feat(cpu): retain Thumb instruction pipeline halfwords

docs/architecture.md

@@ -47,8 +47,9 @@ The repository is a Cargo workspace with three crates:
 | `crates/gba-core/src/dma.rs` | DMA registers, internal pointers, retained channel data, trigger state, priority, and completion IRQs |
 | `crates/gba-core/src/machine.rs` | Timed CPU/DMA/device stepping and IRQ delivery |
 | `crates/gba-core/src/timing.rs` | Bus widths, wait-state costs, and timing breakdowns |
-| `crates/gba-core/src/cpu/pipeline.rs` | CPU-owned ARM instruction words, deferred fetch diagnostics, refill sampling, and explicit invalidation |
+| `crates/gba-core/src/cpu/pipeline.rs` | CPU-owned ARM/Thumb instructions, PC/state tags, deferred fetch diagnostics, refill sampling, and explicit invalidation |
 | `crates/gba-core/src/cpu/arm_pipeline_tests.rs` | ARM self-modifying code, branches, target pairs, DMA isolation, exceptions, errors, and timing equivalence |
+| `crates/gba-core/src/cpu/thumb_pipeline_tests.rs` | Thumb retained halfwords, BL prefix/suffix, state-tagged refills, DMA isolation, rollback, and timing equivalence |
 | `crates/gba-core/src/cpu/timing.rs` | ARM/Thumb cycle summaries, nominal DMA resume, and data-access accounting |
 | `crates/gba-core/src/cpu/dma_resume_tests.rs` | One-shot non-sequential DMA resume costs, wait settings, failures, idle, IRQs, and API isolation |
 | `crates/gba-core/src/cpu/timing_tests.rs` | Instruction timing and semantic-equivalence checks |

docs/hardware/bios.md

@@ -134,7 +134,7 @@ Missing BIOS images remain unmapped. The unused-memory ARM open-bus snapshot is
 
 The Thumb rule follows documented BIOS bus lanes and a source comparison with NanoBoyAdvance.
 See [Thumb BIOS prefetch research](../research/thumb-bios-prefetch.md) for evidence, emulator differences, and test scope.
-This BIOS readback model remains separate from the CPU's ARM instruction buffer.
+This BIOS readback model remains separate from the CPU's ARM/Thumb instruction buffer.
 It does not model exact refill, BIOS data-access, or DMA bus history.
 The boundary diagnostic policy and precise bus timing remain hardware-unverified.
 Original regressions cover synthetic images, boot, exception returns, access widths, alignment, modes, and diagnostics.

docs/hardware/cpu.md

@@ -76,19 +76,21 @@ These forms retain nominal single-word access costs and the existing atomic-erro
 With writeback enabled, `STM` stores the old base only when that register is first in the list.
 Otherwise, `STM` stores the updated base.
 
-## ARM instruction buffering
+## ARM and Thumb instruction buffering
 
-ARM execution retains fetched instructions in a CPU-owned buffer, independent of later RAM contents.
-At cold entry, a successful step reads the current word P and samples P+4 and P+8 before instruction effects.
-During sequential execution, the current and next words come from retained results; only P+8 is newly sampled.
+ARM and Thumb execution retain fetched instructions in a CPU-owned buffer, independent of later RAM contents.
+Let W be the instruction width: four bytes for ARM, two for Thumb.
+At cold entry, a successful step reads the current instruction P and samples P+W and P+2W before instruction effects.
+During sequential execution, the current and next instructions come from retained results; only P+2W is newly sampled.
 Success advances the buffer. CPU/DMA stores and host writes do not replace already buffered instructions.
 The existing r15 convention is unchanged: it stores the next executing address, not the hardware fetch address.
 
-A successful branch or PC-writing refill into ARM samples target T and T+4 after instruction effects.
+A successful branch or PC-writing refill samples target T and T+W after instruction effects, using the resulting instruction state.
 This includes taken branches, BX, PC loads, status-restoring returns, and software interrupts.
 PC writes refill even when the destination equals fallthrough. Untaken conditional branches retain sequential buffering.
-The first target instruction samples T+8 before execution. Thumb-to-ARM transitions also capture the ARM target pair.
-Leaving ARM discards its buffer. Thumb still fetches directly and uses its separate bus-history snapshots.
+The first target instruction samples T+2W before execution. State transitions replace the buffer with the destination pair.
+Thumb BL's prefix advances sequentially; only its suffix refills. Ordinary Thumb PC writes preserve Thumb state.
+The buffer records both expected PC and instruction state. A state mismatch cannot reinterpret retained ARM words as Thumb halfwords.
 
 Machine IRQ entry captures the ARM vector pair before any handler instruction runs.
 `Cpu::enter_exception` and `Cpu::take_interrupt` have no memory parameter: they invalidate the buffer and leave vector sampling to the next step.
@@ -101,14 +103,14 @@ A failed instruction preserves all CPU state, including the old buffer; its spec
 A successful branch discards abandoned-path errors and replaces them with target fetch results.
 
 CPU clones and equality include the buffer. Architectural state checks are separate from full-state rollback checks in tests.
-`Cpu::invalidate_pipeline()` explicitly discards buffered words without changing registers, flags, or device clocks.
+`Cpu::invalidate_pipeline()` explicitly discards buffered instructions without changing registers, flags, or device clocks.
 Use it after debugger code repair or when attaching different memory to a retained CPU.
 Do not call it for ordinary CPU/DMA stores: that would hide self-modifying-code behavior.
 
 This is instruction buffering, not a complete timed fetch pipeline.
 Samples add no nominal data accesses or device cycles. Existing refill costs and one-shot DMA resume costs remain unchanged.
-Thumb buffering, fetch-driven bus history, exact refill costs, per-access device updates, and DMA arbitration remain incomplete.
-See [the evidence, diagnostic policy, and tests](../research/arm-instruction-buffer.md).
+Fetch-driven bus history, exact refill costs, per-access device updates, and DMA arbitration remain incomplete.
+See the [ARM evidence and diagnostic policy](../research/arm-instruction-buffer.md) and [Thumb extension](../research/thumb-instruction-buffer.md).
 
 ## ARM unused-memory data reads
 
@@ -137,8 +139,8 @@ Limits remain explicit:
   [DMA channel data](dma.md#retained-channel-data) is separate and never overrides a CPU snapshot.
 - Missing BIOS, truncated ROM, unsupported I/O, and save-memory accesses retain their existing diagnostics.
 - Unused-memory writes remain diagnostics rather than ignored hardware writes. Swaps cannot silently discard their write.
-- ARM instruction buffering is persistent, but these data snapshots remain a separate bounded model.
-  Thumb IWRAM refills sample their target pair without buffering Thumb instructions.
+- ARM/Thumb instruction buffering is persistent, but these data snapshots remain a separate bounded model.
+  Thumb IWRAM bus-history samples do not share storage with retained instructions.
   DMA updates existing IWRAM continuation lanes at instruction boundaries, not during CPU accesses.
 
 This subset lets public ARM test 362 complete. That test does not assert the loaded data value.
@@ -220,13 +222,13 @@ Stack and block-load returns finish their data accesses before the target sample
 Failed instructions do not sample a target or replace committed history.
 
 Snapshots use strict mapped reads and add no nominal data or device cycles.
-They update bus history only; the interpreter does not cache these instructions for execution.
+They update bus history only; a separate CPU buffer retains the target instructions for execution.
 Host inspection does not change captured lanes. A failed target fetch remains a later instruction diagnostic.
 Cold direct startup, unsupported target states/regions, and region-crossing lookahead still have no inferred refill history.
 DMA between refill and arrival updates this continuation's actual IWRAM access lanes before the target+4 sample.
 
 The [refill evidence and scope](../research/iwram-bus-history.md#thumb-iwram-refill-extension) distinguish these samples from a full pipeline.
-ARM-target refill history, sub-instruction DMA ordering, self-modifying instruction execution, and exact refill timing remain incomplete.
+ARM-target refill history, sub-instruction DMA ordering, and exact refill timing remain incomplete.
 
 ### DMA effects on Thumb IWRAM continuations
 
@@ -273,7 +275,7 @@ In User/System modes, they perform ordinary test/compare flag updates without a
 Invalid saved modes still produce an atomic diagnostic. Failed conditions do not restore or validate status.
 Nominal timing remains one sequential code access, plus an internal cycle for register-specified shifts; there is no refill cost.
 This fixes the mode-switch expectation in public `jsmolka/gba-tests` ARM test 234 and agrees with mGBA's shared ALU flag handling.
-ARM instruction buffering is discarded on a state change without an ordinary refill.
+Instruction buffering is discarded on a state change without an ordinary refill.
 Instruction-state-changing compare forms and exact pipeline behavior remain hardware-unverified.
 
 Other S-bit block transfers access User registers while using the current mode's base register.

docs/references.md

@@ -147,13 +147,16 @@ DMA resume-timing research:
 See [non-sequential CPU resume](research/dma-resume-timing.md) for the nominal subset and unmodeled refill/prefetch details.
 The public test was reviewed, not executed. No hardware timing pass is claimed.
 
-ARM instruction-buffer research:
+ARM/Thumb instruction-buffer research:
 
-- [ARM7TDMI instruction pipeline](https://developer.arm.com/documentation/dvi0027/b/arm7tdmi/instruction-pipeline) and [technical reference manual](https://documentation-service.arm.com/static/5e8e1323fd977155116a3129), for fetch/decode/execute stages and the visible ARM PC offset.
-- The pinned NanoBoyAdvance ARM7TDMI `Run` and `ReloadPipeline32` helpers above, for retained words, pre-execution fetching, and target-pair refill order.
+- [ARM7TDMI instruction pipeline](https://developer.arm.com/documentation/dvi0027/b/arm7tdmi/instruction-pipeline) and [technical reference manual](https://documentation-service.arm.com/static/5e8e1323fd977155116a3129), for fetch/decode/execute stages and the visible ARM/Thumb PC offsets.
+- The pinned NanoBoyAdvance ARM7TDMI `Run`, `ReloadPipeline32`, and `ReloadPipeline16` helpers above, for retained instructions, pre-execution fetching, and target-pair refill order.
 - The ARM branch cycle sequence above, for target and target+instruction-width fetches.
 
-See [persistent ARM instruction buffering](research/arm-instruction-buffer.md). Instruction retention is implemented; per-access timing and Thumb buffering remain incomplete.
+- [ARM Thumb branch-with-link timing](https://support.arm.com/documentation/ddi0210/c/Instruction-Cycle-Timings/Thumb-branch-with-link), for sequential prefix execution and suffix target refill.
+
+See [persistent ARM instruction buffering](research/arm-instruction-buffer.md) and its [Thumb extension](research/thumb-instruction-buffer.md).
+Instruction retention is implemented; unified fetch-driven bus history and per-access timing remain incomplete.
 
 Use [GBATEK](https://problemkaputt.de/gbatek.htm) and ARM7TDMI documentation for further hardware work.
 Only use game ROMs that you may lawfully use. Do not commit game ROMs, BIOS files, or game assets.

docs/research/arm-instruction-buffer.md

@@ -24,7 +24,8 @@ No external source code or test ROM was imported. No physical-hardware or extern
 
 ## Implementation
 
-`cpu/pipeline.rs` owns a private two-slot ARM continuation with its expected execution PC.
+`cpu/pipeline.rs` owns a private two-slot continuation with its expected execution PC and instruction state.
+The later [Thumb extension](thumb-instruction-buffer.md) uses this same structure for halfwords.
 Each slot retains either a mapped word or its strict fetch error.
 `Cpu` owns and clones this state; full CPU equality includes it.
 
@@ -37,13 +38,13 @@ Successful non-refill ARM execution commits the next pair.
 A successful refill into ARM instead samples T and T+4 after data transfers and status restoration.
 This includes ARM/Thumb BX, ARM PC writes and loads, taken branches, exception returns, and SWI vectors.
 A refill to the sequential address still discards the previous sequential pair.
-Untaken branches retain the pair. Leaving ARM clears it; Thumb continues to use direct instruction reads.
+Untaken branches retain the pair. A transition to Thumb now replaces it with a Thumb target pair.
 
 Machine IRQ entry captures its vector pair immediately after exception entry.
 The standalone exception APIs have no Memory argument, so they invalidate the old pair and leave the vector cold.
 This distinction is explicit rather than retaining unrelated words at a coincident PC.
 
-`Memory::fetch_arm_word` reads aligned mapped words without CPU data context, timing traces, or bus-history changes.
+`Memory::fetch_instruction` reads aligned mapped instructions without CPU data context, timing traces, or bus-history changes.
 Normal memory mirrors apply. Unmapped, truncated, and misaligned fetches retain their existing errors.
 No BIOS-protected data value or general open-bus value can become a synthetic instruction through this path.
 
@@ -74,7 +75,7 @@ The current instruction address still selects nominal code cost rather than a se
 ARM PC+8 open bus and protected BIOS readback remain separate snapshots.
 The instruction-buffer sample and those snapshots see mapped memory before instruction effects, but no unified per-access bus model exists yet.
 The target samples do not establish complete ARM IWRAM or BIOS bus history.
-Thumb buffering, instruction-state-changing compare quirks, Game Pak prefetch, and DMA arbitration remain incomplete.
+Instruction-state-changing compare quirks, Game Pak prefetch, and DMA arbitration remain incomplete.
 DMA still runs between whole instructions, not during their data accesses or internal cycles.
 
 ## Original regression coverage

docs/research/dma-resume-timing.md

@@ -45,7 +45,7 @@ A completed DMA WAITCNT store changes the settings before CPU resume.
 ## Limits
 
 The timing model has no per-access fetch scheduling or DMA arbitration.
-The later [ARM instruction buffer](arm-instruction-buffer.md) retains instruction words but does not change these nominal costs.
+The later [ARM](arm-instruction-buffer.md) and [Thumb](thumb-instruction-buffer.md) instruction buffers retain instructions without changing these nominal costs.
 It charges the current instruction address, not a separately scheduled PC+4/PC+8 pipeline fetch.
 DMA still executes only between instructions, not between data accesses or during CPU internal cycles.
 

docs/research/iwram-bus-history.md

@@ -56,7 +56,7 @@ An accepted machine IRQ invalidates history. Failed DMA units preserve it.
 The DMA extension below updates existing continuation lanes from successful IWRAM accesses.
 
 This is not a full IWRAM bus model across all CPU states. ARM-target history and DMA-to-CPU ordering remain incomplete.
-It is not a persistent instruction pipeline. Self-modifying instruction execution and exact per-access device timing remain unverified.
+It is not a persistent instruction pipeline. Exact per-access device timing remains unverified.
 
 ## Thumb IWRAM refill extension
 
@@ -77,7 +77,7 @@ Unmapped instruction targets still fail on the following fetch.
 Cold direct startup and arbitrary PC changes do not manufacture a refill.
 
 These are bus-history samples, not instruction-buffer contents or extra emulated cycles.
-The interpreter still reads Thumb instructions when it executes them; ARM now has separate instruction buffering.
+ARM and Thumb execution now use a separate instruction buffer. Cold buffer filling does not seed this bus history.
 Changing T+2 after the branch does not replace its captured bus value; changing T+4 before arrival affects the later sample.
 Those original tests verify sample ordering, not hardware-accurate self-modifying instruction execution.
 
@@ -111,8 +111,8 @@ Only complete successful units commit history, preserving the project's atomic d
 Cold direct entry still has no expected continuation PC. DMA does not manufacture one, even after a word access.
 An existing partially known continuation can gain lanes. IRQ entry and CPU discontinuities retain their invalidation rules.
 General DMA open-bus reads, cross-state history, sub-instruction arbitration, and DMA during CPU internal cycles remain outside this subset.
-This extension does not fix self-modifying Thumb instruction-buffer behavior.
-The later [ARM instruction buffer](arm-instruction-buffer.md) separately retains ARM words across DMA.
+This extension models bus lanes, not self-modifying instruction execution.
+The later [ARM](arm-instruction-buffer.md) and [Thumb](thumb-instruction-buffer.md) instruction buffers separately retain instructions across DMA.
 
 No physical-hardware measurements or external emulator differential runs were performed.
 All regression programs are original, with a separate byte-array lane reference in the DMA matrix tests.

docs/research/thumb-instruction-buffer.md

@@ -0,0 +1,85 @@
+# Persistent Thumb instruction buffering
+
+## Evidence and scope
+
+The [ARM7TDMI pipeline description](https://developer.arm.com/documentation/dvi0027/b/arm7tdmi/instruction-pipeline) identifies fetch, decode, and execute stages.
+The [technical reference manual](https://documentation-service.arm.com/static/5e8e1323fd977155116a3129) describes Thumb's two-byte instruction width and visible PC offset of four bytes.
+The [Thumb BL cycle sequence](https://support.arm.com/documentation/ddi0210/c/Instruction-Cycle-Timings/Thumb-branch-with-link) distinguishes the sequential prefix from the branching suffix.
+
+[NanoBoyAdvance at 55b5cf0a](https://github.com/nba-emu/NanoBoyAdvance/blob/55b5cf0ae3d929582ac5bfd486558173502b8354/src/nba/src/arm/arm7tdmi.hh) provides an implementation cross-check:
+
+- `Run` takes the retained current instruction and shifts the next instruction forward.
+- In Thumb state, it reads the next halfword before executing the current instruction.
+- `ReloadPipeline16` reads target T, then T+2. The target instruction later fetches T+4.
+- `ReloadPipeline32` uses ARM's four-byte width instead.
+
+Thus, execution at P retains the halfwords at P+2 and P+4 before instruction effects.
+A store cannot replace these retained instructions. It can affect P+6, which is fetched later.
+A taken PC write discards the sequential pair, even when its destination equals fallthrough.
+The BL prefix retains its suffix; only the suffix refills the target pair.
+
+This extends the [ARM instruction buffer](arm-instruction-buffer.md), not the bus scheduler.
+No external source code or test ROM was imported. No physical-hardware or external-emulator differential run was performed.
+
+## Implementation
+
+`cpu/pipeline.rs` shares one two-slot buffer between ARM and Thumb.
+Each buffer records its expected execution PC and instruction state.
+Both must match before retained instructions can be reused.
+Thumb halfwords are zero-extended in the slots; upper bits do not hold another instruction.
+
+Cold execution reads the current instruction and samples the next two instructions.
+Sequential execution uses retained results and samples only P+4 in Thumb state.
+The prospective continuation commits only after successful execution.
+Refills sample the target pair after data transfers and status restoration, using the resulting instruction state.
+ARM-to-Thumb BX and saved-state exception returns therefore capture T and T+2, not T and T+4.
+Thumb-to-ARM transitions and SWI/IRQ vectors capture ARM pairs.
+
+`Memory::fetch_instruction` uses strict mapped reads with the selected instruction width.
+A Thumb fetch reads exactly two bytes, even in a region whose separate bus snapshot uses a full word.
+Memory mirrors apply. Unmapped and misaligned instruction reads retain diagnostics rather than using data open bus.
+Lookahead errors remain deferred until their slot executes; a branch can discard them.
+
+Failed execution preserves the previous buffer exactly. Newly sampled lookahead does not commit.
+CPU stores, DMA transfers, and host writes never replace retained instructions automatically.
+`Cpu::invalidate_pipeline()` explicitly discards retained instructions for debugger repair or attachment to different memory.
+It does not clear separate BIOS or IWRAM bus history.
+CPU clones own independent buffers; full CPU equality includes them.
+
+## Separation from bus history and timing
+
+Instruction retention and data-bus snapshots remain separate models.
+Cold instruction-buffer filling does not make unknown IWRAM bus lanes known.
+Successful DMA can update existing IWRAM bus lanes without changing retained CPU instructions.
+Refill bus-history sampling and instruction sampling currently perform separate strict mapped reads.
+
+Buffer samples add no nominal cycles or data accesses.
+Timed and untimed execution use the same buffer logic.
+Destination-based refill summaries and one-shot non-sequential CPU resume costs remain unchanged.
+Unified fetch-driven bus history, exact region crossings, per-access timing, Game Pak prefetch, and sub-instruction DMA arbitration remain incomplete.
+Instruction-state-changing compare quirks also remain hardware-unverified.
+
+## Original regression coverage
+
+Original programs cover:
+
+- CPU byte/halfword stores to P+2, P+4, and the later P+6 instruction.
+- Host writes, RAM/video mirrors, and halfword/word DMA writes.
+- Taken and untaken branches, PC writes to fallthrough, and standalone BL suffixes.
+- BL prefix retention and suffix refill, with unchanged nominal costs.
+- ARM-to-Thumb target pairs at both halfword alignments and SWI/IRQ saved-state returns.
+- Failed data loads, discarded speculative advances, deferred short-ROM errors, and strict target diagnostics.
+- Debugger invalidation, independent clones, PC/state mismatches, and alignment errors.
+- Equal timed/untimed buffers without additional nominal cycles.
+
+The retention regressions failed with the previous direct-fetch Thumb interpreter before implementation.
+Existing bus-history tests now invalidate deliberately repaired code or repair a data address without changing the retained instruction.
+Successful instruction-semantic tests compare architectural state separately; failed-step tests still compare complete CPU state.
+
+## Validation result
+
+Workspace and core/demo tests pass in debug and release on Darwin arm64.
+Formatting, lint checks, rustdoc, preparation tests, native ROM windows, and graphics smoke modes pass.
+Public ARM, Thumb, memory, and BIOS reports match the previous ARM-buffer reports exactly, including nominal cycle counts.
+Debug and release reports also match for the same fixture paths.
+These checks do not establish full hardware pipeline or timing conformance.

docs/status.md

@@ -27,7 +27,7 @@ Update this file when a feature lands or a limit is removed.
 - `KEYCNT` selection and OR/AND matching, keypad IRQ latching, and HALT wake-up through IE bit 12.
 - Original ARM graphics demo that uses DMA, BIOS VBlank waiting, and a ROM-side IRQ callback.
 - Sixteen active 32-bit CPU registers, with ARM7 mode-specific register banks.
-- Persistent ARM instruction buffering, sequential fetch retention, branch/vector target pairs, and deferred fetch diagnostics.
+- Persistent ARM/Thumb instruction buffering, sequential fetch retention, branch/vector target pairs, and deferred fetch diagnostics.
 - User, System, Supervisor, IRQ, FIQ, Abort, and Undefined modes.
 - Current and saved program status registers (`CPSR`/`SPSR`), with `MRS`/`MSR` transfers.
 - ARM/Thumb software interrupts (`SWI`), exception vectors, and status-restoring returns.
@@ -141,8 +141,8 @@ Cold or invalidated IWRAM history remains diagnostic until all lanes are known.
 Refills into Thumb IWRAM establish new target-pair history after the instruction succeeds.
 Accepted machine IRQs, unsupported refills, and other execution states/regions invalidate continuation history.
 Successful DMA updates existing Thumb IWRAM continuation lanes for actual IWRAM accesses, before the resumed PC+4 sample.
-ARM instruction buffering now retains sequential words and refill target pairs, independently of these bus snapshots.
-Thumb buffering, complete ARM bus history, exact region-crossing bus behavior, general DMA handoff, and unused/write-only I/O open bus remain incomplete.
+ARM/Thumb instruction buffering retains sequential instructions and refill target pairs, independently of these bus snapshots.
+Complete ARM bus history, exact region-crossing bus behavior, general DMA handoff, and unused/write-only I/O open bus remain incomplete.
 [DMA channel data latches](hardware/dma.md#retained-channel-data) support blocked-source reuse, but never replace CPU bus history.
 BIOS protection uses separate retained BIOS fetch snapshots as described in [BIOS behavior](hardware/bios.md#cpu-bios-read-protection).
 Host inspection and instruction fetches remain strict. Other unmapped reads return errors.
@@ -153,7 +153,7 @@ Writes to cartridge addresses return errors instead of modeling cartridge hardwa
 
 ## Next steps
 
-1. Extend persistent ARM instruction buffering to Thumb, then connect fetches to bus history with independent per-access tests.
+1. Connect ARM/Thumb instruction fetches to bus history with independent per-access tests.
    General DMA open-bus reads and sub-instruction arbitration remain separate from retained channel data and local IWRAM lanes.
    Keep unknown history diagnostic until fetch ordering and latch ownership have independent coverage.
    Validate BIOS snapshots with independent hardware tests before claiming exact refill or data-access history.

docs/testing.md

@@ -85,7 +85,10 @@ They cover refill target pairs, PC writes to fallthrough, conditional branches,
 Full CPU equality checks buffer rollback and cloning. Successful instruction-semantic tests compare architectural state separately.
 Explicit invalidation tests cover debugger repair. Timed/untimed tests verify equal buffers without added nominal cycles.
 The display-runner error test allows an already buffered branch to complete before the patched unsupported word executes.
-See [ARM instruction buffering](research/arm-instruction-buffer.md) for scope and remaining timing limits.
+Thumb instruction-buffer tests verify retained P+2/P+4 halfwords, BL prefix/suffix behavior, and state-tagged target pairs.
+They also cover stores, host/DMA writes, saved-state returns, deferred errors, mirrors, debugger repair, and nominal timing.
+Bus-history repair tests explicitly invalidate buffered code or repair a data address; failure checks retain full CPU equality.
+See [ARM instruction buffering](research/arm-instruction-buffer.md) and its [Thumb extension](research/thumb-instruction-buffer.md) for remaining limits.
 The pinned public ARM ROM now reaches its completion checkpoint with r12 = 0 in debug and release builds.
 The pinned public Thumb ROM also reaches its ARM-state checkpoint with r7 = 0 in both builds.
 Empty-list Thumb regressions cover PC+6, all low bases and processor modes, banked stacks, both code alignments, and unaligned data.