pureboot: the unified autobaud loader, and the hang that settled the decision

Hardware testing found that a lone calibration pulse wedged the autobaud loader:
run() budgeted only the start-edge wait in measure(), and the rx() that read the
knock behind it was unbudgeted, so one stray low pulse held an unattended device
in the loader and the application never ran. Bound the whole activation — an
expired knock budget returns a byte that cannot be the knock, so control falls
back into the budgeted measure() and an idle line boots the app there.

That fix costs ~22 B, which neither version under review could absorb: the pure
one goes 508 -> 530 on the 1284P and the register one 512 -> 534, both over a
512 B slot. Their margin was never spare capacity, it was the space the missing
fix should have occupied. So the choice between them is moot; both are kept for
the record and no longer built.

pureboot_autobaud_uni.cpp replaces them at 464 B. It is pureboot 5: one read
command and one write command over named spaces (G/g, sel8, addr16, n8) instead
of four per-memory bodies, which collapses four transfer loops into one. The
selector's high nibble carries flash's bank, so the shared cursor stays 16 bits
and no command speaks word addresses. Three things fall out of the freed space:
RAM read/write — the missing feature, and with it arbitrary I/O access, since
AVR maps peripherals into the data space; host-issued SPM, so W's hardcoded
erase/write/RWW tail becomes three writes to a space and any SPM operation is
reachable; and W on the same selector-and-address decode as everything else.

Strictly pure throughout: no inline asm, no global register variable, and no
GPIOR either — the unit lives in a .noinit static, so the loader claims no chip
resource and the chips without GPIOR stop being a special case.

pureboot.py speaks both generations, keyed on the version, so the fixed-baud
path is untouched; --peek/--poke reach the new data space. pbautobaud.py adds a
RAM round-trip and a regression for the hang: a lone pulse must still let the
app boot. All 37 chips plus the 12-preset reflect spot set build and size-test
green, 444-466 B, worst case 46 B under budget. Sim suites 100%: 1284P 17/17,
328P 23/23. Only real-hardware acceptance remains (pureboot/autobaud.md).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CMakeLists.txt

@@ -245,18 +245,23 @@ if(PROJECT_IS_TOP_LEVEL)
 		                 -DLIMIT=${PUREBOOT_LIMIT} -P ${CMAKE_CURRENT_SOURCE_DIR}/test/check_size.cmake)
 	endfunction()
 
-	# The autobaud variants under review (pureboot/autobaud.md): one clock-agnostic
-	# image per chip, no clock × baud axis. Both are size-tested against the same
-	# per-chip budget on every chip — the decider is whether pure C++ fits 512,
-	# and the 1284 is the tight one (pure 508, register 512).
+	# The autobaud loader (pureboot/autobaud.md): one clock-agnostic image per
+	# chip, no clock × baud axis, size-tested against the same per-chip budget on
+	# every chip.
+	#
+	# Only the unified version is built. Its two predecessors —
+	# pureboot_autobaud_pure.cpp at 508 B and pureboot_autobaud_reg.cpp at 512 —
+	# had 4 B and 0 B of margin on the 1284P, and the fix for the activation hang
+	# costs ~22, which puts them at 530 and 534. Neither can ship, so the choice
+	# the branch existed to offer is settled by measurement rather than taste.
+	# The sources stay for the record; autobaud.md carries the numbers.
 	function(pureboot_autobaud_variant name source)
 		pureboot_add_autobaud(${name} ${source})
 		add_test(NAME ${name}.size
 		         COMMAND ${CMAKE_COMMAND} -DSIZE_TOOL=${CMAKE_SIZE} -DELF=$<TARGET_FILE:${name}>
 		                 -DLIMIT=${PUREBOOT_LIMIT} -P ${CMAKE_CURRENT_SOURCE_DIR}/test/check_size.cmake)
 	endfunction()
-	pureboot_autobaud_variant(pureboot_autobaud_pure pureboot_autobaud_pure.cpp)
-	pureboot_autobaud_variant(pureboot_autobaud_reg pureboot_autobaud_reg.cpp)
+	pureboot_autobaud_variant(pureboot_autobaud_uni pureboot_autobaud_uni.cpp)
 
 	# One point of the exhaustive matrix, named from its resolved parameters
 	# so the enumeration cannot collide with itself. Unreachable rates drop
@@ -404,7 +409,7 @@ if(PROJECT_IS_TOP_LEVEL)
 		add_custom_command(TARGET pbapp_autobaud POST_BUILD
 		                   COMMAND ${CMAKE_OBJCOPY} -O binary
 		                           $<TARGET_FILE:pbapp_autobaud> $<TARGET_FILE:pbapp_autobaud>.bin)
-		foreach(_variant pure reg)
+		foreach(_variant uni)
 			add_test(NAME pureboot.autobaud_${_variant}
 			         COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/test/pbautobaud.py
 			                 ${PB_DEVICE} $<TARGET_FILE:pureboot_autobaud_${_variant}> ${PUREBOOT_SIM_MCU}