fix: address Phase 3 code review issues

- Remove dead except block around flit_count() in _handle_exec
flit_count() handles all 16-bit inputs without raising exceptions,
so the try/except (ValueError, KeyError) block was unreachable code

- Update stale _handle_t0_write docstring to reflect current architecture
T0 is now list[int] with pack_token()/unpack_token() serialization
(future work from original docstring was already implemented in Phase 3)

- Change t0_store padding from None to 0 to match list[int] annotation
Simplifies _handle_t0_read by removing None check
Makes padding consistent with type annotation

- Update test comment in test_malformed_flit_invalid_prefix
Accurately describes what happens: flit_count(0xFFFF) returns 2,
but only 1 flit available, so truncation check catches it

- Rename test_exec_stops_at_none_sentinel to test_exec_processes_multiple_packets_until_end
Old test relied on None sentinel that no longer exists
New test verifies EXEC processes multiple consecutive valid packets

emu/sm.py

···
         yield self.env.timeout(1)  # process cycle
         if t0_idx < len(self.t0_store):
             data = self.t0_store[t0_idx]
-            yield from self._send_result(token.ret, data if data is not None else 0)
+            yield from self._send_result(token.ret, data)
         else:
             yield from self._send_result(token.ret, 0)
 
     def _handle_t0_write(self, addr: int, token: SMToken):
         """T0 WRITE: store raw integer data without presence checking.
 
-        Note: This stores token.data (an int) into t0_store. For Token object
-        storage (needed by EXEC), populate t0_store directly before simulation
-        starts (e.g., via build_topology or test setup). This asymmetry is
-        intentional — SM WRITE provides data-level access (lookup tables,
-        shared counters), while EXEC consumes pre-loaded Token objects for
-        bootstrap. Future work will unify T0 as list[int] with token
-        serialisation/deserialisation.
+        Stores token.data (an int) into t0_store at the T0-relative index.
+        For EXEC bootstrap, pre-load t0_store with packed flit sequences
+        (via pack_token()) before simulation starts. T0 is now list[int] with
+        token serialisation/deserialisation via pack_token()/unpack_token().
         """
         t0_idx = addr - self.tier_boundary
         while len(self.t0_store) <= t0_idx:
-            self.t0_store.append(None)
+            self.t0_store.append(0)
         self.t0_store[t0_idx] = token.data
 
     def _handle_exec(self, addr: int):
···
         pos = t0_idx
         while pos < len(self.t0_store):
             header = self.t0_store[pos]
-            if header is None:
-                break
-            try:
-                count = flit_count(header)
-            except (ValueError, KeyError):
-                logger.warning("SM%d: malformed flit at T0[%d], stopping EXEC", self.sm_id, pos)
-                break
+            count = flit_count(header)
             if pos + count > len(self.t0_store):
                 logger.warning("SM%d: truncated packet at T0[%d], stopping EXEC", self.sm_id, pos)
                 break

tests/test_sm_t0_raw.py

···
         assert isinstance(received2, MonadToken)
         assert received2.data == 0x2222
 
-    def test_exec_stops_at_none_sentinel(self):
-        """EXEC stops reading T0 when it encounters None."""
+    def test_exec_processes_multiple_packets_until_end(self):
+        """EXEC processes multiple consecutive packets until end of T0 store."""
         env = simpy.Environment()
         sm = StructureMemory(env, 0, cell_count=512, tier_boundary=256)
 
···
 
         mock_system.send = mock_send
 
-        # Create one token
+        # Create three valid tokens
         token1 = DyadToken(target=0, offset=5, act_id=1, data=0x1111, port=Port.L)
+        token2 = MonadToken(target=1, offset=10, act_id=2, data=0x2222, inline=False)
+        token3 = DyadToken(target=2, offset=15, act_id=3, data=0x3333, port=Port.R)
+
         flits1 = pack_token(token1)
+        flits2 = pack_token(token2)
+        flits3 = pack_token(token3)
 
-        # Pre-load with token, then None sentinel, then junk
+        # Pre-load all three tokens
         sm.t0_store.extend(flits1)
-        sm.t0_store.append(None)
-        sm.t0_store.extend([0xFFFF, 0xFFFF])  # junk after None
+        sm.t0_store.extend(flits2)
+        sm.t0_store.extend(flits3)
 
         # EXEC from start
         exec_token = SMToken(
···
         env.process(do_exec())
         env.run()
 
-        # Should have received exactly 1 token (stopped at None)
-        assert len(mock_pe_store.items) == 1
+        # Should have received all three tokens
+        assert len(mock_pe_store.items) == 3
         assert mock_pe_store.items[0].data == 0x1111
+        assert mock_pe_store.items[1].data == 0x2222
+        assert mock_pe_store.items[2].data == 0x3333
 
 
 class TestAC4_3RoundTripPackUnpack:
···
     """AC4.4: Malformed flit sequences are handled gracefully without crash."""
 
     def test_malformed_flit_invalid_prefix(self):
-        """EXEC stops gracefully on invalid flit prefix bits."""
+        """EXEC stops gracefully when flit count exceeds available data (truncation detection)."""
         env = simpy.Environment()
         sm = StructureMemory(env, 0, cell_count=512, tier_boundary=256)
 
···
 
         mock_system.send = mock_send
 
-        # Pre-load T0 with invalid header (impossible bit pattern)
-        # flit_count() should raise ValueError for bad prefix
+        # Pre-load T0 with 0xFFFF (SM token prefix).
+        # flit_count(0xFFFF) returns 2 (SM token header indicates 2 flits),
+        # but only 1 flit is in store, so truncation check catches it.
         sm.t0_store.extend([0xFFFF])
 
         # EXEC from start