fix(tests): drag remaining stale tests into line with the corrected ISA

After commit 6761f0c unblocked the workspace test step in CI by fixing
the SRAI/L32R decoder unit tests, five more pre-existing stale tests
surfaced (the fmt + clippy gates above were masking them on the same
runs). Fix:

* tests/xtensa_exec.rs::enc_srai: helper aliased `at = shamt` (a
  shortcut that worked only when the broken decoder colocated source
  and shamt in the `t` field). Take both arguments independently —
  source goes in `t`, shamt in `s` — matching ISA RM §4.3 RRR
  encoding. Updated the two SRAI exec callers.

* tests/xtensa_exec.rs::test_exec_entry_window_overflow_of{4,8,12}:
  mark `#[ignore]`. They verify the F5 per-instruction window-overflow
  vector path that is intentionally disabled in execute() with
  `#[cfg(any())]` (the canonical OF{4,8,12} firmware handlers
  double-fault on freshly-created task frames). Sim uses transparent
  shadow-spill on CALL{n} instead — see spill_shadow_on_call.

* hw-oracle/tests/oracles.rs::entry_window_overflow_of4: split into
  an inner spec helper plus manual `#[test] #[ignore]` for the sim
  variant and `#[test] #[cfg(feature="hw-oracle")] #[ignore]` for the
  hw variant. Same reason as the xtensa_exec ignore. Keeps the
  oracle case as the canonical hardware spec without dragging the
  sim suite into red.

* hw-oracle/src/arm_thumb.rs::movw_r0_0xbeef_encoding: the expected
  bit-pattern (0xF64B_00EF) decoded back to `movw r0, #0xB8EF`, not
  `#0xBEEF`. Recomputed using ARMv7-M ARM §A6.7.74 — imm4=0xB, i=1,
  imm3=6, imm8=0xEF gives lo=0x60EF, so the full word is 0xF64B_60EF.

After this: 347 lib tests + every workspace integration test pass,
3 sim-side overflow tests ignored with reasons. fmt + clippy clean.

Author: w1ne

crates/core/tests/xtensa_exec.rs

@@ -91,14 +91,15 @@ fn enc_srli(ar: u32, at: u32, shamt: u32) -> u32 {
 
 /// Encode SRAI ar, at, shamt (0..=31).
 ///
-/// ISA encoding: shamt = (op2 & 1) << 4 | t; at = t (low nibble of shamt).
-/// For shamt 0..=15: op2=0x2, t=shamt, at=shamt.
-/// For shamt 16..=31: op2=0x3, t=shamt&0xF, at=shamt&0xF.
-/// Caller must place the value to shift in register `shamt & 0xF`.
-fn enc_srai(ar: u32, shamt: u32) -> u32 {
-    let op2 = 0x2 | (shamt >> 4); // 0x2 or 0x3
-    let t = shamt & 0xF; // t == at (source register)
-    rrr(op2, 0x1, ar, 0, t)
+/// ISA encoding per Xtensa RM §4.3 (RRR variant):
+///   r (15:12) = ar       — destination
+///   s (11:8)  = shamt[3:0]
+///   t (7:4)   = at        — source register (independent of shamt)
+///   op2[0]    = shamt[4]
+fn enc_srai(ar: u32, at: u32, shamt: u32) -> u32 {
+    let op2 = 0x2 | (shamt >> 4); // 0x2 or 0x3 for shamt[4]
+    let s = shamt & 0xF; // shamt[3:0]
+    rrr(op2, 0x1, ar, s, at)
 }
 
 /// Encode SSL as_  (op0=0, op1=0, op2=0x4, r=0x1, s=as_, t=0).
@@ -855,7 +856,7 @@ fn test_exec_srai_positive() {
         &mut bus,
         TEST_PC as u64,
         &[
-            enc_srai(5, 4), // SRAI a5, a4, 4 → 0x7FFFFFFF >> 4 = 0x07FFFFFF
+            enc_srai(5, 4, 4), // SRAI a5, a4, 4 → 0x7FFFFFFF >> 4 = 0x07FFFFFF
             st0(4, 0, 0),
         ],
     );
@@ -883,7 +884,7 @@ fn test_exec_srai_negative() {
         &mut bus,
         TEST_PC as u64,
         &[
-            enc_srai(5, 8), // SRAI a5, a8, 8 → sign-extended
+            enc_srai(5, 8, 8), // SRAI a5, a8, 8 → sign-extended
             st0(4, 0, 0),
         ],
     );
@@ -4046,7 +4047,18 @@ fn setup_entry_overflow(cpu: &mut XtensaLx7, callinc: u8) {
 /// F3: ENTRY with CALLINC=1 triggers WindowOverflow4.
 /// Expect: PC = VECBASE + OF4 offset (0x000), EPC1 = original PC, PS.EXCM=1,
 /// WindowBase NOT rotated (still 0), WindowStart check bit still set.
-#[test]
+///
+/// IGNORED: real silicon vectors to OF4/OF8/OF12 handlers on overflow; the
+/// sim instead transparently shadows the displaced frame on CALL{n} (see
+/// `spill_shadow_on_call` in cpu/xtensa_lx7.rs). Vectoring to the
+/// firmware's canonical OF handler would double-fault — its
+/// `l32e a0, a1, -12` reads uninitialised stack on freshly-created task
+/// frames. The F5 per-instruction overflow check at the top of execute()
+/// is gated off with `#[cfg(any())]` for the same reason. Re-enable both
+/// the check and this test if/when the firmware OF-handler path is fully
+/// modelled.
+#[test]
+#[ignore = "F5 overflow vector intentionally disabled; sim uses shadow-spill instead"]
 fn test_exec_entry_window_overflow_of4() {
     let mut cpu = XtensaLx7::new();
     let mut bus = SystemBus::new();
@@ -4087,9 +4099,9 @@ fn test_exec_entry_window_overflow_of4() {
 }
 
 /// F3: ENTRY with CALLINC=2 triggers WindowOverflow8.
-/// Expect: PC = VECBASE + OF8 offset (0x080), EPC1 = original PC, PS.EXCM=1,
-/// WindowBase NOT rotated (still 0).
+/// IGNORED — same reason as `test_exec_entry_window_overflow_of4`.
 #[test]
+#[ignore = "F5 overflow vector intentionally disabled; sim uses shadow-spill instead"]
 fn test_exec_entry_window_overflow_of8() {
     let mut cpu = XtensaLx7::new();
     let mut bus = SystemBus::new();
@@ -4124,9 +4136,9 @@ fn test_exec_entry_window_overflow_of8() {
 }
 
 /// F3: ENTRY with CALLINC=3 triggers WindowOverflow12.
-/// Expect: PC = VECBASE + OF12 offset (0x100), EPC1 = original PC, PS.EXCM=1,
-/// WindowBase NOT rotated (still 0).
+/// IGNORED — same reason as `test_exec_entry_window_overflow_of4`.
 #[test]
+#[ignore = "F5 overflow vector intentionally disabled; sim uses shadow-spill instead"]
 fn test_exec_entry_window_overflow_of12() {
     let mut cpu = XtensaLx7::new();
     let mut bus = SystemBus::new();

crates/hw-oracle/src/arm_thumb.rs

@@ -937,10 +937,13 @@ mod encoder_tests {
 
     #[test]
     fn movw_r0_0xbeef_encoding() {
-        // MOV.W r0, #0xBEEF (T3 encoding).  Cross-checked with:
-        //   echo 'movw r0, #0xBEEF' | arm-none-eabi-as -mthumb -mcpu=cortex-m4 -o /tmp/t.o
-        //   arm-none-eabi-objdump -d /tmp/t.o → 0xf64b 0x00ef
-        // Our encoder returns u32 in hi-then-lo order: hi=0xF64B, lo=0x00EF.
-        assert_eq!(movw_imm16(0, 0xBEEF), 0xF64B_00EF);
+        // MOV.W r0, #0xBEEF (T3 encoding) per ARMv7-M ARM §A6.7.74:
+        //   imm32 = ZeroExtend(imm4:i:imm3:imm8, 32)
+        // For 0xBEEF: imm4=0xB, i=1, imm3=6, imm8=0xEF.
+        //   hi = 0xF240 | (i<<10) | imm4         = 0xF240 | 0x0400 | 0x000B = 0xF64B
+        //   lo = (imm3<<12) | (Rd<<8) | imm8     = 0x6000 | 0x0000 | 0x00EF = 0x60EF
+        // Cross-checked: arm-none-eabi-as `movw r0, #0xBEEF` → 4b f6 ef 60
+        // (LE byte stream: hi=0xF64B, lo=0x60EF).
+        assert_eq!(movw_imm16(0, 0xBEEF), 0xF64B_60EF);
     }
 }

crates/hw-oracle/tests/oracles.rs

@@ -920,8 +920,15 @@ fn call4_entry_retw_no_overflow() -> OracleCase {
 ///   IRAM_BASE+3..7:  zeros (unreachable)
 ///   IRAM_BASE+8:     ENTRY a1, 32                          [0x36,0x41,0x00]
 ///   IRAM_BASE+0x800: BREAK  ← OF4 vector (VECBASE+0x000)  [0xF0,0x41,0x00]
-#[hw_oracle_test]
-fn entry_window_overflow_of4() -> OracleCase {
+///
+/// NOTE — F5 window-overflow vectoring is intentionally disabled in our
+/// sim (the canonical `l32e a0, a1, -12` handler double-faults on
+/// freshly-created task frames). We use transparent shadow-spilling on
+/// CALL{n} instead — see `spill_shadow_on_call` in cpu/xtensa_lx7.rs and
+/// the `#[cfg(any())]`-gated F5 check at the top of execute(). The case
+/// body below is still kept as the canonical hardware spec; the sim
+/// variant is wrapped manually as `#[ignore]` below.
+fn entry_window_overflow_of4_inner_spec() -> OracleCase {
     // Oracle program lays out BREAKs at all three OF vectors (0x000, 0x080,
     // 0x100) so the CPU halts cleanly regardless of which OFx the rotation
     // algorithm dispatches to. The expectation pins the dispatch — change it
@@ -952,6 +959,21 @@ fn entry_window_overflow_of4() -> OracleCase {
         })
 }
 
+/// Sim variant: ignored. See note on `entry_window_overflow_of4_inner_spec`.
+#[test]
+#[ignore = "F5 overflow vector disabled in sim — shadow-spill used instead"]
+fn entry_window_overflow_of4_sim() {
+    labwired_hw_oracle::run_sim(entry_window_overflow_of4_inner_spec());
+}
+
+/// HW variant: feature-gated, exercises real-silicon vectoring.
+#[test]
+#[cfg(feature = "hw-oracle")]
+#[ignore = "hw-oracle: requires connected ESP32-S3 board"]
+fn entry_window_overflow_of4_hw() {
+    labwired_hw_oracle::run_hw(entry_window_overflow_of4_inner_spec());
+}
+
 // ── H7.3: Nested 2-level CALL4 → ENTRY → CALL4 → ENTRY (no overflow) ────────
 
 /// Two successive CALL4→ENTRY pairs; WindowBase ends at 2, WindowStart = 0x0007.