -> d < N -> rok N (gCOPY x d).
+Proof.
+  intros N [a p] d H0 Ha Hd. cbn [fst] in *. unfold rok, gCOPY. cbn [fst snd].
+  refine (conj (pm_ok p) (conj _ (conj _ (conj Ha (conj H0 Hd))))); [auto | destruct p; lia].
+Qed.
+
+Lemma rok_const : forall N b d, 0 < N -> d < N -> rok N (gCONST b d).
+Proof. intros N [|] d H0 Hd; [apply rok_or | apply rok_and]; cbn [fst]; unfold SINK; lia. Qed.
+
+Lemma rok_empty : forall N, 0 < N -> rok N EMPTY.
+Proof. intros N H. unfold rok, EMPTY. lia. Qed.
+
+Lemma chain_rok : forall N g ls d acc,
+  (forall x y d', fst x < N -> fst y < N -> d' < N -> rok N (g x y d')) -> 0 < N ->
+  (forall l, In l ls -> fst l < N) -> d < N -> acc < N -> Forall (rok N) (chain g ls d acc).
+Proof.
+  intros N g ls d acc Hg H0 Hl Hd Ha.
+  assert (T : forall l t, (forall l', In l' (l :: t) -> fst l' < N) -> Forall (rok N) (chain_tail g acc l t d)).
+  { intros l t. revert l. induction t as [|l' t IH]; intros l H; cbn [chain_tail].
+    - constructor; [apply Hg; [exact Ha | apply H; left; reflexivity | exact Hd] | constructor].
+    - constructor; [apply Hg; [exact Ha | apply H; left; reflexivity | exact Ha]|].
+      apply IH. intros l'' Hin. apply H. right. exact Hin. }
+  destruct ls as [|l0 [|l1 [|l2 t]]]; cbn [chain].
+  - constructor.
+  - constructor; [apply rok_copy; [exact H0 | apply Hl; left; reflexivity | exact Hd] | constructor].
+  - constructor; [apply Hg; [apply Hl; left; reflexivity | apply Hl; right; left; reflexivity | exact Hd] | constructor].
+  - constructor; [apply Hg; [apply Hl; left; reflexivity | apply Hl; right; left; reflexivity | exact Ha]|].
+    apply T. intros l' Hin. apply Hl. right. right. exact Hin.
+Qed.
+
+(* the compiled threshold unit uses its levels of cells below LV *)
+Lemma ucomp_rok : forall N LV (xc : nat -> nat -> nat), (forall j k, j < LV -> k < 3 -> xc j k < N) -> 0 < N ->
+  forall ls t d acc lev, d < N -> acc < N -> (forall l, In l ls -> fst l < N) ->
+  ((1 < t < Z.of_nat (length ls))%Z -> lev + length ls <= LV + 2) -> Forall (rok N) (ucomp xc t ls d acc lev).
+Proof.
+  intros N LV xc Hx H0. induction ls as [|l0 rest IH]; intros t d acc lev Hd Ha Hl Hlev; cbn [ucomp].
+  - cbn [length]. destruct (Z.leb t 0); [constructor; [apply rok_const; assumption | constructor]|].
+    destruct (Z.ltb (Z.of_nat 0) t); [constructor; [apply rok_const; assumption | constructor]|].
+    destruct (Z.eqb t 1); [cbn [chain]; constructor|].
+    destruct (Z.eqb t (Z.of_nat 0)); cbn [chain]; constructor.
+  - destruct (Z.leb_spec t 0); [constructor; [apply rok_const; assumption | constructor]|].
+    destruct (Z.ltb_spec (Z.of_nat (length (l0 :: rest))) t); [constructor; [apply rok_const; assumption | constructor]|].
+    destruct (Z.eqb_spec t 1); [apply chain_rok; [exact (rok_or N) | exact H0 | exact Hl | exact Hd | exact Ha]|].
+    destruct (Z.eqb_spec t (Z.of_nat (length (l0 :: rest))));
+      [apply chain_rok; [exact (rok_and N) | exact H0 | exact Hl | exact Hd | exact Ha]|].
+    cbn [length] in *. assert (Hlv : lev < LV) by (specialize (Hlev ltac:(lia)); lia).
+    assert (Hlev' : forall t', (1 < t' < Z.of_nat (length rest))%Z -> S lev + length rest <= LV + 2)
+      by (intros t' Ht'; specialize (Hlev ltac:(lia)); lia).
+    apply Forall_app. split; [apply IH; [apply Hx; lia | apply Hx; lia | intros l Hin; apply Hl; right; exact Hin
+                                         | apply Hlev']|].
+    apply Forall_app. split; [apply IH; [apply Hx; lia | apply Hx; lia | intros l Hin; apply Hl; right; exact Hin
+                                         | apply Hlev']|].
+    constructor; [apply rok_and; [apply Hl; left; reflexivity | cbn [fst]; apply Hx; lia | apply Hx; lia]|].
+    constructor; [apply rok_or; [cbn [fst]; apply Hx; lia | cbn [fst]; apply Hx; lia | exact Hd] | constructor].
+Qed.
+
+(* ---- the records of the stored host --------------------------------------------------------------------- *)
+Section Ok.
+Variables (A w : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w).
+
+Local Notation nu := (length (host_units A)).
+Local Notation lvs := (levels (host_units A)).
+Local Notation n := (nH A).
+Local Notation N := (ncells A w nu lvs).
+Local Notation m := (image A (progPstar A)).
+
+Lemma N_pos : 0 < N.
+Proof. unfold ncells. lia. Qed.
+
+Ltac cl := unfold dCAR, dG, dCC, dCA, dEOT, dEQ, dE, dRW, dRD, dWR, M0, M1, ncells, carry in *;
+  unfold DB, XC, UC, MB in *; unfold ST, CNT, LIM, DEST, BOOT, nh, nH in *;
+  unfold HO, CPY, AR, AA, AC, RR, RA, RC, CB, CT, ARM, RD, SINK, cwr, crd, crw, ceot, rin, rout in *;
+  first [lia | nia].
+
+Lemma MB_lt : forall j t, j < SW A -> t < A -> MB A w j t < N.
+Proof.
+  intros j t Hj Ht. pose proof (DB_gt A w N HA Hw (le_n _) j t Hj Ht). unfold ncells. lia.
+Qed.
+
+Lemma step_rok : Forall (rok N) (step_go A w nu 0 (host_units A) (next_tbl n nu (host_next A))).
+Proof.
+  assert (G : forall k u, u + k = nu ->
+    Forall (rok N) (step_go A w nu u (skipn u (host_units A)) (skipn u (next_tbl n nu (host_next A))))).
+  { induction k as [|k IH]; intros u Hk.
+    - rewrite Nat.add_0_r in Hk. subst u. rewrite step_go_end. constructor.
+    - rewrite (step_go_unit A w N ltac:(lia) (le_n _) (repeat false N) (repeat_length _ _) u ltac:(lia)).
+      apply Forall_app. split; [|apply IH; lia].
+      set (U := nth u (host_units A) tu0).
+      assert (HUin : In U (host_units A)) by (apply nth_In; lia).
+      unfold unit_recs. fold U.
+      apply (ucomp_rok N lvs); [intros j k' Hj Hk'; cl | exact N_pos | | cl | |].
+      + destruct (nth u (next_tbl n nu (host_next A)) None) as [i|] eqn:Eo; [|cl].
+        destruct (nt_some A ltac:(lia) u i ltac:(lia) Eo) as [Hi _]. cl.
+      + intros l Hl. apply in_map_iff in Hl as ([i wt] & <- & Hin). unfold lit_of. cbn [fst].
+        pose proof (host_reads_below A ltac:(lia) u ltac:(lia) i wt Hin) as Hr.
+        destruct (Nat.ltb_spec i (nh A)); cl.
+      + intros [H1 H2]. rewrite length_map in *.
+        assert (Ht : thr_unit U = true) by (unfold thr_unit; apply andb_true_intro; split; apply Z.ltb_lt; lia).
+        pose proof (lv_bound A w N ltac:(lia) (le_n _) (repeat false N) (repeat_length _ _) U HUin Ht). lia. }
+  exact (G nu 0 eq_refl).
+Qed.
+
+Ltac rg := first [ apply rok_const; cl | apply rok_copy; cbn [fst]; cl | apply rok_and; cbn [fst]; cl
+                 | apply rok_or; cbn [fst]; cl ].
+Ltac frg := repeat (apply Forall_cons; [rg|]); apply Forall_nil.
+
+Lemma startup_rok : Forall (rok N) (startup A w m).
+Proof.
+  pose proof N_pos as H0. unfold startup. rewrite !Forall_app. repeat split.
+  - apply Forall_concat, Forall_map, Forall_forall. intros [j v] Hjv. cbn [fst snd].
+    pose proof (in_combine_l _ _ _ _ Hjv) as Hj. apply in_seq in Hj.
+    unfold boot_word. apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht.
+    pose proof (MB_lt j t ltac:(lia) ltac:(lia)).
+    destruct (Nat.testbit v t); [apply rok_or | apply rok_and]; cbn [fst]; cl.
+  - apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. apply rok_and; cbn [fst]; cl.
+  - constructor; [apply rok_and; cbn [fst]; cl | constructor].
+  - apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi.
+    constructor; [apply rok_and; cbn [fst]; cl | constructor; [apply rok_and; cbn [fst]; cl | constructor]].
+  - constructor; [apply rok_and; cbn [fst]; cl | constructor].
+  - cbn [map]. frg.
+  - constructor; [apply rok_const; cl | constructor].
+Qed.
+
+Lemma handover_rok : Forall (rok N) (handover A w).
+Proof.
+  unfold handover. repeat (apply Forall_cons; [first [apply rok_and | apply rok_copy]; cbn [fst]; cl|]). apply Forall_nil.
+Qed.
+
+Lemma device_rok : Forall (rok N) (Stored.device A w nu lvs).
+Proof.
+  pose proof N_pos as H0. pose proof (io_lt A w N HA Hw (le_n _)) as (I1 & I2 & I3 & I4 & I5 & I6).
+  assert (Hw1 : forall j d, j < SW A -> d < N -> Forall (rok N) (word1 A w j d)).
+  { intros j d Hj Hd. unfold word1. apply chain_rok; [exact (rok_and N) | exact H0 | | exact Hd | exact Hd].
+    intros l [<-|Hl]; [cbn [fst]; apply MB_lt; lia|].
+    apply in_map_iff in Hl as (t & <- & Ht). apply in_seq in Ht. cbn [fst]. apply MB_lt; lia. }
+  rewrite device_split. unfold segA. rewrite !Forall_app. repeat split.
+  - apply Hw1; [exact I1 | cl].
+  - apply Hw1; [exact I4 | cl].
+  - apply Hw1; [exact I3 | cl].
+  - unfold segB. apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. frg.
+  - unfold segC. apply chain_rok; [exact (rok_and N) | exact H0 | | cl | cl].
+    intros l Hl. apply in_map_iff in Hl as (i & <- & Hi). apply in_seq in Hi. cbn [fst]. cl.
+  - unfold segD. frg.
+  - unfold segE. apply Forall_concat, Forall_map, Forall_forall. intros k Hk. apply in_seq in Hk.
+    pose proof (MB_lt (rout A) (7 - k) I6 ltac:(lia)). unfold gMUX. cbn [app]. frg.
+  - unfold segF. apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. pose proof (MB_lt (rout A) t I6 ltac:(lia)). rg.
+  - unfold segG. frg.
+  - unfold segH. apply Forall_concat, Forall_map, Forall_forall. intros k Hk. apply in_seq in Hk.
+    pose proof (MB_lt (rin A) (7 - k) I5 ltac:(lia)). unfold gMUX. cbn [app]. frg.
+  - unfold segI. apply Forall_concat, Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht.
+    pose proof (MB_lt (rin A) t I5 ltac:(lia)). pose proof (MB_lt (rin A) 7 I5 ltac:(lia)). unfold gMUX. frg.
+  - unfold segJ, gMUX. pose proof (MB_lt (ceot A) 0 I2 ltac:(lia)). frg.
+  - unfold segK. apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. pose proof (MB_lt (ceot A) t I2 ltac:(lia)). rg.
+  - unfold segL. apply Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. unfold carry.
+    destruct (Nat.eqb i 0); rg.
+  - unfold segM. apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. unfold gXOR, carry.
+    destruct (Nat.eqb i 0); frg.
+  - unfold segN. frg.
+  - unfold segO. apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi. unfold gMUX. cbn [app]. frg.
+  - unfold segP. frg.
+  - unfold segQ. apply Forall_concat, Forall_map, Forall_forall. intros c Hc.
+    assert (Hcl : c < SW A) by (destruct Hc as [<-|[<-|[<-|[]]]]; assumption).
+    apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. pose proof (MB_lt c t Hcl ltac:(lia)). rg.
+Qed.
+
+(* every record of the image fits the code of the window of 2^alS cells *)
+Theorem stored_ok : Forall (rec_ok (alS A w)) (stored A w).
+Proof.
+  apply Forall_forall. intros r Hr. apply rok_rec_ok.
+  assert (Hr' : Forall (rok N) (stored A w)).
+  { rewrite (stored_split A w). rewrite !Forall_app. refine (conj startup_rok (conj step_rok (conj device_rok (conj _ handover_rok)))).
+    apply Forall_forall. intros x Hx. apply repeat_spec in Hx. subst x. apply rok_empty, N_pos. }
+  rewrite Forall_forall in Hr'. pose proof (Hr' r Hr) as Hrk. pose proof (HW A w HA Hw) as Hb.
+  destruct r as [a0 w0 a1 w1 beta ao]. unfold rok in Hrk |- *.
+  destruct Hrk as (H1 & H2 & H3 & H4 & H5 & H6).
+  refine (conj H1 (conj H2 (conj H3 (conj _ (conj _ _))))); eapply Nat.lt_le_trans; eassumption.
+Qed.
+
+End Ok.

rocq/StoredPass.v

@@ -0,0 +1,674 @@
+(* One pass of the stored host against one step of the transducer of Definition 8.4: the records of H_A,
+   the device and the hand-over carry the window, the read tape, the arm and the copy tape of a
+   configuration of SUBLEQ_A with its device to those of the next configuration, for every A >= 8. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Decoder Run PhysSem View Stored WinRun WinPar ViewOps Host HostWF
+  HostSem HostIP Device Pstar StoredStep StoredBoot StoredDev.
+
+(* ---- bits of numbers --------------------------------------------------------------------------------- *)
+Lemma forallb_seq_S0 : forall (f : nat -> bool) k, forallb f (seq 0 (S k)) = f 0 && forallb (fun j => f (S j)) (seq 0 k).
+Proof. intros f k. cbn [seq forallb]. f_equal. rewrite <- seq_shift, forallb_map'. reflexivity. Qed.
+
+(* the bits of c + 1: bit i flips when the bits below it are all 1 *)
+Lemma testbit_succ : forall c i, Nat.testbit (S c) i = xorb (Nat.testbit c i) (forallb (Nat.testbit c) (seq 0 i)).
+Proof.
+  intros c i. revert c. induction i as [|i IH]; intro c.
+  - cbn [seq forallb]. rewrite xorb_true_r, !Nat.bit0_odd, Nat.odd_succ, Nat.negb_odd. reflexivity.
+  - rewrite forallb_seq_S0. destruct (Nat.Even_or_Odd c) as [[k ->]|[k ->]].
+    + replace (S (2 * k)) with (2 * k + 1) by lia.
+      rewrite Nat.testbit_odd_succ, Nat.testbit_even_succ, Nat.testbit_even_0 by lia. cbn [andb]. rewrite xorb_false_r.
+      reflexivity.
+    + replace (S (2 * k + 1)) with (2 * S k) by lia.
+      rewrite Nat.testbit_even_succ, Nat.testbit_odd_succ, Nat.testbit_odd_0 by lia. cbn [andb].
+      rewrite IH. f_equal. apply forallb_ext_in'. intros j _. symmetry. apply Nat.testbit_odd_succ. lia.
+Qed.
+
+Lemma testbit_lt_false : forall b k, b < 2 ^ k -> Nat.testbit b k = false.
+Proof.
+  intros b k H. rewrite <- (Nat.add_0_l k), <- Nat.div_pow2_bits, Nat.div_small by exact H. reflexivity.
+Qed.
+
+(* a byte with its sign bit copied into the bits above the eighth *)
+Lemma testbit_sext : forall A b t, 8 <= A -> b < 256 -> t < A ->
+  Nat.testbit (sext A b) t = Nat.testbit b (7 - (7 - t)).
+Proof.
+  intros A b t HA Hb Ht. unfold sext. destruct (Nat.ltb_spec b 128) as [Hs|Hs].
+  - destruct (Nat.lt_ge_cases t 8) as [Hlo|Hhi]; [f_equal; lia|].
+    replace (7 - (7 - t)) with 7 by lia.
+    rewrite (testbit_lt_false b 7) by (cbn; lia). apply testbit_lt_false.
+    apply (Nat.lt_le_trans _ (2 ^ 8)); [cbn; lia | apply Nat.pow_le_mono_r; lia].
+  - assert (E : b + SW A - 256 = b + (2 ^ (A - 8) - 1) * 2 ^ 8).
+    { unfold SW. replace A with ((A - 8) + 8) at 1 by lia. rewrite Nat.pow_add_r.
+      pose proof (Nat.pow_nonzero 2 (A - 8) ltac:(lia)). change (2 ^ 8) with 256. nia. }
+    rewrite E. destruct (Nat.lt_ge_cases t 8) as [Hlo|Hhi].
+    + rewrite <- (Nat.mod_pow2_bits_low _ 8 t) by exact Hlo. rewrite Nat.Div0.mod_add, Nat.mod_small by (cbn; lia).
+      f_equal. lia.
+    + replace t with ((t - 8) + 8) at 1 by lia. rewrite <- Nat.div_pow2_bits.
+      rewrite Nat.div_add, Nat.div_small, Nat.add_0_l by (cbn; lia).
+      replace (2 ^ (A - 8) - 1) with (Nat.ones (A - 8)) by (rewrite Nat.ones_equiv; lia).
+      rewrite Nat.ones_spec_low by lia. replace (7 - (7 - t)) with 7 by lia.
+      symmetry. rewrite <- (Nat.add_0_l 7), <- Nat.div_pow2_bits.
+      replace (b / 2 ^ 7) with 1 by (apply Nat.div_unique with (r := b - 128); cbn; lia). reflexivity.
+Qed.
+
+(* a word of A bits that holds 1 *)
+Lemma bits_one : forall A x, 1 <= A -> x < 2 ^ A ->
+  Nat.testbit x 0 && forallb (fun t => negb (Nat.testbit x t)) (seq 1 (A - 1)) = Nat.eqb x 1.
+Proof.
+  intros A x HA Hx. rewrite <- (testbits_eqb A x 1 Hx) by (apply (Nat.lt_le_trans _ (2 ^ 1)); [cbn; lia
+    | apply Nat.pow_le_mono_r; lia]).
+  replace (seq 0 A) with (0 :: seq 1 (A - 1)) by (replace A with (S (A - 1)) at 2 by lia; reflexivity).
+  cbn [forallb]. change (Nat.testbit 1 0) with true. f_equal.
+  - destruct (Nat.testbit x 0); reflexivity.
+  - apply forallb_ext_in'. intros t Ht. apply in_seq in Ht.
+    rewrite (testbit_lt_false 1 t) by (apply (Nat.lt_le_trans _ (2 ^ 1)); [cbn; lia | apply Nat.pow_le_mono_r; lia]).
+    destruct (Nat.testbit x t); reflexivity.
+Qed.
+
+(* ---- bytes on a tape, most significant bit first ------------------------------------------------------ *)
+Definition bbits (o : list nat) : list bool := concat (map (nat2bits 8) o).
+
+(* the bytes o followed by blank cells, the head on cell 8 k *)
+Definition obt (Lt : nat) (o : list nat) (k : nat) : tape := mkT (bbits o ++ repeat false (Lt - 8 * length o)) ((8 * k) mod Lt).
+
+Lemma length_bbits : forall o, length (bbits o) = 8 * length o.
+Proof.
+  intro o. unfold bbits. rewrite (length_concat_const _ _ 8).
+  - rewrite length_map. lia.
+  - apply Forall_forall. intros l Hl. apply in_map_iff in Hl as (x & <- & _). apply length_nat2bits.
+Qed.
+
+Lemma bbits_app : forall o1 o2, bbits (o1 ++ o2) = bbits o1 ++ bbits o2.
+Proof. intros o1 o2. unfold bbits. rewrite map_app, concat_app. reflexivity. Qed.
+
+Lemma nth_bbits : forall o k j, k < length o -> j < 8 -> nth (8 * k + j) (bbits o) false = Nat.testbit (nth k o 0) (7 - j).
+Proof.
+  intros o k j Hk Hj. unfold bbits.
+  rewrite (nth_concat_const _ false (map (nat2bits 8) o) 8 k j).
+  - rewrite (nth_map_d _ _ (nat2bits 8) o k [] 0) by exact Hk. rewrite nth_nat2bits by exact Hj. reflexivity.
+  - apply Forall_forall. intros l Hl. apply in_map_iff in Hl as (x & <- & _). apply length_nat2bits.
+  - rewrite length_map. exact Hk.
+  - exact Hj.
+Qed.
+
+Lemma nat2bits_map : forall k x, nat2bits k x = map (fun j => Nat.testbit x (k - 1 - j)) (seq 0 k).
+Proof.
+  intros k x. apply (nth_ext _ _ false false); [rewrite length_nat2bits, length_map, length_seq; reflexivity|].
+  intros j Hj. rewrite length_nat2bits in Hj. rewrite nth_nat2bits by exact Hj.
+  rewrite (nth_map_seq _ (fun j => Nat.testbit x (k - 1 - j)) k j false Hj). reflexivity.
+Qed.
+
+Lemma nat2bits_mod : forall x, nat2bits 8 (x mod 256) = nat2bits 8 x.
+Proof.
+  intro x. rewrite !nat2bits_map. apply map_ext_in. intros j Hj. apply in_seq in Hj.
+  change 256 with (2 ^ 8). apply Nat.mod_pow2_bits_low. lia.
+Qed.
+
+Lemma adv_mod : forall Lt k x, 1 <= Lt -> adv Lt k (x mod Lt) = (x + k) mod Lt.
+Proof.
+  intros Lt k x H. induction k as [|k IH]; cbn [adv]; [rewrite Nat.add_0_r; reflexivity|].
+  rewrite IH, succ_mod_mod by exact H. f_equal. lia.
+Qed.
+
+Lemma wseq_cons : forall Lt b bs t, wseq Lt (b :: bs) t = wseq Lt bs (wstep Lt b t).
+Proof. reflexivity. Qed.
+
+(* bits written one after another from the first blank cell *)
+Lemma wseq_fill : forall Lt bs pre, length pre + length bs <= Lt ->
+  wseq Lt bs (mkT (pre ++ repeat false (Lt - length pre)) (length pre mod Lt))
+  = mkT (pre ++ bs ++ repeat false (Lt - length pre - length bs)) ((length pre + length bs) mod Lt).
+Proof.
+  induction bs as [|b bs IH]; intros pre H.
+  - cbn [length]. rewrite app_nil_l, Nat.add_0_r, Nat.sub_0_r. reflexivity.
+  - rewrite wseq_cons. cbn [length] in H.
+    assert (Hp : length pre < Lt) by lia.
+    assert (E : wstep Lt b (mkT (pre ++ repeat false (Lt - length pre)) (length pre mod Lt))
+                = mkT ((pre ++ [b]) ++ repeat false (Lt - length (pre ++ [b]))) (length (pre ++ [b]) mod Lt)).
+    { unfold wstep. cbn [td th]. rewrite succ_mod_mod by lia. rewrite (Nat.mod_small (length pre) Lt Hp).
+      replace (Lt - length pre) with (S (Lt - length pre - 1)) by lia. cbn [repeat].
+      rewrite upd_app_cons, <- app_assoc, length_app. cbn [app length]. f_equal; [do 3 f_equal; lia | f_equal; lia]. }
+    rewrite E, IH by (rewrite length_app; cbn [length]; lia).
+    rewrite <- app_assoc, length_app. cbn [app length]. f_equal; [do 4 f_equal; lia | f_equal; lia].
+Qed.
+
+(* a byte written under a head on the first blank cell *)
+Lemma wseq_byte : forall Lt o x, 8 * S (length o) <= Lt ->
+  wseq Lt (nat2bits 8 x) (obt Lt o (length o)) = obt Lt (o ++ [x mod 256]) (length (o ++ [x mod 256])).
+Proof.
+  intros Lt o x H. unfold obt. rewrite <- (length_bbits o).
+  rewrite wseq_fill by (rewrite length_nat2bits, length_bbits; lia).
+  rewrite bbits_app, length_app, length_nat2bits, length_bbits. cbn [length]. unfold bbits at 3. cbn [map concat].
+  rewrite nat2bits_mod, app_nil_r, <- app_assoc. f_equal; [do 3 f_equal; lia | f_equal; lia].
+Qed.
+
+(* a bit of the byte under the read head *)
+Lemma read_bit : forall tau Lt h t, 8 * length tau <= Lt -> h < length tau ->
+  nth (adv Lt (7 - t) ((8 * h) mod Lt)) (bbits tau ++ repeat false (Lt - 8 * length tau)) false
+  = Nat.testbit (nth h tau 0) (7 - (7 - t)).
+Proof.
+  intros tau Lt h t H1 H2. rewrite adv_mod by lia. rewrite Nat.mod_small by lia.
+  rewrite app_nth1 by (rewrite length_bbits; lia). rewrite nth_bbits by lia. reflexivity.
+Qed.
+
+(* ---- states of the host ------------------------------------------------------------------------------- *)
+Section States.
+Variable A : nat.
+Hypothesis HA : 8 <= A.
+
+Lemma subleq_valid : forall s, hvalid A s -> hvalid A (subleq A s).
+Proof.
+  intros s (Hp & Hl & Hf). pose proof (SW256 A HA) as HS. rewrite Forall_forall in Hf.
+  assert (Hm : forall j, j < SW A -> memv s j < SW A) by (intros j Hj; unfold memv; apply Hf, nth_In; lia).
+  unfold subleq. destruct (hhalt s); [refine (conj Hp (conj Hl _)); apply Forall_forall; exact Hf|].
+  cbv zeta. unfold hvalid. cbn [hpc hmem]. split; [|split].
+  - destruct (_ || _); [apply Hm, Nat.mod_upper_bound; lia | apply Nat.mod_upper_bound; lia].
+  - rewrite length_map, length_seq. reflexivity.
+  - apply Forall_forall. intros x Hx. apply in_map_iff in Hx as (j & <- & Hj). apply in_seq in Hj.
+    destruct (Nat.eqb j _); [apply Nat.mod_upper_bound; lia | apply Hm; lia].
+Qed.
+
+Lemma setm_valid : forall s c v, hvalid A s -> v < SW A -> hvalid A (setm A s c v).
+Proof.
+  intros s c v (Hp & Hl & Hf) Hv. unfold setm, hvalid. cbn [hpc hmem]. split; [exact Hp|].
+  split; [rewrite length_map, length_seq; reflexivity|].
+  apply Forall_forall. intros x Hx. apply in_map_iff in Hx as (j & <- & Hj). apply in_seq in Hj.
+  destruct (Nat.eqb j c); [exact Hv|]. unfold memv. rewrite Forall_forall in Hf. apply Hf, nth_In. lia.
+Qed.
+
+Lemma device_valid : forall s d, hvalid A s -> Forall (fun x => x < 256) (dtape d) -> hvalid A (fst (device A s d)).
+Proof.
+  intros s d Hv Hb. pose proof (SW256 A HA) as HS. unfold device. cbv zeta. cbn [fst].
+  rewrite Forall_forall in Hb.
+  repeat apply setm_valid; try lia.
+  destruct (Nat.eqb (memv s (crd A)) 1); [destruct (Nat.ltb (dhead d) (length (dtape d))) eqn:Ok|];
+    repeat apply setm_valid; try lia;
+    try (destruct (Nat.eqb (memv s (cwr A)) 1); [apply setm_valid; [exact Hv | lia] | exact Hv]).
+  apply sext_lt; [exact HA|]. apply Nat.ltb_lt in Ok.
+  destruct (Nat.lt_ge_cases (dhead d) (length (dtape d))) as [H|H]; [apply Hb, nth_In, H | lia].
+Qed.
+
+Lemma device_pc : forall s d, hpc (fst (device A s d)) = hpc s /\ hhalt (fst (device A s d)) = hhalt s
+  /\ length (hmem (fst (device A s d))) = SW A.
+Proof.
+  intros s d. unfold device. cbv zeta. cbn [fst]. split; [|split; [|apply setm_len]];
+    unfold setm; cbn [hpc hhalt];
+    destruct (Nat.eqb (memv s (crd A)) 1), (Nat.ltb (dhead d) (length (dtape d))), (Nat.eqb (memv s (cwr A)) 1);
+    reflexivity.
+Qed.
+
+(* the words of memory after the device *)
+Lemma memv_device : forall s d j, j < SW A ->
+  memv (fst (device A s d)) j =
+  if Nat.eqb j (cwr A) || Nat.eqb j (crd A) || Nat.eqb j (crw A) then 0
+  else if Nat.eqb j (rout A) then (if Nat.eqb (memv s (cwr A)) 1 then 0 else memv s j)
+  else if Nat.eqb j (rin A) then
+    (if Nat.eqb (memv s (crd A)) 1 && Nat.ltb (dhead d) (length (dtape d))
+     then sext A (nth (dhead d) (dtape d) 0) else memv s j)
+  else if Nat.eqb j (ceot A) then
+    (if Nat.eqb (memv s (crd A)) 1 then (if Nat.ltb (dhead d) (length (dtape d)) then 0 else 1) else memv s j)
+  else memv s j.
+Proof.
+  intros s d j Hj. pose proof (SW256 A HA) as HS. unfold device. cbv zeta. cbn [fst].
+  rewrite !setm_mem by exact Hj.
+  destruct (Nat.eqb (memv s (crd A)) 1), (Nat.ltb (dhead d) (length (dtape d))), (Nat.eqb (memv s (cwr A)) 1);
+    cbn [andb]; rewrite ?setm_mem by exact Hj;
+    unfold cwr, crd, crw, rout, rin, ceot in *;
+    repeat match goal with |- context [Nat.eqb ?x ?y] => destruct (Nat.eqb_spec x y) end;
+    cbn [orb]; try lia; reflexivity.
+Qed.
+
+(* the initial memory image holds words *)
+Lemma prog_lt : forall a b c, In (a, b, c) (progPstar A) -> a < SW A /\ b < SW A /\ c < SW A.
+Proof.
+  intros a b c H. pose proof (SW256 A HA). unfold progPstar, decode_loop in H. cbn [app In] in H.
+  repeat (destruct H as [H|H];
+          [injection H as <- <- <-; unfold t1c, t2c, zc, rin, rout, eokc, ceot, cwr, crd, crw, neg1c, onec, haltc; lia|]).
+  destruct H.
+Qed.
+
+Lemma img0_lt : forall j, img0 A (progPstar A) j < SW A.
+Proof.
+  intro j. pose proof (SW256 A HA). unfold img0. destruct (j <? _).
+  - unfold word. destruct (nth (j / 3) (progPstar A) (0, 0, 0)) as [[a b] c] eqn:E.
+    destruct (Nat.lt_ge_cases (j / 3) (length (progPstar A))) as [Hl|Hl].
+    + pose proof (nth_In (progPstar A) (0, 0, 0) Hl) as Hin. rewrite E in Hin.
+      destruct (prog_lt a b c Hin) as (Ha & Hb & Hc). destruct (j mod 3) as [|[|]]; assumption.
+    + rewrite nth_overflow in E by exact Hl. injection E as <- <- <-. destruct (j mod 3) as [|[|]]; lia.
+  - destruct (Nat.eqb j _); [lia|]. destruct (Nat.eqb j _); [lia|]. destruct (Nat.eqb j _); lia.
+Qed.
+
+Lemma init_valid : hvalid A (x0m (image A (progPstar A))).
+Proof.
+  unfold hvalid, x0m, image. cbn [hpc hmem]. split; [pose proof (SW256 A HA); lia|].
+  split; [rewrite length_map, length_seq; reflexivity|].
+  apply Forall_forall. intros v Hv. apply in_map_iff in Hv as (j & <- & _). apply img0_lt.
+Qed.
+
+End States.
+
+Definition isnil (l : list nat) : bool := match l with [] => true | _ => false end.
+
+(* ---- a pass on a view ------------------------------------------------------------------------------------ *)
+Section Pass.
+Variables (A w Lb L : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w).
+
+Local Notation nu := (length (host_units A)).
+Local Notation lvs := (levels (host_units A)).
+Local Notation n := (nH A).
+Local Notation nt := (next_tbl (nH A) (length (host_units A)) (host_next A)).
+Local Notation W := (2 ^ alS A w).
+
+Lemma alS_eq : alS A w = Nat.log2_up (ncells A w nu lvs).
+Proof. reflexivity. Qed.
+
+Lemma HW : ncells A w nu lvs <= W.
+Proof.
+  rewrite alS_eq. destruct (Nat.log2_up_spec (ncells A w nu lvs)) as [_ H]; [unfold ncells, DB; lia | exact H].
+Qed.
+
+(* the state bits of the window hold the state s of the host *)
+Definition holds (ww : list bool) (s : hst) : Prop := forall i, i < n -> wget ww (ST w i) = nth i (encodeH A s) false.
+
+Lemma holds_MB : forall ww s j t, holds ww s -> length (hmem s) = SW A -> j < SW A -> t < A ->
+  wget ww (MB A w j t) = Nat.testbit (memv s j) t.
+Proof.
+  intros ww s j t H Hl Hj Ht. unfold MB. rewrite H by (unfold nH; nia).
+  replace (A + 1 + A * j + (A - 1 - t)) with (A + 1 + j * A + (A - 1 - t)) by lia.
+  rewrite nth_encodeH_mem by (assumption || lia). unfold bitof. f_equal. lia.
+Qed.
+
+Lemma holds_of : forall ww s, length (hmem s) = SW A ->
+  (forall i, i < A -> wget ww (ST w i) = bitof A (hpc s) i) -> wget ww (ST w A) = hhalt s ->
+  (forall j t, j < SW A -> t < A -> wget ww (MB A w j t) = Nat.testbit (memv s j) t) -> holds ww s.
+Proof.
+  intros ww s Hl Hp Hh Hm i Hi. destruct (Nat.lt_ge_cases i A) as [H1|H1].
+  - rewrite nth_encodeH_pc by exact H1. apply Hp. exact H1.
+  - destruct (Nat.eq_dec i A) as [->|H2]; [rewrite nth_encodeH_halt; exact Hh|].
+    set (j := (i - A - 1) / A). set (k := (i - A - 1) mod A).
+    assert (Hk : k < A) by (apply Nat.mod_upper_bound; lia).
+    assert (Hji : i = A + 1 + j * A + k) by (pose proof (Nat.div_mod_eq (i - A - 1) A); unfold j, k; lia).
+    assert (Hj : j < SW A) by (unfold nH in Hi; nia).
+    rewrite Hji at 2. rewrite nth_encodeH_mem by assumption. unfold bitof.
+    pose proof (Hm j (A - 1 - k) Hj ltac:(lia)) as E. unfold MB in E.
+    replace (A + 1 + A * j + (A - 1 - (A - 1 - k))) with i in E by lia. rewrite E; reflexivity.
+Qed.
+
+(* a view at the start of a pass, h after the hand-over, against a configuration c of the transducer: the
+   window holds the state of the host, cnt the head, lim the head of the last rewind and dest whether one was
+   requested; the read tape holds the tape of c, and the arm and the copy tape the bytes o1 and o2 emitted
+   before and after the rewind *)
+Definition Rv (h : bool) (c : hst * dev) (o1 o2 : list nat) (v : view) : Prop :=
+  reqclear (vw v) /\ length (vw v) = W /\ vho v = h /\ wget (vw v) BOOT = negb h
+  /\ holds (vw v) (fst c) /\ hvalid A (fst c)
+  /\ (forall i, i < w -> wget (vw v) (CNT i) = Nat.testbit (dhead (snd c)) i)
+  /\ (forall i, i < w -> wget (vw v) (LIM w i) = Nat.testbit (last (drew (snd c)) 0) i)
+  /\ wget (vw v) (DEST w) = negb (isnil (drew (snd c)))
+  /\ vr v = obt L (dtape (snd c)) (dhead (snd c))
+  /\ va v = obt Lb o1 (if h then 0 else length o1)
+  /\ vc v = obt L o2 (if h then 0 else length o2)
+  /\ dout (snd c) = o1 ++ o2 /\ (isnil (drew (snd c)) = true -> o2 = []).
+
+(* ---- the step block ---------------------------------------------------------------------------------------- *)
+Lemma step_view : forall v s, reqclear (vw v) -> length (vw v) = W -> holds (vw v) s -> hvalid A s ->
+  let v' := vrun Lb L (step_go A w nu 0 (host_units A) nt) v in
+  reqclear (vw v') /\ length (vw v') = W /\ holds (vw v') (subleq A s)
+  /\ (forall c, c < ST w 0 \/ DB A w nu lvs <= c -> wget (vw v') c = wget (vw v) c)
+  /\ vr v' = vr v /\ va v' = va v /\ vc v' = vc v /\ vho v' = vho v.
+Proof.
+  intros v s Hq Hl Hh Hv v'. unfold v'.
+  rewrite (vrun_wrun Lb L _ v (step_wrec A w W ltac:(lia) HW (vw v) Hl) Hq). cbn [vw vr va vc vho].
+  destruct (step_run A w W ltac:(lia) HW (vw v) Hl Hq) as (L1 & Q1 & _ & S1 & U1).
+  refine (conj Q1 (conj L1 (conj _ (conj U1 (conj eq_refl (conj eq_refl (conj eq_refl eq_refl))))))).
+  intros i Hi. rewrite S1 by exact Hi. pose proof (host_next_range A ltac:(lia) i Hi) as Hr.
+  rewrite (proj2 (Nat.ltb_lt _ _)) by lia.
+  assert (Ex : xbits A w (vw v) = encodeH A s).
+  { destruct Hv as (_ & Hlen & _). apply (nth_ext _ _ false false).
+    - rewrite length_encodeH by exact Hlen. unfold xbits. rewrite length_map, length_seq. reflexivity.
+    - intros j Hj. unfold xbits in *. rewrite length_map, length_seq in Hj.
+      rewrite (nth_map_seq _ (fun i => wget (vw v) (ST w i)) n j false Hj). apply Hh. exact Hj. }
+  unfold E, X. rewrite Ex.
+  pose proof (host_step A s ltac:(lia) Hv) as Hs. unfold netstep in Hs. cbv zeta in Hs.
+  rewrite <- Hs. rewrite (nth_map_d _ _ _ (host_next A) i false 0) by (rewrite length_host_next; exact Hi).
+  reflexivity.
+Qed.
+
+(* ---- the startup ------------------------------------------------------------------------------------------- *)
+Local Notation m := (image A (progPstar A)).
+
+Lemma length_image : length m = SW A.
+Proof. unfold image. rewrite length_map, length_seq. reflexivity. Qed.
+
+Lemma HWs : 15 + 2 * w + n <= W.
+Proof. pose proof HW. unfold ncells, DB, nh in *. lia. Qed.
+
+Lemma view_eta : forall u : view, u = mkV (vw u) (vr u) (va u) (vc u) (vho u).
+Proof. intros [? ? ? ? ?]. reflexivity. Qed.
+
+(* once booted, the startup changes nothing *)
+Lemma startup_booted : forall v, reqclear (vw v) -> length (vw v) = W -> wget (vw v) BOOT = true ->
+  vrun Lb L (startup A w m) v = v.
+Proof.
+  intros v Hq Hl Hb.
+  destruct (startup_run A w W Lb L m ltac:(lia) length_image HWs v Hq Hl)
+    as (Q & L1 & B1 & S1 & R1 & D1 & U1 & VR & VA & VC & VH).
+  cbv zeta in *. rewrite Hb in S1, R1, D1, VR, VA, VC.
+  transitivity (mkV (vw v) (vr v) (va v) (vc v) (vho v)); [|symmetry; apply view_eta].
+  rewrite (view_eta (vrun Lb L (startup A w m) v)). rewrite VR, VA, VC, VH.
+  f_equal. apply (nth_ext _ _ false false); [congruence|]. intros i Hi.
+  change (wget (vw (vrun Lb L (startup A w m) v)) i = wget (vw v) i).
+  destruct (Nat.lt_ge_cases i BOOT) as [H1|H1]; [apply U1; left; exact H1|].
+  destruct (Nat.eq_dec i BOOT) as [->|H2]; [rewrite B1; symmetry; exact Hb|].
+  destruct (Nat.lt_ge_cases i (14 + w)) as [H3|H3].
+  { replace i with (CNT (i - 14)) by (unfold CNT, BOOT in *; lia). rewrite (proj1 (R1 (i - 14) ltac:(unfold BOOT in *; lia))).
+    apply andb_true_r. }
+  destruct (Nat.eq_dec i (14 + w)) as [->|H4]; [change (14 + w) with (DEST w); rewrite D1; apply andb_true_r|].
+  destruct (Nat.lt_ge_cases i (15 + 2 * w)) as [H5|H5].
+  { replace i with (LIM w (i - 15 - w)) by (unfold LIM; lia). rewrite (proj2 (R1 (i - 15 - w) ltac:(lia))).
+    apply andb_true_r. }
+  destruct (Nat.lt_ge_cases i (15 + 2 * w + n)) as [H6|H6]; [|apply U1; right; exact H6].
+  replace i with (ST w (i - 15 - 2 * w)) by (unfold ST; lia). apply S1. lia.
+Qed.
+
+(* the first pass of a generation loads the initial state of the transducer *)
+Lemma startup_first : forall v tau, reqclear (vw v) -> length (vw v) = W -> wget (vw v) BOOT = false -> vho v = false ->
+  td (vr v) = bbits tau ++ repeat false (L - 8 * length tau) ->
+  Rv false (init A (progPstar A) tau) [] [] (vrun Lb L (startup A w m) v).
+Proof.
+  intros v tau Hq Hl Hb Hh Ht.
+  destruct (startup_run A w W Lb L m ltac:(lia) length_image HWs v Hq Hl)
+    as (Q & L1 & B1 & S1 & R1 & D1 & U1 & VR & VA & VC & VH).
+  cbv zeta in *. rewrite Hb in S1, R1, D1, VR, VA, VC.
+  unfold Rv, init. cbn [fst snd dhead drew dtape dout last isnil negb].
+  refine (conj Q (conj L1 (conj _ (conj B1 (conj _ (conj (init_valid A HA) (conj _ (conj _ (conj _ (conj _
+            (conj _ (conj _ (conj eq_refl (fun _ => eq_refl)))))))))))))).
+  - rewrite VH. exact Hh.
+  - intros i Hi. rewrite S1 by exact Hi. reflexivity.
+  - intros i Hi. rewrite (proj1 (R1 i Hi)), andb_false_r, Nat.bits_0. reflexivity.
+  - intros i Hi. rewrite (proj2 (R1 i Hi)), andb_false_r, Nat.bits_0. reflexivity.
+  - rewrite D1, andb_false_r. reflexivity.
+  - rewrite VR. unfold obt. rewrite Ht, Nat.mul_0_r, Nat.Div0.mod_0_l. reflexivity.
+  - rewrite VA. unfold obt. cbn [length bbits map concat app]. rewrite Nat.mul_0_r, Nat.sub_0_r, Nat.Div0.mod_0_l.
+    reflexivity.
+  - rewrite VC. unfold obt. cbn [length bbits map concat app]. rewrite Nat.mul_0_r, Nat.sub_0_r, Nat.Div0.mod_0_l.
+    reflexivity.
+Qed.
+
+(* ---- the values the device reads from a window that holds a state -------------------------------------- *)
+Lemma word1v_holds : forall ww s j, holds ww s -> hvalid A s -> j < SW A -> word1v A w ww j = Nat.eqb (memv s j) 1.
+Proof.
+  intros ww s j Hh Hv Hj. destruct Hv as (_ & Hl & Hf).
+  assert (Hm : memv s j < 2 ^ A) by (unfold memv; rewrite Forall_forall in Hf; apply Hf, nth_In; lia).
+  unfold word1v. rewrite (holds_MB ww s j 0 Hh Hl Hj ltac:(lia)).
+  rewrite <- (bits_one A (memv s j) ltac:(lia) Hm). f_equal.
+  apply forallb_ext_in'. intros t Ht. apply in_seq in Ht. rewrite (holds_MB ww s j t Hh Hl Hj ltac:(lia)). reflexivity.
+Qed.
+
+Lemma regs_eq : forall ww h lim, h < 2 ^ w -> lim < 2 ^ w ->
+  (forall i, i < w -> wget ww (CNT i) = Nat.testbit h i) -> (forall i, i < w -> wget ww (LIM w i) = Nat.testbit lim i) ->
+  eqv w ww = Nat.eqb h lim.
+Proof.
+  intros ww h lim Hh Hlim Hc Hl. unfold eqv. rewrite <- (testbits_eqb w h lim Hh Hlim).
+  apply forallb_ext_in'. intros i Hi. apply in_seq in Hi. rewrite Hc, Hl by lia. reflexivity.
+Qed.
+
+Lemma cntv_eq : forall ww h, (forall i, i < w -> wget ww (CNT i) = Nat.testbit h i) ->
+  forall i, i < w -> cntv A w ww i = Nat.testbit (if gv A w ww then S h else h) i.
+Proof.
+  intros ww h Hc i Hi. unfold cntv, carryv. rewrite Hc by exact Hi.
+  destruct (gv A w ww); cbn [andb].
+  - rewrite testbit_succ. f_equal. apply forallb_ext_in'. intros k Hk. apply in_seq in Hk. apply Hc. lia.
+  - rewrite xorb_false_r. reflexivity.
+Qed.
+
+Lemma outbits_eq : forall ww s, holds ww s -> length (hmem s) = SW A -> rout A < SW A ->
+  outbits A w ww = nat2bits 8 (memv s (rout A)).
+Proof.
+  intros ww s Hh Hl Hr. unfold outbits. rewrite nat2bits_map. apply map_ext_in. intros k Hk. apply in_seq in Hk.
+  rewrite (holds_MB ww s (rout A) (7 - k) Hh Hl Hr ltac:(lia)). reflexivity.
+Qed.
+
+(* the cells of the counter, the halt bit and the words the device does not touch *)
+Lemma ST_ndevw : forall i, i <= A -> ~ devw A w (ST w i).
+Proof.
+  intros i Hi H. destruct H as [H|[(j & Hj & [E|E])|[E|(c0 & t & _ & Ht & E)]]];
+    unfold MB, DB, ST, CNT, LIM, DEST, nh, nH in *; nia.
+Qed.
+
+Lemma MB_ndevw : forall j t, j < SW A -> t < A -> j <> cwr A -> j <> crd A -> j <> crw A -> j <> rout A -> j <> rin A ->
+  j <> ceot A -> ~ devw A w (MB A w j t).
+Proof.
+  intros j t Hj Ht N1 N2 N3 N4 N5 N6 H. pose proof (io_lt A w W HA Hw HW) as (I1 & I2 & I3 & I4 & I5 & I6).
+  pose proof (MB_range A w W HA Hw HW j t Hj Ht). pose proof (DB_gt A w W HA Hw HW j t Hj Ht).
+  destruct H as [H|[(i & Hi & [E|E])|[E|(c0 & t0 & Hc & Ht0 & E)]]]; [lia | unfold CNT in E; lia | unfold LIM in E; lia
+                                                                      | unfold DEST in E; lia |].
+  assert (Hc0 : c0 < SW A) by (destruct Hc as [->|[->|[->|[->|[->| ->]]]]]; assumption).
+  apply (MB_inj A w W HA Hw HW) in E as [E _]; [|assumption | assumption | assumption | assumption].
+  destruct Hc as [->|[->|[->|[->|[->| ->]]]]]; contradiction.
+Qed.
+
+(* ---- one step of the transducer: the records of H_A, the device, the padding and the hand-over ------------- *)
+Theorem pass_step : forall c o1 o2 v p, Rv false c o1 o2 v -> hhalt (fst c) = false ->
+  Forall (fun x => x < 256) (dtape (snd c)) -> 8 * length (dtape (snd c)) <= L -> length (dtape (snd c)) < 2 ^ w ->
+  dhead (snd c) <= length (dtape (snd c)) ->
+  (isnil (drew (snd c)) = false -> last (drew (snd c)) 0 = length (dtape (snd c))) ->
+  (memv (subleq A (fst c)) (crd A) = 1 -> isnil (drew (snd c)) = true -> dhead (snd c) < length (dtape (snd c))) ->
+  (memv (subleq A (fst c)) (cwr A) = 1 -> isnil (drew (snd c)) = true -> 8 * S (length o1) <= Lb) ->
+  (memv (subleq A (fst c)) (cwr A) = 1 -> isnil (drew (snd c)) = false -> 8 * S (length o2) <= L) ->
+  1 <= Lb -> 1 <= L ->
+  let s1 := subleq A (fst c) in
+  let x := memv s1 (rout A) mod 256 in
+  let wr := Nat.eqb (memv s1 (cwr A)) 1 in
+  let o1' := if wr && isnil (drew (snd c)) then o1 ++ [x] else o1 in
+  let o2' := if wr && negb (isnil (drew (snd c))) then o2 ++ [x] else o2 in
+  let c' := tstep A c in
+  Rv (hhalt (fst c')) c' o1' o2'
+     (vrun Lb L (step_go A w nu 0 (host_units A) nt ++ Stored.device A w nu lvs ++ repeat EMPTY p ++ handover A w) v).
+Proof.
+  intros c o1 o2 v p HR Hh Hb8 HtL Htw Hhd Hlim Hlate Hca Hcc HLb HL. cbv zeta.
+  destruct c as [s d]. unfold tstep.
+  destruct HR as (Q0 & L0 & H0 & B0 & Hs & Hv & C0 & M0 & D0 & R0 & A0 & V0 & O0 & N0). cbn [negb] in B0.
+  cbn [fst snd] in *.
+  pose proof (SW256 A HA) as HS. pose proof (io_lt A w W HA Hw HW) as (I1 & I2 & I3 & I4 & I5 & I6).
+  set (s1 := subleq A s) in *.
+  assert (Hv1 : hvalid A s1) by (apply subleq_valid; assumption).
+  pose proof Hv1 as (_ & Hl1 & _).
+  rewrite !vrun_app.
+  (* the step of H_A *)
+  destruct (step_view v s Q0 L0 Hs Hv) as (Q1 & L1 & S1 & U1 & R1 & A1 & V1 & H1).
+  set (v1 := vrun Lb L (step_go A w nu 0 (host_units A) nt) v) in *.
+  assert (C1 : forall i, i < w -> wget (vw v1) (CNT i) = Nat.testbit (dhead d) i)
+    by (intros i Hi; rewrite U1 by (left; unfold CNT, ST; lia); apply C0, Hi).
+  assert (M1 : forall i, i < w -> wget (vw v1) (LIM w i) = Nat.testbit (last (drew d) 0) i)
+    by (intros i Hi; rewrite U1 by (left; unfold LIM, ST; lia); apply M0, Hi).
+  assert (D1 : wget (vw v1) (DEST w) = negb (isnil (drew d))) by (rewrite U1 by (left; unfold DEST, ST; lia); exact D0).
+  assert (B1 : wget (vw v1) BOOT = true) by (rewrite U1 by (left; unfold BOOT, ST; lia); exact B0).
+  (* what the device reads *)
+  set (rdb := Nat.eqb (memv s1 (crd A)) 1). set (okb := Nat.ltb (dhead d) (length (dtape d))).
+  set (rwb := Nat.eqb (memv s1 (crw A)) 1). set (wrb := Nat.eqb (memv s1 (cwr A)) 1).
+  assert (WR : wrv A w (vw v1) = wrb) by (apply word1v_holds; assumption).
+  assert (RD : rdv A w (vw v1) = rdb) by (apply word1v_holds; assumption).
+  assert (RW : rwv A w (vw v1) = rwb) by (apply word1v_holds; assumption).
+  assert (Hlim2 : last (drew d) 0 < 2 ^ w).
+  { destruct (isnil (drew d)) eqn:En; [|rewrite Hlim by reflexivity; exact Htw].
+    destruct (drew d); [|discriminate]. cbn [last]. pose proof (Nat.pow_nonzero 2 w ltac:(lia)). lia. }
+  assert (EQ : eqv w (vw v1) = Nat.eqb (dhead d) (last (drew d) 0)) by (apply regs_eq; try assumption; lia).
+  assert (G : gv A w (vw v1) = rdb && okb).
+  { unfold gv, eotv, destv. rewrite RD, EQ, D1.
+    destruct (isnil (drew d)) eqn:En; cbn [negb andb].
+    - rewrite andb_false_r. cbn [negb]. rewrite andb_true_r.
+      destruct rdb eqn:Er; [|reflexivity]. symmetry. apply Nat.ltb_lt.
+      apply Hlate; [apply Nat.eqb_eq; exact Er | first [exact En | reflexivity]].
+    - rewrite andb_true_r, Hlim by (first [exact En | reflexivity]). unfold okb. f_equal.
+      destruct (Nat.eqb_spec (dhead d) (length (dtape d))), (Nat.ltb_spec (dhead d) (length (dtape d))); cbn [negb]; lia. }
+  assert (EOT : rdb = true -> eotv w (vw v1) = negb okb).
+  { intro Er. unfold eotv, destv. rewrite EQ, D1. destruct (isnil (drew d)) eqn:En; cbn [negb andb].
+    - rewrite andb_false_r. unfold okb. rewrite (proj2 (Nat.ltb_lt _ _)); [reflexivity|].
+      apply Hlate; [apply Nat.eqb_eq; exact Er | first [exact En | reflexivity]].
+    - rewrite andb_true_r, Hlim by (first [exact En | reflexivity]). unfold okb.
+      destruct (Nat.eqb_spec (dhead d) (length (dtape d))), (Nat.ltb_spec (dhead d) (length (dtape d))); cbn [negb]; lia. }
+  assert (CA : cav A w (vw v1) = wrb && isnil (drew d)) by (unfold cav, destv; rewrite WR, D1, negb_involutive; reflexivity).
+  assert (CC : ccv A w (vw v1) = wrb && negb (isnil (drew d))) by (unfold ccv, destv; rewrite WR, D1; reflexivity).
+  assert (CN : forall i, i < w -> cntv A w (vw v1) i = Nat.testbit (if rdb && okb then S (dhead d) else dhead d) i)
+    by (intros i Hi; rewrite (cntv_eq (vw v1) (dhead d) C1 i Hi), G; reflexivity).
+  assert (OB : outbits A w (vw v1) = nat2bits 8 (memv s1 (rout A))) by (apply outbits_eq; assumption).
+  (* the device *)
+  destruct (device_run A w W Lb L HA Hw HW v1 Q1 L1)
+    as (Q2 & L2 & H2 & A2 & C2 & R2 & RO2 & RI2 & CE02 & CE2 & RQ2 & CL2 & D2 & U2).
+  cbv zeta in Q2, L2, H2, A2, C2, R2, RO2, RI2, CE02, CE2, RQ2, CL2, D2, U2.
+  set (v2 := vrun Lb L (Stored.device A w nu lvs) v1) in *.
+  rewrite (pad_run Lb L p v2 Q2).
+  (* the hand-over *)
+  assert (HWh : 15 + 2 * w + A < W) by (pose proof HWs; unfold nH in *; nia).
+  destruct (handover_run A w W Lb L HWh v2 Q2 L2) as (Q3 & L3 & U3 & R3 & A3 & C3 & H3).
+  cbv zeta in Q3, L3, U3, R3, A3, C3, H3.
+  set (v3 := vrun Lb L (handover A w) v2) in *.
+  assert (Hh3 : wget (vw v2) (ST w A) = hhalt s1).
+  { rewrite U2 by (apply ST_ndevw; lia). rewrite S1 by (unfold nH; lia). apply nth_encodeH_halt. }
+  rewrite Hh3 in U3, A3, C3, H3.
+  assert (W3 : forall y, y <> BOOT -> wget (vw v3) y = wget (vw v2) y)
+    by (intros y Hy; rewrite U3, (proj2 (Nat.eqb_neq _ _) Hy); reflexivity).
+  destruct (device_pc A s1 d) as (Dp & Dh & Dl).
+  set (d' := snd (device A s1 d)).
+  assert (Hd' : dtape d' = dtape d
+             /\ dhead d' = (if rwb then 0 else if rdb && okb then S (dhead d) else dhead d)
+             /\ drew d' = (if rwb then drew d ++ [if rdb && okb then S (dhead d) else dhead d] else drew d)
+             /\ dout d' = (if wrb then dout d ++ [memv s1 (rout A) mod 256] else dout d))
+    by (unfold d', device; cbv zeta; cbn [snd dtape dhead drew dout]; repeat split).
+  destruct Hd' as (Td & Hdh & Hdr & Hdo).
+  rewrite Dh. unfold Rv. fold d'. rewrite Td, Hdh, Hdr, Hdo.
+  refine (conj Q3 (conj L3 (conj _ (conj _ (conj _ (conj (device_valid A HA s1 d Hv1 Hb8) (conj _ (conj _ (conj _
+            (conj _ (conj _ (conj _ (conj _ _))))))))))))).
+  - (* the hand-over flag *) rewrite H3, H2, H1, H0. reflexivity.
+  - (* booted *) rewrite U3, Nat.eqb_refl. rewrite U2 by (unfold devw; intro H; unfold BOOT, DB, CNT, LIM, DEST, MB, ST in *;
+      destruct H as [H|[(j & Hj & [E|E])|[E|(c0 & t & _ & Ht & E)]]]; lia). rewrite B1. reflexivity.
+  - (* the state of the host *)
+    apply holds_of; [exact Dl | | |].
+    + intros i Hi. rewrite W3 by (unfold ST, BOOT; lia). rewrite U2 by (apply ST_ndevw; lia).
+      rewrite S1 by (unfold nH; lia). rewrite nth_encodeH_pc by exact Hi. rewrite Dp. reflexivity.
+    + rewrite W3 by (unfold ST, BOOT; lia). rewrite Hh3. symmetry. apply Dh.
+    + intros j t Hj Ht. rewrite W3 by (pose proof (MB_range A w W HA Hw HW j t Hj Ht); unfold BOOT; lia).
+      rewrite (memv_device A HA s1 d j Hj). fold rdb okb wrb.
+      destruct (Nat.eqb_spec j (cwr A)) as [->|N1].
+      { cbn [orb]. rewrite RQ2 by (auto; lia). rewrite Nat.bits_0. reflexivity. }
+      destruct (Nat.eqb_spec j (crd A)) as [->|N2].
+      { cbn [orb]. rewrite RQ2 by (auto; lia). rewrite Nat.bits_0. reflexivity. }
+      destruct (Nat.eqb_spec j (crw A)) as [->|N3].
+      { cbn [orb]. rewrite RQ2 by (auto; lia). rewrite Nat.bits_0. reflexivity. }
+      cbn [orb].
+      destruct (Nat.eqb_spec j (rout A)) as [->|N4].
+      { rewrite RO2 by exact Ht. rewrite (holds_MB (vw v1) s1 (rout A) t S1 Hl1 I6 Ht), WR.
+        destruct wrb; cbn [negb]; [rewrite andb_false_r, Nat.bits_0 | rewrite andb_true_r]; reflexivity. }
+      destruct (Nat.eqb_spec j (rin A)) as [->|N5].
+      { rewrite RI2 by exact Ht. rewrite G, R1, R0.
+        destruct (rdb && okb) eqn:Eg.
+        - apply andb_prop in Eg as [_ Eo]. apply Nat.ltb_lt in Eo. unfold obt. cbn [td th].
+          rewrite read_bit by assumption.
+          rewrite testbit_sext by (try assumption; rewrite Forall_forall in Hb8; apply Hb8, nth_In; exact Eo).
+          reflexivity.
+        - apply (holds_MB (vw v1) s1 (rin A) t S1 Hl1 I5 Ht). }
+      destruct (Nat.eqb_spec j (ceot A)) as [->|N6].
+      { destruct (Nat.eq_dec t 0) as [->|Ht0].
+        - rewrite CE02, RD. destruct rdb eqn:Er.
+          + rewrite (EOT eq_refl). destruct okb; reflexivity.
+          + apply (holds_MB (vw v1) s1 (ceot A) 0 S1 Hl1 I2 Ht).
+        - rewrite CE2 by lia. rewrite RD, (holds_MB (vw v1) s1 (ceot A) t S1 Hl1 I2 Ht).
+          destruct rdb; cbn [negb]; [rewrite andb_false_r | rewrite andb_true_r; reflexivity].
+          destruct okb; [rewrite Nat.bits_0; reflexivity|]. symmetry. apply testbit_lt_false.
+          apply (Nat.lt_le_trans _ (2 ^ 1)); [cbn; lia | apply Nat.pow_le_mono_r; lia]. }
+      rewrite U2 by (apply MB_ndevw; assumption). apply holds_MB; assumption.
+  - (* the count *)
+    intros i Hi. rewrite W3 by (unfold CNT, BOOT; lia). rewrite (proj1 (CL2 i Hi)), CN, RW by exact Hi.
+    destruct rwb; cbn [negb]; [rewrite andb_false_r, Nat.bits_0 | rewrite andb_true_r]; reflexivity.
+  - (* the limit *)
+    intros i Hi. rewrite W3 by (unfold LIM, BOOT; lia). rewrite (proj2 (CL2 i Hi)), RW.
+    destruct rwb; [rewrite last_last; apply CN; exact Hi | apply M1; exact Hi].
+  - (* dest *)
+    rewrite W3 by (unfold DEST, BOOT; lia). rewrite D2. unfold destv. rewrite D1, RW.
+    destruct rwb; [rewrite orb_true_r; destruct (drew d); reflexivity | apply orb_false_r].
+  - (* the read tape *)
+    rewrite R3, R2, R1, R0, RW, G. unfold obt. cbn [td th]. f_equal.
+    destruct rwb; [symmetry; apply Nat.Div0.mod_0_l|].
+    destruct (rdb && okb); [|reflexivity]. rewrite adv_mod by exact HL. f_equal. lia.
+  - (* the arm *)
+    rewrite A3, A2, A1, A0, CA, OB. cbn [orb].
+    assert (Ea : (if wrb && isnil (drew d) then wseq Lb (nat2bits 8 (memv s1 (rout A))) (obt Lb o1 (length o1))
+                  else obt Lb o1 (length o1))
+                 = obt Lb (if wrb && isnil (drew d) then o1 ++ [memv s1 (rout A) mod 256] else o1)
+                       (length (if wrb && isnil (drew d) then o1 ++ [memv s1 (rout A) mod 256] else o1))).
+    { destruct (wrb && isnil (drew d)) eqn:Ew; [|reflexivity].
+      apply andb_prop in Ew as [Ew En]. apply wseq_byte. apply Hca; [apply Nat.eqb_eq; exact Ew | exact En]. }
+    rewrite Ea. destruct (hhalt s1); [|reflexivity]. unfold obt. cbn [td]. rewrite Nat.mul_0_r, Nat.Div0.mod_0_l.
+    reflexivity.
+  - (* the copy tape *)
+    rewrite C3, C2, V1, V0, CC, OB. cbn [orb].
+    assert (Ec : (if wrb && negb (isnil (drew d)) then wseq L (nat2bits 8 (memv s1 (rout A))) (obt L o2 (length o2))
+                  else obt L o2 (length o2))
+                 = obt L (if wrb && negb (isnil (drew d)) then o2 ++ [memv s1 (rout A) mod 256] else o2)
+                       (length (if wrb && negb (isnil (drew d)) then o2 ++ [memv s1 (rout A) mod 256] else o2))).
+    { destruct (wrb && negb (isnil (drew d))) eqn:Ew; [|reflexivity].
+      apply andb_prop in Ew as [Ew En]. apply wseq_byte. apply Hcc; [apply Nat.eqb_eq; exact Ew | destruct (isnil (drew d)); [discriminate | reflexivity]]. }
+    rewrite Ec. destruct (hhalt s1); [|reflexivity]. unfold obt. cbn [td]. rewrite Nat.mul_0_r, Nat.Div0.mod_0_l.
+    reflexivity.
+  - (* the output *)
+    rewrite O0. destruct wrb; [|reflexivity]. cbn [andb].
+    destruct (isnil (drew d)) eqn:En; cbn [negb].
+    + rewrite (N0 ltac:(first [exact En | reflexivity])), !app_nil_r. reflexivity.
+    + rewrite <- app_assoc. reflexivity.
+  - (* nothing after a rewind before one is requested *)
+    destruct rwb; [destruct (drew d); discriminate|]. intro En. rewrite (N0 En), En. destruct wrb; reflexivity.
+Qed.
+
+(* ---- a pass of the whole image ------------------------------------------------------------------------------- *)
+Lemma stored_split : stored A w = startup A w m ++ step_go A w nu 0 (host_units A) nt ++ Stored.device A w nu lvs
+  ++ repeat EMPTY (padn (alS A w) (length (startup A w m ++ step_go A w nu 0 (host_units A) nt ++ Stored.device A w nu lvs)))
+  ++ handover A w.
+Proof. unfold stored, alS, stored_of. cbv zeta. cbn [fst snd]. rewrite <- !app_assoc. reflexivity. Qed.
+
+(* the conditions under which a pass carries out the step from c *)
+Definition step_ok (c : hst * dev) (o1 o2 : list nat) : Prop :=
+  hhalt (fst c) = false /\ Forall (fun x => x < 256) (dtape (snd c)) /\ 8 * length (dtape (snd c)) <= L
+  /\ length (dtape (snd c)) < 2 ^ w /\ dhead (snd c) <= length (dtape (snd c))
+  /\ (isnil (drew (snd c)) = false -> last (drew (snd c)) 0 = length (dtape (snd c)))
+  /\ (memv (subleq A (fst c)) (crd A) = 1 -> isnil (drew (snd c)) = true -> dhead (snd c) < length (dtape (snd c)))
+  /\ (memv (subleq A (fst c)) (cwr A) = 1 -> isnil (drew (snd c)) = true -> 8 * S (length o1) <= Lb)
+  /\ (memv (subleq A (fst c)) (cwr A) = 1 -> isnil (drew (snd c)) = false -> 8 * S (length o2) <= L)
+  /\ 1 <= Lb /\ 1 <= L.
+
+(* the bytes emitted under the arm and under the copy head by the step from c *)
+Definition out1 (c : hst * dev) (o1 : list nat) : list nat :=
+  if Nat.eqb (memv (subleq A (fst c)) (cwr A)) 1 && isnil (drew (snd c))
+  then o1 ++ [memv (subleq A (fst c)) (rout A) mod 256] else o1.
+Definition out2 (c : hst * dev) (o2 : list nat) : list nat :=
+  if Nat.eqb (memv (subleq A (fst c)) (cwr A)) 1 && negb (isnil (drew (snd c)))
+  then o2 ++ [memv (subleq A (fst c)) (rout A) mod 256] else o2.
+
+Lemma pass_rest : forall c o1 o2 v p, Rv false c o1 o2 v -> step_ok c o1 o2 ->
+  Rv (hhalt (fst (tstep A c))) (tstep A c) (out1 c o1) (out2 c o2)
+     (vrun Lb L (step_go A w nu 0 (host_units A) nt ++ Stored.device A w nu lvs ++ repeat EMPTY p ++ handover A w) v).
+Proof.
+  intros c o1 o2 v p HR (H1 & H2 & H3 & H4 & H5 & H6 & H7 & H8 & H9 & H10 & H11).
+  exact (pass_step c o1 o2 v p HR H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 H11).
+Qed.
+
+(* a pass once booted *)
+Theorem pass_next : forall c o1 o2 v, Rv false c o1 o2 v -> step_ok c o1 o2 ->
+  Rv (hhalt (fst (tstep A c))) (tstep A c) (out1 c o1) (out2 c o2) (vrun Lb L (stored A w) v).
+Proof.
+  intros c o1 o2 v HR Hok. pose proof HR as (Q & Hl & _ & B & _).
+  rewrite stored_split, vrun_app, (startup_booted v Q Hl B). apply pass_rest; assumption.
+Qed.
+
+(* the first pass of a generation: the startup loads the initial state of the transducer on the tape, which
+   it then steps *)
+Theorem pass_first : forall v tau, reqclear (vw v) -> length (vw v) = W -> wget (vw v) BOOT = false -> vho v = false ->
+  td (vr v) = bbits tau ++ repeat false (L - 8 * length tau) -> step_ok (init A (progPstar A) tau) [] [] ->
+  Rv (hhalt (fst (tstep A (init A (progPstar A) tau)))) (tstep A (init A (progPstar A) tau))
+     (out1 (init A (progPstar A) tau) []) (out2 (init A (progPstar A) tau) []) (vrun Lb L (stored A w) v).
+Proof.
+  intros v tau Hq Hl Hb Hh Ht Hok. rewrite stored_split, vrun_app. apply pass_rest; [|exact Hok].
+  apply startup_first; assumption.
+Qed.
+
+End Pass.

rocq/StoredRun.v

@@ -0,0 +1,565 @@
+(* The stored host runs P* on a recipe by the dynamics of the ring machine (Theorem 8.6): a pass of its records
+   for each step of the transducer, the bytes it decodes written under the arm and the recipe under the copy
+   head, and the hand-over at the halt. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run PhysSem PhysMain View Stored WinRun ViewOps Host HostSem
+  Device Pstar StoredStep StoredBoot StoredDev StoredPass StoredOk.
+
+(* ---- lists that grow at their end ------------------------------------------------------------------------ *)
+Definition prefix (a b : list nat) : Prop := exists o, b = a ++ o.
+
+Lemma prefix_refl : forall a, prefix a a.
+Proof. intro a. exists []. rewrite app_nil_r. reflexivity. Qed.
+
+Lemma prefix_trans : forall a b c, prefix a b -> prefix b c -> prefix a c.
+Proof. intros a b c [o1 ->] [o2 ->]. exists (o1 ++ o2). rewrite app_assoc. reflexivity. Qed.
+
+Lemma prefix_length : forall a b, prefix a b -> length a <= length b.
+Proof. intros a b [o ->]. rewrite length_app. lia. Qed.
+
+Lemma prefix_nil : forall a, prefix a [] -> a = [].
+Proof. intros a [o E]. destruct a; [reflexivity | discriminate]. Qed.
+
+Lemma prefix_app : forall a b c, prefix (a ++ b) (a ++ c) -> prefix b c.
+Proof. intros a b c [o E]. exists o. rewrite <- app_assoc in E. apply app_inv_head in E. exact E. Qed.
+
+Lemma prefix_antisym : forall a b, prefix a b -> prefix b a -> a = b.
+Proof.
+  intros a b [o1 E1] [o2 E2]. rewrite E1, <- app_assoc in E2.
+  assert (Hl : length (o1 ++ o2) = 0) by (apply (f_equal (@length nat)) in E2; rewrite length_app in E2; lia).
+  destruct o1; [rewrite app_nil_r in E1; symmetry; exact E1 | cbn in Hl; lia].
+Qed.
+
+(* ---- the device along a run ---------------------------------------------------------------------------------- *)
+Section Dev.
+Variable A : nat.
+
+Lemma tstep_snd : forall c,
+  dtape (snd (tstep A c)) = dtape (snd c)
+  /\ dout (snd (tstep A c)) = (if Nat.eqb (memv (subleq A (fst c)) (cwr A)) 1
+                               then dout (snd c) ++ [memv (subleq A (fst c)) (rout A) mod 256] else dout (snd c))
+  /\ prefix (drew (snd c)) (drew (snd (tstep A c)))
+  /\ dlate (snd (tstep A c)) = dlate (snd c) || (Nat.eqb (memv (subleq A (fst c)) (crd A)) 1
+                                && negb (Nat.ltb (dhead (snd c)) (length (dtape (snd c)))) && isnil (drew (snd c)))
+  /\ (dhead (snd c) <= length (dtape (snd c)) -> dhead (snd (tstep A c)) <= length (dtape (snd c))).
+Proof.
+  intro c. unfold tstep, device. cbv zeta. cbn [snd dtape dout drew dlate dhead].
+  refine (conj eq_refl (conj eq_refl (conj _ (conj _ _)))).
+  - destruct (Nat.eqb (memv (subleq A (fst c)) (crw A)) 1); [eexists; reflexivity | apply prefix_refl].
+  - unfold isnil. reflexivity.
+  - intro H. destruct (Nat.eqb (memv (subleq A (fst c)) (crw A)) 1); [lia|].
+    destruct (_ && _) eqn:E; [|exact H]. apply andb_prop in E as [_ E]. apply Nat.ltb_lt in E. lia.
+Qed.
+
+Lemma trun_snd : forall n c,
+  dtape (snd (trun A n c)) = dtape (snd c) /\ prefix (dout (snd c)) (dout (snd (trun A n c)))
+  /\ prefix (drew (snd c)) (drew (snd (trun A n c))) /\ (dlate (snd c) = true -> dlate (snd (trun A n c)) = true)
+  /\ (dhead (snd c) <= length (dtape (snd c)) -> dhead (snd (trun A n c)) <= length (dtape (snd c))).
+Proof.
+  induction n as [|n IH]; intro c; cbn [trun].
+  - exact (conj eq_refl (conj (prefix_refl _) (conj (prefix_refl _) (conj (fun H => H) (fun H => H))))).
+  - destruct (tstep_snd c) as (T1 & O1 & R1 & D1 & H1). destruct (IH (tstep A c)) as (T2 & O2 & R2 & D2 & H2).
+    rewrite T1 in T2, H2. refine (conj T2 (conj _ (conj (prefix_trans _ _ _ R1 R2) (conj _ _)))).
+    + eapply prefix_trans; [|exact O2]. rewrite O1. destruct (_ =? 1); [eexists; reflexivity | apply prefix_refl].
+    + intro H. apply D2. rewrite D1, H. reflexivity.
+    + intro H. apply H2, H1, H.
+Qed.
+
+Lemma trun_S : forall n c, trun A (S n) c = tstep A (trun A n c).
+Proof. intros n c. replace (S n) with (n + 1) by lia. rewrite trun_add. reflexivity. Qed.
+
+End Dev.
+
+(* ---- the run of P* on a recipe, in three phases ---------------------------------------------------------- *)
+Section Phases.
+Variables (A : nat) (ks : list token).
+Hypotheses (HA : 8 <= A) (Hks : Forall tok_ok ks).
+
+Local Notation tau := (recipe ks).
+Definition c0 : hst * dev := init A (progPstar A) (recipe ks).
+Definition n0 : nat := dsteps ks + 7.
+Definition NN : nat := dsteps ks + 7 + 1 + (6 * length (recipe ks) + 2).
+Definition cr (t : nat) : hst * dev := trun A t c0.
+
+Lemma Htl : length (tailS A) <= 7.
+Proof. cbn. lia. Qed.
+
+(* the decoding: the decoded bytes emitted and the head at the end of the recipe *)
+Lemma phase_A : Reach A c0 n0 (fun c => At A (tailS A) tau c 60 (V 0 0 0 0 0 1 0) (length tau) (delta ks) false []).
+Proof.
+  destruct (end_At A HA (tailS A) Htl tau ks eq_refl) as (E1 & E2 & E3).
+  assert (Hs : skipn 0 tau = concat (map enc ks) ++ [0]) by reflexivity.
+  unfold n0, c0. rewrite E3.
+  apply (reach_seq A _ (dsteps ks) 7
+    (fun c => exists t1 t2 r e, At A (tailS A) tau c 0 (V t1 t2 0 r 0 1 e) (length (concat (map enc ks))) (delta ks) false [])).
+  - eapply reach_mono; [exact (decode A HA (tailS A) Htl tau ks _ 0 0 0 0 1 0 [] false [] [0] Hks
+                                 (init_At A HA (tailS A) Htl tau) Hs)|].
+    intros c (t1 & t2 & r & e & St). exists t1, t2, r, e. exact St.
+  - intros c (t1 & t2 & r & e & St). exact (end_tok A HA (tailS A) Htl tau c t1 t2 r e 1 _ (delta ks) false [] St E1 E2).
+Qed.
+
+(* the rewind *)
+Lemma phase_R : Reach A c0 (S n0) (fun c => At A (tailS A) tau c 63 (V 0 0 0 0 0 1 0) 0 (delta ks) false [length tau]).
+Proof.
+  replace (S n0) with (n0 + 1) by lia. apply (reach_seq A _ n0 1 _ _ phase_A).
+  intros c St. exact (rew_S A HA (tailS A) Htl tau eq_refl c _ _ _ _ _ St).
+Qed.
+
+(* the copy *)
+Lemma phase_B : Reach A c0 NN (fun c => hhalt (fst c) = true
+                                        /\ snd c = mkD tau (length tau) (delta ks ++ tau) false [length tau]).
+Proof.
+  unfold NN. replace (dsteps ks + 7 + 1 + (6 * length tau + 2)) with (S n0 + (6 * length tau + 2)) by (unfold n0; lia).
+  apply (reach_seq A _ (S n0) _ _ _ phase_R). intros c St.
+  apply (copy_loop A HA (tailS A) Htl tau eq_refl tau c 0 0 0 0 0 (delta ks) [length tau] St); [reflexivity | lia | discriminate|].
+  apply recipe_bytes. exact Hks.
+Qed.
+
+Lemma not_halted : forall t, t < NN -> hhalt (fst (cr t)) = false.
+Proof. intros t Ht. exact (proj1 phase_B t Ht). Qed.
+
+Lemma at_n0 : snd (cr n0) = mkD tau (length tau) (delta ks) false [].
+Proof. destruct (proj2 phase_A) as (_ & _ & _ & _ & _ & E). exact E. Qed.
+
+Lemma at_n1 : snd (cr (S n0)) = mkD tau 0 (delta ks) false [length tau].
+Proof. destruct (proj2 phase_R) as (_ & _ & _ & _ & _ & E). exact E. Qed.
+
+Lemma at_NN : hhalt (fst (cr NN)) = true /\ snd (cr NN) = mkD tau (length tau) (delta ks ++ tau) false [length tau].
+Proof. exact (proj2 phase_B). Qed.
+
+Lemma n0_NN : S n0 < NN.
+Proof. unfold n0, NN. lia. Qed.
+
+Lemma cr_S : forall t, cr (S t) = tstep A (cr t).
+Proof. intro t. unfold cr. apply trun_S. Qed.
+
+Lemma cr_add : forall t k, cr (t + k) = trun A k (cr t).
+Proof. intros t k. unfold cr. apply trun_add. Qed.
+
+(* ---- the device along the run ----------------------------------------------------------------------------- *)
+Lemma inv_tape : forall t, dtape (snd (cr t)) = tau.
+Proof. intro t. unfold cr. rewrite (proj1 (trun_snd A t c0)). reflexivity. Qed.
+
+Lemma inv_head : forall t, dhead (snd (cr t)) <= length tau.
+Proof.
+  intro t. unfold cr. destruct (trun_snd A t c0) as (_ & _ & _ & _ & H). apply H. cbn. lia.
+Qed.
+
+Lemma inv_early : forall t, t <= n0 -> drew (snd (cr t)) = [] /\ prefix (dout (snd (cr t))) (delta ks).
+Proof.
+  intros t Ht. pose proof (cr_add t (n0 - t)) as E. replace (t + (n0 - t)) with n0 in E by lia.
+  destruct (trun_snd A (n0 - t) (cr t)) as (_ & O & R & _ & _). rewrite <- E, at_n0 in O, R. cbn [drew dout] in O, R.
+  split; [apply prefix_nil, R | exact O].
+Qed.
+
+Lemma inv_late : forall t, S n0 <= t <= NN ->
+  drew (snd (cr t)) = [length tau] /\ exists o, dout (snd (cr t)) = delta ks ++ o /\ prefix o tau.
+Proof.
+  intros t Ht. pose proof (cr_add (S n0) (t - S n0)) as E1. replace (S n0 + (t - S n0)) with t in E1 by lia.
+  pose proof (cr_add t (NN - t)) as E2. replace (t + (NN - t)) with NN in E2 by lia.
+  destruct (trun_snd A (t - S n0) (cr (S n0))) as (_ & O1 & R1 & _ & _). rewrite <- E1, at_n1 in O1, R1.
+  destruct (trun_snd A (NN - t) (cr t)) as (_ & O2 & R2 & _ & _). rewrite <- E2, (proj2 at_NN) in O2, R2.
+  cbn [drew dout] in O1, R1, O2, R2. split; [exact (eq_sym (prefix_antisym _ _ R1 R2))|].
+  destruct O1 as [o Eo]. exists o. split; [exact Eo|]. rewrite Eo in O2. exact (prefix_app _ _ _ O2).
+Qed.
+
+Lemma inv_nolate : forall t, t <= NN -> dlate (snd (cr t)) = false.
+Proof.
+  intros t Ht. pose proof (cr_add t (NN - t)) as E. replace (t + (NN - t)) with NN in E by lia.
+  destruct (dlate (snd (cr t))) eqn:D; [|reflexivity].
+  destruct (trun_snd A (NN - t) (cr t)) as (_ & _ & _ & L & _). specialize (L D). rewrite <- E, (proj2 at_NN) in L.
+  discriminate.
+Qed.
+
+(* no byte is requested at the end of the tape before the rewind *)
+Lemma inv_read : forall t, t < NN -> memv (subleq A (fst (cr t))) (crd A) = 1 -> isnil (drew (snd (cr t))) = true ->
+  dhead (snd (cr t)) < length (dtape (snd (cr t))).
+Proof.
+  intros t Ht Hrd Hn. destruct (Nat.ltb_spec (dhead (snd (cr t))) (length (dtape (snd (cr t))))) as [H|H]; [exact H|].
+  exfalso. pose proof (inv_nolate (S t) ltac:(lia)) as L. rewrite cr_S in L.
+  destruct (tstep_snd A (cr t)) as (_ & _ & _ & D & _). rewrite D, Hrd, Hn in L. cbn [Nat.eqb andb orb] in L.
+  rewrite (proj2 (Nat.ltb_ge _ _) H) in L. rewrite orb_true_r in L. discriminate.
+Qed.
+
+(* ---- the bytes written under the arm and under the copy head ----------------------------------------------- *)
+Fixpoint outs (t : nat) : list nat * list nat :=
+  match t with
+  | O => ([], [])
+  | S t' => (out1 A (cr t') (fst (outs t')), out2 A (cr t') (snd (outs t')))
+  end.
+
+Lemma outs_early : forall t, t <= S n0 -> fst (outs t) = dout (snd (cr t)) /\ snd (outs t) = [].
+Proof.
+  induction t as [|t IH]; intro Ht; [split; reflexivity|].
+  destruct (IH ltac:(lia)) as [O1 O2]. destruct (inv_early t ltac:(lia)) as [Rn _].
+  cbn [outs fst snd]. unfold out1, out2. rewrite Rn, O1, O2. cbn [isnil negb]. rewrite andb_false_r, andb_true_r.
+  split; [|reflexivity]. rewrite cr_S. destruct (tstep_snd A (cr t)) as (_ & Eo & _). rewrite Eo. reflexivity.
+Qed.
+
+Lemma outs_late : forall t, S n0 <= t <= NN -> fst (outs t) = delta ks /\ dout (snd (cr t)) = delta ks ++ snd (outs t).
+Proof.
+  intros t Ht. induction t as [|t IH]; [lia|].
+  destruct (Nat.eq_dec (S t) (S n0)) as [E|E].
+  - injection E as ->. destruct (outs_early (S n0) (le_n _)) as [O1 O2]. rewrite O1, O2, at_n1. cbn [dout].
+    rewrite app_nil_r. split; reflexivity.
+  - destruct (IH ltac:(lia)) as [O1 O2]. destruct (inv_late t ltac:(lia)) as [Rn _].
+    cbn [outs fst snd]. unfold out1, out2. rewrite Rn, O1. cbn [isnil negb]. rewrite andb_false_r, andb_true_r.
+    split; [reflexivity|]. rewrite cr_S. destruct (tstep_snd A (cr t)) as (_ & Eo & _). rewrite Eo, O2.
+    destruct (_ =? 1); [rewrite app_assoc|]; reflexivity.
+Qed.
+
+Lemma cap1 : forall t, t < NN -> memv (subleq A (fst (cr t))) (cwr A) = 1 -> isnil (drew (snd (cr t))) = true ->
+  S (length (fst (outs t))) <= length (delta ks).
+Proof.
+  intros t Ht Hwr Hn. destruct (Nat.le_gt_cases t n0) as [H|H].
+  2:{ rewrite (proj1 (inv_late t ltac:(lia))) in Hn. discriminate. }
+  destruct (outs_early (S t) ltac:(lia)) as [O1 _]. cbn [outs fst] in O1. unfold out1 in O1. rewrite Hn, Hwr in O1.
+  cbn [Nat.eqb andb] in O1. apply (f_equal (@length nat)) in O1. rewrite length_app in O1. cbn [length] in O1.
+  rewrite Nat.add_1_r in O1. rewrite O1.
+  destruct (Nat.eq_dec (S t) (S n0)) as [E|E].
+  - rewrite E, at_n1. cbn [dout]. lia.
+  - apply prefix_length. exact (proj2 (inv_early (S t) ltac:(lia))).
+Qed.
+
+Lemma cap2 : forall t, t < NN -> memv (subleq A (fst (cr t))) (cwr A) = 1 -> isnil (drew (snd (cr t))) = false ->
+  S (length (snd (outs t))) <= length tau.
+Proof.
+  intros t Ht Hwr Hn. destruct (Nat.le_gt_cases t n0) as [H|H].
+  { rewrite (proj1 (inv_early t H)) in Hn. discriminate. }
+  destruct (outs_late (S t) ltac:(lia)) as [_ O2]. destruct (inv_late (S t) ltac:(lia)) as [_ (o & Eo & Po)].
+  rewrite Eo in O2. apply app_inv_head in O2. cbn [outs snd] in O2. unfold out2 in O2. rewrite Hn, Hwr in O2.
+  cbn [Nat.eqb negb andb] in O2. apply prefix_length in Po. rewrite O2, length_app in Po. cbn [length] in Po. lia.
+Qed.
+
+End Phases.
+
+(* ---- the hand-over request ------------------------------------------------------------------------------------ *)
+Section Ho.
+Variables (Lb L : nat).
+
+Lemma vexec_vho_mono : forall r v, vho v = true -> vho (vexec Lb L r v) = true.
+Proof. intros r v H. unfold vexec, vput. cbn [vho]. rewrite H. reflexivity. Qed.
+
+Lemma vrun_vho_mono : forall l v, vho v = true -> vho (vrun Lb L l v) = true.
+Proof. induction l as [|r l IH]; intros v H; [exact H|]. cbn [vrun]. apply IH, vexec_vho_mono, H. Qed.
+
+Lemma vexec_noho : forall r v, reqclear (vw v) -> ao_of r <> HO ->
+  vho (vexec Lb L r v) = vho v /\ reqclear (vw (vexec Lb L r v)).
+Proof.
+  intros r v Hq Ho. unfold vexec, vput. cbn [vho vw]. split.
+  - unfold wnext. destruct (Nat.leb (ao_of r) CPY); [rewrite (Hq HO) by (unfold AR, HO; lia)|].
+    + apply orb_false_r.
+    + rewrite wget_upd. replace (Nat.eqb HO (ao_of r)) with false by (symmetry; apply Nat.eqb_neq; congruence).
+      rewrite (Hq HO) by (unfold AR, HO; lia). apply orb_false_r.
+  - intros c Hc. apply wget_clearq_req. exact Hc.
+Qed.
+
+Lemma vrun_noho : forall l v, reqclear (vw v) -> Forall (fun r => ao_of r <> HO) l -> vho (vrun Lb L l v) = vho v.
+Proof.
+  induction l as [|r l IH]; intros v Hq Hf; [reflexivity|]. apply Forall_cons_iff in Hf as [Hr Hf].
+  cbn [vrun]. destruct (vexec_noho r v Hq Hr) as [E Q]. rewrite IH by assumption. exact E.
+Qed.
+
+End Ho.
+
+Lemma Forall_firstn' : forall (T : Type) (P : T -> Prop) l j, Forall P l -> Forall P (firstn j l).
+Proof. intros T P l j H. rewrite <- (firstn_skipn j l) in H. apply Forall_app in H. exact (proj1 H). Qed.
+
+Lemma wrec_noho : forall r, wrec r -> ao_of r <> HO.
+Proof. intros [a0 w0 a1 w1 beta ao] (_ & _ & H). cbn [ao_of]. unfold SINK, HO in *. lia. Qed.
+
+(* ---- the records of the stored host but the last request no hand-over --------------------------------------- *)
+Section Body.
+Variables (A w : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w).
+
+Local Notation nu := (length (host_units A)).
+Local Notation lvs := (levels (host_units A)).
+Local Notation m := (image A (progPstar A)).
+
+Definition body : list rec :=
+  startup A w m ++ step_go A w nu 0 (host_units A) (next_tbl (nH A) nu (host_next A)) ++ Stored.device A w nu lvs
+  ++ repeat EMPTY (padn (alS A w) (length (startup A w m ++ step_go A w nu 0 (host_units A) (next_tbl (nH A) nu (host_next A))
+                                             ++ Stored.device A w nu lvs)))
+  ++ [gAND (BOOT, true) (ST w A, false) BOOT; gCOPY (ST w A, true) RA; gCOPY (ST w A, true) RC].
+
+Lemma stored_body : stored A w = body ++ [gCOPY (ST w A, true) HO].
+Proof. rewrite (stored_split A w). unfold body, handover. rewrite <- !app_assoc. reflexivity. Qed.
+
+Lemma body_noho : Forall (fun r => ao_of r <> HO) body.
+Proof.
+  pose proof (HWs A w HA Hw) as HW'. pose proof (HW A w HA Hw) as HWn.
+  unfold body. rewrite !Forall_app. refine (conj _ (conj _ (conj _ (conj _ _)))).
+  - rewrite (startup_split A w m (length_image A)). rewrite !Forall_app. refine (conj _ (conj _ _)).
+    + apply Forall_forall. intros r Hr. pose proof (wpart_ao_range A w _ m ltac:(lia) (length_image A) HW' r Hr).
+      unfold HO. lia.
+    + unfold req_recs. cbn [map]. repeat constructor; cbn [ao_of gCOPY]; unfold RR, CB, RA, CT, RC, HO; lia.
+    + constructor; [cbn [ao_of gCONST gOR]; unfold BOOT, HO; lia | constructor].
+  - eapply Forall_impl; [exact wrec_noho|]. exact (step_wrec A w _ ltac:(lia) HWn (repeat false _) (repeat_length _ _)).
+  - rewrite device_split.
+    assert (Hm0 : M0 A w nu lvs <> HO /\ M1 A w nu lvs <> HO) by (unfold M0, M1, DB, HO; lia). destruct Hm0 as [Hm0 Hm1].
+    apply Forall_app; split; [|apply Forall_app; split; [|apply Forall_app; split; [|apply Forall_app; split;
+      [|apply Forall_app; split; [|apply Forall_app; split]]]]].
+    + eapply Forall_impl; [exact wrec_noho | exact (chunk1_wrec A w _ HA Hw HWn)].
+    + unfold segE. apply Forall_concat, Forall_map, Forall_forall. intros k _. unfold gMUX. cbn [app].
+      repeat constructor; cbn [ao_of gAND gOR gCOPY]; first [exact Hm0 | exact Hm1 | unfold ARM, AA, CPY, AC, HO; lia].
+    + eapply Forall_impl; [exact wrec_noho | exact (chunk2_wrec A w _ HA Hw HWn)].
+    + unfold segH. apply Forall_concat, Forall_map, Forall_forall. intros k Hk. apply in_seq in Hk. unfold gMUX. cbn [app].
+      pose proof (io_lt A w _ HA Hw HWn) as (_ & _ & _ & _ & Hri & _).
+      pose proof (MB_range A w _ HA Hw HWn (rin A) (7 - k) Hri ltac:(lia)).
+      repeat constructor; cbn [ao_of gAND gOR gCOPY]; first [exact Hm0 | exact Hm1 | unfold AR, HO in *; lia].
+    + eapply Forall_impl; [exact wrec_noho | exact (chunk3_wrec A w _ HA Hw HWn)].
+    + unfold segN. repeat constructor. cbn [ao_of gCOPY]. unfold RR, HO. lia.
+    + eapply Forall_impl; [exact wrec_noho | exact (chunk4_wrec A w _ HA Hw HWn)].
+  - apply Forall_forall. intros r Hr. apply repeat_spec in Hr. subst r. cbn. unfold HO. lia.
+  - repeat constructor; cbn [ao_of gAND gCOPY]; unfold BOOT, RA, RC, HO; lia.
+Qed.
+
+End Body.
+
+(* ---- a pass of the machine ------------------------------------------------------------------------------------- *)
+Section Mach.
+Variables (A w K S0 L : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w) (HK : 2 <= K) (HS : length (stored A w) <= S0) (HL : 1 <= L).
+
+Local Notation al := (alS A w).
+Local Notation rs := (stored A w).
+Local Notation G := (length (stored A w)).
+Local Notation Lb := (S0 * recw (alS A w)).
+
+Lemma al4 : 4 <= al.
+Proof.
+  pose proof (HW A w HA Hw) as H.
+  assert (Hn : 16 <= ncells A w (length (host_units A)) (levels (host_units A))) by (unfold ncells, DB; lia).
+  destruct (Nat.le_gt_cases 4 al) as [E|E]; [exact E|]. exfalso.
+  assert (Hp : 2 ^ al <= 2 ^ 3) by (apply Nat.pow_le_mono_r; lia). change (2 ^ 3) with 8 in Hp. lia.
+Qed.
+
+Lemma G_ge : 4 <= G.
+Proof. rewrite (stored_body A w). rewrite length_app. unfold body. rewrite !length_app. cbn [length]. lia. Qed.
+
+Lemma S0_pos : 1 <= S0.
+Proof. pose proof G_ge. lia. Qed.
+
+Lemma Lb_pos : 1 <= Lb.
+Proof. pose proof S0_pos. unfold recw. nia. Qed.
+
+Lemma nat2bits_0 : forall k, nat2bits k 0 = repeat false k.
+Proof. induction k as [|k IH]; [reflexivity|]. cbn [nat2bits repeat]. rewrite IH, Nat.bits_0. reflexivity. Qed.
+
+Lemma enc_empty : enc_recA al EMPTY = repeat false (recw al).
+Proof.
+  unfold enc_recA, EMPTY, enc_w. cbn [Z.eqb]. change (Z.to_nat (0 mod 16)) with 0. rewrite !nat2bits_0.
+  change [false; false] with (repeat false 2). rewrite <- !repeat_app. f_equal; unfold recw; lia.
+Qed.
+
+Lemma encA_repeat : forall k, encA al (repeat EMPTY k) = repeat false (k * recw al).
+Proof.
+  induction k as [|k IH]; [reflexivity|]. cbn [repeat]. unfold encA in *. cbn [map concat].
+  rewrite IH, enc_empty, <- repeat_app. f_equal; lia.
+Qed.
+
+(* the active bank holds the image from its first slot, followed by empty slots *)
+Definition img : list bool := encA al rs ++ repeat false ((S0 - G) * recw al).
+
+Lemma img_pad : encA al (rs ++ repeat EMPTY (S0 - G)) = img ++ [].
+Proof. rewrite encA_app, encA_repeat, app_nil_r. reflexivity. Qed.
+
+Lemma ok_pad : Forall (rec_ok al) (rs ++ repeat EMPTY (S0 - G)).
+Proof.
+  apply Forall_app. split; [exact (stored_ok A w HA Hw)|]. apply Forall_forall. intros r Hr. apply repeat_spec in Hr.
+  subst r. pose proof (Nat.pow_nonzero 2 al ltac:(lia)). unfold rec_ok, EMPTY. lia.
+Qed.
+
+(* a pass: the records of the image, in G steps if they hand over and otherwise in S0 *)
+Lemma machine_pass : forall s0 h c o1 o2,
+  fits al K S0 L s0 -> bq (nth (kap s0) (banks s0) bank0) = img -> bs (nth (kap s0) (banks s0) bank0) = 0 ->
+  reqclear (win s0) -> Rv A w Lb L h c o1 o2 (vrun Lb L rs (view0 al K s0)) ->
+  View.mv al K S0 L s0 (if h then G else S0) (itern al K S0 L (if h then G else S0) s0) (vrun Lb L rs (view0 al K s0)).
+Proof.
+  intros s0 h c o1 o2 Hf Hb Hs Hq HR. destruct HR as (Q & _ & Hh & _).
+  pose proof al4 as Hal. pose proof S0_pos as HS0.
+  assert (Hq0 : reqclear (vw (view0 al K s0))) by exact Hq.
+  destruct h.
+  - pose proof (seg_run al K S0 L s0 Hal HK HS0 HL Hf rs (repeat false ((S0 - G) * recw al)) Hb Hs HS
+                  (stored_ok A w HA Hw)) as SR.
+    assert (Hho : forall j, 1 <= j < G -> vho (vrun (S0 * recw al) L (firstn j rs) (view0 al K s0)) = false).
+    { intros j Hj. rewrite (stored_body A w), firstn_app.
+      replace (j - length (body A w)) with 0 by (rewrite (stored_body A w), length_app in Hj; cbn [length] in Hj; lia).
+      rewrite firstn_O, app_nil_r. rewrite vrun_noho by (try exact Hq0; apply Forall_firstn', (body_noho A w HA Hw)).
+      reflexivity. }
+    pose proof (SR Hho G (le_n _)) as M. rewrite firstn_all in M. exact M.
+  - pose proof (seg_run al K S0 L s0 Hal HK HS0 HL Hf (rs ++ repeat EMPTY (S0 - G)) [] ltac:(rewrite img_pad, !app_nil_r; exact Hb) Hs
+                  ltac:(rewrite length_app, repeat_length; lia) ok_pad) as SR.
+    assert (Hfull : vrun Lb L (rs ++ repeat EMPTY (S0 - G)) (view0 al K s0) = vrun Lb L rs (view0 al K s0))
+      by (rewrite vrun_app; apply pad_run, Q).
+    assert (Hho : forall j, 1 <= j < length (rs ++ repeat EMPTY (S0 - G)) ->
+                  vho (vrun (S0 * recw al) L (firstn j (rs ++ repeat EMPTY (S0 - G))) (view0 al K s0)) = false).
+    { intros j _. destruct (vho (vrun (S0 * recw al) L (firstn j (rs ++ repeat EMPTY (S0 - G))) (view0 al K s0))) eqn:E;
+        [|reflexivity].
+      exfalso. pose proof (vrun_vho_mono Lb L (skipn j (rs ++ repeat EMPTY (S0 - G))) _ E) as E'.
+      rewrite <- vrun_app, firstn_skipn, Hfull, Hh in E'. discriminate. }
+    pose proof (SR Hho S0 ltac:(rewrite length_app, repeat_length; lia)) as M.
+    rewrite firstn_all2 in M by (rewrite length_app, repeat_length; lia). rewrite Hfull in M. exact M.
+Qed.
+
+(* a pass that does not hand over leaves the state it started from but for the window, the idle bank and the
+   copy tape, and the view it ends in is the view of the next pass *)
+Lemma bank_eta0 : forall q, bs q = 0 -> mkB (bq q) 0 (bj q) = q.
+Proof. intros [q s j] H. cbn in H. subst s. reflexivity. Qed.
+
+Lemma mv_next : forall s0 s v, bs (nth (kap s0) (banks s0) bank0) = 0 ->
+  View.mv al K S0 L s0 S0 s v -> vho v = false ->
+  fits al K S0 L s /\ kap s = kap s0 /\ nth (kap s0) (banks s) bank0 = nth (kap s0) (banks s0) bank0
+  /\ (forall x, x < K -> x <> kap s0 -> x <> succ_mod K (kap s0) ->
+        nth x (banks s) bank0 = nth x (banks s0) bank0 /\ nth x (tapes s) tape0 = nth x (tapes s0) tape0)
+  /\ view0 al K s = v.
+Proof.
+  intros s0 s v Hb0 (Hf & Hwn & Hk & Ha & HI & HR & HC & Ho) Hh. rewrite Hh in Hk.
+  refine (conj Hf (conj Hk (conj _ (conj Ho _)))).
+  - rewrite Ha, Hb0, Nat.add_0_l, Nat.Div0.mod_same. apply bank_eta0. exact Hb0.
+  - unfold view0. rewrite Hk, Hwn, HR, HC, HI. transitivity (mkV (vw v) (vr v) (va v) (vc v) (vho v));
+      [rewrite Hh; reflexivity | symmetry; apply view_eta].
+Qed.
+
+End Mach.
+
+(* ---- the passes of a generation: Theorem 8.6 ------------------------------------------------------------------ *)
+Section Gen.
+Variables (A w K S0 L : nat) (ks : list token).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w) (HK : 2 <= K) (HS : length (stored A w) <= S0) (HL : 1 <= L)
+  (Hks : Forall tok_ok ks) (Ht1 : 8 * length (recipe ks) <= L) (Ht2 : length (recipe ks) < 2 ^ w)
+  (Hd : 8 * length (delta ks) <= S0 * recw (alS A w)).
+
+Local Notation al := (alS A w).
+Local Notation rs := (stored A w).
+Local Notation G := (length (stored A w)).
+Local Notation Lb := (S0 * recw (alS A w)).
+Local Notation tau := (recipe ks).
+
+(* the views the passes start from *)
+Fixpoint vpass (n : nat) (v : view) : view := match n with O => v | S n' => vrun Lb L rs (vpass n' v) end.
+
+Lemma ok_at : forall t, t < NN ks -> step_ok A w Lb L (cr A ks t) (fst (outs A ks t)) (snd (outs A ks t)).
+Proof.
+  intros t Ht. pose proof (Lb_pos A w K S0 L HA Hw HK HS HL) as HLb.
+  unfold step_ok. rewrite (inv_tape A ks t).
+  refine (conj (not_halted A ks HA Hks t Ht) (conj (recipe_bytes ks Hks) (conj Ht1 (conj Ht2
+            (conj (inv_head A ks HA t) (conj _ (conj _ (conj _ (conj _ (conj HLb HL)))))))))).
+  - intro Hn. destruct (Nat.le_gt_cases t (n0 ks)) as [H|H].
+    + rewrite (proj1 (inv_early A ks HA Hks t H)) in Hn. discriminate.
+    + rewrite (proj1 (inv_late A ks HA Hks t ltac:(lia))). reflexivity.
+  - intros Hrd Hn. pose proof (inv_read A ks HA Hks t Ht Hrd Hn) as R. rewrite (inv_tape A ks t) in R. exact R.
+  - intros Hwr Hn. pose proof (cap1 A ks HA Hks t Ht Hwr Hn). lia.
+  - intros Hwr Hn. pose proof (cap2 A ks HA Hks t Ht Hwr Hn). lia.
+Qed.
+
+(* the state t passes into a generation started from s0 *)
+Definition PI (s0 : st) (t : nat) (s : st) : Prop :=
+  fits al K S0 L s /\ kap s = kap s0 /\ nth (kap s0) (banks s) bank0 = nth (kap s0) (banks s0) bank0
+  /\ (forall x, x < K -> x <> kap s0 -> x <> succ_mod K (kap s0) ->
+        nth x (banks s) bank0 = nth x (banks s0) bank0 /\ nth x (tapes s) tape0 = nth x (tapes s0) tape0)
+  /\ view0 al K s = vpass t (view0 al K s0)
+  /\ Rv A w Lb L false (cr A ks t) (fst (outs A ks t)) (snd (outs A ks t)) (view0 al K s).
+
+(* the hypothesis of Theorem 8.6: the image in the active bank from its first slot, the slot head there, the
+   recipe on the read tape from its first cell, booted clear and the requests clear *)
+Definition ready (s0 : st) : Prop :=
+  fits al K S0 L s0 /\ bq (nth (kap s0) (banks s0) bank0) = img A w S0 /\ bs (nth (kap s0) (banks s0) bank0) = 0
+  /\ reqclear (win s0) /\ wget (win s0) BOOT = false
+  /\ td (nth (kap s0) (tapes s0) tape0) = bbits tau ++ repeat false (L - 8 * length tau).
+
+Lemma passes : forall s0, ready s0 -> forall t, 1 <= t < NN ks -> PI s0 t (itern al K S0 L (t * S0) s0).
+Proof.
+  intros s0 (Hf & Hb & Hs & Hq & Hboot & Htd) t. induction t as [|t IH]; intro Ht; [lia|].
+  destruct (Nat.eq_dec t 0) as [->|Ht0].
+  - set (v0 := view0 al K s0).
+    assert (Hl0 : length (vw v0) = 2 ^ al) by (destruct Hf as (Hl & _); exact Hl).
+    pose proof (pass_first A w Lb L HA Hw v0 tau Hq Hl0 Hboot eq_refl Htd (ok_at 0 ltac:(lia))) as R1.
+    assert (E1 : cr A ks 1 = tstep A (init A (progPstar A) tau)) by reflexivity.
+    rewrite <- E1, (not_halted A ks HA Hks 1 ltac:(lia)) in R1.
+    change (out1 A (init A (progPstar A) tau) []) with (fst (outs A ks 1)) in R1.
+    change (out2 A (init A (progPstar A) tau) []) with (snd (outs A ks 1)) in R1.
+    pose proof (machine_pass A w K S0 L HA Hw HK HS HL s0 false _ _ _ Hf Hb Hs Hq R1) as M. cbn iota in M.
+    destruct (mv_next A w K S0 L s0 _ _ Hs M (proj1 (proj2 (proj2 R1))))
+      as (Hf1 & Hk1 & Hb1 & Ho1 & Hv1).
+    replace (1 * S0) with S0 by lia.
+    refine (conj Hf1 (conj Hk1 (conj Hb1 (conj Ho1 (conj Hv1 _))))). rewrite Hv1. exact R1.
+  - destruct (IH ltac:(lia)) as (Hf' & Hk' & Hb' & Ho' & Hv' & HR').
+    set (s := itern al K S0 L (t * S0) s0) in *.
+    pose proof (pass_next A w Lb L HA Hw _ _ _ _ HR' (ok_at t ltac:(lia))) as R1.
+    rewrite <- (cr_S A ks t), (not_halted A ks HA Hks (S t) ltac:(lia)) in R1.
+    change (out1 A (cr A ks t) (fst (outs A ks t))) with (fst (outs A ks (S t))) in R1.
+    change (out2 A (cr A ks t) (snd (outs A ks t))) with (snd (outs A ks (S t))) in R1.
+    assert (Hbs : bq (nth (kap s) (banks s) bank0) = img A w S0 /\ bs (nth (kap s) (banks s) bank0) = 0)
+      by (rewrite Hk', Hb'; split; assumption).
+    pose proof (machine_pass A w K S0 L HA Hw HK HS HL s false _ _ _ Hf' (proj1 Hbs) (proj2 Hbs)
+                  (proj1 HR') R1) as M. cbn iota in M.
+    destruct (mv_next A w K S0 L s _ _ (proj2 Hbs) M (proj1 (proj2 (proj2 R1))))
+      as (Hf1 & Hk1 & Hb1 & Ho1 & Hv1).
+    replace (S t * S0) with (t * S0 + S0) by lia. rewrite itern_add. fold s.
+    rewrite Hk' in Hk1, Hb1, Ho1. rewrite Hb' in Hb1.
+    refine (conj Hf1 (conj Hk1 (conj Hb1 (conj _ (conj _ _))))).
+    + intros x Hx E1 E2. destruct (Ho1 x Hx E1 E2) as [B T]. destruct (Ho' x Hx E1 E2) as [B' T'].
+      split; congruence.
+    + rewrite Hv1, Hv'. reflexivity.
+    + rewrite Hv1. exact R1.
+Qed.
+
+(* Theorem 8.6: after NN passes, each of S0 steps but the last, which has G, the next bank holds the decoded bytes
+   from its first slot and the next tape the recipe from its first cell, both with their heads at their origins;
+   the active bank and the read tape keep the image and the recipe, booted and the requests are clear, no other
+   bank or tape has changed, and the bank index has moved on *)
+Theorem stored_construct : forall s0, ready s0 ->
+  let s := itern al K S0 L ((NN ks - 1) * S0 + G) s0 in
+  fits al K S0 L s /\ kap s = succ_mod K (kap s0)
+  /\ nth (succ_mod K (kap s0)) (banks s) bank0 = mkB (bbits (delta ks) ++ repeat false (Lb - 8 * length (delta ks))) 0 0
+  /\ nth (succ_mod K (kap s0)) (tapes s) tape0 = mkT (bbits tau ++ repeat false (L - 8 * length tau)) 0
+  /\ nth (kap s0) (banks s) bank0 = mkB (img A w S0) (G mod S0) (bj (nth (kap s0) (banks s0) bank0))
+  /\ nth (kap s0) (tapes s) tape0 = mkT (td (nth (kap s0) (tapes s0) tape0)) ((8 * length tau) mod L)
+  /\ reqclear (win s) /\ wget (win s) BOOT = false
+  /\ win s = vw (vpass (NN ks) (view0 al K s0))
+  /\ (forall x, x < K -> x <> kap s0 -> x <> succ_mod K (kap s0) ->
+        nth x (banks s) bank0 = nth x (banks s0) bank0 /\ nth x (tapes s) tape0 = nth x (tapes s0) tape0).
+Proof.
+  intros s0 Hr s. pose proof Hr as (Hf & Hb & Hs & Hq & Hboot & Htd).
+  assert (HN : 2 <= NN ks) by (unfold NN; lia).
+  destruct (passes s0 Hr (NN ks - 1) ltac:(lia)) as (Hf' & Hk' & Hb' & Ho' & Hv' & HR').
+  set (s' := itern al K S0 L ((NN ks - 1) * S0) s0) in *.
+  assert (Es : s = itern al K S0 L G s') by (unfold s, s'; apply itern_add).
+  pose proof (pass_next A w Lb L HA Hw _ _ _ _ HR' (ok_at (NN ks - 1) ltac:(lia))) as R1.
+  rewrite <- (cr_S A ks), (Nat.sub_1_r (NN ks)), (Nat.succ_pred_pos (NN ks) ltac:(lia)) in R1.
+  rewrite (proj1 (at_NN A ks HA Hks)) in R1.
+  assert (EO : forall t, out1 A (cr A ks t) (fst (outs A ks t)) = fst (outs A ks (S t))
+                         /\ out2 A (cr A ks t) (snd (outs A ks t)) = snd (outs A ks (S t))) by (intro t; split; reflexivity).
+  rewrite (proj1 (EO _)), (proj2 (EO _)), (Nat.succ_pred_pos (NN ks) ltac:(lia)) in R1.
+  assert (Hbs : bq (nth (kap s') (banks s') bank0) = img A w S0 /\ bs (nth (kap s') (banks s') bank0) = 0)
+    by (rewrite Hk', Hb'; split; assumption).
+  pose proof (machine_pass A w K S0 L HA Hw HK HS HL s' true _ _ _ Hf' (proj1 Hbs) (proj2 Hbs) (proj1 HR') R1) as M.
+  cbn iota in M. rewrite <- Es in M. clear EO.
+  destruct (outs_late A ks HA Hks (NN ks) ltac:(unfold NN, n0; lia)) as [O1 O2].
+  rewrite (proj2 (at_NN A ks HA Hks)) in O2. cbn [dout] in O2. apply app_inv_head in O2.
+  destruct R1 as (Q & _ & Hh & Hbt & _ & _ & _ & _ & _ & VR & VA & VC & _).
+  rewrite (proj2 (at_NN A ks HA Hks)) in VR. cbn [dtape dhead] in VR.
+  rewrite O1 in VA. rewrite <- O2 in VC.
+  destruct M as (Hfs & Hws & Hks' & Has & His & Hrs & Hcs & Hos). rewrite Hh in Hks'. rewrite Hk' in *.
+  pose proof (Hfs) as (_ & _ & _ & _ & HB & _).
+  refine (conj Hfs (conj Hks' (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ _))))))))).
+  - rewrite VA in His. unfold obt, lin in His.
+    pose proof (f_equal td His) as Eq. pose proof (f_equal th His) as Ep. cbn [td th] in Eq, Ep.
+    assert (Hk0 : succ_mod K (kap s0) < K)
+      by (destruct Hf as (_ & Hk0 & _); unfold succ_mod; destruct (Nat.eqb_spec (S (kap s0)) K); lia).
+    destruct (HB _ Hk0) as (_ & _ & Hj).
+    rewrite Nat.mul_0_r, Nat.Div0.mod_0_l in Ep. rewrite <- (eta_bank (nth _ (banks s) bank0)), Eq.
+    assert (Hr8 : 1 <= recw al) by (unfold recw; lia). f_equal; nia.
+  - rewrite Hcs, VC. unfold obt. rewrite Nat.mul_0_r, Nat.Div0.mod_0_l. reflexivity.
+  - rewrite Has, Hb', Hs, Hb, Nat.add_0_l. reflexivity.
+  - rewrite Hrs, VR. unfold obt. f_equal. rewrite Hv' in HR'. rewrite Htd. reflexivity.
+  - rewrite Hws. exact Q.
+  - rewrite Hws. rewrite Hbt. reflexivity.
+  - assert (EN : NN ks = S (NN ks - 1)) by lia. rewrite Hws, Hv'. rewrite EN at 2. reflexivity.
+  - intros x Hx E1 E2. destruct (Hos x Hx E1 E2) as [B T]. destruct (Ho' x Hx E1 E2) as [B' T']. split; congruence.
+Qed.
+
+End Gen.

rocq/StoredStep.v

@@ -0,0 +1,362 @@
+(* The step block of the stored host: evaluated in the order of the netlist, each unit of H_A into its
+   own cell, the unit of each next value into its state bit, the records leave in the state bits the next
+   state of H_A, from every window and for every A >= 3. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run View Stored WinRun Host HostWF HostSem HostIP.
+
+(* ---- a unit of weights 1 and -1 fires when at least tval of its literals hold -------------------------- *)
+Definition litE (E : nat -> bool) (p : nat * Z) : bool := if Z.ltb 0 (snd p) then E (fst p) else negb (E (fst p)).
+
+Lemma wsum_count : forall ins E, (forall i w, In (i, w) ins -> w = 1%Z \/ w = (-1)%Z) ->
+  wsum ins E = (Z.of_nat (length (filter (litE E) ins)) - Z.of_nat (length (filter (fun p => Z.ltb (snd p) 0) ins)))%Z.
+Proof.
+  induction ins as [|[i w] t IH]; intros E H; [reflexivity|].
+  cbn [wsum filter]. rewrite IH by (intros i' w' Hin; apply (H i' w'); right; exact Hin).
+  destruct (H i w (or_introl eq_refl)) as [->| ->]; unfold litE; cbn [fst snd Z.ltb Z.compare];
+    destruct (E i); cbn [negb length b2z]; rewrite ?Nat2Z.inj_succ; lia.
+Qed.
+
+Lemma fire_count : forall u E, (forall i w, In (i, w) (tin u) -> w = 1%Z \/ w = (-1)%Z) ->
+  fire u E = Z.leb (tval u) (Z.of_nat (length (filter (litE E) (tin u)))).
+Proof.
+  intros u E H. unfold fire, tval. rewrite (wsum_count _ E H).
+  destruct (Z.leb_spec 0 (Net.tb u + (Z.of_nat (length (filter (litE E) (tin u)))
+                                       - Z.of_nat (length (filter (fun p => Z.ltb (snd p) 0) (tin u)))))),
+    (Z.leb_spec (Z.of_nat (length (filter (fun p => Z.ltb (snd p) 0) (tin u))) - Net.tb u)
+                (Z.of_nat (length (filter (litE E) (tin u))))); lia.
+Qed.
+
+(* ---- the table of next values ---------------------------------------------------------------------- *)
+Lemma length_setopt : forall l k x, length (setopt l k x) = length l.
+Proof. induction l as [|y l IH]; intros [|k] x; cbn [setopt length]; try rewrite IH; reflexivity. Qed.
+
+Lemma nth_setopt : forall l k x u, nth u (setopt l k x) None = if Nat.eqb u k && Nat.ltb k (length l) then Some x else nth u l None.
+Proof.
+  induction l as [|y l IH]; intros k x u.
+  - cbn [setopt nth length]. destruct (Nat.ltb_spec k 0); [lia|]. rewrite andb_false_r. destruct u; reflexivity.
+  - destruct k as [|k], u as [|u]; cbn [setopt nth length]; try reflexivity.
+    rewrite IH. reflexivity.
+Qed.
+
+Lemma find_none_of : forall (T : Type) (f : T -> bool) l, (forall x, In x l -> f x = false) -> find f l = None.
+Proof.
+  intros T f l. induction l as [|x l IH]; intro H; [reflexivity|]. cbn [find].
+  rewrite (H x (or_introl eq_refl)). apply IH. intros y Hy. apply H. right. exact Hy.
+Qed.
+
+Lemma fold_setopt : forall n ps tbl, NoDup (map snd ps) -> (forall p, In p ps -> n <= snd p < n + length tbl) ->
+  length (fold_left (fun tb p => setopt tb (snd p - n) (fst p)) ps tbl) = length tbl
+  /\ forall u, u < length tbl -> nth u (fold_left (fun tb p => setopt tb (snd p - n) (fst p)) ps tbl) None
+     = match find (fun p => Nat.eqb (snd p) (n + u)) ps with Some p => Some (fst p) | None => nth u tbl None end.
+Proof.
+  intros n. induction ps as [|p ps IH]; intros tbl Hnd Hr; [split; [reflexivity | intros u Hu; reflexivity]|].
+  cbn [fold_left find]. inversion Hnd as [|? ? Hni Hnd']; subst.
+  assert (Hr' : forall q, In q ps -> n <= snd q < n + length (setopt tbl (snd p - n) (fst p)))
+    by (intros q Hq; rewrite length_setopt; apply Hr; right; exact Hq).
+  destruct (IH (setopt tbl (snd p - n) (fst p)) Hnd' Hr') as [L E]. rewrite length_setopt in L.
+  split; [exact L|]. intros u Hu. rewrite E by (rewrite length_setopt; exact Hu).
+  pose proof (Hr p (or_introl eq_refl)) as Hp.
+  rewrite nth_setopt. destruct (Nat.eqb_spec (snd p) (n + u)) as [Ep|Ep].
+  - assert (Hf : find (fun q => Nat.eqb (snd q) (n + u)) ps = None).
+    { apply find_none_of. intros q Hq. apply Nat.eqb_neq. intro Eq. apply Hni. rewrite Ep, <- Eq.
+      apply in_map. exact Hq. }
+    rewrite Hf. replace (Nat.eqb u (snd p - n)) with true by (symmetry; apply Nat.eqb_eq; lia).
+    rewrite (proj2 (Nat.ltb_lt _ _)) by lia. reflexivity.
+  - destruct (find (fun q => Nat.eqb (snd q) (n + u)) ps); [reflexivity|].
+    replace (Nat.eqb u (snd p - n)) with false by (symmetry; apply Nat.eqb_neq; lia). reflexivity.
+Qed.
+
+Lemma in_combine_seq : forall (l : list nat) p, In p (combine (seq 0 (length l)) l) ->
+  fst p < length l /\ snd p = nth (fst p) l 0.
+Proof.
+  intros l p Hin. destruct p as [i x]. cbn [fst snd].
+  pose proof (in_combine_l _ _ _ _ Hin) as Hi. apply in_seq in Hi.
+  assert (G : forall m (l' : list nat), In (i, x) (combine (seq m (length l')) l') -> m <= i /\ x = nth (i - m) l' 0).
+  { intros m l'. revert m. induction l' as [|y l' IHl]; intros m H; [destruct H|].
+    cbn [length seq combine In] in H. destruct H as [H|H].
+    - injection H as <- <-. rewrite Nat.sub_diag. split; [lia | reflexivity].
+    - destruct (IHl (S m) H) as [H1 H2]. split; [lia|]. replace (i - m) with (S (i - S m)) by lia. exact H2. }
+  destruct (G 0 l Hin) as [_ H]. rewrite Nat.sub_0_r in H. split; [lia | exact H].
+Qed.
+
+Lemma map_snd_combine : forall (a b : list nat), length a = length b -> map snd (combine a b) = b.
+Proof.
+  induction a as [|x a IH]; intros [|y b] H; cbn in H |- *; try reflexivity; try discriminate.
+  rewrite IH by lia. reflexivity.
+Qed.
+
+Section Tbl.
+Variable A : nat.
+Hypothesis HA : 3 <= A.
+
+Local Notation us := (host_units A).
+Local Notation n := (nH A).
+Local Notation nt := (next_tbl (nH A) (length (host_units A)) (host_next A)).
+
+Lemma nodup_next : NoDup (host_next A).
+Proof.
+  apply (NoDup_nth (host_next A) 0). intros i i' Hi Hi' E. rewrite length_host_next in Hi, Hi'.
+  exact (host_next_inj A HA i i' Hi Hi' E).
+Qed.
+
+Lemma nt_spec : length nt = length us
+  /\ forall u, u < length us -> nth u nt None
+     = match find (fun p => Nat.eqb (snd p) (n + u)) (combine (seq 0 n) (host_next A)) with
+       | Some p => Some (fst p) | None => None end.
+Proof.
+  assert (Hm : map snd (combine (seq 0 n) (host_next A)) = host_next A)
+    by (apply map_snd_combine; rewrite length_seq, length_host_next; reflexivity).
+  assert (Hnd : NoDup (map snd (combine (seq 0 n) (host_next A)))) by (rewrite Hm; exact nodup_next).
+  assert (Hr : forall p, In p (combine (seq 0 n) (host_next A)) -> n <= snd p < n + length (repeat (@None nat) (length us))).
+  { intros p Hp. rewrite repeat_length. rewrite <- length_host_next in Hp.
+    destruct (in_combine_seq (host_next A) p Hp) as [H1 H2]. rewrite H2.
+    rewrite length_host_next in H1. exact (host_next_range A HA (fst p) H1). }
+  destruct (fold_setopt n _ _ Hnd Hr) as [L E]. rewrite repeat_length in L.
+  split; [exact L|]. intros u Hu. unfold next_tbl. rewrite E by (rewrite repeat_length; exact Hu).
+  destruct (find _ _); [reflexivity|]. apply nth_repeat.
+Qed.
+
+Lemma nt_some : forall u i, u < length us -> nth u nt None = Some i -> i < n /\ nth i (host_next A) 0 = n + u.
+Proof.
+  intros u i Hu E. rewrite (proj2 nt_spec u Hu) in E.
+  destruct (find _ _) as [p|] eqn:Ef; [|discriminate]. injection E as <-.
+  apply find_some in Ef as [Hin Hp]. apply Nat.eqb_eq in Hp.
+  assert (Hin' : In p (combine (seq 0 (length (host_next A))) (host_next A))) by (rewrite length_host_next; exact Hin).
+  destruct (in_combine_seq _ _ Hin') as [H1 H2]. rewrite length_host_next in H1.
+  split; [exact H1 | rewrite <- H2; exact Hp].
+Qed.
+
+Lemma in_combine_at : forall m (l : list nat) j, j < length l -> In (m + j, nth j l 0) (combine (seq m (length l)) l).
+Proof.
+  intros m l. revert m. induction l as [|y l IHl]; intros m j Hj; cbn [length] in Hj; [lia|].
+  cbn [length seq combine In]. destruct j as [|j]; [left; rewrite Nat.add_0_r; reflexivity|].
+  right. replace (m + S j) with (S m + j) by lia. apply IHl. lia.
+Qed.
+
+Lemma nt_none : forall u, u < length us -> nth u nt None = None -> forall i, i < n -> nth i (host_next A) 0 <> n + u.
+Proof.
+  intros u Hu E i Hi Hni. rewrite (proj2 nt_spec u Hu) in E.
+  destruct (find _ _) as [p|] eqn:Ef; [discriminate|].
+  pose proof (in_combine_at 0 (host_next A) i ltac:(rewrite length_host_next; exact Hi)) as Hin.
+  rewrite length_host_next in Hin.
+  pose proof (find_none _ _ Ef _ Hin) as Hf. cbn [snd] in Hf. rewrite Hni, Nat.eqb_refl in Hf. discriminate.
+Qed.
+
+End Tbl.
+
+(* ---- the step block ---------------------------------------------------------------------------------- *)
+Section Step.
+Variables (A w W : nat).
+Hypothesis HA : 3 <= A.
+
+Local Notation us := (host_units A).
+Local Notation nu := (length (host_units A)).
+Local Notation lv := (levels (host_units A)).
+Local Notation n := (nH A).
+Local Notation nt := (next_tbl (nH A) (length (host_units A)) (host_next A)).
+
+Hypothesis HW : ncells A w nu lv <= W.
+
+(* the window at the start of the block, its state bits, and the values of the netlist on them *)
+Variable w0 : list bool.
+Hypotheses (Hw0 : length w0 = W) (Hq0 : reqclear w0).
+
+Definition xbits : list bool := map (fun i => wget w0 (ST w i)) (seq 0 n).
+Definition X (i : nat) : bool := nth i xbits false.
+Definition E : nat -> bool := run us n X.
+
+Definition unit_recs (u : nat) : list rec :=
+  ucomp (XC A w nu) (tval (nth u us tu0)) (map (lit_of A w) (tin (nth u us tu0)))
+        (match nth u nt None with Some i => ST w i | None => UC A w u end) (UC A w u) 0.
+
+Definition Inv (u : nat) (w' : list bool) : Prop :=
+  length w' = W /\ reqclear w'
+  /\ (forall v, v < u -> nth v nt None = None -> wget w' (UC A w v) = E (n + v))
+  /\ (forall i, i < n -> wget w' (ST w i)
+                       = if Nat.ltb (nth i (host_next A) 0) (n + u) then E (nth i (host_next A) 0) else X i)
+  /\ (forall c, c < ST w 0 \/ DB A w nu lv <= c -> wget w' c = wget w0 c).
+
+Lemma X_eq : forall i, i < n -> X i = wget w0 (ST w i).
+Proof. intros i Hi. unfold X, xbits. rewrite (nth_map_seq _ (fun i => wget w0 (ST w i)) n i false Hi). reflexivity. Qed.
+
+Lemma E_low : forall i, i < n -> E i = X i.
+Proof. intros i Hi. unfold E. apply run_prefix. exact Hi. Qed.
+
+Lemma Inv_0 : Inv 0 w0.
+Proof.
+  refine (conj Hw0 (conj Hq0 (conj _ (conj _ _)))).
+  - intros v Hv. lia.
+  - intros i Hi. pose proof (host_next_range A HA i Hi) as Hr.
+    replace (Nat.ltb (nth i (host_next A) 0) (n + 0)) with false by (symmetry; apply Nat.ltb_ge; lia).
+    rewrite X_eq by exact Hi. reflexivity.
+  - intros c _. reflexivity.
+Qed.
+
+Lemma max_fold : forall l a x, In x l \/ x <= a -> x <= fold_left Nat.max l a.
+Proof.
+  induction l as [|y l IH]; intros a x H; cbn [fold_left]; [destruct H as [[]|H]; exact H|].
+  apply IH. destruct H as [[<-|H]|H]; [right; lia | left; exact H | right; lia].
+Qed.
+
+Lemma lv_bound : forall U, In U us -> thr_unit U = true -> length (tin U) - 2 <= lv.
+Proof.
+  intros U Hin Ht. unfold levels. apply max_fold. left.
+  apply in_map_iff. exists U. split; [rewrite Ht; reflexivity | exact Hin].
+Qed.
+
+Lemma xc_gt : forall j k, k < 3 -> HO < XC A w nu j k.
+Proof. intros. unfold XC, HO. lia. Qed.
+
+Lemma xc_lt : forall j k, j < lv -> k < 3 -> XC A w nu j k < W.
+Proof. intros j k Hj Hk. unfold ncells, DB in HW. unfold XC, nh in *. lia. Qed.
+
+Lemma xc_inj : forall j k j' k', k < 3 -> k' < 3 -> XC A w nu j k = XC A w nu j' k' -> j = j' /\ k = k'.
+Proof. intros j k j' k' Hk Hk' E. unfold XC in E. lia. Qed.
+
+Lemma not_scr : forall c lev, c < XC A w nu 0 0 -> ~ scr lv (XC A w nu) lev c.
+Proof. intros c lev Hc (j & k & _ & _ & ->). unfold XC in Hc. lia. Qed.
+
+Lemma scr_db : forall c lev, DB A w nu lv <= c -> ~ scr lv (XC A w nu) lev c.
+Proof. intros c lev Hc (j & k & Hj & Hk & ->). unfold XC, DB in *. lia. Qed.
+
+Lemma ntrue_lits : forall w' U, (forall p, In p (tin U) -> wl w' (lit_of A w p) = litE E p) ->
+  ntrue w' (map (lit_of A w) (tin U)) = length (filter (litE E) (tin U)).
+Proof.
+  intros w' U H. unfold ntrue. induction (tin U) as [|p t IH]; [reflexivity|].
+  cbn [map filter]. rewrite (H p (or_introl eq_refl)).
+  assert (IH' : length (filter (wl w') (map (lit_of A w) t)) = length (filter (litE E) t))
+    by (apply IH; intros q Hq; apply H; right; exact Hq).
+  destruct (litE E p); cbn [length]; rewrite IH'; reflexivity.
+Qed.
+
+Theorem unit_step : forall u w', u < nu -> Inv u w' -> Inv (S u) (wrun (unit_recs u) w').
+Proof.
+  intros u w' Hu (Hl & Hq & Hun & Hst & Hfix).
+  set (U := nth u us tu0).
+  assert (HUin : In U us) by (apply nth_In; exact Hu).
+  assert (Hwt : forall i wt, In (i, wt) (tin U) -> wt = 1%Z \/ wt = (-1)%Z)
+    by (intros i wt Hin; exact (host_weights A HA u i wt Hu Hin)).
+  assert (Hrb : forall i wt, In (i, wt) (tin U) -> i < n + u)
+    by (intros i wt Hin; exact (host_reads_below A HA u Hu i wt Hin)).
+  (* every literal holds the value of the netlist *)
+  assert (Hlit : forall p, In p (tin U) -> wl w' (lit_of A w p) = litE E p).
+  { intros [i wt] Hin. unfold lit_of, litE, wl, nh. cbn [fst snd].
+    assert (Ev : wcell w' (if i <? n then ST w i else UC A w (i - n)) = E i).
+    { unfold wcell. replace (Nat.eqb (if i <? n then ST w i else UC A w (i - n)) SINK) with false
+        by (symmetry; apply Nat.eqb_neq; destruct (i <? n); unfold ST, UC, SINK; lia).
+      destruct (Nat.ltb_spec i n) as [Hi|Hi].
+      - rewrite Hst by exact Hi.
+        pose proof (host_in_before A HA u i wt Hu Hin Hi) as Hb.
+        replace (Nat.ltb (nth i (host_next A) 0) (n + u)) with false by (symmetry; apply Nat.ltb_ge; lia).
+        rewrite E_low by exact Hi. reflexivity.
+      - pose proof (Hrb i wt Hin) as Hlt.
+        assert (Hnone : nth (i - n) nt None = None).
+        { destruct (nth (i - n) nt None) as [i'|] eqn:Ei; [|reflexivity]. exfalso.
+          destruct (nt_some A HA (i - n) i' ltac:(lia) Ei) as [Hi' Ei'].
+          apply (host_no_out A HA u i wt Hu Hin i' Hi'). lia. }
+        rewrite Hun by (lia || exact Hnone). f_equal. lia. }
+    rewrite Ev. reflexivity. }
+  assert (Hval : Z.leb (tval U) (Z.of_nat (ntrue w' (map (lit_of A w) (tin U)))) = E (n + u)).
+  { rewrite (ntrue_lits w' U Hlit), <- (fire_count U E Hwt).
+    unfold E. rewrite run_at; [reflexivity | exact Hu | intros k Hk; exact (host_reads_below A HA k Hk)]. }
+  assert (Hlits : forall l, In l (map (lit_of A w) (tin U)) -> fst l <> UC A w u /\ ~ scr lv (XC A w nu) 0 (fst l)).
+  { intros l Hl'. apply in_map_iff in Hl' as ([i wt] & <- & Hin). unfold lit_of, nh. cbn [fst].
+    pose proof (Hrb i wt Hin). split.
+    - destruct (Nat.ltb_spec i n); unfold ST, UC, nh; lia.
+    - apply not_scr. destruct (Nat.ltb_spec i n); unfold ST, UC, XC, nh; lia. }
+  assert (Hlev : (1 < tval U < Z.of_nat (length (map (lit_of A w) (tin U))))%Z ->
+                 0 + length (map (lit_of A w) (tin U)) <= lv + 2).
+  { intros [H1 H2]. rewrite length_map in *.
+    assert (Ht : thr_unit U = true) by (unfold thr_unit; apply andb_true_intro; split; apply Z.ltb_lt; lia).
+    pose proof (lv_bound U HUin Ht). lia. }
+  assert (HUC : UC A w u < W) by (unfold ncells, DB in HW; unfold UC, nh in *; lia).
+  assert (Hacc : ok_cell W (UC A w u)) by (split; [unfold UC, HO; lia | exact HUC]).
+  assert (Hsacc : ~ scr lv (XC A w nu) 0 (UC A w u)) by (apply not_scr; unfold UC, XC, nh; lia).
+  unfold unit_recs. fold U.
+  destruct (nth u nt None) as [i0|] eqn:Eo.
+  - (* the unit of the next value of state bit i0 writes that bit *)
+    destruct (nt_some A HA u i0 Hu Eo) as [Hi0 Ei0].
+    assert (Hd : ok_cell W (ST w i0)) by (split; [unfold ST, HO; lia | unfold ncells, DB in HW; unfold ST, nh in *; lia]).
+    assert (Hsd : ~ scr lv (XC A w nu) 0 (ST w i0)) by (apply not_scr; unfold ST, XC, nh; lia).
+    destruct (ucomp_run W lv (XC A w nu) xc_gt xc_lt xc_inj (map (lit_of A w) (tin U)) (tval U) (ST w i0)
+                (UC A w u) 0 w' Hl Hd Hacc Hsd Hsacc Hlits Hlev) as (L1 & V1 & U1).
+    rewrite Hval in V1.
+    refine (conj L1 (conj _ (conj _ (conj _ _)))).
+    + intros c Hc. rewrite U1; [apply Hq; exact Hc | unfold ST, AR, HO in *; lia | unfold UC, AR, HO in *; lia
+                               | apply not_scr; unfold XC, AR, HO in *; lia].
+    + intros v Hv Hnv. destruct (Nat.eq_dec v u) as [->|Hvu]; [rewrite Eo in Hnv; discriminate|].
+      rewrite U1; [apply Hun; [lia | exact Hnv] | unfold ST, UC, nh in *; lia | unfold UC; lia
+                  | apply not_scr; unfold UC, XC, nh; lia].
+    + intros i Hi. destruct (Nat.eq_dec i i0) as [->|Hii].
+      * rewrite V1, Ei0. replace (Nat.ltb (n + u) (n + S u)) with true by (symmetry; apply Nat.ltb_lt; lia).
+        reflexivity.
+      * rewrite U1; [|unfold ST; lia | unfold ST, UC, nh; lia | apply not_scr; unfold ST, XC, nh; lia].
+        rewrite Hst by exact Hi.
+        assert (Hne : nth i (host_next A) 0 <> n + u).
+        { intro E1. apply Hii. apply (host_next_inj A HA i i0 Hi Hi0). rewrite E1, Ei0. reflexivity. }
+        destruct (Nat.ltb_spec (nth i (host_next A) 0) (n + u)), (Nat.ltb_spec (nth i (host_next A) 0) (n + S u));
+          try reflexivity; lia.
+    + intros c Hc. rewrite U1; [apply Hfix; exact Hc
+                               | unfold ST, DB, nh in *; lia | unfold UC, DB, ST, nh in *; lia|].
+      destruct Hc as [Hc|Hc]; [apply not_scr; unfold ST, XC, nh in *; lia | apply scr_db; exact Hc].
+  - (* any other unit writes its own cell *)
+    destruct (ucomp_run W lv (XC A w nu) xc_gt xc_lt xc_inj (map (lit_of A w) (tin U)) (tval U) (UC A w u)
+                (UC A w u) 0 w' Hl Hacc Hacc Hsacc Hsacc Hlits Hlev) as (L1 & V1 & U1).
+    rewrite Hval in V1.
+    refine (conj L1 (conj _ (conj _ (conj _ _)))).
+    + intros c Hc. rewrite U1; [apply Hq; exact Hc | unfold UC, AR, HO in *; lia | unfold UC, AR, HO in *; lia
+                               | apply not_scr; unfold XC, AR, HO in *; lia].
+    + intros v Hv Hnv. destruct (Nat.eq_dec v u) as [->|Hvu]; [exact V1|].
+      rewrite U1; [apply Hun; [lia | exact Hnv] | unfold UC; lia | unfold UC; lia
+                  | apply not_scr; unfold UC, XC, nh; lia].
+    + intros i Hi. rewrite U1; [|unfold ST, UC, nh; lia | unfold ST, UC, nh; lia | apply not_scr; unfold ST, XC, nh; lia].
+      rewrite Hst by exact Hi.
+      pose proof (nt_none A HA u Hu Eo i Hi) as Hne.
+      destruct (Nat.ltb_spec (nth i (host_next A) 0) (n + u)), (Nat.ltb_spec (nth i (host_next A) 0) (n + S u));
+        try reflexivity; lia.
+    + intros c Hc. rewrite U1; [apply Hfix; exact Hc | unfold UC, DB, ST, nh in *; lia | unfold UC, DB, ST, nh in *; lia|].
+      destruct Hc as [Hc|Hc]; [apply not_scr; unfold ST, XC, nh in *; lia | apply scr_db; exact Hc].
+Qed.
+
+Lemma skipn_cons_nth : forall (T : Type) (l : list T) k d, k < length l -> skipn k l = nth k l d :: skipn (S k) l.
+Proof.
+  intros T l. induction l as [|x l IH]; intros [|k] d Hk; cbn [length] in Hk; try lia; [reflexivity|].
+  cbn [skipn nth]. apply IH. lia.
+Qed.
+
+Lemma step_go_unit : forall u, u < nu ->
+  step_go A w nu u (skipn u us) (skipn u nt) = unit_recs u ++ step_go A w nu (S u) (skipn (S u) us) (skipn (S u) nt).
+Proof.
+  intros u Hu. rewrite (skipn_cons_nth _ us u tu0 Hu).
+  rewrite (skipn_cons_nth _ nt u None) by (rewrite (proj1 (nt_spec A HA)); exact Hu).
+  reflexivity.
+Qed.
+
+Lemma step_go_end : step_go A w nu nu (skipn nu us) (skipn nu nt) = [].
+Proof. rewrite skipn_all. reflexivity. Qed.
+
+Theorem step_run : Inv nu (wrun (step_go A w nu 0 us nt) w0).
+Proof.
+  assert (G : forall k u w', u + k = nu -> Inv u w' -> Inv nu (wrun (step_go A w nu u (skipn u us) (skipn u nt)) w')).
+  { induction k as [|k IH]; intros u w' Hk Hi.
+    - rewrite Nat.add_0_r in Hk. subst u. rewrite step_go_end. exact Hi.
+    - rewrite step_go_unit by lia. rewrite wrun_app. apply IH; [lia|]. apply unit_step; [lia | exact Hi]. }
+  exact (G nu 0 w0 eq_refl Inv_0).
+Qed.
+
+(* the block's records read and write only the window, above the requests *)
+Theorem step_wrec : Forall wrec (step_go A w nu 0 us nt).
+Proof.
+  assert (G : forall L NT u, Forall wrec (step_go A w nu u L NT)).
+  { induction L as [|U L IH]; intros [|o NT] u; cbn [step_go]; try constructor.
+    apply Forall_app. split; [|apply IH].
+    apply (ucomp_wrec (XC A w nu) xc_gt).
+    - destruct o; unfold ST, UC, HO; lia.
+    - unfold UC, HO; lia.
+    - intros l Hl. apply in_map_iff in Hl as ([i wt] & <- & _). unfold lit_of, rd_ok. cbn [fst]. right.
+      destruct (i <? nh A); unfold ST, UC, CPY; lia. }
+  apply G.
+Qed.
+
+End Step.

rocq/StoredWbr.v

@@ -0,0 +1,639 @@
+(* Every cell that a pass of the stored host reads, other than the sink and the cells under the heads, holds the
+   state of the host, a register, booted or a request, or is written earlier in the pass. Two views that agree on
+   those cells and on the heads therefore agree after the pass on them and on every cell the pass writes, whatever
+   the other cells of the window hold; the cells no record writes keep their values. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run View Stored WinRun ViewOps Host HostIP Device StoredStep.
+
+(* ---- reads of cells written before ------------------------------------------------------------------------- *)
+Definition cok (D : nat -> Prop) (c : nat) : Prop := c <= CPY \/ D c.
+
+Definition rdw (D : nat -> Prop) (a : nat) (wt : Z) : Prop := wt = 0%Z \/ cok D a.
+
+Definition rdr (D : nat -> Prop) (r : rec) : Prop :=
+  match r with Rec a0 w0 a1 w1 _ _ => rdw D a0 w0 /\ rdw D a1 w1 end.
+
+(* the records of rs read, of the window cells from 4 on, only those in D and those written before them *)
+Fixpoint wbr (D : nat -> Prop) (rs : list rec) : Prop :=
+  match rs with
+  | [] => True
+  | r :: t => rdr D r /\ wbr (fun c => D c \/ c = ao_of r) t
+  end.
+
+Definition wrt (rs : list rec) (c : nat) : Prop := In c (map ao_of rs).
+
+Lemma cok_mono : forall (D D' : nat -> Prop) c, (forall x, D x -> D' x) -> cok D c -> cok D' c.
+Proof. intros D D' c H [Hc|Hc]; [left; exact Hc | right; apply H; exact Hc]. Qed.
+
+Lemma rdr_mono : forall (D D' : nat -> Prop) r, (forall c, D c -> D' c) -> rdr D r -> rdr D' r.
+Proof.
+  intros D D' [a0 w0 a1 w1 beta ao] H [H0 H1].
+  split; [destruct H0 as [H0|H0] | destruct H1 as [H1|H1]];
+    solve [left; exact H0 | left; exact H1 | right; exact (cok_mono D D' _ H H0) | right; exact (cok_mono D D' _ H H1)].
+Qed.
+
+Lemma wbr_mono : forall rs (D D' : nat -> Prop), (forall c, D c -> D' c) -> wbr D rs -> wbr D' rs.
+Proof.
+  induction rs as [|r rs IH]; intros D D' H Hw; [exact I|]. destruct Hw as [Hr Hw].
+  split; [exact (rdr_mono D D' r H Hr)|].
+  apply (IH (fun c => D c \/ c = ao_of r)); [|exact Hw].
+  intros c [Hc|Hc]; [left; apply H; exact Hc | right; exact Hc].
+Qed.
+
+Lemma wbr_app : forall a b (D D' : nat -> Prop), wbr D a -> (forall c, D' c -> D c \/ wrt a c) -> wbr D' b ->
+  wbr D (a ++ b).
+Proof.
+  induction a as [|r a IH]; intros b D D' Ha HD Hb.
+  - cbn [app]. apply (wbr_mono b D'); [|exact Hb]. intros c Hc. destruct (HD c Hc) as [H|[]]. exact H.
+  - destruct Ha as [Hr Ha]. cbn [app wbr]. split; [exact Hr|]. apply (IH b _ D' Ha); [|exact Hb].
+    intros c Hc. destruct (HD c Hc) as [H|H]; [left; left; exact H|].
+    unfold wrt in H. cbn [map In] in H. destruct H as [H|H]; [left; right; symmetry; exact H | right; exact H].
+Qed.
+
+Lemma wbr_all : forall rs (D : nat -> Prop), Forall (rdr D) rs -> wbr D rs.
+Proof.
+  induction rs as [|r rs IH]; intros D H; [exact I|]. apply Forall_cons_iff in H as [Hr Hrs].
+  split; [exact Hr|]. apply IH. eapply Forall_impl; [|exact Hrs].
+  intros r' Hr'. apply (rdr_mono D); [|exact Hr']. intros c Hc. left. exact Hc.
+Qed.
+
+Lemma wbr_concat_map : forall (f : nat -> list rec) l (D : nat -> Prop), (forall i, In i l -> wbr D (f i)) ->
+  wbr D (concat (map f l)).
+Proof.
+  intros f l. induction l as [|i l IH]; intros D H; [exact I|]. cbn [map concat].
+  apply (wbr_app _ _ D D); [apply H; left; reflexivity | intros c Hc; left; exact Hc |].
+  apply IH. intros j Hj. apply H. right. exact Hj.
+Qed.
+
+Lemma wrt_app_l : forall a b c, wrt a c -> wrt (a ++ b) c.
+Proof. intros a b c H. unfold wrt in *. rewrite map_app. apply in_or_app. left. exact H. Qed.
+
+Lemma wrt_app_r : forall a b c, wrt b c -> wrt (a ++ b) c.
+Proof. intros a b c H. unfold wrt in *. rewrite map_app. apply in_or_app. right. exact H. Qed.
+
+Lemma wrt_concat_map : forall (f : nat -> list rec) l i c, In i l -> wrt (f i) c -> wrt (concat (map f l)) c.
+Proof.
+  intros f l i c Hi H. unfold wrt in *. apply in_map_iff in H as (r & Hr & Hin).
+  apply in_map_iff. exists r. split; [exact Hr|]. apply in_concat. exists (f i). split; [apply in_map; exact Hi | exact Hin].
+Qed.
+
+Lemma wrt_map : forall (f : nat -> rec) l i, In i l -> wrt (map f l) (ao_of (f i)).
+Proof. intros f l i Hi. unfold wrt. rewrite map_map. apply (in_map (fun x => ao_of (f x))). exact Hi. Qed.
+
+(* ---- the gates ----------------------------------------------------------------------------------------------- *)
+Lemma rdr_and : forall (D : nat -> Prop) x y d, cok D (fst x) -> cok D (fst y) -> rdr D (gAND x y d).
+Proof. intros D x y d Hx Hy. split; right; assumption. Qed.
+
+Lemma rdr_or : forall (D : nat -> Prop) x y d, cok D (fst x) -> cok D (fst y) -> rdr D (gOR x y d).
+Proof. intros D x y d Hx Hy. split; right; assumption. Qed.
+
+Lemma rdr_copy : forall (D : nat -> Prop) x d, cok D (fst x) -> rdr D (gCOPY x d).
+Proof. intros D x d Hx. split; [right; exact Hx | left; reflexivity]. Qed.
+
+Lemma rdr_const : forall (D : nat -> Prop) b d, rdr D (gCONST b d).
+Proof. intros D [|] d; split; right; left; unfold SINK, CPY; cbn; lia. Qed.
+
+Lemma rdr_empty : forall (D : nat -> Prop), rdr D EMPTY.
+Proof. intro D. split; left; reflexivity. Qed.
+
+Section Chains.
+Variable g : nat * bool -> nat * bool -> nat -> rec.
+Hypotheses (Hg : forall (D : nat -> Prop) x y d, cok D (fst x) -> cok D (fst y) -> rdr D (g x y d))
+  (Hgo : forall x y d, ao_of (g x y d) = d).
+
+Lemma wbr_chain_tail : forall ls (D : nat -> Prop) acc l d, D acc -> cok D (fst l) ->
+  (forall l', In l' ls -> cok D (fst l')) -> wbr D (chain_tail g acc l ls d).
+Proof.
+  induction ls as [|l' ls IH]; intros D acc l d Ha Hl Hls; cbn [chain_tail wbr].
+  - split; [apply Hg; [right; exact Ha | exact Hl] | exact I].
+  - split; [apply Hg; [right; exact Ha | exact Hl]|]. rewrite Hgo.
+    apply IH; [left; exact Ha | |].
+    + apply (cok_mono D); [intros c Hc; left; exact Hc | apply Hls; left; reflexivity].
+    + intros l'' Hl''. apply (cok_mono D); [intros c Hc; left; exact Hc | apply Hls; right; exact Hl''].
+Qed.
+
+Lemma wbr_chain : forall ls (D : nat -> Prop) d acc, (forall l, In l ls -> cok D (fst l)) -> wbr D (chain g ls d acc).
+Proof.
+  intros [|l0 [|l1 [|l2 t]]] D d acc H; cbn [chain wbr].
+  - exact I.
+  - split; [apply rdr_copy, H; left; reflexivity | exact I].
+  - split; [apply Hg; apply H; [left | right; left]; reflexivity | exact I].
+  - split; [apply Hg; apply H; [left | right; left]; reflexivity|]. rewrite Hgo.
+    apply wbr_chain_tail; [right; reflexivity | |].
+    + apply (cok_mono D); [intros c Hc; left; exact Hc | apply H; right; right; left; reflexivity].
+    + intros l' Hl'. apply (cok_mono D); [intros c Hc; left; exact Hc | apply H; right; right; right; exact Hl'].
+Qed.
+
+Lemma chain_tail_writes : forall ls acc l d, wrt (chain_tail g acc l ls d) d.
+Proof.
+  induction ls as [|l' ls IH]; intros acc l d; cbn [chain_tail]; unfold wrt; cbn [map In].
+  - left. apply Hgo.
+  - right. apply IH.
+Qed.
+
+Lemma chain_writes : forall ls d acc, ls <> [] -> wrt (chain g ls d acc) d.
+Proof.
+  intros [|l0 [|l1 [|l2 t]]] d acc Hne; [contradiction Hne; reflexivity | | |]; unfold wrt; cbn [chain map In].
+  - left. reflexivity.
+  - left. apply Hgo.
+  - right. apply chain_tail_writes.
+Qed.
+
+End Chains.
+
+Lemma wbr_chain_and : forall ls (D : nat -> Prop) d acc, (forall l, In l ls -> cok D (fst l)) ->
+  wbr D (chain gAND ls d acc).
+Proof. apply wbr_chain; [exact rdr_and | reflexivity]. Qed.
+
+Lemma wbr_chain_or : forall ls (D : nat -> Prop) d acc, (forall l, In l ls -> cok D (fst l)) ->
+  wbr D (chain gOR ls d acc).
+Proof. apply wbr_chain; [exact rdr_or | reflexivity]. Qed.
+
+(* ---- a unit: the cells of its levels are written before they are read ---------------------------------------- *)
+Section Ucomp.
+Variable xc : nat -> nat -> nat.
+
+Lemma ucomp_eq : forall t ls d acc lev, ucomp xc t ls d acc lev =
+  if Z.leb t 0 then [gCONST true d]
+  else if Z.ltb (Z.of_nat (length ls)) t then [gCONST false d]
+  else if Z.eqb t 1 then chain gOR ls d acc
+  else if Z.eqb t (Z.of_nat (length ls)) then chain gAND ls d acc
+  else match ls with
+       | [] => []
+       | l0 :: rest =>
+           ucomp xc t rest (xc lev 0) (xc lev 0) (S lev) ++ ucomp xc (t - 1) rest (xc lev 1) (xc lev 1) (S lev)
+           ++ [gAND l0 (xc lev 1, true) (xc lev 2); gOR (xc lev 0, true) (xc lev 2, true) d]
+       end.
+Proof. intros t [|l0 rest] d acc lev; reflexivity. Qed.
+
+Lemma ucomp_writes : forall ls t d acc lev, wrt (ucomp xc t ls d acc lev) d.
+Proof.
+  intros ls t d acc lev. rewrite ucomp_eq.
+  destruct (Z.leb_spec t 0); [unfold wrt; cbn [map In]; left; reflexivity|].
+  destruct (Z.ltb_spec (Z.of_nat (length ls)) t); [unfold wrt; cbn [map In]; left; reflexivity|].
+  destruct (Z.eqb_spec t 1).
+  { apply (chain_writes gOR (fun _ _ _ => eq_refl)). intro E. subst ls. cbn in *. lia. }
+  destruct (Z.eqb_spec t (Z.of_nat (length ls))).
+  { apply (chain_writes gAND (fun _ _ _ => eq_refl)). intro E. subst ls. cbn in *. lia. }
+  destruct ls as [|l0 rest]; [cbn in *; lia|].
+  apply wrt_app_r, wrt_app_r. unfold wrt. cbn [map In]. right. left. reflexivity.
+Qed.
+
+Lemma wbr_ucomp : forall ls t d acc lev (D : nat -> Prop), (forall l, In l ls -> cok D (fst l)) ->
+  wbr D (ucomp xc t ls d acc lev).
+Proof.
+  induction ls as [|l0 rest IH]; intros t d acc lev D H; rewrite ucomp_eq.
+  - destruct (Z.leb t 0); [exact (conj (rdr_const D true d) I)|].
+    destruct (Z.ltb _ t); [exact (conj (rdr_const D false d) I)|].
+    destruct (Z.eqb t 1); [apply wbr_chain_or; exact H|].
+    destruct (Z.eqb t _); [apply wbr_chain_and; exact H | exact I].
+  - destruct (Z.leb t 0); [exact (conj (rdr_const D true d) I)|].
+    destruct (Z.ltb _ t); [exact (conj (rdr_const D false d) I)|].
+    destruct (Z.eqb t 1); [apply wbr_chain_or; exact H|].
+    destruct (Z.eqb t _); [apply wbr_chain_and; exact H|].
+    assert (Hr : forall l, In l rest -> cok D (fst l)) by (intros l Hl; apply H; right; exact Hl).
+    set (U1 := ucomp xc t rest (xc lev 0) (xc lev 0) (S lev)).
+    set (U2 := ucomp xc (t - 1) rest (xc lev 1) (xc lev 1) (S lev)).
+    apply (wbr_app U1 _ D (fun c => D c \/ c = xc lev 0)); [apply IH; exact Hr | |].
+    { intros c [Hc|Hc]; [left; exact Hc | right; subst c; apply ucomp_writes]. }
+    apply (wbr_app U2 _ _ (fun c => (D c \/ c = xc lev 0) \/ c = xc lev 1)).
+    { apply IH. intros l Hl. apply (cok_mono D); [intros c Hc; left; exact Hc | apply Hr; exact Hl]. }
+    { intros c [Hc|Hc]; [left; exact Hc | right; subst c; apply ucomp_writes]. }
+    cbn [wbr]. split; [|split; [|exact I]].
+    + apply rdr_and; [|right; right; reflexivity].
+      apply (cok_mono D); [intros c Hc; left; left; exact Hc | apply H; left; reflexivity].
+    + apply rdr_or; right; [left; left; right; reflexivity | right; reflexivity].
+Qed.
+
+End Ucomp.
+
+(* ---- two views that agree on the cells read ------------------------------------------------------------------ *)
+Definition vagree (D : nat -> Prop) (v1 v2 : view) : Prop :=
+  vr v1 = vr v2 /\ va v1 = va v2 /\ vc v1 = vc v2 /\ vho v1 = vho v2 /\ length (vw v1) = length (vw v2)
+  /\ (forall c, CPY < c -> D c -> wget (vw v1) c = wget (vw v2) c).
+
+Lemma vagree_mono : forall (D D' : nat -> Prop) v1 v2, (forall c, D' c -> D c) -> vagree D v1 v2 -> vagree D' v1 v2.
+Proof.
+  intros D D' v1 v2 H (HR & HA & HC & HH & Hl & HW).
+  refine (conj HR (conj HA (conj HC (conj HH (conj Hl _))))). intros c Hc Hd. apply HW; [exact Hc | apply H; exact Hd].
+Qed.
+
+Section Agree.
+Variables (Lb L : nat).
+
+Lemma vcell_agree : forall (D : nat -> Prop) v1 v2 a wt, vagree D v1 v2 -> rdw D a wt ->
+  (wt * b2z (vcell v1 a) = wt * b2z (vcell v2 a))%Z.
+Proof.
+  intros D v1 v2 a wt (HR & HA & HC & _ & _ & HW) Hrd. destruct Hrd as [->|[Ha|Ha]]; [reflexivity| |].
+  - assert (Hc : a = SINK \/ a = RD \/ a = ARM \/ a = CPY) by (unfold SINK, RD, ARM, CPY in *; lia).
+    unfold vcell. rewrite HR, HA, HC. destruct Hc as [->|[->|[->| ->]]]; reflexivity.
+  - destruct (Nat.leb_spec a CPY) as [Hle|Hgt].
+    + assert (Hc : a = SINK \/ a = RD \/ a = ARM \/ a = CPY) by (unfold SINK, RD, ARM, CPY in *; lia).
+      unfold vcell. rewrite HR, HA, HC. destruct Hc as [->|[->|[->| ->]]]; reflexivity.
+    + unfold vcell.
+      replace (Nat.eqb a SINK) with false by (symmetry; apply Nat.eqb_neq; unfold SINK, CPY in *; lia).
+      replace (Nat.eqb a RD) with false by (symmetry; apply Nat.eqb_neq; unfold RD, CPY in *; lia).
+      replace (Nat.eqb a ARM) with false by (symmetry; apply Nat.eqb_neq; unfold ARM, CPY in *; lia).
+      replace (Nat.eqb a CPY) with false by (symmetry; apply Nat.eqb_neq; lia).
+      rewrite (HW a Hgt Ha). reflexivity.
+Qed.
+
+Lemma rval_agree : forall (D : nat -> Prop) v1 v2 r, vagree D v1 v2 -> rdr D r -> rval v1 r = rval v2 r.
+Proof.
+  intros D v1 v2 [a0 w0 a1 w1 beta ao] H [H0 H1]. unfold rval.
+  rewrite (vcell_agree D v1 v2 a0 w0 H H0), (vcell_agree D v1 v2 a1 w1 H H1). reflexivity.
+Qed.
+
+Lemma vexec_agree : forall (D : nat -> Prop) v1 v2 r, (forall c, AR <= c <= HO -> D c) -> vagree D v1 v2 -> rdr D r ->
+  vagree (fun c => D c \/ c = ao_of r) (vexec Lb L r v1) (vexec Lb L r v2).
+Proof.
+  intros D v1 v2 r Hreq H Hr. pose proof (rval_agree D v1 v2 r H Hr) as Ex.
+  destruct H as (HR & HA & HC & HH & Hl & HW).
+  unfold vexec. rewrite Ex. set (x := rval v2 r). set (ao := ao_of r).
+  assert (Hn : forall c, CPY < c -> D c \/ c = ao -> wget (wnext (vw v1) ao x) c = wget (wnext (vw v2) ao x) c).
+  { intros c Hc Hd. unfold wnext. destruct (Nat.leb_spec ao CPY) as [Ha|Ha].
+    - destruct Hd as [Hd|Hd]; [exact (HW c Hc Hd) | lia].
+    - rewrite !wget_upd, Hl. destruct (Nat.eqb c ao && Nat.ltb ao (length (vw v2))) eqn:E; [reflexivity|].
+      destruct Hd as [Hd|Hd]; [exact (HW c Hc Hd)|]. subst c.
+      rewrite Nat.eqb_refl in E. cbn [andb] in E. apply Nat.ltb_ge in E.
+      unfold wget. rewrite !nth_overflow by lia. reflexivity. }
+  assert (Hq : forall c, AR <= c <= HO -> wget (wnext (vw v1) ao x) c = wget (wnext (vw v2) ao x) c)
+    by (intros c Hc; apply Hn; [unfold AR, CPY in *; lia | left; apply Hreq; exact Hc]).
+  unfold vput. cbv zeta. unfold vagree. cbn [vr va vc vho vw].
+  rewrite (Hq RR), (Hq AR), (Hq CB), (Hq RA), (Hq AA), (Hq CT), (Hq RC), (Hq AC), (Hq HO)
+    by (unfold AR, RR, CB, RA, AA, CT, RC, AC, HO; lia).
+  rewrite HR, HA, HC, HH.
+  refine (conj eq_refl (conj eq_refl (conj eq_refl (conj eq_refl (conj _ _))))).
+  - rewrite !length_clearq, !length_wnext. exact Hl.
+  - intros c Hc Hd. destruct (Nat.le_gt_cases c HO) as [H1|H1].
+    + rewrite !wget_clearq_req by (unfold AR, CPY in *; lia). reflexivity.
+    + rewrite !wget_clearq_out by (right; exact H1). exact (Hn c Hc Hd).
+Qed.
+
+Lemma vrun_agree : forall rs (D : nat -> Prop) v1 v2, (forall c, AR <= c <= HO -> D c) -> wbr D rs -> vagree D v1 v2 ->
+  vagree (fun c => D c \/ wrt rs c) (vrun Lb L rs v1) (vrun Lb L rs v2).
+Proof.
+  induction rs as [|r rs IH]; intros D v1 v2 Hreq Hw H.
+  - cbn [vrun]. apply (vagree_mono D); [intros c [Hc|[]]; exact Hc | exact H].
+  - destruct Hw as [Hr Hw]. cbn [vrun].
+    pose proof (vexec_agree D v1 v2 r Hreq H Hr) as H1.
+    pose proof (IH _ _ _ (fun c Hc => or_introl (Hreq c Hc)) Hw H1) as H2.
+    refine (vagree_mono _ _ _ _ _ H2).
+    intros c [Hc|Hc]; [left; left; exact Hc|]. unfold wrt in Hc. cbn [map In] in Hc.
+    destruct Hc as [Hc|Hc]; [left; right; symmetry; exact Hc | right; exact Hc].
+Qed.
+
+(* the cells under the heads and the cells from the requests on that no record writes keep their values *)
+Lemma vexec_frame : forall r v c, c <= CPY \/ (HO < c /\ c <> ao_of r) -> wget (vw (vexec Lb L r v)) c = wget (vw v) c.
+Proof.
+  intros r v c Hc. unfold vexec, vput. cbv zeta. cbn [vw].
+  rewrite wget_clearq_out by (destruct Hc as [Hc|[Hc _]]; [left; unfold AR, CPY in *; lia | right; exact Hc]).
+  unfold wnext. destruct (Nat.leb_spec (ao_of r) CPY); [reflexivity|].
+  rewrite wget_upd. replace (Nat.eqb c (ao_of r)) with false; [reflexivity|].
+  symmetry. apply Nat.eqb_neq. destruct Hc as [Hc|[_ Hc]]; [lia | exact Hc].
+Qed.
+
+Lemma vrun_frame : forall rs v c, c <= CPY \/ (HO < c /\ ~ wrt rs c) -> wget (vw (vrun Lb L rs v)) c = wget (vw v) c.
+Proof.
+  induction rs as [|r rs IH]; intros v c Hc; [reflexivity|]. cbn [vrun].
+  rewrite IH; [apply vexec_frame|].
+  - destruct Hc as [Hc|[Hc Hn]]; [left; exact Hc | right; split; [exact Hc|]].
+    intro E. apply Hn. unfold wrt. cbn [map In]. left. symmetry. exact E.
+  - destruct Hc as [Hc|[Hc Hn]]; [left; exact Hc | right; split; [exact Hc|]].
+    intro E. apply Hn. unfold wrt. cbn [map In]. right. exact E.
+Qed.
+
+End Agree.
+
+(* ---- the stored host ----------------------------------------------------------------------------------------- *)
+Section Host.
+Variables (A w : nat).
+Hypotheses (HA : 8 <= A) (Hw : 1 <= w).
+
+Local Notation n := (nH A).
+Local Notation us := (host_units A).
+Local Notation nu := (length (host_units A)).
+Local Notation lv := (levels (host_units A)).
+Local Notation nt := (next_tbl (nH A) (length (host_units A)) (host_next A)).
+
+(* the cells a pass reads before it writes them: the requests, booted, the registers and the state of the host *)
+Definition D0 (c : nat) : Prop := c < ST w n.
+
+Lemma SW8 : 256 <= SW A.
+Proof.
+  unfold SW. replace A with (8 + (A - 8)) by lia. rewrite Nat.pow_add_r. change (2 ^ 8) with 256.
+  pose proof (Nat.pow_nonzero 2 (A - 8) ltac:(lia)). lia.
+Qed.
+
+Lemma MB_D0 : forall j t, j < SW A -> t < A -> D0 (MB A w j t).
+Proof. intros j t Hj Ht. unfold D0, MB, ST, nH. nia. Qed.
+
+Lemma ST_D0 : forall i, i < n -> D0 (ST w i).
+Proof. intros i Hi. unfold D0, ST. lia. Qed.
+
+Lemma reg_D0 : forall i, i < w -> D0 (CNT i) /\ D0 (LIM w i).
+Proof. intros i Hi. unfold D0, CNT, LIM, ST. lia. Qed.
+
+Lemma CNT_D0 : forall i, i < w -> D0 (CNT i).
+Proof. intros i Hi. exact (proj1 (reg_D0 i Hi)). Qed.
+
+Lemma LIM_D0 : forall i, i < w -> D0 (LIM w i).
+Proof. intros i Hi. exact (proj2 (reg_D0 i Hi)). Qed.
+
+Lemma DEST_D0 : D0 (DEST w).
+Proof. unfold D0, DEST, ST. lia. Qed.
+
+Lemma BOOT_D0 : D0 BOOT.
+Proof. unfold D0, BOOT, ST. lia. Qed.
+
+Lemma req_D0 : forall c, AR <= c <= HO -> D0 c.
+Proof. intros c Hc. unfold D0, ST, AR, HO in *. lia. Qed.
+
+Lemma dev_lt : cwr A < SW A /\ crd A < SW A /\ crw A < SW A /\ rout A < SW A /\ rin A < SW A /\ ceot A < SW A.
+Proof. pose proof SW8. unfold cwr, crd, crw, rout, rin, ceot. lia. Qed.
+
+(* the startup reads only its own cells and booted *)
+Lemma wbr_startup : forall m, length m = SW A -> wbr D0 (startup A w m).
+Proof.
+  intros m Hm. apply wbr_all. unfold startup. rewrite !Forall_app. pose proof BOOT_D0 as HB.
+  refine (conj _ (conj _ (conj _ (conj _ (conj _ (conj _ _)))))).
+  - apply Forall_concat, Forall_map, Forall_forall. intros [j v] Hp. apply in_combine_l in Hp. apply in_seq in Hp.
+    cbn [fst snd]. unfold boot_word. apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht.
+    destruct (Nat.testbit v t); [apply rdr_or | apply rdr_and]; right; cbn [fst];
+      first [exact HB | apply MB_D0; lia].
+  - apply Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht.
+    apply rdr_and; right; cbn [fst]; [apply ST_D0; unfold nH; lia | exact HB].
+  - apply Forall_cons; [|apply Forall_nil]. apply rdr_and; right; cbn [fst]; [apply ST_D0; unfold nH; lia | exact HB].
+  - apply Forall_concat, Forall_map, Forall_forall. intros i Hi. apply in_seq in Hi.
+    destruct (reg_D0 i ltac:(lia)) as [H1 H2].
+    apply Forall_cons; [|apply Forall_cons; [|apply Forall_nil]]; apply rdr_and; right; cbn [fst]; assumption.
+  - apply Forall_cons; [|apply Forall_nil]. apply rdr_and; right; cbn [fst]; [exact DEST_D0 | exact HB].
+  - cbn [map]. repeat (apply Forall_cons; [apply rdr_copy; right; exact HB|]). apply Forall_nil.
+  - apply Forall_cons; [apply rdr_const | apply Forall_nil].
+Qed.
+
+(* the step: every input of a unit is a state bit, or a unit before it whose cell it writes *)
+Definition Du (u : nat) (c : nat) : Prop := D0 c \/ exists v, v < u /\ nth v nt None = None /\ c = UC A w v.
+
+Lemma lit_Du : forall u, u < nu -> forall p, In p (tin (nth u us tu0)) -> cok (Du u) (fst (lit_of A w p)).
+Proof.
+  intros u Hu [i wt] Hin. right. unfold lit_of, nh. cbn [fst].
+  destruct (Nat.ltb_spec i n) as [Hi|Hi]; [left; apply ST_D0; exact Hi|].
+  right. pose proof (host_reads_below A ltac:(lia) u Hu i wt Hin) as Hlt.
+  exists (i - n). split; [lia|]. split; [|reflexivity].
+  destruct (nth (i - n) nt None) as [i'|] eqn:Ei; [|reflexivity]. exfalso.
+  destruct (nt_some A ltac:(lia) (i - n) i' ltac:(lia) Ei) as [Hi' Ei'].
+  apply (host_no_out A ltac:(lia) u i wt Hu Hin i' Hi'). lia.
+Qed.
+
+Lemma skipn_nth' : forall (T : Type) (l : list T) k d, k < length l -> skipn k l = nth k l d :: skipn (S k) l.
+Proof.
+  intros T l. induction l as [|x l IH]; intros [|k] d Hk; cbn [length] in Hk; try lia; [reflexivity|].
+  cbn [skipn nth]. apply IH. lia.
+Qed.
+
+Lemma step_go_cons : forall u, u < nu ->
+  step_go A w nu u (skipn u us) (skipn u nt) = unit_recs A w u ++ step_go A w nu (S u) (skipn (S u) us) (skipn (S u) nt).
+Proof.
+  intros u Hu. rewrite (skipn_nth' _ us u tu0 Hu).
+  rewrite (skipn_nth' _ nt u None) by (rewrite (proj1 (nt_spec A ltac:(lia))); exact Hu).
+  reflexivity.
+Qed.
+
+Lemma wbr_step : wbr D0 (step_go A w nu 0 us nt).
+Proof.
+  assert (G : forall k u, u + k = nu -> wbr (Du u) (step_go A w nu u (skipn u us) (skipn u nt))).
+  { induction k as [|k IH]; intros u Hk.
+    - rewrite Nat.add_0_r in Hk. subst u. rewrite skipn_all. exact I.
+    - rewrite step_go_cons by lia. apply (wbr_app _ _ _ (Du (S u))).
+      + unfold unit_recs. apply wbr_ucomp. intros l Hl. apply in_map_iff in Hl as (p & <- & Hp).
+        apply lit_Du; [lia | exact Hp].
+      + intros c [Hc|(v & Hv & Hn & ->)]; [left; left; exact Hc|].
+        destruct (Nat.eq_dec v u) as [->|Hvu]; [right | left; right; exists v; split; [lia | split; [exact Hn | reflexivity]]].
+        unfold unit_recs. rewrite Hn. apply ucomp_writes.
+      + apply IH. lia. }
+  apply (wbr_mono _ (Du 0)); [|exact (G nu 0 eq_refl)].
+  intros c [Hc|(v & Hv & _)]; [exact Hc | lia].
+Qed.
+
+(* the device: its temporaries are written in order, each before its first read *)
+Local Notation dWR := (dWR A w nu lv).
+Local Notation dRD := (dRD A w nu lv).
+Local Notation dRW := (dRW A w nu lv).
+Local Notation dE := (dE A w nu lv).
+Local Notation dEQ := (dEQ A w nu lv).
+Local Notation dEOT := (dEOT A w nu lv).
+Local Notation dCA := (dCA A w nu lv).
+Local Notation dCC := (dCC A w nu lv).
+Local Notation dG := (dG A w nu lv).
+Local Notation dCAR := (dCAR A w nu lv).
+
+Definition Tn (j c : nat) : Prop :=
+  match j with
+  | 1 => c = dWR | 2 => c = dRD | 3 => c = dRW | 4 => exists i, i < w /\ c = dE i | 5 => c = dEQ
+  | 6 => c = dEOT \/ c = dCA \/ c = dCC | 7 => c = dG | 8 => exists j, 1 <= j < w /\ c = dCAR j
+  | _ => False
+  end.
+
+Fixpoint Td (k c : nat) : Prop := match k with O => D0 c | S k' => Td k' c \/ Tn k c end.
+
+Lemma Td_mono : forall k k' c, k <= k' -> Td k c -> Td k' c.
+Proof.
+  intros k k' c Hk. induction k' as [|k' IH]; intro H.
+  - assert (k = 0) by lia. subst k. exact H.
+  - destruct (Nat.eq_dec k (S k')) as [->|E]; [exact H|]. left. apply IH; [lia | exact H].
+Qed.
+
+Lemma td_D0 : forall k c, D0 c -> Td k c.
+Proof. intros k c H. apply (Td_mono 0); [lia | exact H]. Qed.
+
+Lemma td_new : forall j k c, 1 <= j <= k -> Tn j c -> Td k c.
+Proof. intros j k c Hj H. apply (Td_mono j); [lia|]. destruct j as [|j]; [lia|]. right. exact H. Qed.
+
+Lemma td_up : forall k (s : list rec), (forall c, Tn (S k) c -> wrt s c) -> forall c, Td (S k) c -> Td k c \/ wrt s c.
+Proof. intros k s H c [Hc|Hc]; [left; exact Hc | right; apply H; exact Hc]. Qed.
+
+Lemma td_same : forall k (s : list rec) c, Td k c -> Td k c \/ wrt s c.
+Proof. intros k s c Hc. left. exact Hc. Qed.
+
+Ltac tdc :=
+  match goal with
+  | |- cok _ (Stored.dWR _ _ _ _) => right; apply (td_new 1); [lia | reflexivity]
+  | |- cok _ (Stored.dRD _ _ _ _) => right; apply (td_new 2); [lia | reflexivity]
+  | |- cok _ (Stored.dRW _ _ _ _) => right; apply (td_new 3); [lia | reflexivity]
+  | |- cok _ (Stored.dE _ _ _ _ _) => right; apply (td_new 4); [lia | eexists; split; [|reflexivity]; lia]
+  | |- cok _ (Stored.dEQ _ _ _ _) => right; apply (td_new 5); [lia | reflexivity]
+  | |- cok _ (Stored.dEOT _ _ _ _) => right; apply (td_new 6); [lia | left; reflexivity]
+  | |- cok _ (Stored.dCA _ _ _ _) => right; apply (td_new 6); [lia | right; left; reflexivity]
+  | |- cok _ (Stored.dCC _ _ _ _) => right; apply (td_new 6); [lia | right; right; reflexivity]
+  | |- cok _ (Stored.dG _ _ _ _) => right; apply (td_new 7); [lia | reflexivity]
+  | |- cok _ (Stored.dCAR _ _ _ _ _) => right; apply (td_new 8); [lia | eexists; split; [|reflexivity]; lia]
+  | |- cok _ (MB _ _ _ _) => right; apply td_D0, MB_D0; destruct dev_lt as (? & ? & ? & ? & ? & ?); lia
+  | |- cok _ (CNT _) => right; apply td_D0, CNT_D0; lia
+  | |- cok _ (LIM _ _) => right; apply td_D0, LIM_D0; lia
+  | |- cok _ (DEST _) => right; apply td_D0; exact DEST_D0
+  | |- cok _ _ => left; unfold SINK, RD, ARM, CPY; lia
+  end.
+
+Lemma wbr_tri : forall (D : nat -> Prop) x y x' y' d, cok D (fst x) -> cok D (fst y) -> cok D (fst x') -> cok D (fst y') ->
+  wbr D [gAND x y (M0 A w nu lv); gAND x' y' (M1 A w nu lv); gOR (M0 A w nu lv, true) (M1 A w nu lv, true) d].
+Proof.
+  intros D x y x' y' d Hx Hy Hx' Hy'. cbn [wbr]. split; [apply rdr_and; assumption|]. split.
+  - apply rdr_and; apply (cok_mono D); try (intros c Hc; left; exact Hc); assumption.
+  - split; [|exact I]. apply rdr_or; right; [left; right; reflexivity | right; reflexivity].
+Qed.
+
+Lemma wbr_mux : forall k s a b d, cok (Td k) s -> cok (Td k) (fst a) -> cok (Td k) (fst b) ->
+  wbr (Td k) (gMUX A w nu lv s a b d).
+Proof. intros k s a b d Hs Ha Hb. apply wbr_tri; assumption. Qed.
+
+Lemma wbr_xor : forall k x y d, cok (Td k) (fst x) -> cok (Td k) (fst y) -> wbr (Td k) (gXOR A w nu lv x y d).
+Proof.
+  intros k x y d Hx Hy. unfold gXOR. cbn [wbr]. split; [apply rdr_or; assumption|]. split.
+  - apply rdr_or; apply (cok_mono (Td k)); try (intros c Hc; left; exact Hc); assumption.
+  - split; [|exact I]. apply rdr_and; right; [left; right; reflexivity | right; reflexivity].
+Qed.
+
+Lemma wbr_word1 : forall k j d, j < SW A -> wbr (Td k) (word1 A w j d).
+Proof.
+  intros k j d Hj. unfold word1. apply wbr_chain_and. intros l [<-|Hl]; [cbn [fst]; tdc|].
+  apply in_map_iff in Hl as (t & <- & Ht). apply in_seq in Ht. cbn [fst]. right. apply td_D0, MB_D0; lia.
+Qed.
+
+Lemma word1_writes : forall j d, wrt (word1 A w j d) d.
+Proof. intros j d. unfold word1. apply (chain_writes gAND (fun _ _ _ => eq_refl)). discriminate. Qed.
+
+Lemma wbr_carries : forall len k (D : nat -> Prop), k + len <= w - 1 -> (forall c, Td 7 c -> D c) ->
+  (forall j, 1 <= j <= k -> D (dCAR j)) ->
+  wbr D (map (fun i => gAND (carry A w nu lv i, true) (CNT i, true) (dCAR (S i))) (seq k len)).
+Proof.
+  induction len as [|len IH]; intros k D Hk H7 Hc; [exact I|]. cbn [seq map wbr]. split.
+  - apply rdr_and; right; cbn [fst].
+    + unfold carry. destruct (Nat.eqb_spec k 0) as [->|E]; [apply H7; apply (td_new 7); [lia | reflexivity]|].
+      apply Hc. lia.
+    + apply H7, td_D0. apply (proj1 (reg_D0 k ltac:(lia))).
+  - apply IH; [lia | intros c Hc'; left; apply H7; exact Hc' |].
+    intros j Hj. destruct (Nat.eq_dec j (S k)) as [->|E]; [right; reflexivity | left; apply Hc; lia].
+Qed.
+
+Lemma wbr_device : wbr D0 (Stored.device A w nu lv).
+Proof.
+  pose proof dev_lt as (Hwr & Hrd & Hrw & Hro & Hri & Heo).
+  apply (wbr_mono _ (Td 0)); [intros c Hc; exact Hc|]. unfold Stored.device.
+  apply (wbr_app _ _ _ (Td 1)); [apply wbr_word1; exact Hwr | apply td_up; intros c ->; apply word1_writes|].
+  apply (wbr_app _ _ _ (Td 2)); [apply wbr_word1; exact Hrd | apply td_up; intros c ->; apply word1_writes|].
+  apply (wbr_app _ _ _ (Td 3)); [apply wbr_word1; exact Hrw | apply td_up; intros c ->; apply word1_writes|].
+  apply (wbr_app _ _ _ (Td 4)).
+  { apply wbr_concat_map. intros i Hi. apply in_seq in Hi. apply wbr_tri; cbn [fst]; tdc. }
+  { apply td_up. intros c (i & Hi & ->). apply (wrt_concat_map _ _ i); [apply in_seq; lia|].
+    unfold wrt. cbn [map In]. right. right. left. reflexivity. }
+  apply (wbr_app _ _ _ (Td 5)).
+  { apply wbr_chain_and. intros l Hl. apply in_map_iff in Hl as (i & <- & Hi). apply in_seq in Hi. cbn [fst]. tdc. }
+  { apply td_up. intros c ->. apply (chain_writes gAND (fun _ _ _ => eq_refl)).
+    destruct w as [|w']; [lia | discriminate]. }
+  apply (wbr_app _ _ _ (Td 6)).
+  { apply wbr_all. do 3 (apply Forall_cons; [apply rdr_and; cbn [fst]; tdc|]). apply Forall_nil. }
+  { apply td_up. intros c [->|[->| ->]]; unfold wrt; cbn [map In]; [left | right; left | right; right; left];
+      reflexivity. }
+  apply (wbr_app _ _ _ (Td 6)).
+  { apply wbr_concat_map. intros k Hk. apply in_seq in Hk.
+    apply (wbr_app _ _ _ (Td 6)); [apply wbr_mux; cbn [fst]; tdc | intros c Hc; left; exact Hc|].
+    apply (wbr_app _ _ _ (Td 6)); [(split; [apply rdr_copy; cbn [fst]; tdc | exact I])
+                                  | intros c Hc; left; exact Hc |].
+    apply (wbr_app _ _ _ (Td 6)); [apply wbr_mux; cbn [fst]; tdc | intros c Hc; left; exact Hc|].
+    (split; [apply rdr_copy; cbn [fst]; tdc | exact I]). }
+  { apply td_same. }
+  apply (wbr_app _ _ _ (Td 6)).
+  { apply wbr_all, Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. apply rdr_and; cbn [fst]; tdc. }
+  { apply td_same. }
+  apply (wbr_app _ _ _ (Td 7)).
+  { (split; [apply rdr_and; cbn [fst]; tdc | exact I]). }
+  { apply td_up. intros c ->. unfold wrt. cbn [map In]. left. reflexivity. }
+  apply (wbr_app _ _ _ (Td 7)).
+  { apply wbr_concat_map. intros k Hk. apply in_seq in Hk.
+    apply (wbr_app _ _ _ (Td 7)); [apply wbr_mux; cbn [fst]; tdc | intros c Hc; left; exact Hc|].
+    (split; [apply rdr_copy; cbn [fst]; tdc | exact I]). }
+  { apply td_same. }
+  apply (wbr_app _ _ _ (Td 7)).
+  { apply wbr_concat_map. intros t Ht. apply in_seq in Ht. apply wbr_mux; cbn [fst]; tdc. }
+  { apply td_same. }
+  apply (wbr_app _ _ _ (Td 7)); [apply wbr_mux; cbn [fst]; tdc | apply td_same|].
+  apply (wbr_app _ _ _ (Td 7)).
+  { apply wbr_all, Forall_map, Forall_forall. intros t Ht. apply in_seq in Ht. apply rdr_and; cbn [fst]; tdc. }
+  { apply td_same. }
+  apply (wbr_app _ _ _ (Td 8)).
+  { apply wbr_carries; [lia | intros c Hc; exact Hc | intros j Hj; lia]. }
+  { apply td_up. intros c (j & Hj & ->).
+    assert (E : dCAR j = dCAR (S (j - 1))) by (f_equal; lia). rewrite E.
+    apply (wrt_map (fun i => gAND (carry A w nu lv i, true) (CNT i, true) (dCAR (S i))) _ (j - 1)).
+    apply in_seq. lia. }
+  apply (wbr_app _ _ _ (Td 8)).
+  { apply wbr_concat_map. intros i Hi. apply in_seq in Hi. apply wbr_xor; cbn [fst]; [tdc|].
+    unfold carry. destruct (Nat.eqb_spec i 0) as [->|E]; tdc. }
+  { apply td_same. }
+  apply (wbr_app _ _ _ (Td 8)); [(split; [apply rdr_copy; cbn [fst]; tdc | exact I]) | apply td_same|].
+  apply (wbr_app _ _ _ (Td 8)).
+  { apply wbr_concat_map. intros i Hi. apply in_seq in Hi.
+    apply (wbr_app _ _ _ (Td 8)); [apply wbr_mux; cbn [fst]; tdc | intros c Hc; left; exact Hc|].
+    (split; [apply rdr_and; cbn [fst]; tdc | exact I]). }
+  { apply td_same. }
+  apply (wbr_app _ _ _ (Td 8)).
+  { split; [apply rdr_or; cbn [fst]; tdc | exact I]. }
+  { apply td_same. }
+  apply wbr_concat_map. intros c Hc. apply wbr_all, Forall_map, Forall_forall. intros t _. apply rdr_const.
+Qed.
+
+(* the whole image: each block reads only the cells of D0 and its own *)
+Local Notation m := (image A (progPstar A)).
+
+Lemma length_m : length m = SW A.
+Proof. unfold image. rewrite length_map, length_seq. reflexivity. Qed.
+
+Definition rest : list rec :=
+  step_go A w nu 0 us nt ++ Stored.device A w nu lv
+  ++ repeat EMPTY (padn (alS A w) (length (startup A w m ++ step_go A w nu 0 us nt ++ Stored.device A w nu lv)))
+  ++ handover A w.
+
+Lemma stored_rest : stored A w = startup A w m ++ rest.
+Proof. unfold stored, stored_of, rest. cbv zeta. cbn [fst]. rewrite <- !app_assoc. reflexivity. Qed.
+
+Lemma wbr_rest : wbr D0 rest.
+Proof.
+  unfold rest.
+  apply (wbr_app _ _ _ D0); [exact wbr_step | intros c Hc; left; exact Hc|].
+  apply (wbr_app _ _ _ D0); [exact wbr_device | intros c Hc; left; exact Hc|].
+  apply (wbr_app _ _ _ D0); [apply wbr_all, Forall_forall; intros r Hr; apply repeat_spec in Hr; subst r; apply rdr_empty
+                             | intros c Hc; left; exact Hc|].
+  apply wbr_all. unfold handover. pose proof BOOT_D0 as HB. pose proof (ST_D0 A ltac:(unfold nH; lia)) as HS.
+  apply Forall_cons; [apply rdr_and; right; assumption|].
+  do 3 (apply Forall_cons; [apply rdr_copy; right; assumption|]). apply Forall_nil.
+Qed.
+
+Lemma wrt_startup : forall c, wrt (startup A w m) c -> D0 c.
+Proof.
+  intros c Hc. unfold wrt, startup in Hc. rewrite !map_app in Hc.
+  repeat (apply in_app_or in Hc as [Hc|Hc]).
+  - apply in_map_iff in Hc as (r & <- & Hr). apply in_concat in Hr as (l & Hl & Hr).
+    apply in_map_iff in Hl as ([j v] & <- & Hp). apply in_combine_l in Hp. apply in_seq in Hp.
+    unfold boot_word in Hr. apply in_map_iff in Hr as (t & <- & Ht). apply in_seq in Ht. cbn [fst snd].
+    destruct (Nat.testbit v t); apply MB_D0; lia.
+  - apply in_map_iff in Hc as (r & <- & Hr). apply in_map_iff in Hr as (t & <- & Ht). apply in_seq in Ht.
+    apply ST_D0. unfold nH. lia.
+  - destruct Hc as [<-|[]]. apply ST_D0. unfold nH. lia.
+  - apply in_map_iff in Hc as (r & <- & Hr). apply in_concat in Hr as (l & Hl & Hr).
+    apply in_map_iff in Hl as (i & <- & Hi). apply in_seq in Hi.
+    destruct Hr as [<-|[<-|[]]]; [exact (proj1 (reg_D0 i ltac:(lia))) | exact (proj2 (reg_D0 i ltac:(lia)))].
+  - destruct Hc as [<-|[]]. exact DEST_D0.
+  - destruct Hc as [<-|[<-|[<-|[<-|[<-|[]]]]]]; cbn [ao_of gCOPY]; apply req_D0; unfold AR, HO, RR, CB, RA, CT, RC;
+      lia.
+  - destruct Hc as [<-|[]]. exact BOOT_D0.
+Qed.
+
+Theorem wbr_stored : wbr D0 (stored A w).
+Proof.
+  rewrite stored_rest. apply (wbr_app _ _ _ D0); [exact (wbr_startup m length_m) | intros c Hc; left; exact Hc |].
+  exact wbr_rest.
+Qed.
+
+End Host.

rocq/StoredWidth.v

@@ -0,0 +1,152 @@
+(* Theorem 8.8: for every word width A >= 8 there is a counter width w >= 20 for which the recipe of literal tokens
+   of the image of S_{A,w} is shorter than 2^w, so that Theorems 8.6 and 8.7 apply to S_{A,w}: its records grow
+   linearly in w and its window logarithmically, while 2^w grows exponentially. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run PhysSem View Stored Host Device Pstar StoredPass StoredWbr
+  StoredImage.
+
+(* ---- the number of records ------------------------------------------------------------------------------- *)
+Lemma length_cmk : forall (S T : Type) (f : S -> list T) l k, (forall x, length (f x) = k) ->
+  length (concat (map f l)) = k * length l.
+Proof. intros S T f l k H. induction l as [|x l IH]; cbn [map concat length]; [lia|]. rewrite length_app, H, IH. lia. Qed.
+
+Lemma length_chain_tail : forall (g : nat * bool -> nat * bool -> nat -> rec) acc ls l d,
+  length (chain_tail g acc l ls d) = S (length ls).
+Proof.
+  intros g acc ls. induction ls as [|l' ls IH]; intros l d; cbn [chain_tail length]; [reflexivity|].
+  rewrite IH. reflexivity.
+Qed.
+
+Lemma length_chain : forall g ls d acc, length (chain g ls d acc) <= length ls.
+Proof. intros g [|l0 [|l1 [|l2 t]]] d acc; cbn [chain length]; try lia. rewrite length_chain_tail. lia. Qed.
+
+Lemma length_ucomp : forall xc ls t d acc lev, length (ucomp xc t ls d acc lev) <= 2 ^ (length ls + 2) - 2.
+Proof.
+  intros xc. induction ls as [|l0 rest IH]; intros t d acc lev; rewrite ucomp_eq.
+  - destruct (Z.leb t 0); [cbn; lia|]. destruct (Z.ltb _ t); [cbn; lia|].
+    destruct (Z.eqb t 1); [pose proof (length_chain gOR [] d acc); cbn in *; lia|].
+    destruct (Z.eqb t _); [pose proof (length_chain gAND [] d acc); cbn in *; lia | cbn; lia].
+  - cbn [length]. rewrite Nat.add_succ_l, Nat.pow_succ_r'.
+    assert (Hp : 4 <= 2 ^ (length rest + 2)) by (change 4 with (2 ^ 2); apply Nat.pow_le_mono_r; lia).
+    pose proof (Nat.pow_gt_lin_r 2 (length rest + 2) ltac:(lia)) as Hl.
+    destruct (Z.leb t 0); [cbn [length]; lia|]. destruct (Z.ltb _ t); [cbn [length]; lia|].
+    destruct (Z.eqb t 1); [pose proof (length_chain gOR (l0 :: rest) d acc) as H; cbn [length] in H; lia|].
+    destruct (Z.eqb t _); [pose proof (length_chain gAND (l0 :: rest) d acc) as H; cbn [length] in H; lia|].
+    rewrite !length_app. cbn [length].
+    pose proof (IH t (xc lev 0) (xc lev 0) (S lev)). pose proof (IH (t - 1)%Z (xc lev 1) (xc lev 1) (S lev)). lia.
+Qed.
+
+Definition sbound (us : list tu) : nat := fold_right (fun U acc => 2 ^ (length (tin U) + 2) + acc) 0 us.
+
+Lemma length_step_go : forall A w nu us nt u, length (step_go A w nu u us nt) <= sbound us.
+Proof.
+  intros A w nu us. induction us as [|U us IH]; intros nt u; [cbn; lia|].
+  destruct nt as [|o nt]; [cbn [step_go length]; lia|]. cbn [step_go sbound fold_right]. rewrite length_app.
+  pose proof (length_ucomp (XC A w nu) (map (lit_of A w) (tin U)) (tval U)
+                (match o with Some i => ST w i | None => UC A w u end) (UC A w u) 0) as H.
+  rewrite length_map in H. specialize (IH nt (S u)). fold (sbound us). lia.
+Qed.
+
+Lemma length_startup : forall A w m, length m = SW A -> length (startup A w m) = SW A * A + A + 2 * w + 8.
+Proof.
+  intros A w m Hm. unfold startup. rewrite !length_app, !length_map, !length_seq. cbn [length].
+  rewrite (length_cmk _ _ _ _ A) by (intros [j v]; unfold boot_word; rewrite length_map, length_seq; reflexivity).
+  rewrite (length_cmk _ _ _ _ 2) by (intro; reflexivity).
+  rewrite length_combine, length_seq, Hm, Nat.min_id, length_seq. lia.
+Qed.
+
+Lemma length_word1 : forall A w j d, 1 <= A -> length (word1 A w j d) <= A.
+Proof.
+  intros A w j d HA. unfold word1. eapply Nat.le_trans; [apply length_chain|]. cbn [length].
+  rewrite length_map, length_seq. lia.
+Qed.
+
+Lemma length_device : forall A w nu lv, 8 <= A -> length (Stored.device A w nu lv) <= 11 * A + 12 * w + 120.
+Proof.
+  intros A w nu lv HA.
+  pose proof (length_word1 A w (cwr A) (dWR A w nu lv) ltac:(lia)) as C1.
+  pose proof (length_word1 A w (crd A) (dRD A w nu lv) ltac:(lia)) as C2.
+  pose proof (length_word1 A w (crw A) (dRW A w nu lv) ltac:(lia)) as C3.
+  pose proof (length_chain gAND (map (fun i => (dE A w nu lv i, true)) (seq 0 w)) (dEQ A w nu lv) (dEQ A w nu lv))
+    as C4.
+  rewrite length_map, length_seq in C4.
+  unfold Stored.device. rewrite !length_app.
+  rewrite (length_cmk _ _ _ _ 3) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 8) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 4) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 3) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 3) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ 4) by (intro; reflexivity).
+  rewrite (length_cmk _ _ _ _ A) by (intro; rewrite length_map, length_seq; reflexivity).
+  rewrite !length_map, !length_seq. unfold gMUX. cbn [length]. lia.
+Qed.
+
+Lemma padn_lt : forall al len, padn al len < 8.
+Proof.
+  intros al len. unfold padn. destruct (find _ (seq 0 8)) as [p|] eqn:E; [|lia].
+  apply find_some in E as [E _]. apply in_seq in E. lia.
+Qed.
+
+Lemma length_stored : forall A w, 8 <= A ->
+  length (stored A w) <= SW A * A + 12 * A + sbound (host_units A) + 14 * w + 139.
+Proof.
+  intros A w HA. rewrite (stored_split A w), !length_app, repeat_length. unfold handover. cbn [length].
+  rewrite (length_startup A w _ (length_image A)).
+  pose proof (length_step_go A w (length (host_units A)) (host_units A)
+                (next_tbl (nH A) (length (host_units A)) (host_next A)) 0).
+  pose proof (length_device A w (length (host_units A)) (levels (host_units A)) HA).
+  match goal with |- context [padn ?a ?b] => pose proof (padn_lt a b) end.
+  lia.
+Qed.
+
+Lemma alS_le : forall A w, alS A w <= nH A + length (host_units A) + 3 * levels (host_units A) + 24 + 4 * w.
+Proof.
+  intros A w. unfold alS, stored_of. cbv zeta. cbn [snd].
+  eapply Nat.le_trans; [apply Nat.log2_up_le_lin; lia|]. unfold ncells, DB, nh. lia.
+Qed.
+
+(* ---- 2^w outgrows every polynomial of degree two in w -------------------------------------------------------- *)
+Lemma cube_pow : forall w, 11 <= w -> (w + 1) * (w + 1) * (w + 1) < 2 ^ w.
+Proof.
+  induction w as [|w IH]; intro Hw; [lia|].
+  destruct (Nat.eq_dec w 10) as [->|E]; [change (2 ^ 11) with 2048; lia|].
+  assert (IH' : (w + 1) * (w + 1) * (w + 1) < 2 ^ w) by (apply IH; lia).
+  assert (H1 : (S w + 1) * (S w + 1) * (S w + 1) <= 2 * ((w + 1) * (w + 1) * (w + 1))) by nia.
+  rewrite Nat.pow_succ_r'. lia.
+Qed.
+
+(* Theorem 8.8: a counter width for every word width, with room for every recipe of at most 2B + 1 bytes *)
+Theorem width_exists : forall A, 8 <= A ->
+  exists w, 20 <= w /\ 2 * length (image_bytes A w) + 1 < 2 ^ w.
+Proof.
+  intros A HA.
+  set (c0 := SW A * A + 12 * A + sbound (host_units A) + 139).
+  set (c1 := nH A + length (host_units A) + 3 * levels (host_units A) + 24).
+  set (a := 8 + 3 * c1 + 12). set (b := c0 + 14). set (C := 2 * a * b + 1).
+  exists (C + 20). split; [lia|]. set (w := C + 20).
+  pose proof (length_image_bytes A w) as B.
+  pose proof (length_stored A w HA) as G. fold c0 in G.
+  pose proof (alS_le A w) as Hal. fold c1 in Hal.
+  assert (HX : recw (alS A w) <= a * (w + 1)) by (unfold recw, a; nia).
+  assert (HY : length (stored A w) <= b * (w + 1)) by (unfold b; nia).
+  assert (HXY : recw (alS A w) * length (stored A w) <= (a * (w + 1)) * (b * (w + 1)))
+    by (apply Nat.mul_le_mono; assumption).
+  assert (HC : C * ((w + 1) * (w + 1)) <= (w + 1) * (w + 1) * (w + 1)).
+  { replace ((w + 1) * (w + 1) * (w + 1)) with ((w + 1) * ((w + 1) * (w + 1))) by ring.
+    apply Nat.mul_le_mono_r. unfold w. lia. }
+  pose proof (cube_pow w ltac:(unfold w; lia)) as P.
+  assert (Hab : 2 * ((a * (w + 1)) * (b * (w + 1))) + 1 <= C * ((w + 1) * (w + 1))).
+  { unfold C. replace (2 * (a * (w + 1) * (b * (w + 1)))) with (2 * a * b * ((w + 1) * (w + 1))) by ring.
+    assert (1 * 1 <= (w + 1) * (w + 1)) by (apply Nat.mul_le_mono; lia). lia. }
+  lia.
+Qed.
+
+(* the hypotheses of Theorem 8.7 hold for the recipe of literal tokens of the image, at every such w *)
+Corollary recipe_of_image : forall A w, 2 * length (image_bytes A w) + 1 < 2 ^ w ->
+  Forall tok_ok (lits (image_bytes A w)) /\ bbits (delta (lits (image_bytes A w))) = encA (alS A w) (stored A w)
+  /\ length (recipe (lits (image_bytes A w))) < 2 ^ w.
+Proof.
+  intros A w Hw. split; [apply lits_ok|]. split; [rewrite delta_lits by apply image_bytes_lt; apply bbits_image|].
+  pose proof (length_recipe_lits (image_bytes A w)). lia.
+Qed.

rocq/View.v

@@ -0,0 +1,283 @@
+(* Records executed one after another on a view of the ring machine: the window, the read tape, the idle
+   bank read as a tape, the copy tape, and whether a record has handed over. A segment of the active bank
+   runs as the records it holds, whatever the width of the window. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Net Abstract Indep Run PhysSem PhysMain.
+
+Record view := mkV { vw : list bool; vr : tape; va : tape; vc : tape; vho : bool }.
+
+Section View.
+Variables (Lb L : nat).
+
+Definition vcell (v : view) (a : nat) : bool :=
+  if Nat.eqb a SINK then false
+  else if Nat.eqb a RD then tget (vr v)
+  else if Nat.eqb a ARM then tget (va v)
+  else if Nat.eqb a CPY then tget (vc v)
+  else wget (vw v) a.
+
+Definition rval (v : view) (r : rec) : bool :=
+  match r with Rec a0 w0 a1 w1 beta _ => Z.leb 0 (w0 * b2z (vcell v a0) + w1 * b2z (vcell v a1) + beta) end.
+
+(* the value x written into cell ao, then the requests carried out and cleared *)
+Definition vput (v : view) (ao : nat) (x : bool) : view :=
+  let wn := wnext (vw v) ao x in
+  let A1 := if Nat.eqb ao ARM then mkT (upd (td (va v)) (th (va v)) x) (th (va v)) else va v in
+  let C1 := if Nat.eqb ao CPY then mkT (upd (td (vc v)) (th (vc v)) x) (th (vc v)) else vc v in
+  mkV (clearq wn)
+      (mkT (td (vr v)) (if wget wn RR then 0 else if wget wn AR then succ_mod L (th (vr v)) else th (vr v)))
+      (mkT (if wget wn CB then repeat false Lb else td A1)
+           (if wget wn RA then 0 else if wget wn AA then succ_mod Lb (th A1) else th A1))
+      (mkT (if wget wn CT then repeat false L else td C1)
+           (if wget wn RC then 0 else if wget wn AC then succ_mod L (th C1) else th C1))
+      (vho v || wget wn HO).
+
+Definition vexec (r : rec) (v : view) : view := vput v (ao_of r) (rval v r).
+
+Fixpoint vrun (rs : list rec) (v : view) : view :=
+  match rs with [] => v | r :: t => vrun t (vexec r v) end.
+
+Lemma vrun_app : forall a b v, vrun (a ++ b) v = vrun b (vrun a v).
+Proof. induction a as [|r a IH]; intros b v; [reflexivity|]. cbn [app vrun]. apply IH. Qed.
+
+End View.
+
+(* ---- the code of a record, for every width of the window ------------------------------------------ *)
+Lemma length_enc_w : forall w, length (enc_w w) = 2.
+Proof. intro w. unfold enc_w. destruct (Z.eqb w 1); [|destruct (Z.eqb w (-1))]; reflexivity. Qed.
+
+Lemma length_nat2bits : forall k v, length (nat2bits k v) = k.
+Proof. induction k as [|k IH]; intro v; cbn [nat2bits length]; [reflexivity | rewrite IH; reflexivity]. Qed.
+
+Lemma length_enc_recA : forall al r, length (enc_recA al r) = recw al.
+Proof.
+  intros al [a0 w0 a1 w1 beta ao]. unfold enc_recA, recw.
+  rewrite !length_app, !length_enc_w, !length_nat2bits. lia.
+Qed.
+
+Lemma nth_nat2bits : forall k v t, t < k -> nth t (nat2bits k v) false = Nat.testbit v (k - 1 - t).
+Proof.
+  induction k as [|k IH]; intros v t Ht; [lia|]. cbn [nat2bits].
+  destruct t as [|t]; cbn [nth]; [f_equal; lia|]. rewrite IH by lia. f_equal. lia.
+Qed.
+
+Lemma bits2nat_nat2bits : forall k v, v < 2 ^ k -> bits2nat (nat2bits k v) = v.
+Proof.
+  intros k v Hv. apply (bits_eq_nat _ _ k); [|exact Hv|].
+  - pose proof (bits2nat_lt (nat2bits k v)) as H. rewrite length_nat2bits in H. exact H.
+  - intros i Hi. pose proof (testbit_bits2nat (nat2bits k v) (k - 1 - i)) as T.
+    rewrite length_nat2bits in T. replace (k - 1 - (k - 1 - i)) with i in T by lia.
+    rewrite T by lia. rewrite nth_nat2bits by lia. f_equal. lia.
+Qed.
+
+(* a record whose weights, bias and addresses fit their codes *)
+Definition rec_ok (al : nat) (r : rec) : Prop :=
+  match r with
+  | Rec a0 w0 a1 w1 beta ao =>
+      (w0 = 1 \/ w0 = 0 \/ w0 = -1)%Z /\ (w1 = 1 \/ w1 = 0 \/ w1 = -1)%Z /\ (-8 <= beta <= 7)%Z
+      /\ a0 < 2 ^ al /\ a1 < 2 ^ al /\ ao < 2 ^ al
+  end.
+
+Lemma wcode_enc : forall w, (w = 1 \/ w = 0 \/ w = -1)%Z ->
+  wcode (nth 0 (enc_w w) false) (nth 1 (enc_w w) false) = w.
+Proof. intros w [->|[->| ->]]; reflexivity. Qed.
+
+Lemma beta_code : forall beta, (-8 <= beta <= 7)%Z ->
+  (if Z.leb 8 (Z.of_nat (Z.to_nat (beta mod 16))) then Z.of_nat (Z.to_nat (beta mod 16)) - 16
+   else Z.of_nat (Z.to_nat (beta mod 16)))%Z = beta.
+Proof.
+  intros beta Hb.
+  assert (E : (beta mod 16 = if Z.leb 0 beta then beta else beta + 16)%Z).
+  { destruct (Z.leb_spec 0 beta).
+    - apply Z.mod_small. lia.
+    - symmetry. apply (Z.mod_unique beta 16 (-1)); lia. }
+  rewrite E. destruct (Z.leb_spec 0 beta); rewrite Z2Nat.id by lia;
+    destruct (Z.leb_spec 8 beta); try destruct (Z.leb_spec 8 (beta + 16)); lia.
+Qed.
+
+Lemma decode_enc : forall al r, rec_ok al r -> decodeA al (enc_recA al r) = r.
+Proof.
+  intros al [a0 w0 a1 w1 beta ao] (Hw0 & Hw1 & Hb & H0 & H1 & Ho).
+  unfold decodeA, enc_recA. cbv zeta.
+  set (e0 := enc_w w0). set (e1 := enc_w w1).
+  set (eb := nat2bits 4 (Z.to_nat (beta mod 16))).
+  set (x0 := nat2bits al a0). set (x1 := nat2bits al a1). set (xo := nat2bits al ao).
+  assert (L0 : length e0 = 2) by apply length_enc_w. assert (L1 : length e1 = 2) by apply length_enc_w.
+  assert (Lb : length eb = 4) by apply length_nat2bits.
+  assert (Lx0 : length x0 = al) by apply length_nat2bits. assert (Lx1 : length x1 = al) by apply length_nat2bits.
+  assert (Lxo : length xo = al) by apply length_nat2bits.
+  assert (G0 : forall i, i < 2 -> nth i (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) false = nth i e0 false)
+    by (intros i Hi; apply app_nth1; lia).
+  assert (G1 : forall i, i < 2 -> nth (2 + i) (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) false = nth i e1 false).
+  { intros i Hi. rewrite app_nth2 by lia. rewrite L0. replace (2 + i - 2) with i by lia. apply app_nth1. lia. }
+  assert (G2 : nth 2 (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) false = nth 0 e1 false) by exact (G1 0 ltac:(lia)).
+  assert (G3 : nth 3 (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) false = nth 1 e1 false) by exact (G1 1 ltac:(lia)).
+  assert (S4 : skipn 4 (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) = eb ++ x0 ++ x1 ++ xo).
+  { rewrite app_assoc, skipn_app, skipn_all2 by (rewrite length_app; lia).
+    rewrite length_app, L0, L1. reflexivity. }
+  assert (S8 : skipn 8 (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) = x0 ++ x1 ++ xo).
+  { replace 8 with (4 + 4) by reflexivity. rewrite <- skipn_skipn, S4.
+    rewrite skipn_app, skipn_all2 by lia. rewrite Lb. reflexivity. }
+  assert (S8a : skipn (8 + al) (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) = x1 ++ xo).
+  { rewrite Nat.add_comm, <- skipn_skipn, S8, skipn_app, skipn_all2 by lia. rewrite Lx0, Nat.sub_diag. reflexivity. }
+  assert (S8b : skipn (8 + 2 * al) (e0 ++ e1 ++ eb ++ x0 ++ x1 ++ xo) = xo).
+  { replace (8 + 2 * al) with (al + (8 + al)) by lia. rewrite <- skipn_skipn, S8a, skipn_app, skipn_all2 by lia.
+    rewrite Lx1, Nat.sub_diag. reflexivity. }
+  rewrite S4, S8, S8a, S8b.
+  rewrite (G0 0), (G0 1), G2, G3 by lia.
+  rewrite !firstn_app, Lb, Lx0, Lx1, !Nat.sub_diag, !firstn_O, !app_nil_r.
+  rewrite !firstn_all2 by lia.
+  unfold x0, x1, xo, eb, e0, e1.
+  rewrite (bits2nat_nat2bits al a0 H0), (bits2nat_nat2bits al a1 H1), (bits2nat_nat2bits al ao Ho).
+  rewrite (bits2nat_nat2bits 4 (Z.to_nat (beta mod 16)))
+    by (change (2 ^ 4) with 16; pose proof (Z.mod_pos_bound beta 16 ltac:(lia)); lia).
+  rewrite (wcode_enc w0 Hw0), (wcode_enc w1 Hw1), (beta_code beta Hb). reflexivity.
+Qed.
+
+(* ---- a bank holding records -------------------------------------------------------------------- *)
+Definition encA (al : nat) (rs : list rec) : list bool := concat (map (enc_recA al) rs).
+
+Lemma length_encA : forall al rs, length (encA al rs) = recw al * length rs.
+Proof.
+  intros al rs. induction rs as [|r rs IH]; unfold encA in *; cbn [map concat length]; [lia|].
+  rewrite length_app, length_enc_recA, IH. lia.
+Qed.
+
+Lemma encA_app : forall al a b, encA al (a ++ b) = encA al a ++ encA al b.
+Proof. intros al a b. unfold encA. rewrite map_app, concat_app. reflexivity. Qed.
+
+Lemma slot_recA : forall al rs tail a r, nth_error rs a = Some r ->
+  firstn (recw al) (skipn (a * recw al) (encA al rs ++ tail)) = enc_recA al r.
+Proof.
+  intros al rs tail a r H.
+  destruct (nth_error_split rs a H) as (l1 & l2 & -> & Hl).
+  rewrite encA_app. assert (E : encA al (r :: l2) = enc_recA al r ++ encA al l2) by reflexivity. rewrite E.
+  replace (a * recw al) with (length (encA al l1)) by (rewrite length_encA; lia).
+  rewrite <- !app_assoc, skipn_app, skipn_all, Nat.sub_diag, skipn_O, app_nil_l.
+  rewrite firstn_app, length_enc_recA, Nat.sub_diag, firstn_O, app_nil_r. apply firstn_all2.
+  rewrite length_enc_recA. lia.
+Qed.
+
+(* ---- the machine against the view ---------------------------------------------------------------- *)
+(* the idle bank read as a tape: its bits, the arm on bit bs * b + bj *)
+Definition lin (al : nat) (q : bank) : tape := mkT (bq q) (bs q * recw al + bj q).
+
+Lemma advb_lin : forall al S0 q, bs q < S0 -> bj q < recw al ->
+  lin al (advb S0 (recw al) q) = mkT (bq q) (succ_mod (S0 * recw al) (bs q * recw al + bj q))
+  /\ bs (advb S0 (recw al) q) < S0 /\ bj (advb S0 (recw al) q) < recw al.
+Proof.
+  intros al S0 [X s j] Hs Hj. cbn [bs bj] in *. unfold advb, lin, succ_mod. cbn [bq bs bj].
+  set (b := recw al) in *.
+  destruct (Nat.eqb_spec (S j) b) as [E|E]; cbn [bq bs bj].
+  - destruct (Nat.eqb_spec (S s) S0) as [E2|E2];
+      destruct (Nat.eqb_spec (S (s * b + j)) (S0 * b)) as [E3|E3]; repeat split; try f_equal; nia.
+  - destruct (Nat.eqb_spec (S (s * b + j)) (S0 * b)) as [E3|E3]; repeat split; try f_equal; nia.
+Qed.
+
+Section Seg.
+Variables (al K S0 L : nat) (s0 : st).
+Hypotheses (Hal : 4 <= al) (HK : 2 <= K) (HS : 1 <= S0) (HL : 1 <= L) (Hfit : fits al K S0 L s0).
+
+Definition view0 : view :=
+  mkV (win s0) (nth (kap s0) (tapes s0) tape0) (lin al (nth (succ_mod K (kap s0)) (banks s0) bank0))
+      (nth (succ_mod K (kap s0)) (tapes s0) tape0) false.
+
+(* s is the state n steps into a segment of the active bank of s0, seen as the view v *)
+Definition mv (n : nat) (s : st) (v : view) : Prop :=
+  fits al K S0 L s /\ win s = vw v /\ kap s = (if vho v then succ_mod K (kap s0) else kap s0)
+  /\ nth (kap s0) (banks s) bank0
+     = mkB (bq (nth (kap s0) (banks s0) bank0)) ((bs (nth (kap s0) (banks s0) bank0) + n) mod S0)
+           (bj (nth (kap s0) (banks s0) bank0))
+  /\ lin al (nth (succ_mod K (kap s0)) (banks s) bank0) = va v
+  /\ nth (kap s0) (tapes s) tape0 = vr v /\ nth (succ_mod K (kap s0)) (tapes s) tape0 = vc v
+  /\ (forall x, x < K -> x <> kap s0 -> x <> succ_mod K (kap s0) ->
+        nth x (banks s) bank0 = nth x (banks s0) bank0 /\ nth x (tapes s) tape0 = nth x (tapes s0) tape0).
+
+Lemma k0_lt' : kap s0 < K.
+Proof. destruct Hfit as (_ & H & _). exact H. Qed.
+
+Lemma i0_lt' : succ_mod K (kap s0) < K.
+Proof. pose proof k0_lt'. unfold succ_mod. destruct (Nat.eqb_spec (S (kap s0)) K); lia. Qed.
+
+Lemma i0_k0' : succ_mod K (kap s0) <> kap s0.
+Proof. pose proof k0_lt'. unfold succ_mod. destruct (Nat.eqb_spec (S (kap s0)) K); lia. Qed.
+
+Lemma mv_0 : mv 0 s0 view0.
+Proof.
+  pose proof k0_lt' as Hk. pose proof Hfit as (_ & _ & _ & _ & HB & _).
+  destruct (HB (kap s0) Hk) as (_ & Hs & _).
+  refine (conj Hfit (conj eq_refl (conj eq_refl (conj _ (conj eq_refl (conj eq_refl (conj eq_refl _))))))).
+  - rewrite Nat.add_0_r, Nat.mod_small by exact Hs. symmetry. apply eta_bank.
+  - intros; split; reflexivity.
+Qed.
+
+Lemma mv_step : forall n s v r, mv n s v -> vho v = false ->
+  slot al (nth (kap s) (banks s) bank0) = enc_recA al r -> decodeA al (enc_recA al r) = r ->
+  mv (S n) (step al K S0 L s) (vexec (S0 * recw al) L r v).
+Proof.
+  intros n s v r (Hf & Hw & Hk & HA & HI & HR & HC & Ho) Hho Hsl Hdr.
+  rewrite Hho in Hk. pose proof k0_lt' as Hk0. pose proof i0_lt' as Hi0. pose proof i0_k0' as Hik.
+  pose proof (step_fits al K S0 L s Hal HK HS HL Hf) as Hf'.
+  pose proof Hf as (_ & _ & _ & _ & HB & HT).
+  destruct (HB (succ_mod K (kap s0)) Hi0) as (Hqi & Hsi & Hji).
+  destruct (HT (kap s0) Hk0) as (Hd0 & Ht0). destruct (HT (succ_mod K (kap s0)) Hi0) as (Hdi & Hti).
+  refine (conj Hf' _).
+  unfold step in *. rewrite Hsl, Hdr. destruct r as [a0 w0 a1 w1 beta ao].
+  assert (Hc : forall a, cellof al K s a = vcell v a).
+  { intro a. unfold cellof, vcell. rewrite Hk.
+    destruct (Nat.eqb a SINK); [reflexivity|]. destruct (Nat.eqb a RD); [rewrite HR; reflexivity|].
+    destruct (Nat.eqb a ARM); [|destruct (Nat.eqb a CPY); [rewrite HC; reflexivity | rewrite Hw; reflexivity]].
+    rewrite <- HI. unfold bget, tget, lin, apos. reflexivity. }
+  rewrite !Hc. unfold vexec, rval, vput, stepres. cbn [ao_of]. rewrite Hk, <- Hw.
+  set (x := Z.leb 0 (w0 * b2z (vcell v a0) + w1 * b2z (vcell v a1) + beta)%Z).
+  set (wn := wnext (win s) ao x).
+  cbn [win kap banks tapes vw vho vr va vc].
+  refine (conj eq_refl (conj _ (conj _ (conj _ (conj _ (conj _ _)))))).
+  - rewrite Hho. cbn [orb]. destruct (wget wn HO); reflexivity.
+  - rewrite (nth_map_seq _ _ K (kap s0) bank0 Hk0), Nat.eqb_refl, HA. cbn [bq bs bj].
+    rewrite succ_mod_mod, Nat.add_succ_r by lia. reflexivity.
+  - rewrite (nth_map_seq _ _ K (succ_mod K (kap s0)) bank0 Hi0), (proj2 (Nat.eqb_neq _ _) Hik), Nat.eqb_refl.
+    rewrite <- HI. unfold lin at 2. set (I := nth (succ_mod K (kap s0)) (banks s) bank0) in *.
+    destruct (Nat.eqb ao ARM); cbn [bq bs bj td th];
+      (destruct (wget wn RA); [unfold lin; cbn [bq bs bj]; reflexivity|]);
+      (destruct (wget wn AA); [|unfold lin; cbn [bq bs bj]; reflexivity]).
+    + destruct (advb_lin al S0 (mkB (if wget wn CB then repeat false (S0 * recw al) else upd (bq I) (apos al I) x)
+                                   (bs I) (bj I)) Hsi Hji) as (E & _). rewrite E. reflexivity.
+    + destruct (advb_lin al S0 (mkB (if wget wn CB then repeat false (S0 * recw al) else bq I) (bs I) (bj I)) Hsi Hji)
+        as (E & _). rewrite E. reflexivity.
+  - rewrite (nth_map_seq _ _ K (kap s0) tape0 Hk0), Nat.eqb_refl, HR. reflexivity.
+  - rewrite (nth_map_seq _ _ K (succ_mod K (kap s0)) tape0 Hi0), (proj2 (Nat.eqb_neq _ _) Hik), Nat.eqb_refl, HC.
+    destruct (Nat.eqb ao CPY); reflexivity.
+  - intros y Hy E1 E2. rewrite (nth_map_seq _ _ K y bank0 Hy), (nth_map_seq _ _ K y tape0 Hy).
+    rewrite (proj2 (Nat.eqb_neq _ _) E1), (proj2 (Nat.eqb_neq _ _) E2). apply Ho; assumption.
+Qed.
+
+Lemma itern_S_r : forall n s, itern al K S0 L (S n) s = step al K S0 L (itern al K S0 L n s).
+Proof. intros n s. replace (S n) with (n + 1) by lia. rewrite itern_add. reflexivity. Qed.
+
+(* the records rs in the active bank from slot 0, none but the last handing over: running them is the
+   machine running the segment *)
+Theorem seg_run : forall rs tail,
+  bq (nth (kap s0) (banks s0) bank0) = encA al rs ++ tail -> bs (nth (kap s0) (banks s0) bank0) = 0 ->
+  length rs <= S0 -> Forall (rec_ok al) rs ->
+  (forall j, 1 <= j < length rs -> vho (vrun (S0 * recw al) L (firstn j rs) view0) = false) ->
+  forall j, j <= length rs ->
+  mv j (itern al K S0 L j s0) (vrun (S0 * recw al) L (firstn j rs) view0).
+Proof.
+  intros rs tail Hq Hb Hl Hok Hho j. induction j as [|j IH]; intro Hj; [exact mv_0|].
+  rewrite itern_S_r.
+  destruct (nth_error rs j) as [r|] eqn:Er; [|apply nth_error_None in Er; lia].
+  rewrite (firstn_S_nth rs j r Er), vrun_app. cbn [vrun].
+  pose proof (IH ltac:(lia)) as M.
+  apply mv_step; [exact M | | |].
+  - destruct j as [|j]; [reflexivity|]. apply Hho. lia.
+  - destruct M as (_ & _ & Hk & HA & _).
+    assert (Hk' : kap (itern al K S0 L j s0) = kap s0).
+    { rewrite Hk. destruct j as [|j]; [reflexivity|]. rewrite Hho by lia. reflexivity. }
+    rewrite Hk', HA. unfold slot. cbn [bq bs]. rewrite Hb, Nat.add_0_l, Nat.mod_small by lia.
+    rewrite Hq. apply slot_recA. exact Er.
+  - apply decode_enc. rewrite Forall_forall in Hok. apply Hok. eapply nth_error_In. exact Er.
+Qed.
+
+End Seg.

rocq/ViewOps.v

@@ -0,0 +1,171 @@
+(* One record on a view: the value of a gate, and the effect of a record that writes a window cell, the
+   cell under the arm or under the copy head, or a request. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Abstract Indep Run View Stored WinRun.
+
+Definition lv (v : view) (l : nat * bool) : bool := if snd l then vcell v (fst l) else negb (vcell v (fst l)).
+
+Lemma rval_and : forall v x y d, rval v (gAND x y d) = lv v x && lv v y.
+Proof.
+  intros v [a p] [c q] d. unfold rval, gAND, lv, pm. cbn [fst snd].
+  destruct p, q, (vcell v a), (vcell v c); reflexivity.
+Qed.
+
+Lemma rval_or : forall v x y d, rval v (gOR x y d) = lv v x || lv v y.
+Proof.
+  intros v [a p] [c q] d. unfold rval, gOR, lv, pm. cbn [fst snd].
+  destruct p, q, (vcell v a), (vcell v c); reflexivity.
+Qed.
+
+Lemma rval_copy : forall v x d, rval v (gCOPY x d) = lv v x.
+Proof. intros v [a p] d. unfold rval, gCOPY, lv, pm. cbn [fst snd]. destruct p, (vcell v a); reflexivity. Qed.
+
+Lemma rval_const : forall v b d, rval v (gCONST b d) = b.
+Proof. intros v [|] d; reflexivity. Qed.
+
+Lemma rval_empty : forall v, rval v EMPTY = true.
+Proof. reflexivity. Qed.
+
+Lemma vcell_win : forall v c, CPY < c -> vcell v c = wget (vw v) c.
+Proof.
+  intros v c Hc. unfold vcell. unfold SINK, RD, ARM, CPY in *.
+  replace (Nat.eqb c 0) with false by (symmetry; apply Nat.eqb_neq; lia).
+  replace (Nat.eqb c 1) with false by (symmetry; apply Nat.eqb_neq; lia).
+  replace (Nat.eqb c 2) with false by (symmetry; apply Nat.eqb_neq; lia).
+  replace (Nat.eqb c 3) with false by (symmetry; apply Nat.eqb_neq; lia). reflexivity.
+Qed.
+
+Lemma lv_win : forall v c p, CPY < c -> lv v (c, p) = if p then wget (vw v) c else negb (wget (vw v) c).
+Proof. intros v c p Hc. unfold lv. cbn [fst snd]. rewrite vcell_win by exact Hc. reflexivity. Qed.
+
+(* ---- the request cells ------------------------------------------------------------------------------ *)
+Lemma wget_upd_same_false : forall w i, wget (upd w i false) i = false.
+Proof.
+  intros w i. unfold wget. destruct (Nat.lt_ge_cases i (length w)) as [H|H].
+  - apply nth_upd_same. exact H.
+  - rewrite nth_overflow; [reflexivity | rewrite upd_length; exact H].
+Qed.
+
+Lemma wget_upd_other : forall w i j v, i <> j -> wget (upd w i v) j = wget w j.
+Proof. intros w i j v H. unfold wget. apply nth_upd_other. exact H. Qed.
+
+Lemma wget_clearq_req : forall w i, AR <= i <= HO -> wget (clearq w) i = false.
+Proof.
+  intros w i Hi. unfold clearq. unfold AR, AA, AC, RR, RA, RC, CB, CT, HO in *.
+  assert (Hc : i = 4 \/ i = 5 \/ i = 6 \/ i = 7 \/ i = 8 \/ i = 9 \/ i = 10 \/ i = 11 \/ i = 12) by lia.
+  destruct Hc as [->|[->|[->|[->|[->|[->|[->|[->| ->]]]]]]]];
+    repeat (rewrite wget_upd_other by lia); apply wget_upd_same_false.
+Qed.
+
+Lemma wget_clearq_cell : forall w i, ~ (AR <= i <= HO) -> wget (clearq w) i = wget w i.
+Proof.
+  intros w i Hi. destruct (Nat.lt_ge_cases i AR); [apply wget_clearq_out; left; assumption|].
+  apply wget_clearq_out. right. unfold AR, HO in *. lia.
+Qed.
+
+Lemma clearq_upd_req : forall w c x, AR <= c <= HO -> reqclear w -> clearq (upd w c x) = w.
+Proof.
+  intros w c x Hc Hq. apply (nth_ext _ _ false false); [rewrite length_clearq, upd_length; reflexivity|].
+  intros i _. change (wget (clearq (upd w c x)) i = wget w i).
+  destruct (Nat.le_gt_cases AR i) as [H1|H1]; [destruct (Nat.le_gt_cases i HO) as [H2|H2]|].
+  - rewrite wget_clearq_req by lia. symmetry. apply Hq. lia.
+  - rewrite wget_clearq_cell by lia. rewrite wget_upd. replace (Nat.eqb i c) with false by (symmetry; apply Nat.eqb_neq; lia).
+    reflexivity.
+  - rewrite wget_clearq_cell by lia. rewrite wget_upd. replace (Nat.eqb i c) with false by (symmetry; apply Nat.eqb_neq; lia).
+    reflexivity.
+Qed.
+
+Lemma reqclear_upd : forall w c x, HO < c -> reqclear w -> reqclear (upd w c x).
+Proof.
+  intros w c x Hc Hq i Hi. rewrite wget_upd. replace (Nat.eqb i c) with false by (symmetry; apply Nat.eqb_neq; lia).
+  apply Hq. exact Hi.
+Qed.
+
+(* ---- a record writing a window cell, the arm, the copy head, a request, or the sink ----------------- *)
+Section Ops.
+Variables (Lb L : nat).
+
+Lemma vexec_cell : forall r v, reqclear (vw v) -> HO < ao_of r ->
+  vexec Lb L r v = mkV (upd (vw v) (ao_of r) (rval v r)) (vr v) (va v) (vc v) (vho v).
+Proof.
+  intros r v Hq Hc. unfold vexec, vput.
+  assert (Hw : wnext (vw v) (ao_of r) (rval v r) = upd (vw v) (ao_of r) (rval v r)).
+  { unfold wnext. destruct (Nat.leb_spec (ao_of r) CPY); [unfold CPY, HO in *; lia | reflexivity]. }
+  rewrite Hw. pose proof (reqclear_upd (vw v) (ao_of r) (rval v r) Hc Hq) as Hq'.
+  rewrite (Hq' RR), (Hq' AR), (Hq' CB), (Hq' RA), (Hq' AA), (Hq' CT), (Hq' RC), (Hq' AC), (Hq' HO)
+    by (unfold AR, AA, AC, RR, RA, RC, CB, CT, HO; lia).
+  rewrite (clearq_id _ Hq').
+  replace (Nat.eqb (ao_of r) ARM) with false by (symmetry; apply Nat.eqb_neq; unfold ARM, HO in *; lia).
+  replace (Nat.eqb (ao_of r) CPY) with false by (symmetry; apply Nat.eqb_neq; unfold CPY, HO in *; lia).
+  rewrite orb_false_r, !eta_tape. reflexivity.
+Qed.
+
+Lemma vexec_sink : forall r v, reqclear (vw v) -> ao_of r = SINK -> vexec Lb L r v = v.
+Proof.
+  intros r v Hq Hs. unfold vexec, vput. rewrite Hs.
+  change (wnext (vw v) SINK (rval v r)) with (vw v).
+  rewrite (Hq RR), (Hq AR), (Hq CB), (Hq RA), (Hq AA), (Hq CT), (Hq RC), (Hq AC), (Hq HO)
+    by (unfold AR, AA, AC, RR, RA, RC, CB, CT, HO; lia).
+  rewrite (clearq_id _ Hq). cbn [Nat.eqb SINK ARM CPY]. rewrite orb_false_r, !eta_tape. destruct v; reflexivity.
+Qed.
+
+Lemma vexec_arm : forall r v, reqclear (vw v) -> ao_of r = ARM ->
+  vexec Lb L r v = mkV (vw v) (vr v) (mkT (upd (td (va v)) (th (va v)) (rval v r)) (th (va v))) (vc v) (vho v).
+Proof.
+  intros r v Hq Ha. unfold vexec, vput. rewrite Ha.
+  change (wnext (vw v) ARM (rval v r)) with (vw v).
+  rewrite (Hq RR), (Hq AR), (Hq CB), (Hq RA), (Hq AA), (Hq CT), (Hq RC), (Hq AC), (Hq HO)
+    by (unfold AR, AA, AC, RR, RA, RC, CB, CT, HO; lia).
+  rewrite (clearq_id _ Hq). cbn [Nat.eqb ARM CPY td th]. rewrite orb_false_r, !eta_tape. reflexivity.
+Qed.
+
+Lemma vexec_cpy : forall r v, reqclear (vw v) -> ao_of r = CPY ->
+  vexec Lb L r v = mkV (vw v) (vr v) (va v) (mkT (upd (td (vc v)) (th (vc v)) (rval v r)) (th (vc v))) (vho v).
+Proof.
+  intros r v Hq Ha. unfold vexec, vput. rewrite Ha.
+  change (wnext (vw v) CPY (rval v r)) with (vw v).
+  rewrite (Hq RR), (Hq AR), (Hq CB), (Hq RA), (Hq AA), (Hq CT), (Hq RC), (Hq AC), (Hq HO)
+    by (unfold AR, AA, AC, RR, RA, RC, CB, CT, HO; lia).
+  rewrite (clearq_id _ Hq). cbn [Nat.eqb ARM CPY td th]. rewrite orb_false_r, !eta_tape. reflexivity.
+Qed.
+
+(* what a request does when it holds 1 *)
+Definition vact (c : nat) (v : view) : view :=
+  match c with
+  | 4 => mkV (vw v) (mkT (td (vr v)) (succ_mod L (th (vr v)))) (va v) (vc v) (vho v)
+  | 5 => mkV (vw v) (vr v) (mkT (td (va v)) (succ_mod Lb (th (va v)))) (vc v) (vho v)
+  | 6 => mkV (vw v) (vr v) (va v) (mkT (td (vc v)) (succ_mod L (th (vc v)))) (vho v)
+  | 7 => mkV (vw v) (mkT (td (vr v)) 0) (va v) (vc v) (vho v)
+  | 8 => mkV (vw v) (vr v) (mkT (td (va v)) 0) (vc v) (vho v)
+  | 9 => mkV (vw v) (vr v) (va v) (mkT (td (vc v)) 0) (vho v)
+  | 10 => mkV (vw v) (vr v) (mkT (repeat false Lb) (th (va v))) (vc v) (vho v)
+  | 11 => mkV (vw v) (vr v) (va v) (mkT (repeat false L) (th (vc v))) (vho v)
+  | 12 => mkV (vw v) (vr v) (va v) (vc v) true
+  | _ => v
+  end.
+
+Lemma vexec_req : forall r v, reqclear (vw v) -> AR <= ao_of r <= HO -> ao_of r < length (vw v) ->
+  vexec Lb L r v = if rval v r then vact (ao_of r) v else v.
+Proof.
+  intros r v Hq Hc Hl. unfold vexec, vput.
+  assert (Hw : wnext (vw v) (ao_of r) (rval v r) = upd (vw v) (ao_of r) (rval v r)).
+  { unfold wnext. destruct (Nat.leb_spec (ao_of r) CPY); [unfold AR, CPY in *; lia | reflexivity]. }
+  rewrite Hw, (clearq_upd_req _ _ _ Hc Hq).
+  assert (Hg : forall c', AR <= c' <= HO -> wget (upd (vw v) (ao_of r) (rval v r)) c'
+                           = if Nat.eqb c' (ao_of r) then rval v r else false).
+  { intros c' Hc'. rewrite wget_upd, (proj2 (Nat.ltb_lt _ _) Hl), andb_true_r.
+    destruct (Nat.eqb c' (ao_of r)); [reflexivity | apply Hq; exact Hc']. }
+  rewrite (Hg RR), (Hg AR), (Hg CB), (Hg RA), (Hg AA), (Hg CT), (Hg RC), (Hg AC), (Hg HO)
+    by (unfold AR, AA, AC, RR, RA, RC, CB, CT, HO; lia).
+  replace (Nat.eqb (ao_of r) ARM) with false by (symmetry; apply Nat.eqb_neq; unfold AR, ARM in *; lia).
+  replace (Nat.eqb (ao_of r) CPY) with false by (symmetry; apply Nat.eqb_neq; unfold AR, CPY in *; lia).
+  destruct v as [w R I C h]. cbn [vw vr va vc vho] in *.
+  unfold AR, AA, AC, RR, RA, RC, CB, CT, HO in *.
+  assert (Hc9 : ao_of r = 4 \/ ao_of r = 5 \/ ao_of r = 6 \/ ao_of r = 7 \/ ao_of r = 8 \/ ao_of r = 9
+                \/ ao_of r = 10 \/ ao_of r = 11 \/ ao_of r = 12) by lia.
+  destruct Hc9 as [E|[E|[E|[E|[E|[E|[E|[E|E]]]]]]]]; rewrite E; cbn [Nat.eqb vact vw vr va vc vho];
+    destruct (rval (mkV w R I C h) r); cbn [orb]; rewrite ?orb_false_r, ?orb_true_r; destruct R, I, C; reflexivity.
+Qed.
+
+End Ops.

rocq/WinPar.v

@@ -0,0 +1,136 @@
+(* Window records that read no cell another record of the list writes run as if at once; a multiplexer and
+   an exclusive or of three records through two scratch cells. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Abstract Indep Run View Stored WinRun.
+
+Definition reads_of (r : rec) : list nat :=
+  match r with Rec a0 w0 a1 w1 _ _ => (if Z.eqb w0 0 then [] else [a0]) ++ (if Z.eqb w1 0 then [] else [a1]) end.
+
+Lemma wval_ext : forall r w1 w2, (forall c, In c (reads_of r) -> wcell w1 c = wcell w2 c) -> wval w1 r = wval w2 r.
+Proof.
+  intros [a0 w0 a1 w1' beta ao] x y H. unfold wval. cbn [reads_of] in H.
+  assert (H0 : (w0 * b2z (wcell x a0) = w0 * b2z (wcell y a0))%Z).
+  { destruct (Z.eqb_spec w0 0) as [->|E]; [reflexivity|]. rewrite (H a0); [reflexivity|]. left. reflexivity. }
+  assert (H1 : (w1' * b2z (wcell x a1) = w1' * b2z (wcell y a1))%Z).
+  { destruct (Z.eqb_spec w1' 0) as [->|E]; [reflexivity|]. rewrite (H a1); [reflexivity|].
+    apply in_or_app. right. left. reflexivity. }
+  rewrite H0, H1. reflexivity.
+Qed.
+
+Lemma wcell_wnext_other : forall w ao x c, HO < ao -> ao < length w -> c <> ao -> wcell (wnext w ao x) c = wcell w c.
+Proof.
+  intros w ao x c H1 H2 H3. unfold wcell. destruct (Nat.eqb c SINK); [reflexivity|].
+  rewrite wget_wnext by assumption. rewrite (proj2 (Nat.eqb_neq _ _) H3). reflexivity.
+Qed.
+
+(* records that read, among the cells the list writes, only their own *)
+Lemma wrun_par : forall rs w, NoDup (map ao_of rs) -> (forall r, In r rs -> HO < ao_of r < length w) ->
+  (forall r r', In r rs -> In r' rs -> In (ao_of r') (reads_of r) -> ao_of r' = ao_of r) ->
+  (forall r, In r rs -> wget (wrun rs w) (ao_of r) = wval w r)
+  /\ (forall c, ~ In c (map ao_of rs) -> wget (wrun rs w) c = wget w c).
+Proof.
+  induction rs as [|r rs IH]; intros w Hnd Hl Hrd; [split; [intros r [] | intros; reflexivity]|].
+  inversion Hnd as [|? ? Hni Hnd']; subst.
+  cbn [wrun]. unfold wexec.
+  destruct (Hl r (or_introl eq_refl)) as [Hr1 Hr2].
+  set (w1 := wnext w (ao_of r) (wval w r)).
+  assert (Hw1 : forall c, wget w1 c = if Nat.eqb c (ao_of r) then wval w r else wget w c)
+    by (intro c; unfold w1; apply wget_wnext; assumption).
+  assert (Hl1 : forall r', In r' rs -> HO < ao_of r' < length w1)
+    by (intros r' Hr'; unfold w1; rewrite length_wnext; apply Hl; right; exact Hr').
+  assert (Hrd' : forall r1 r2, In r1 rs -> In r2 rs -> In (ao_of r2) (reads_of r1) -> ao_of r2 = ao_of r1)
+    by (intros r1 r2 H1 H2 H3; apply Hrd; [right; exact H1 | right; exact H2 | exact H3]).
+  destruct (IH w1 Hnd' Hl1 Hrd') as [IH1 IH2].
+  assert (Hv : forall r', In r' rs -> wval w1 r' = wval w r').
+  { intros r' Hr'. apply wval_ext. intros c Hc. unfold w1. apply wcell_wnext_other; [exact Hr1 | exact Hr2|].
+    intro E. subst c. pose proof (Hrd r' r (or_intror Hr') (or_introl eq_refl) Hc) as E.
+    apply Hni. rewrite E. apply in_map. exact Hr'. }
+  split.
+  - intros r' [<-|Hr'].
+    + rewrite IH2 by exact Hni. rewrite Hw1, Nat.eqb_refl. reflexivity.
+    + rewrite (IH1 r' Hr'). apply Hv. exact Hr'.
+  - intros c Hc. rewrite IH2 by (intro H; apply Hc; right; exact H). rewrite Hw1.
+    replace (Nat.eqb c (ao_of r)) with false by (symmetry; apply Nat.eqb_neq; intro E; apply Hc; left; congruence).
+    reflexivity.
+Qed.
+
+(* ---- a multiplexer and an exclusive or through the cells m0 and m1 ----------------------------------- *)
+Section Mux.
+Variables (m0 m1 : nat).
+
+Lemma wl_wnext : forall w ao x l, HO < ao -> ao < length w -> fst l <> ao -> wl (wnext w ao x) l = wl w l.
+Proof. intros w ao x [c p] H1 H2 H3. unfold wl. cbn [fst snd] in *. rewrite wcell_wnext_other by assumption. reflexivity. Qed.
+
+Lemma wl_cell : forall w c, HO < c -> wl w (c, true) = wget w c.
+Proof.
+  intros w c H. unfold wl, wcell. cbn [fst snd].
+  replace (Nat.eqb c SINK) with false by (symmetry; apply Nat.eqb_neq; unfold SINK, HO in *; lia). reflexivity.
+Qed.
+
+Lemma wrun_mux : forall s a b d w,
+  HO < m0 -> HO < m1 -> m0 <> m1 -> m0 < length w -> m1 < length w -> HO < d -> d < length w ->
+  HO < s -> s <> m0 -> fst a <> m0 -> fst b <> m0 -> fst b <> m1 ->
+  let w' := wrun [gAND (s, true) a m0; gAND (s, false) b m1; gOR (m0, true) (m1, true) d] w in
+  length w' = length w
+  /\ wget w' d = (if wget w s then wl w a else wl w b)
+  /\ (forall c, c <> m0 -> c <> m1 -> c <> d -> wget w' c = wget w c).
+Proof.
+  intros s a b d w H0 H1 H01 Hl0 Hl1 Hd Hld Hs Hs0 Ha0 Hb0 Hb1 w'. unfold w'. cbn [wrun]. unfold wexec.
+  cbn [ao_of gAND gOR]. rewrite !wval_and, wval_or.
+  set (w1 := wnext w m0 (wl w (s, true) && wl w a)).
+  assert (L1 : length w1 = length w) by apply length_wnext.
+  set (w2 := wnext w1 m1 (wl w1 (s, false) && wl w1 b)).
+  assert (L2 : length w2 = length w) by (unfold w2; rewrite length_wnext; exact L1).
+  assert (E1s : wl w1 (s, false) = negb (wget w s))
+    by (unfold w1; rewrite wl_wnext by (cbn [fst]; assumption); unfold wl, wcell; cbn [fst snd];
+        replace (Nat.eqb s SINK) with false by (symmetry; apply Nat.eqb_neq; unfold SINK, HO in *; lia); reflexivity).
+  assert (E1b : wl w1 b = wl w b) by (unfold w1; apply wl_wnext; assumption).
+  assert (E2m0 : wl w2 (m0, true) = wl w (s, true) && wl w a).
+  { rewrite wl_cell by exact H0. unfold w2. rewrite wget_wnext by (rewrite ?L1; assumption).
+    rewrite (proj2 (Nat.eqb_neq _ _) H01). unfold w1. rewrite wget_wnext by assumption. rewrite Nat.eqb_refl. reflexivity. }
+  assert (E2m1 : wl w2 (m1, true) = negb (wget w s) && wl w b).
+  { rewrite wl_cell by exact H1. unfold w2. rewrite wget_wnext by (rewrite ?L1; assumption). rewrite Nat.eqb_refl.
+    rewrite E1s, E1b. reflexivity. }
+  rewrite E2m0, E2m1. rewrite wl_cell by exact Hs.
+  split; [rewrite length_wnext; exact L2|]. split.
+  - rewrite wget_wnext by (rewrite ?L2; assumption). rewrite Nat.eqb_refl.
+    destruct (wget w s); cbn [andb orb negb]; [rewrite orb_false_r | ]; reflexivity.
+  - intros c C0 C1 Cd. rewrite wget_wnext by (rewrite ?L2; assumption). rewrite (proj2 (Nat.eqb_neq _ _) Cd).
+    unfold w2. rewrite wget_wnext by (rewrite ?L1; assumption). rewrite (proj2 (Nat.eqb_neq _ _) C1).
+    unfold w1. rewrite wget_wnext by assumption. rewrite (proj2 (Nat.eqb_neq _ _) C0). reflexivity.
+Qed.
+
+Lemma wrun_xor : forall x y d w,
+  HO < m0 -> HO < m1 -> m0 <> m1 -> m0 < length w -> m1 < length w -> HO < d -> d < length w ->
+  fst x <> m0 -> fst y <> m0 -> fst x <> m1 -> fst y <> m1 ->
+  let w' := wrun [gOR x y m0; gOR (fst x, negb (snd x)) (fst y, negb (snd y)) m1; gAND (m0, true) (m1, true) d] w in
+  length w' = length w
+  /\ wget w' d = xorb (wl w x) (wl w y)
+  /\ (forall c, c <> m0 -> c <> m1 -> c <> d -> wget w' c = wget w c).
+Proof.
+  intros x y d w H0 H1 H01 Hl0 Hl1 Hd Hld Hx0 Hy0 Hx1 Hy1 w'. unfold w'. cbn [wrun]. unfold wexec.
+  cbn [ao_of gAND gOR]. rewrite !wval_or, wval_and.
+  set (w1 := wnext w m0 (wl w x || wl w y)).
+  assert (L1 : length w1 = length w) by apply length_wnext.
+  assert (Ex : forall l, fst l <> m0 -> wl w1 l = wl w l) by (intros l Hl; unfold w1; apply wl_wnext; assumption).
+  set (w2 := wnext w1 m1 (wl w1 (fst x, negb (snd x)) || wl w1 (fst y, negb (snd y)))).
+  assert (L2 : length w2 = length w) by (unfold w2; rewrite length_wnext; exact L1).
+  assert (Neg : forall l, wl w (fst l, negb (snd l)) = negb (wl w l)) by (intros [c p]; unfold wl; cbn [fst snd]; destruct p; [reflexivity | apply negb_involutive_reverse]).
+  assert (E2m0 : wl w2 (m0, true) = wl w x || wl w y).
+  { rewrite wl_cell by exact H0. unfold w2. rewrite wget_wnext by (rewrite ?L1; assumption).
+    rewrite (proj2 (Nat.eqb_neq _ _) H01). unfold w1. rewrite wget_wnext by assumption. rewrite Nat.eqb_refl. reflexivity. }
+  assert (E2m1 : wl w2 (m1, true) = negb (wl w x) || negb (wl w y)).
+  { rewrite wl_cell by exact H1. unfold w2. rewrite wget_wnext by (rewrite ?L1; assumption). rewrite Nat.eqb_refl.
+    rewrite (Ex (fst x, negb (snd x))) by (cbn [fst]; exact Hx0). rewrite (Ex (fst y, negb (snd y))) by (cbn [fst]; exact Hy0).
+    rewrite !Neg. reflexivity. }
+  rewrite E2m0, E2m1.
+  split; [rewrite length_wnext; exact L2|]. split.
+  - rewrite wget_wnext by (rewrite ?L2; assumption). rewrite Nat.eqb_refl.
+    destruct (wl w x), (wl w y); reflexivity.
+  - intros c C0 C1 Cd. rewrite wget_wnext by (rewrite ?L2; assumption). rewrite (proj2 (Nat.eqb_neq _ _) Cd).
+    unfold w2. rewrite wget_wnext by (rewrite ?L1; assumption). rewrite (proj2 (Nat.eqb_neq _ _) C1).
+    unfold w1. rewrite wget_wnext by assumption. rewrite (proj2 (Nat.eqb_neq _ _) C0). reflexivity.
+Qed.
+
+End Mux.

rocq/WinRun.v

@@ -0,0 +1,453 @@
+(* Records that read and write the window alone, and the gates, chains and threshold units of Stored.v
+   run on it: a chain leaves the conjunction or the disjunction of its literals in its cell, and the
+   compiled threshold unit leaves in its cell whether at least t of its literals are true. *)
+From Stdlib Require Import List Bool Arith ZArith Lia.
+Import ListNotations.
+From TH Require Import TwoHead Abstract Indep Run View Stored.
+
+(* ---- the window alone ------------------------------------------------------------------------------ *)
+Definition wcell (w : list bool) (a : nat) : bool := if Nat.eqb a SINK then false else wget w a.
+
+Definition wval (w : list bool) (r : rec) : bool :=
+  match r with Rec a0 w0 a1 w1 beta _ => Z.leb 0 (w0 * b2z (wcell w a0) + w1 * b2z (wcell w a1) + beta) end.
+
+Definition wexec (r : rec) (w : list bool) : list bool := wnext w (ao_of r) (wval w r).
+
+Fixpoint wrun (rs : list rec) (w : list bool) : list bool :=
+  match rs with [] => w | r :: t => wrun t (wexec r w) end.
+
+Lemma wrun_app : forall a b w, wrun (a ++ b) w = wrun b (wrun a w).
+Proof. induction a as [|r a IH]; intros b w; [reflexivity|]. cbn [app wrun]. apply IH. Qed.
+
+(* a record that reads no head and writes the sink or a cell above the requests *)
+Definition wrec (r : rec) : Prop :=
+  match r with
+  | Rec a0 w0 a1 w1 _ ao => (w0 = 0%Z \/ a0 = SINK \/ CPY < a0) /\ (w1 = 0%Z \/ a1 = SINK \/ CPY < a1)
+                            /\ (ao = SINK \/ HO < ao)
+  end.
+
+Lemma reqclear_wnext : forall w ao x, reqclear w -> (ao = SINK \/ HO < ao) -> reqclear (wnext w ao x).
+Proof.
+  intros w ao x H Hao c Hc. unfold wnext. destruct (Nat.leb_spec ao CPY); [apply H; exact Hc|].
+  rewrite wget_upd. destruct Hao as [->|Hao]; [unfold SINK, CPY in *; lia|].
+  replace (Nat.eqb c ao) with false by (symmetry; apply Nat.eqb_neq; unfold HO in *; lia). apply H. exact Hc.
+Qed.
+
+Lemma vexec_wrec : forall Lb L r v, wrec r -> reqclear (vw v) ->
+  vexec Lb L r v = mkV (wexec r (vw v)) (vr v) (va v) (vc v) (vho v).
+Proof.
+  intros Lb L [a0 w0 a1 w1 beta ao] v (H0 & H1 & Ho) Hq.
+  assert (Hc : forall a w', (w' = 0%Z \/ a = SINK \/ CPY < a) -> (w' * b2z (vcell v a) = w' * b2z (wcell (vw v) a))%Z).
+  { intros a w' [->|[->|Ha]]; [reflexivity | reflexivity|].
+    unfold vcell, wcell. unfold SINK, RD, ARM, CPY in *.
+    replace (Nat.eqb a 0) with false by (symmetry; apply Nat.eqb_neq; lia).
+    replace (Nat.eqb a 1) with false by (symmetry; apply Nat.eqb_neq; lia).
+    replace (Nat.eqb a 2) with false by (symmetry; apply Nat.eqb_neq; lia).
+    replace (Nat.eqb a 3) with false by (symmetry; apply Nat.eqb_neq; lia). reflexivity. }
+  unfold vexec, wexec, rval, wval, vput. cbn [ao_of]. rewrite (Hc a0 w0 H0), (Hc a1 w1 H1).
+  set (x := Z.leb 0 (w0 * b2z (wcell (vw v) a0) + w1 * b2z (wcell (vw v) a1) + beta)%Z).
+  pose proof (reqclear_wnext (vw v) ao x Hq Ho) as Hq'.
+  rewrite (Hq' RR), (Hq' AR), (Hq' CB), (Hq' RA), (Hq' AA), (Hq' CT), (Hq' RC), (Hq' AC), (Hq' HO)
+    by (unfold AR, AA, AC, RR, RA, RC, CB, CT, HO; lia).
+  rewrite (clearq_id _ Hq').
+  replace (Nat.eqb ao ARM) with false by (symmetry; apply Nat.eqb_neq; destruct Ho as [->|Ho]; unfold SINK, ARM, HO in *; lia).
+  replace (Nat.eqb ao CPY) with false by (symmetry; apply Nat.eqb_neq; destruct Ho as [->|Ho]; unfold SINK, CPY, HO in *; lia).
+  rewrite orb_false_r, !eta_tape. reflexivity.
+Qed.
+
+Lemma vrun_wrun : forall Lb L rs v, Forall wrec rs -> reqclear (vw v) ->
+  vrun Lb L rs v = mkV (wrun rs (vw v)) (vr v) (va v) (vc v) (vho v).
+Proof.
+  intros Lb L rs. induction rs as [|r rs IH]; intros v Hf Hq; [destruct v; reflexivity|].
+  apply Forall_cons_iff in Hf as [Hr Hf]. cbn [vrun wrun]. rewrite (vexec_wrec Lb L r v Hr Hq).
+  rewrite IH; [reflexivity | exact Hf |]. cbn [vw]. unfold wexec.
+  apply reqclear_wnext; [exact Hq|]. destruct r as [a0 w0 a1 w1 beta ao]. apply Hr.
+Qed.
+
+Lemma wget_wnext : forall w ao x c, HO < ao -> ao < length w ->
+  wget (wnext w ao x) c = if Nat.eqb c ao then x else wget w c.
+Proof.
+  intros w ao x c H1 H2. unfold wnext. destruct (Nat.leb_spec ao CPY) as [E|E]; [unfold CPY, HO in *; lia|].
+  rewrite wget_upd. destruct (Nat.eqb c ao); [|reflexivity]. rewrite (proj2 (Nat.ltb_lt _ _) H2). reflexivity.
+Qed.
+
+Lemma length_wnext' : forall w ao x, length (wnext w ao x) = length w.
+Proof. apply length_wnext. Qed.
+
+Lemma length_wrun : forall rs w, length (wrun rs w) = length w.
+Proof. induction rs as [|r rs IH]; intro w; [reflexivity|]. cbn [wrun]. rewrite IH. apply length_wnext. Qed.
+
+(* ---- gates ----------------------------------------------------------------------------------------- *)
+Definition wl (w : list bool) (l : nat * bool) : bool := if snd l then wcell w (fst l) else negb (wcell w (fst l)).
+
+Lemma wval_and : forall w x y d, wval w (gAND x y d) = wl w x && wl w y.
+Proof.
+  intros w [a p] [c q] d. unfold wval, gAND, wl, pm. cbn [fst snd].
+  destruct p, q, (wcell w a), (wcell w c); reflexivity.
+Qed.
+
+Lemma wval_or : forall w x y d, wval w (gOR x y d) = wl w x || wl w y.
+Proof.
+  intros w [a p] [c q] d. unfold wval, gOR, wl, pm. cbn [fst snd].
+  destruct p, q, (wcell w a), (wcell w c); reflexivity.
+Qed.
+
+Lemma wval_copy : forall w x d, wval w (gCOPY x d) = wl w x.
+Proof. intros w [a p] d. unfold wval, gCOPY, wl, pm. cbn [fst snd]. destruct p, (wcell w a); reflexivity. Qed.
+
+Lemma wval_const : forall w b d, wval w (gCONST b d) = b.
+Proof. intros w [|] d; reflexivity. Qed.
+
+Lemma ao_gates : forall x y d b,
+  ao_of (gAND x y d) = d /\ ao_of (gOR x y d) = d /\ ao_of (gCOPY x d) = d /\ ao_of (gCONST b d) = d.
+Proof. intros x y d [|]; repeat split. Qed.
+
+(* the cells a record reads, by weight *)
+Definition rd_ok (c : nat) : Prop := c = SINK \/ CPY < c.
+
+Lemma wrec_and : forall x y d, rd_ok (fst x) -> rd_ok (fst y) -> (d = SINK \/ HO < d) -> wrec (gAND x y d).
+Proof. intros [a p] [c q] d Ha Hc Hd. cbn [fst] in *. unfold wrec, gAND, rd_ok in *. cbn [fst snd]. tauto. Qed.
+
+Lemma wrec_or : forall x y d, rd_ok (fst x) -> rd_ok (fst y) -> (d = SINK \/ HO < d) -> wrec (gOR x y d).
+Proof. intros [a p] [c q] d Ha Hc Hd. cbn [fst] in *. unfold wrec, gOR, rd_ok in *. cbn [fst snd]. tauto. Qed.
+
+Lemma wrec_copy : forall x d, rd_ok (fst x) -> (d = SINK \/ HO < d) -> wrec (gCOPY x d).
+Proof. intros [a p] d Ha Hd. cbn [fst] in *. unfold wrec, gCOPY, rd_ok in *. cbn [fst snd]. tauto. Qed.
+
+Lemma wrec_const : forall b d, (d = SINK \/ HO < d) -> wrec (gCONST b d).
+Proof. intros [|] d Hd; unfold wrec, gCONST, gOR, gAND; cbn [fst snd]; tauto. Qed.
+
+(* ---- chains ---------------------------------------------------------------------------------------- *)
+Section Chain.
+Variable W : nat.
+
+Definition ok_cell (c : nat) : Prop := HO < c /\ c < W.
+
+Variables (g : nat * bool -> nat * bool -> nat -> rec) (f : bool -> bool -> bool).
+Hypothesis Hg : forall x y d w, wval w (g x y d) = f (wl w x) (wl w y).
+Hypothesis Hgo : forall x y d, ao_of (g x y d) = d.
+
+Lemma chain_tail_run : forall acc d ls l w,
+  length w = W -> ok_cell d -> ok_cell acc -> (forall l', In l' (l :: ls) -> fst l' <> acc) ->
+  let w' := wrun (chain_tail g acc l ls d) w in
+  length w' = W
+  /\ wget w' d = fold_left (fun a l' => f a (wl w l')) (l :: ls) (wget w acc)
+  /\ (forall c, c <> d -> c <> acc -> wget w' c = wget w c).
+Proof.
+  intros acc d. induction ls as [|l2 ls IH]; intros l w Hw Hd Ha Hl.
+  - cbn [chain_tail wrun fold_left]. unfold wexec. rewrite Hgo, Hg.
+    assert (Eacc : wl w (acc, true) = wget w acc) by (unfold wl, wcell; cbn [fst snd];
+      replace (Nat.eqb acc SINK) with false by (symmetry; apply Nat.eqb_neq; unfold ok_cell, SINK, HO in *; lia);
+      reflexivity).
+    rewrite Eacc. split; [rewrite length_wnext; exact Hw|].
+    split; [rewrite wget_wnext by (unfold ok_cell in Hd; lia); rewrite Nat.eqb_refl; reflexivity|].
+    intros c H1 H2. rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1). reflexivity.
+  - cbn [chain_tail wrun].
+    assert (E1 : wexec (g (acc, true) l acc) w = wnext w acc (f (wl w (acc, true)) (wl w l)))
+      by (unfold wexec; rewrite Hgo, Hg; reflexivity).
+    rewrite E1. set (w1 := wnext w acc (f (wl w (acc, true)) (wl w l))).
+    assert (Hw1 : length w1 = W) by (unfold w1; rewrite length_wnext; exact Hw).
+    assert (Eacc : wl w (acc, true) = wget w acc) by (unfold wl, wcell; cbn [fst snd];
+      replace (Nat.eqb acc SINK) with false by (symmetry; apply Nat.eqb_neq; unfold ok_cell, SINK, HO in *; lia);
+      reflexivity).
+    assert (Hlv : forall l', In l' (l2 :: ls) -> wl w1 l' = wl w l').
+    { intros l' Hin. assert (Hne : fst l' <> acc) by (apply Hl; right; exact Hin).
+      unfold wl, wcell. destruct (Nat.eqb (fst l') SINK); [reflexivity|].
+      unfold w1. rewrite wget_wnext by (unfold ok_cell in Ha; lia). rewrite (proj2 (Nat.eqb_neq _ _) Hne). reflexivity. }
+    destruct (IH l2 w1 Hw1 Hd Ha ltac:(intros l' Hin; apply Hl; right; exact Hin)) as (L1 & V1 & U1).
+    split; [exact L1|]. split.
+    + rewrite V1. cbn [fold_left].
+      assert (Wacc : wget w1 acc = f (wget w acc) (wl w l)).
+      { unfold w1. rewrite wget_wnext by (unfold ok_cell in Ha; lia). rewrite Nat.eqb_refl, Eacc. reflexivity. }
+      rewrite Wacc, (Hlv l2 (or_introl eq_refl)).
+      assert (Fe : forall ys a, (forall y, In y ys -> wl w1 y = wl w y) ->
+                   fold_left (fun a l' => f a (wl w1 l')) ys a = fold_left (fun a l' => f a (wl w l')) ys a).
+      { induction ys as [|y ys IHy]; intros a Hy; [reflexivity|]. cbn [fold_left].
+        rewrite (Hy y (or_introl eq_refl)). apply IHy. intros y' Hy'. apply Hy. right. exact Hy'. }
+      apply Fe. intros y Hy. apply Hlv. right. exact Hy.
+    + intros c H1 H2. rewrite (U1 c H1 H2). unfold w1. rewrite wget_wnext by (unfold ok_cell in Ha; lia).
+      rewrite (proj2 (Nat.eqb_neq _ _) H2). reflexivity.
+Qed.
+
+Lemma chain_run : forall ls d acc w,
+  ls <> [] -> length w = W -> ok_cell d -> ok_cell acc -> (forall l, In l ls -> fst l <> acc) ->
+  let w' := wrun (chain g ls d acc) w in
+  length w' = W
+  /\ wget w' d = fold_left (fun a l => f a (wl w l)) (tl ls) (wl w (hd (SINK, true) ls))
+  /\ (forall c, c <> d -> c <> acc -> wget w' c = wget w c).
+Proof.
+  intros ls d acc w Hne Hw Hd Ha Hl.
+  destruct ls as [|l0 [|l1 [|l2 t]]]; [contradiction | | |].
+  - cbn [chain wrun hd tl fold_left]. unfold wexec. rewrite wval_copy. cbn [ao_of gCOPY].
+    split; [rewrite length_wnext; exact Hw|].
+    split; [rewrite wget_wnext by (unfold ok_cell in Hd; lia); rewrite Nat.eqb_refl; reflexivity|].
+    intros c H1 H2. rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1). reflexivity.
+  - cbn [chain wrun hd tl fold_left]. unfold wexec. rewrite Hgo, Hg.
+    split; [rewrite length_wnext; exact Hw|].
+    split; [rewrite wget_wnext by (unfold ok_cell in Hd; lia); rewrite Nat.eqb_refl; reflexivity|].
+    intros c H1 H2. rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1). reflexivity.
+  - cbn [chain wrun hd tl].
+    assert (E1 : wexec (g l0 l1 acc) w = wnext w acc (f (wl w l0) (wl w l1)))
+      by (unfold wexec; rewrite Hgo, Hg; reflexivity).
+    rewrite E1. set (w1 := wnext w acc (f (wl w l0) (wl w l1))).
+    assert (Hw1 : length w1 = W) by (unfold w1; rewrite length_wnext; exact Hw).
+    assert (Hlv : forall l', In l' (l2 :: t) -> wl w1 l' = wl w l').
+    { intros l' Hin. assert (Hne' : fst l' <> acc) by (apply Hl; right; right; exact Hin).
+      unfold wl, wcell. destruct (Nat.eqb (fst l') SINK); [reflexivity|].
+      unfold w1. rewrite wget_wnext by (unfold ok_cell in Ha; lia). rewrite (proj2 (Nat.eqb_neq _ _) Hne'). reflexivity. }
+    destruct (chain_tail_run acc d t l2 w1 Hw1 Hd Ha ltac:(intros l' Hin; apply Hl; right; right; exact Hin))
+      as (L1 & V1 & U1).
+    split; [exact L1|]. split.
+    + rewrite V1. cbn [fold_left].
+      assert (Wacc : wget w1 acc = f (wl w l0) (wl w l1)).
+      { unfold w1. rewrite wget_wnext by (unfold ok_cell in Ha; lia). rewrite Nat.eqb_refl. reflexivity. }
+      rewrite Wacc, (Hlv l2 (or_introl eq_refl)).
+      assert (Fe : forall ys a, (forall y, In y ys -> wl w1 y = wl w y) ->
+                   fold_left (fun a l' => f a (wl w1 l')) ys a = fold_left (fun a l' => f a (wl w l')) ys a).
+      { induction ys as [|y ys IHy]; intros a Hy; [reflexivity|]. cbn [fold_left].
+        rewrite (Hy y (or_introl eq_refl)). apply IHy. intros y' Hy'. apply Hy. right. exact Hy'. }
+      apply Fe. intros y Hy. apply Hlv. right. exact Hy.
+    + intros c H1 H2. rewrite (U1 c H1 H2). unfold w1. rewrite wget_wnext by (unfold ok_cell in Ha; lia).
+      rewrite (proj2 (Nat.eqb_neq _ _) H2). reflexivity.
+Qed.
+
+End Chain.
+
+Lemma chain_wrec : forall g ls d acc,
+  (forall x y d', rd_ok (fst x) -> rd_ok (fst y) -> (d' = SINK \/ HO < d') -> wrec (g x y d')) ->
+  (forall l, In l ls -> rd_ok (fst l)) -> HO < d -> HO < acc -> Forall wrec (chain g ls d acc).
+Proof.
+  intros g ls d acc Hg Hl Hd Ha.
+  assert (Hacc : rd_ok acc) by (right; unfold CPY, HO in *; lia).
+  assert (T : forall l t, (forall l', In l' (l :: t) -> rd_ok (fst l')) -> Forall wrec (chain_tail g acc l t d)).
+  { intros l t. revert l. induction t as [|l' t IH]; intros l H; cbn [chain_tail].
+    - constructor; [apply Hg; [exact Hacc | apply H; left; reflexivity | right; exact Hd] | constructor].
+    - constructor; [apply Hg; [exact Hacc | apply H; left; reflexivity | right; exact Ha]|].
+      apply IH. intros l'' Hin. apply H. right. exact Hin. }
+  destruct ls as [|l0 [|l1 [|l2 t]]]; cbn [chain].
+  - constructor.
+  - constructor; [apply wrec_copy; [apply Hl; left; reflexivity | right; exact Hd] | constructor].
+  - constructor; [apply Hg; [apply Hl; left; reflexivity | apply Hl; right; left; reflexivity | right; exact Hd]
+                 | constructor].
+  - constructor; [apply Hg; [apply Hl; left; reflexivity | apply Hl; right; left; reflexivity | right; exact Ha]|].
+    apply T. intros l' Hin. apply Hl. right. right. exact Hin.
+Qed.
+
+(* ---- chains as conjunctions and disjunctions ----------------------------------------------------------- *)
+Lemma fold_and : forall (h : nat * bool -> bool) ys a, fold_left (fun a l => a && h l) ys a = a && forallb h ys.
+Proof.
+  induction ys as [|y ys IH]; intro a; cbn [fold_left forallb]; [rewrite andb_true_r; reflexivity|].
+  rewrite IH, andb_assoc. reflexivity.
+Qed.
+
+Lemma fold_or : forall (h : nat * bool -> bool) ys a, fold_left (fun a l => a || h l) ys a = a || existsb h ys.
+Proof.
+  induction ys as [|y ys IH]; intro a; cbn [fold_left existsb]; [rewrite orb_false_r; reflexivity|].
+  rewrite IH, orb_assoc. reflexivity.
+Qed.
+
+(* ---- the threshold units ----------------------------------------------------------------------------- *)
+Definition ntrue (w : list bool) (ls : list (nat * bool)) : nat := length (filter (wl w) ls).
+
+Lemma ntrue_le : forall w ls, ntrue w ls <= length ls.
+Proof. intros w ls. unfold ntrue. apply filter_length_le. Qed.
+
+Lemma forallb_ntrue : forall w ls, forallb (wl w) ls = Nat.eqb (ntrue w ls) (length ls).
+Proof.
+  intros w ls. unfold ntrue. induction ls as [|l ls IH]; [reflexivity|].
+  cbn [forallb filter length]. destruct (wl w l); cbn [andb length].
+  - rewrite IH. reflexivity.
+  - assert (length (filter (wl w) ls) <= length ls) by apply filter_length_le.
+    symmetry. apply Nat.eqb_neq. lia.
+Qed.
+
+Lemma existsb_ntrue : forall w ls, existsb (wl w) ls = Nat.ltb 0 (ntrue w ls).
+Proof.
+  intros w ls. unfold ntrue. induction ls as [|l ls IH]; [reflexivity|].
+  cbn [existsb filter]. destruct (wl w l); cbn [orb length]; [reflexivity | exact IH].
+Qed.
+
+Lemma ntrue_ext : forall w w' ls, (forall l, In l ls -> wl w' l = wl w l) -> ntrue w' ls = ntrue w ls.
+Proof.
+  intros w w' ls H. unfold ntrue. f_equal. apply filter_ext_in. exact H.
+Qed.
+
+Section Ucomp.
+Variables (W LV : nat) (xc : nat -> nat -> nat).
+(* the three cells of each level lie above the requests, and in the window for the LV levels in use *)
+Hypothesis Hxgt : forall j k, k < 3 -> HO < xc j k.
+Hypothesis Hxlt : forall j k, j < LV -> k < 3 -> xc j k < W.
+Hypothesis Hxinj : forall j k j' k', k < 3 -> k' < 3 -> xc j k = xc j' k' -> j = j' /\ k = k'.
+
+(* the scratch cells of the levels from lev on, below LV *)
+Definition scr (lev c : nat) : Prop := exists j k, lev <= j < LV /\ k < 3 /\ c = xc j k.
+
+Lemma scr_S : forall lev c, scr (S lev) c -> scr lev c.
+Proof. intros lev c (j & k & H1 & H2 & H3). exists j, k. split; [lia | split; assumption]. Qed.
+
+Lemma scr_lev : forall lev k, k < 3 -> ~ scr (S lev) (xc lev k).
+Proof. intros lev k Hk (j & k' & H1 & H2 & H3). destruct (Hxinj lev k j k' Hk H2 H3) as [E _]. lia. Qed.
+
+Lemma ucomp_run : forall ls t d acc lev w,
+  length w = W -> ok_cell W d -> ok_cell W acc -> ~ scr lev d -> ~ scr lev acc ->
+  (forall l, In l ls -> fst l <> acc /\ ~ scr lev (fst l)) ->
+  ((1 < t < Z.of_nat (length ls))%Z -> lev + length ls <= LV + 2) ->
+  let w' := wrun (ucomp xc t ls d acc lev) w in
+  length w' = W /\ wget w' d = Z.leb t (Z.of_nat (ntrue w ls))
+  /\ (forall c, c <> d -> c <> acc -> ~ scr lev c -> wget w' c = wget w c).
+Proof.
+  induction ls as [|l0 rest IH]; intros t d acc lev w Hw Hd Ha Hsd Hsa Hl Hlev.
+  - cbn [ucomp length]. unfold ntrue. cbn [filter length Z.of_nat].
+    destruct (Z.leb_spec t 0) as [Ht|Ht].
+    + cbn [wrun]. unfold wexec. rewrite wval_const. cbn [ao_of gCONST gOR gAND].
+      split; [rewrite length_wnext; exact Hw|].
+      split; [rewrite wget_wnext by (unfold ok_cell in Hd; lia); rewrite Nat.eqb_refl;
+        first [reflexivity | symmetry; apply Z.leb_le; lia | symmetry; apply Z.leb_gt; lia]|].
+      intros c H1 _ _. rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1). reflexivity.
+    + rewrite (proj2 (Z.ltb_lt 0 t) Ht). cbn [wrun]. unfold wexec. rewrite wval_const. cbn [ao_of gCONST gOR gAND].
+      split; [rewrite length_wnext; exact Hw|].
+      split; [rewrite wget_wnext by (unfold ok_cell in Hd; lia); rewrite Nat.eqb_refl;
+        first [reflexivity | symmetry; apply Z.leb_le; lia | symmetry; apply Z.leb_gt; lia]|].
+      intros c H1 _ _. rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1). reflexivity.
+  - set (k := length (l0 :: rest)).
+    assert (Hn : ntrue w (l0 :: rest) <= k) by apply ntrue_le.
+    assert (Hla : forall l, In l (l0 :: rest) -> fst l <> acc) by (intros l Hin; apply Hl; exact Hin).
+    cbn [ucomp]. fold k.
+    destruct (Z.leb_spec t 0) as [Ht0|Ht0].
+    { cbn [wrun]. unfold wexec. rewrite wval_const. cbn [ao_of gCONST gOR gAND].
+      split; [rewrite length_wnext; exact Hw|].
+      split; [rewrite wget_wnext by (unfold ok_cell in Hd; lia); rewrite Nat.eqb_refl;
+        first [reflexivity | symmetry; apply Z.leb_le; lia | symmetry; apply Z.leb_gt; lia]|].
+      intros c H1 _ _. rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1). reflexivity. }
+    destruct (Z.ltb_spec (Z.of_nat k) t) as [Htk|Htk].
+    { cbn [wrun]. unfold wexec. rewrite wval_const. cbn [ao_of gCONST gOR gAND].
+      split; [rewrite length_wnext; exact Hw|].
+      split; [rewrite wget_wnext by (unfold ok_cell in Hd; lia); rewrite Nat.eqb_refl;
+        first [reflexivity | symmetry; apply Z.leb_le; lia | symmetry; apply Z.leb_gt; lia]|].
+      intros c H1 _ _. rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1). reflexivity. }
+    destruct (Z.eqb_spec t 1) as [Ht1|Ht1].
+    { (* a disjunction *)
+      destruct (chain_run W gOR orb (fun x y d' w' => wval_or w' x y d') (fun x y d' => proj1 (proj2 (ao_gates x y d' true)))
+                  (l0 :: rest) d acc w ltac:(discriminate) Hw Hd Ha Hla) as (L1 & V1 & U1).
+      split; [exact L1|]. split.
+      - rewrite V1. cbn [hd tl]. rewrite fold_or.
+        replace (wl w l0 || existsb (wl w) rest) with (existsb (wl w) (l0 :: rest)) by reflexivity.
+        rewrite existsb_ntrue, Ht1. destruct (Nat.ltb_spec 0 (ntrue w (l0 :: rest))); symmetry;
+          [apply Z.leb_le | apply Z.leb_gt]; lia.
+      - intros c H1 H2 _. exact (U1 c H1 H2). }
+    destruct (Z.eqb_spec t (Z.of_nat k)) as [Htk'|Htk'].
+    { (* a conjunction *)
+      destruct (chain_run W gAND andb (fun x y d' w' => wval_and w' x y d') (fun x y d' => proj1 (ao_gates x y d' true))
+                  (l0 :: rest) d acc w ltac:(discriminate) Hw Hd Ha Hla) as (L1 & V1 & U1).
+      split; [exact L1|]. split.
+      - rewrite V1. cbn [hd tl]. rewrite fold_and.
+        replace (wl w l0 && forallb (wl w) rest) with (forallb (wl w) (l0 :: rest)) by reflexivity.
+        rewrite forallb_ntrue, Htk'. fold k.
+        destruct (Nat.eqb_spec (ntrue w (l0 :: rest)) k); symmetry; [apply Z.leb_le | apply Z.leb_gt]; lia.
+      - intros c H1 H2 _. exact (U1 c H1 H2). }
+    (* at least t of l0 :: rest, 1 < t < k *)
+    assert (Hlv : lev < LV) by (specialize (Hlev ltac:(fold k; lia)); fold k in Hlev; unfold k in *; cbn [length] in *; lia).
+    assert (Hx0 : ok_cell W (xc lev 0)) by (split; [apply Hxgt | apply Hxlt]; lia).
+    assert (Hx1 : ok_cell W (xc lev 1)) by (split; [apply Hxgt | apply Hxlt]; lia).
+    assert (Hx2 : ok_cell W (xc lev 2)) by (split; [apply Hxgt | apply Hxlt]; lia).
+    assert (Hlev' : forall t', (1 < t' < Z.of_nat (length rest))%Z -> S lev + length rest <= LV + 2).
+    { intros t' Ht'. specialize (Hlev ltac:(fold k; lia)). unfold k in Hlev. cbn [length] in Hlev. lia. }
+    assert (N01 : xc lev 0 <> xc lev 1) by (intro E; apply Hxinj in E; lia).
+    assert (N02 : xc lev 0 <> xc lev 2) by (intro E; apply Hxinj in E; lia).
+    assert (N12 : xc lev 1 <> xc lev 2) by (intro E; apply Hxinj in E; lia).
+    assert (Sx : forall kk, kk < 3 -> scr lev (xc lev kk)) by (intros kk Hkk; exists lev, kk; repeat split; lia).
+    assert (Hlr : forall l, In l rest -> fst l <> xc lev 0 /\ fst l <> xc lev 1 /\ fst l <> xc lev 2
+                                        /\ ~ scr (S lev) (fst l)).
+    { intros l Hin. destruct (Hl l (or_intror Hin)) as [_ Hs].
+      split; [intro E; apply Hs; rewrite E; apply Sx; lia|].
+      split; [intro E; apply Hs; rewrite E; apply Sx; lia|].
+      split; [intro E; apply Hs; rewrite E; apply Sx; lia|].
+      intro H. apply Hs. apply scr_S. exact H. }
+    destruct (IH t (xc lev 0) (xc lev 0) (S lev) w Hw Hx0 Hx0 (scr_lev lev 0 ltac:(lia)) (scr_lev lev 0 ltac:(lia))
+                ltac:(intros l Hin; destruct (Hlr l Hin) as (A0 & _ & _ & A3); split; assumption) (Hlev' t))
+      as (L1 & V1 & U1).
+    set (w1 := wrun (ucomp xc t rest (xc lev 0) (xc lev 0) (S lev)) w) in *.
+    destruct (IH (t - 1)%Z (xc lev 1) (xc lev 1) (S lev) w1 L1 Hx1 Hx1 (scr_lev lev 1 ltac:(lia)) (scr_lev lev 1 ltac:(lia))
+                ltac:(intros l Hin; destruct (Hlr l Hin) as (_ & A1 & _ & A3); split; assumption) (Hlev' (t - 1)%Z))
+      as (L2 & V2 & U2).
+    set (w2 := wrun (ucomp xc (t - 1) rest (xc lev 1) (xc lev 1) (S lev)) w1) in *.
+    (* the literals keep their values over the two sub-units *)
+    assert (Hcell : forall c, c <> xc lev 0 -> c <> xc lev 1 -> ~ scr (S lev) c -> wget w2 c = wget w c).
+    { intros c H0 H1 H2. rewrite (U2 c H1 H1 H2), (U1 c H0 H0 H2). reflexivity. }
+    assert (Hwl : forall l, In l (l0 :: rest) -> wl w2 l = wl w l /\ wl w1 l = wl w l).
+    { intros l Hin. destruct (Hl l Hin) as [_ Hs].
+      assert (E0 : fst l <> xc lev 0) by (intro E; apply Hs; rewrite E; apply Sx; lia).
+      assert (E1 : fst l <> xc lev 1) by (intro E; apply Hs; rewrite E; apply Sx; lia).
+      assert (E2 : ~ scr (S lev) (fst l)) by (intro H; apply Hs; apply scr_S; exact H).
+      unfold wl, wcell. destruct (Nat.eqb (fst l) SINK); [split; reflexivity|].
+      rewrite (Hcell (fst l) E0 E1 E2), (U1 (fst l) E0 E0 E2). split; reflexivity. }
+    assert (Nr : ntrue w1 rest = ntrue w rest)
+      by (apply ntrue_ext; intros l Hin; exact (proj2 (Hwl l (or_intror Hin)))).
+    rewrite Nr in V2.
+    assert (W0 : wget w2 (xc lev 0) = Z.leb t (Z.of_nat (ntrue w rest)))
+      by (rewrite (U2 (xc lev 0) N01 N01 (scr_lev lev 0 ltac:(lia))); exact V1).
+    rewrite !wrun_app. cbn [wrun]. fold w1 w2.
+    assert (E3 : wexec (gAND l0 (xc lev 1, true) (xc lev 2)) w2
+                 = wnext w2 (xc lev 2) (wl w2 l0 && wl w2 (xc lev 1, true)))
+      by (unfold wexec; rewrite wval_and; reflexivity).
+    rewrite E3. set (w3 := wnext w2 (xc lev 2) (wl w2 l0 && wl w2 (xc lev 1, true))).
+    assert (Hw3 : length w3 = W) by (unfold w3; rewrite length_wnext; exact L2).
+    assert (Rx : forall c, ok_cell W c -> wl w2 (c, true) = wget w2 c).
+    { intros c Hc. unfold wl, wcell. cbn [fst snd].
+      replace (Nat.eqb c SINK) with false by (symmetry; apply Nat.eqb_neq; unfold ok_cell, SINK, HO in *; lia).
+      reflexivity. }
+    assert (E4 : wexec (gOR (xc lev 0, true) (xc lev 2, true) d) w3
+                 = wnext w3 d (wl w3 (xc lev 0, true) || wl w3 (xc lev 2, true)))
+      by (unfold wexec; rewrite wval_or; reflexivity).
+    rewrite E4.
+    assert (Rx3 : forall c, ok_cell W c -> wl w3 (c, true) = wget w3 c).
+    { intros c Hc. unfold wl, wcell. cbn [fst snd].
+      replace (Nat.eqb c SINK) with false by (symmetry; apply Nat.eqb_neq; unfold ok_cell, SINK, HO in *; lia).
+      reflexivity. }
+    rewrite (Rx3 _ Hx0), (Rx3 _ Hx2).
+    assert (W30 : wget w3 (xc lev 0) = Z.leb t (Z.of_nat (ntrue w rest))).
+    { unfold w3. rewrite wget_wnext by (unfold ok_cell in Hx2; lia). rewrite (proj2 (Nat.eqb_neq _ _) N02). exact W0. }
+    assert (W32 : wget w3 (xc lev 2) = wl w l0 && Z.leb (t - 1) (Z.of_nat (ntrue w rest))).
+    { unfold w3. rewrite wget_wnext by (unfold ok_cell in Hx2; lia). rewrite Nat.eqb_refl, (Rx _ Hx1), V2.
+      rewrite (proj1 (Hwl l0 (or_introl eq_refl))). reflexivity. }
+    rewrite W30, W32.
+    split; [rewrite length_wnext; exact Hw3|]. split.
+    + rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite Nat.eqb_refl.
+      unfold ntrue. cbn [filter]. destruct (wl w l0); cbn [length andb orb].
+      * rewrite Nat2Z.inj_succ. fold (ntrue w rest).
+        destruct (Z.leb_spec t (Z.of_nat (ntrue w rest))), (Z.leb_spec (t - 1) (Z.of_nat (ntrue w rest))),
+          (Z.leb_spec t (Z.succ (Z.of_nat (ntrue w rest)))); cbn [orb]; lia.
+      * fold (ntrue w rest). rewrite orb_false_r. reflexivity.
+    + intros c H1 H2 H3.
+      assert (C0 : c <> xc lev 0) by (intro E; apply H3; rewrite E; apply Sx; lia).
+      assert (C1 : c <> xc lev 1) by (intro E; apply H3; rewrite E; apply Sx; lia).
+      assert (C2 : c <> xc lev 2) by (intro E; apply H3; rewrite E; apply Sx; lia).
+      rewrite wget_wnext by (unfold ok_cell in Hd; lia). rewrite (proj2 (Nat.eqb_neq _ _) H1).
+      unfold w3. rewrite wget_wnext by (unfold ok_cell in Hx2; lia). rewrite (proj2 (Nat.eqb_neq _ _) C2).
+      apply Hcell; [exact C0 | exact C1 | intro H; apply H3; apply scr_S; exact H].
+Qed.
+
+Lemma ucomp_wrec : forall ls t d acc lev, HO < d -> HO < acc -> (forall l, In l ls -> rd_ok (fst l)) ->
+  Forall wrec (ucomp xc t ls d acc lev).
+Proof.
+  induction ls as [|l0 rest IH]; intros t d acc lev Hd Ha Hl; cbn [ucomp].
+  - cbn [length]. destruct (Z.leb t 0); [constructor; [apply wrec_const; right; exact Hd | constructor]|].
+    destruct (Z.ltb (Z.of_nat 0) t); [constructor; [apply wrec_const; right; exact Hd | constructor]|].
+    destruct (Z.eqb t 1); [cbn [chain]; constructor|].
+    destruct (Z.eqb t (Z.of_nat 0)); cbn [chain]; constructor.
+  - assert (Hxo : forall kk, kk < 3 -> HO < xc lev kk) by (intros kk Hk; apply Hxgt; exact Hk).
+    destruct (Z.leb t 0); [constructor; [apply wrec_const; right; exact Hd | constructor]|].
+    destruct (Z.ltb (Z.of_nat (length (l0 :: rest))) t); [constructor; [apply wrec_const; right; exact Hd | constructor]|].
+    destruct (Z.eqb t 1); [apply chain_wrec; [exact wrec_or | exact Hl | exact Hd | exact Ha]|].
+    destruct (Z.eqb t (Z.of_nat (length (l0 :: rest)))); [apply chain_wrec; [exact wrec_and | exact Hl | exact Hd | exact Ha]|].
+    apply Forall_app. split; [apply IH; [apply Hxo; lia | apply Hxo; lia | intros l Hin; apply Hl; right; exact Hin]|].
+    apply Forall_app. split; [apply IH; [apply Hxo; lia | apply Hxo; lia | intros l Hin; apply Hl; right; exact Hin]|].
+    constructor; [apply wrec_and; [apply Hl; left; reflexivity
+                                   | right; cbn [fst]; pose proof (Hxo 1 ltac:(lia)); unfold CPY, HO in *; lia
+                                   | right; apply Hxo; lia]|].
+    constructor; [|constructor].
+    apply wrec_or; [right; cbn [fst]; pose proof (Hxo 0 ltac:(lia)); unfold CPY, HO in *; lia
+                   | right; cbn [fst]; pose proof (Hxo 2 ltac:(lia)); unfold CPY, HO in *; lia | right; exact Hd].
+Qed.
+
+End Ucomp.

rocq/_CoqProject

@@ -26,3 +26,20 @@ HostSem.v
 Device.v
 Pstar.v
 ExtractHost.v
+HostIP.v
+View.v
+Stored.v
+WinRun.v
+ViewOps.v
+WinPar.v
+StoredStep.v
+StoredBoot.v
+StoredDev.v
+StoredPass.v
+StoredOk.v
+StoredRun.v
+StoredWbr.v
+StoredMain.v
+StoredImage.v
+StoredWidth.v
+ExtractStored.v

rocq/extract/dumpstored.ml

@@ -0,0 +1,13 @@
+(* writes the image of the stored host defined in Stored.v, extracted by ExtractStored.v, as bytes, most
+   significant bit first: dumpstored A W PATH *)
+let () =
+  let a = int_of_string Sys.argv.(1) and w = int_of_string Sys.argv.(2) in
+  let bits = Storednet.stored_bits a w in
+  let oc = open_out_bin Sys.argv.(3) in
+  let rec go acc k = function
+    | [] -> if k > 0 then output_byte oc (acc lsl (8 - k))
+    | b :: t ->
+        let acc = 2 * acc + (if b then 1 else 0) in
+        if k = 7 then (output_byte oc acc; go 0 0 t) else go acc (k + 1) t in
+  go 0 0 bits;
+  close_out oc

src/paper.py

@@ -1077,6 +1077,26 @@ def host_extraction(widths=(8, 9, 10)):
     return dict(members=members, identical=all(m['identical'] for m in members))
 
 
+def stored_extraction(widths=(8, 9)):
+    """The stored host of rocq/Stored.v, extracted to OCaml, against the image src/twohead.py builds."""
+    import twohead
+    ex = os.path.join(ROCQ, 'extract')
+    subprocess.run(['ocamlfind', 'ocamlopt', '-package', 'stdlib', 'storednet.mli', 'storednet.ml',
+                    'dumpstored.ml', '-o', 'dumpstored'], cwd=ex, check=True)
+    out = os.path.join(ex, 'stored_rocq.bin')
+    members = []
+    for A in widths:
+        S = twohead.build_stored(A)
+        subprocess.run([os.path.join(ex, 'dumpstored'), str(A), str(S['w']), out], check=True)
+        theirs = open(out, 'rb').read()
+        members.append(dict(A=A, w=S['w'], records=len(S['recs']), bytes=len(S['image']),
+                            identical=theirs == S['image'], sha256=hashlib.sha256(theirs).hexdigest()))
+    for f in os.listdir(ex):
+        if not f.endswith(('.ml', '.mli')):
+            os.remove(os.path.join(ex, f))
+    return dict(members=members, identical=all(m['identical'] for m in members))
+
+
 def pstar_images():
     """The memory images m* and m_P written in rocq/Pstar.v, against those of src/host.py."""
     from host import M_P, M_STAR
@@ -1138,16 +1158,18 @@ def main_rocq():
         print(out.stdout)
         return 1
     host = host_extraction()
+    stored = stored_extraction()
     images = pstar_images()
     ext = subprocess.run([sys.executable, os.path.join(REPO, 'src', 'twohead.py'), 'net', 'extract'],
                          capture_output=True, text=True)
     identical = (ext.returncode == 0 and '"identical": true' in ext.stdout and host['identical']
-                 and all(images.values()))
+                 and stored['identical'] and all(images.values()))
     files = [l for l in open(os.path.join(ROCQ, '_CoqProject')).read().split() if l.endswith('.v')]
     lines = sum(len(open(os.path.join(ROCQ, f)).read().splitlines()) for f in files)
     res = dict(rocq=version.splitlines()[0], files=len(files), lines=lines,
                build_seconds=round(build, 1), theorems={n: 'closed' for n in names},
-               host_extraction=host, pstar_images=images, extraction_identical=identical)
+               host_extraction=host, stored_extraction=stored, pstar_images=images,
+               extraction_identical=identical)
     rec = json.load(open(RECORD)) if os.path.exists(RECORD) else {}
     rec.update(res)
     json.dump(rec, open(RECORD, 'w'), indent=1)

src/twohead.py

@@ -1,7 +1,6 @@
 """The ring machine M^alpha_{K,S,L}: the organism, the netlist N^alpha_{K,S,L}, and the host stored in it."""
 import argparse
 import hashlib
-import heapq
 import json
 import math
 import os
@@ -891,12 +890,14 @@ def main_net():
         net_update_record('lockstep', res)
         print(json.dumps(res, indent=1))
     elif cmd == 'lev':
-        # the rows of Lev(N^12_{3,S,L}), affine in S and L, and the noise a generation of the stored
-        # host survives with probability 0.999 by Proposition 5.5 and Theorem 5.9(ii)
+        # the rows of Lev(N^alpha_{3,S,L}) for the window of the stored host, affine in S and L, and the noise
+        # a generation of the stored host survives with probability 0.999 by Proposition 5.5 and Theorem 5.9(ii)
         t0 = time.time()
+        run = json.load(open(STORED_RECORD))['run']
+        alpha = (run['record_bits'] - 8) // 3
         pts = []
         for S, L in ((2, 3), (3, 3), (2, 5), (3, 5), (4, 9), (6, 4)):
-            units, nxt, lay = build_net(3, S, L, 12)
+            units, nxt, lay = build_net(3, S, L, alpha)
             d, rows = lev_rows(units, nxt, lay.n)
             pts.append(dict(S=S, L=L, depth=d, rows=rows))
             print(pts[-1], flush=True)
@@ -904,7 +905,6 @@ def main_net():
         cS, cL = r0[(3, 3)] - r0[(2, 3)], (r0[(2, 5)] - r0[(2, 3)]) // 2
         c0 = r0[(2, 3)] - 2 * cS - 3 * cL
         affine = all(c0 + cS * p['S'] + cL * p['L'] == p['rows'] for p in pts)
-        run = json.load(open(STORED_RECORD))['run']
         M = c0 + cS * run['S'] + cL * run['L']
         T = run['steps_expected']
 
@@ -917,7 +917,7 @@ def main_net():
                 else:
                     hi = mid
             return lo
-        res = dict(K=3, alpha=12, members=pts, rows=dict(constant=c0, per_slot=cS, per_cell=cL),
+        res = dict(K=3, alpha=alpha, members=pts, rows=dict(constant=c0, per_slot=cS, per_cell=cL),
                    affine=affine, depth=pts[0]['depth'], stored_member=dict(S=run['S'], L=run['L'], rows=M,
                    steps=T), s_max_0999={str(r): round(s_max(r), 4) for r in (1, 3, 5)},
                    seconds=round(time.time() - t0, 1))
@@ -1011,15 +1011,13 @@ def pc_bit(t, A=8):
 # records over named cells
 # ---------------------------------------------------------------------------
 
+MX = (('v', 'm0'), ('v', 'm1'))                 # the two cells inside a multiplexer or an exclusive or
+
+
 class Prog:
     def __init__(self):
         self.recs = []                           # (a0, w0, a1, w1, beta, ao), cells by name
         self.ends = {}                           # record -> the unit of the host whose value it writes
-        self.uid = 0
-
-    def tmp(self):
-        self.uid += 1
-        return ('t', self.uid)
 
     def emit(self, a0, w0, a1, w1, beta, ao):
         assert -8 <= beta <= 7
@@ -1043,145 +1041,76 @@ class Prog:
         (self.OR if v else self.AND)((x, True), (x, False), dst)
 
     def XOR(self, x, y, dst):
-        t1, t2 = self.tmp(), self.tmp()
+        t1, t2 = MX
         self.OR(x, y, t1)
         self.OR((x[0], not x[1]), (y[0], not y[1]), t2)
         self.AND((t1, True), (t2, True), dst)
 
     def MUX(self, s, a, b, dst):
         """dst <- s ? a : b, s a cell, a and b literals."""
-        t1, t2 = self.tmp(), self.tmp()
+        t1, t2 = MX
         self.AND((s, True), a, t1)
         self.AND((s, False), b, t2)
         self.OR((t1, True), (t2, True), dst)
 
-    def chain(self, kind, lits, dst, before=None):
-        """Chain the literals by 'and' or 'or' into dst, written once, last."""
-        assert lits
-        if len(lits) == 1:
-            if before:
-                before(0)
+    def chain(self, kind, lits, dst, acc):
+        """The literals joined by 'and' or 'or', accumulated in acc, the last record writing dst."""
+        g = self.AND if kind == 'and' else self.OR
+        k = len(lits)
+        if k == 1:
             self.COPY(lits[0], dst)
             return
-        g = self.AND if kind == 'and' else self.OR
-        acc = self.tmp()
-        if before:
-            before(0); before(1)
-        if len(lits) == 2:
+        if k == 2:
             g(lits[0], lits[1], dst)
             return
         g(lits[0], lits[1], acc)
-        for i in range(2, len(lits)):
-            if before:
-                before(i)
-            g((acc, True), lits[i], dst if i == len(lits) - 1 else acc)
+        for i in range(2, k - 1):
+            g((acc, True), lits[i], acc)
+        g((acc, True), lits[k - 1], dst)
 
-    def threshold(self, t, lits, dst):
-        """at least t of the literals, by T_t(x1..xk) = T_t(x2..xk) or (x1 and T_{t-1}(x2..xk))."""
+    def unit(self, t, lits, dst, acc, lev):
+        """At least t of the literals, into dst, by T_t(x1..xk) = T_t(x2..xk) or (x1 and T_{t-1}(x2..xk)),
+        the three cells of level lev holding T_t(x2..xk), T_{t-1}(x2..xk) and the conjunction."""
         k = len(lits)
         if t <= 0:
-            self.CONST(1, dst); return
-        if t > k:
-            self.CONST(0, dst); return
-        if t == 1:
-            self.chain('or', lits, dst); return
-        if t == k:
-            self.chain('and', lits, dst); return
-        a, b = self.tmp(), self.tmp()
-        self.threshold(t, lits[1:], a)
-        self.threshold(t - 1, lits[1:], b)
-        c = self.tmp()
-        self.AND(lits[0], (b, True), c)
-        self.OR((a, True), (c, True), dst)
+            self.CONST(1, dst)
+        elif t > k:
+            self.CONST(0, dst)
+        elif t == 1:
+            self.chain('or', lits, dst, acc)
+        elif t == k:
+            self.chain('and', lits, dst, acc)
+        else:
+            a, b, c = (('x', lev, i) for i in range(3))
+            self.unit(t, lits[1:], a, a, lev + 1)
+            self.unit(t - 1, lits[1:], b, b, lev + 1)
+            self.AND(lits[0], (b, True), c)
+            self.OR((a, True), (c, True), dst)
+
+
+def unit_threshold(bias, ins):
+    """The least number of true literals at which the unit fires."""
+    return sum(1 for _, w in ins if w < 0) - bias
 
 
 def compile_host(P, A=8):
-    """The records of one step of H_A; state bits are cells ('s', i)."""
+    """The records of one step of H_A: the units in the order of the netlist, unit u in cell ('u', u), and the
+    unit of the next value of state bit i writing ('s', i) with its last record."""
     n, units, nxt = host_units(A)
-    cons = {}
-    for u, (_, ins) in enumerate(units):
-        for s, _w in ins:
-            if s >= n:
-                cons.setdefault(s - n, []).append(u)
     is_next = {nxt[i] - n: i for i in range(n)}
     assert len(is_next) == n and all(v >= n for v in nxt)
-    fusable = {u for u, c in cons.items() if len(c) == 1}
-    done, cell = set(), {}
-
-    def cell_of(s):
-        return ('s', s) if s < n else cell[s - n]
-
-    def ensure_ancestors(u):
-        for s, _w in units[u][1]:
-            if s >= n:
-                v = s - n
-                if v in fusable:
-                    ensure_ancestors(v)
-                else:
-                    need(v)
-
-    def need(u):
-        if u in done:
-            return
-        assert u not in is_next, 'a next value is read before the state is written'
-        ensure_ancestors(u)
-        cell[u] = P.tmp()
-        emit_unit(u, cell[u])
-        done.add(u)
-
-    def fused(v):
-        if v not in done:
-            cell[v] = P.tmp()
-            emit_unit(v, cell[v])
-            done.add(v)
-
-    def emit_unit(u, dst):
-        b, ins = units[u]
-        k = len(ins)
-        t = sum(1 for _, w in ins if w < 0) - b
-        lits = [None] * k
-
-        def before(i):
-            s = ins[i][0]
-            if s >= n and (s - n) in fusable:
-                fused(s - n)
-            lits[i] = (cell_of(s), ins[i][1] > 0)
-        if t <= 0 or t > k:
-            P.CONST(1 if t <= 0 else 0, dst)
-        elif 1 < t < k:
-            for i in range(k):
-                before(i)
-            P.threshold(t, lits, dst)
-        else:
-            _chain_lazy(P, 'and' if t == k else 'or', lits, dst, before)
+    for u, (bias, ins) in enumerate(units):
+        assert all(w in (1, -1) for _, w in ins)
+        lits = [(('s', s) if s < n else ('u', s - n), w > 0) for s, w in ins]
+        dst = ('s', is_next[u]) if u in is_next else ('u', u)
+        P.unit(unit_threshold(bias, ins), lits, dst, ('u', u), 0)
         P.ends[len(P.recs) - 1] = u
-
-    order_next = [nxt[pc_bit(t, A)] - n for t in range(A)] + [nxt[A] - n] + \
-                 [nxt[mem_bit(j, t, A)] - n for j in range(1 << A) for t in range(A)]
-    for u in order_next:                         # stage A: everything the next values read
-        ensure_ancestors(u)
-    for u in order_next:                         # stage B: the next values, in place
-        emit_unit(u, ('s', is_next[u]))
-        done.add(u)
     return n, units, nxt
 
 
-def _chain_lazy(P, kind, lits, dst, before):
-    k = len(lits)
-    if k == 1:
-        before(0)
-        P.COPY(lits[0], dst)
-        return
-    g = P.AND if kind == 'and' else P.OR
-    before(0); before(1)
-    if k == 2:
-        g(lits[0], lits[1], dst)
-        return
-    acc = P.tmp()
-    g(lits[0], lits[1], acc)
-    for i in range(2, k):
-        before(i)
-        g((acc, True), lits[i], dst if i == k - 1 else acc)
+def threshold_levels(units):
+    """The levels of cells the units of threshold strictly between 1 and their fan-in use."""
+    return max([len(ins) - 2 for b, ins in units if 1 < unit_threshold(b, ins) < len(ins)] or [0])
 
 
 # ---------------------------------------------------------------------------
@@ -1192,37 +1121,43 @@ def mem_cell(j, t, A=8):
     return ('s', mem_bit(j, t, A))
 
 
-def word_is_one(P, j, A=8):
-    """[memory word j == 1]"""
-    dst = P.tmp()
+def word_is_one(P, j, dst, A=8):
+    """[memory word j == 1] into dst"""
     lits = [(mem_cell(j, 0, A), True)] + [(mem_cell(j, t, A), False) for t in range(1, A)]
-    P.chain('and', lits, dst)
+    P.chain('and', lits, dst, dst)
     return dst
 
 
+def device_cells(w):
+    """The cells of the device, in the order of their addresses."""
+    return ['wr', 'rd', 'rw'] + [('e', i) for i in range(w)] + ['eq', 'eot', 'ca', 'cc', 'g'] + \
+        [('car', i) for i in range(1, w)] + ['m0', 'm1']
+
+
 def compile_device(P, A=8, w=CW):
     io = SR.io_cells(A)
     cnt = [('d', 'cnt', i) for i in range(w)]
     lim = [('d', 'lim', i) for i in range(w)]
     dest = ('d', 'dest')
-    wr = word_is_one(P, io['c_wr'], A)
-    rd = word_is_one(P, io['c_rd'], A)
-    rw = word_is_one(P, io['c_rw'], A)
+    v = lambda name: ('v', name)
+    wr = word_is_one(P, io['c_wr'], v('wr'), A)
+    rd = word_is_one(P, io['c_rd'], v('rd'), A)
+    rw = word_is_one(P, io['c_rw'], v('rw'), A)
     # [cnt == lim]
-    eq = P.tmp()
+    eq = v('eq')
     xs = []
     for i in range(w):
-        e = P.tmp()
-        a1, a0 = P.tmp(), P.tmp()
+        e = v(('e', i))
+        a1, a0 = MX
         P.AND((cnt[i], True), (lim[i], True), a1)
         P.AND((cnt[i], False), (lim[i], False), a0)
         P.OR((a1, True), (a0, True), e)
         xs.append((e, True))
-    P.chain('and', xs, eq)
-    eot = P.tmp()                                # the end of the recipe is known after the rewind
+    P.chain('and', xs, eq, eq)
+    eot = v('eot')                               # the end of the recipe is known after the rewind
     P.AND((eq, True), (dest, True), eot)
     # (i) the low byte of R_out, most significant bit first, under the arm or under the copy head
-    ca, cc = P.tmp(), P.tmp()
+    ca, cc = v('ca'), v('cc')
     P.AND((wr, True), (dest, False), ca)
     P.AND((wr, True), (dest, True), cc)
     out, inp, ceot = io['r_out'], io['r_in'], io['c_eot']
@@ -1233,7 +1168,7 @@ def compile_device(P, A=8, w=CW):
         P.COPY((cc, True), ('c', AC))
     for t in range(A):
         P.AND((mem_cell(out, t, A), True), (wr, False), mem_cell(out, t, A))
-    g = P.tmp()
+    g = v('g')
     P.AND((rd, True), (eot, False), g)
     # (ii) the byte under the read head into R_in, most significant bit first, each bit moving the head,
     # and its sign bit into the bits above it
@@ -1249,7 +1184,7 @@ def compile_device(P, A=8, w=CW):
     # the counter of bytes read: carries first, then the sum bits
     car = [g]
     for i in range(w - 1):
-        c = P.tmp()
+        c = v(('car', i + 1))
         P.AND((car[-1], True), (cnt[i], True), c)
         car.append(c)
     for i in range(w):
@@ -1306,49 +1241,28 @@ HANDOVER_RECORDS = 4
 # allocation and encoding
 # ---------------------------------------------------------------------------
 
-def allocate(recs):
-    """Window addresses for the special cells, the state, the registers and the temporaries."""
-    fixed = {}
-    nxt_addr = FREE
-    names = []
-    for r in recs:
-        for a in (r[0], r[2], r[5]):
-            if a is not None and a[0] in ('s', 'd') and a not in fixed:
-                names.append(a)
-                fixed[a] = None
-    for a in sorted(names, key=lambda x: (x[0], x[1:] if x[0] == 'd' else x[1])):
-        fixed[a] = nxt_addr
-        nxt_addr += 1
-    first_w, last_r = {}, {}
-    for i, (a0, w0, a1, w1, be, ao) in enumerate(recs):
-        for a, w in ((a0, w0), (a1, w1)):
-            if w and a[0] == 't':
-                assert a in first_w, ('read before written', a)
-                last_r[a] = i
-        if ao[0] == 't':
-            first_w.setdefault(ao, i)
-    base = nxt_addr
-    busy, free, top = [], [], base               # (index after which it is free, cell); free cells
-    addr = dict(fixed)
-    for name in sorted(first_w, key=lambda x: first_w[x]):
-        start_, end = first_w[name], last_r.get(name, first_w[name])
-        while busy and busy[0][0] < start_:
-            heapq.heappush(free, heapq.heappop(busy)[1])
-        if free:
-            c = heapq.heappop(free)
-        else:
-            c, top = top, top + 1
-        addr[name] = c
-        heapq.heappush(busy, (end, c))
-
-    def res(a):
-        if a is None:
-            return SINK
-        if a[0] == 'c':
-            return a[1]
-        return addr[a]
-    out = [(res(a0), w0, res(a1), w1, be, res(ao)) for (a0, w0, a1, w1, be, ao) in recs]
-    return out, addr, top
+def layout(A, w, n, n_units, levels):
+    """Window addresses: booted, the counter, dest and the limit, the state bits, one cell for each unit of
+    H_A, three cells for each level of a threshold unit, and the cells of the device."""
+    addr = {('d', 'booted'): FREE}
+    for i in range(w):
+        addr[('d', 'cnt', i)] = FREE + 1 + i
+        addr[('d', 'lim', i)] = FREE + 2 + w + i
+    addr[('d', 'dest')] = FREE + 1 + w
+    base = FREE + 2 + 2 * w
+    for i in range(n):
+        addr[('s', i)] = base + i
+    for u in range(n_units):
+        addr[('u', u)] = base + n + u
+    xbase = base + n + n_units
+    for lev in range(levels):
+        for k in range(3):
+            addr[('x', lev, k)] = xbase + 3 * lev + k
+    dbase = xbase + 3 * levels
+    names = device_cells(w)
+    for k, name in enumerate(names):
+        addr[('v', name)] = dbase + k
+    return addr, dbase + len(names)
 
 
 def bits_to_bytes(bits):
@@ -1361,7 +1275,8 @@ def bytes_to_bits(data):
 
 
 def check_schedule(recs, lo, hi, n):
-    """Check the in-place order of the host block and the live intervals of the temporaries."""
+    """Check the in-place order of the host block: every state bit written once, after its last reader,
+    and every other cell the block reads written earlier in it."""
     written = {}
     for i in range(lo, hi):
         ao = recs[i][5]
@@ -1369,20 +1284,15 @@ def check_schedule(recs, lo, hi, n):
             assert ao not in written, ('state bit written twice', ao)
             written[ao] = i
     assert len(written) == n, 'a state bit without its next value'
+    seen = set()
     for i in range(lo, hi):
-        a0, w0, a1, w1, _, _ = recs[i]
+        a0, w0, a1, w1, _, ao = recs[i]
         for a, w in ((a0, w0), (a1, w1)):
             if w and a[0] == 's':
                 assert i <= written[a], ('state bit read after it is written', a)
-    last_r, last_w = {}, {}
-    for i, (a0, w0, a1, w1, _, ao) in enumerate(recs):
-        for a, w in ((a0, w0), (a1, w1)):
-            if w and a[0] == 't':
-                last_r[a] = i
-        if ao[0] == 't':
-            last_w[ao] = i
-    assert all(last_w[t] < last_r.get(t, last_w[t] + 1) or t not in last_r for t in last_w), \
-        'a temporary written after its last read'
+            elif w and a[0] != 'c':
+                assert a in seen, ('read before written', a)
+        seen.add(ao)
     return dict(state_bits_written=len(written))
 
 
@@ -1402,7 +1312,9 @@ def build_stored(A=8):
         compile_device(P, A, w)
         n_device = len(P.recs) - lo - n_host
         compile_handover(P, A)
-        recs, addr, top = allocate(P.recs)
+        addr, top = layout(A, w, n, len(units), threshold_levels(units))
+        res = lambda a: a[1] if a[0] == 'c' else addr[a]
+        recs = [(res(a0), w0, res(a1), w1, be, res(ao)) for (a0, w0, a1, w1, be, ao) in P.recs]
         alpha = (top - 1).bit_length()
         b = 8 + 3 * alpha
         pad = 0