proof/: add StarForth_Editor_Words.thy and StarForth_Format_Words.thy

editor_words.c: zero tractable words (first such file in this sweep) --
every word routes through the same deferred block-window cache as
block_words.c, and EDIT is an interactive stdin/stdout REPL loop, not a
single-step transition.

format_words.c: 17 of 19 registered words modeled (# and #S deferred,
multi-precision division out of scope). Two genuine C findings recorded:
(1) DECIMAL/HEX/OCTAL write only the FORTH-visible memory cell at
base_addr, never the separate vm->base host-mirror field that number
OUTPUT words actually read -- proved formally
(decimal_does_not_change_vm_base et al.), so HEX/OCTAL/DECIMAL silently
never affect printed output, only parsed input. (2) ? and DUMP cast the
popped cell directly to a host pointer and dereference it, bypassing
vm_addr_ok entirely -- an out-of-VM-bounds read, not modeled since it
isn't a vm->memory access at all.

Adds base_addr/hold_addr/hold_pos to vm_state (StarForth_Base.thy),
matching the scr_addr/here pattern from earlier files.

proof/ROOT

@@ -16,6 +16,8 @@ session "StarForth" = "HOL-Library" +
     StarForth_String_Words
     StarForth_Block_Words
     StarForth_IO_Words
+    StarForth_Editor_Words
+    StarForth_Format_Words
     StarForth_Mutex
     StarForth_Transition
     StarForth_Loop1_Heat

proof/StarForth_Base.thy

@@ -519,6 +519,18 @@ record vm_state =
      block number. Modeled as nat, matching `here`'s convention for VM
      addresses. See StarForth_Block_Words.thy's SCR. *)
   scr_addr      :: nat
+  (* ○ CODE-MUST-MATCH: C: vaddr_t base_addr (include/vm.h:453) -- VM address
+     of the FORTH BASE variable cell; vaddr_t hold_addr (include/vm.h:454) --
+     VM address of the 64-byte pictured-number hold buffer; int hold_pos
+     (include/vm.h:455) -- current fill count in that buffer, 0..63.
+     `vm_base` (above) is the SEPARATE host-mirror cell_t field C reads for
+     number *output* formatting (format_words.c's current_base()); the cell
+     at `base_addr` is what number *parsing* reads (vm.c's vm_get_base()).
+     See StarForth_Format_Words.thy for the finding that these two can
+     desync. *)
+  base_addr     :: nat
+  hold_addr     :: nat
+  hold_pos      :: nat
 
   (* ── Physics Loop #1: Execution heat tracking ───────────────────────── *)
   (* ○ CODE-MUST-MATCH: heat_threshold_{25th,50th,75th} in C VM struct.

proof/StarForth_Editor_Words.thy

@@ -0,0 +1,47 @@
+theory StarForth_Editor_Words
+  imports StarForth_Base
+begin
+
+(* =========================================================================
+   POST-12: Editor Words
+   Mirrors: src/word_source/editor_words.c (4 registered words)
+
+   SCOPE, decided 2026-08-14: none of the 4 registered words are modeled --
+   the first file in this sweep with zero tractable words (block_words.c,
+   the previous "worst case", still had SCR). Every word here routes
+   through the shared helper `line_ptr`, which calls straight into the
+   same block-subsystem cache StarForth_Block_Words.thy already documented
+   as out of scope: `blk_get_buffer`/`blk_is_valid` (block_subsystem.h),
+   backed by real disk I/O, none of it in vm_state. There is no analogue
+   of SCR here -- editor_words.c's `current_scr` *dereferences* memory at
+   `vm->scr_addr` (`vm_load_cell(vm, vm->scr_addr)`) rather than pushing
+   the address itself, so even the SCR-range guard clauses ultimately gate
+   entry into `line_ptr`, which is where every word's real effect lives.
+
+   L ( u -- )     : line_ptr + print_line_64 (console I/O).
+   S ( c-addr len u -- ) : line_ptr + memcpy into the block buffer (disk-
+                    backed memory, not vm_state) + mark_buffer_dirty
+                    (block-window cache, same gap as block_words.c).
+   SHOW ( -- )    : line_ptr x16 (one per line) + printf (console I/O).
+   EDIT ( u -- )  : an interactive stdin/stdout REPL loop (fgets in a
+                    `for (;;)`) that dispatches to L/S/SHOW plus
+                    save_all_buffers (block-window cache) -- not a
+                    single-step vm_state transition in any sense the rest
+                    of this suite's words are, same category as
+                    block_words.c's LOAD/THRU (recursive/looping, not a
+                    leaf effect).
+
+   Nothing new added to vm_state or StarForth_Base.thy for this file --
+   there is nothing self-contained enough to need it.
+   ======================================================================== *)
+
+lemma l_not_modelled: True       \<comment> \<open>L: line_ptr (block-window cache + blk_is_valid) + console I/O.\<close>
+  by simp
+lemma s_not_modelled: True       \<comment> \<open>S: line_ptr + memcpy into block buffer + mark_buffer_dirty.\<close>
+  by simp
+lemma show_not_modelled: True    \<comment> \<open>SHOW: line_ptr x16 + console I/O.\<close>
+  by simp
+lemma edit_not_modelled: True    \<comment> \<open>EDIT: interactive stdin/stdout REPL loop, not a single-step transition.\<close>
+  by simp
+
+end