pureboot: the unified autobaud loader, and the hang that settled the decision

Hardware testing found that a lone calibration pulse wedged the autobaud loader:
run() budgeted only the start-edge wait in measure(), and the rx() that read the
knock behind it was unbudgeted, so one stray low pulse held an unattended device
in the loader and the application never ran. Bound the whole activation — an
expired knock budget returns a byte that cannot be the knock, so control falls
back into the budgeted measure() and an idle line boots the app there.

That fix costs ~22 B, which neither version under review could absorb: the pure
one goes 508 -> 530 on the 1284P and the register one 512 -> 534, both over a
512 B slot. Their margin was never spare capacity, it was the space the missing
fix should have occupied. So the choice between them is moot; both are kept for
the record and no longer built.

pureboot_autobaud_uni.cpp replaces them at 464 B. It is pureboot 5: one read
command and one write command over named spaces (G/g, sel8, addr16, n8) instead
of four per-memory bodies, which collapses four transfer loops into one. The
selector's high nibble carries flash's bank, so the shared cursor stays 16 bits
and no command speaks word addresses. Three things fall out of the freed space:
RAM read/write — the missing feature, and with it arbitrary I/O access, since
AVR maps peripherals into the data space; host-issued SPM, so W's hardcoded
erase/write/RWW tail becomes three writes to a space and any SPM operation is
reachable; and W on the same selector-and-address decode as everything else.

Strictly pure throughout: no inline asm, no global register variable, and no
GPIOR either — the unit lives in a .noinit static, so the loader claims no chip
resource and the chips without GPIOR stop being a special case.

pureboot.py speaks both generations, keyed on the version, so the fixed-baud
path is untouched; --peek/--poke reach the new data space. pbautobaud.py adds a
RAM round-trip and a regression for the hang: a lone pulse must still let the
app boot. All 37 chips plus the 12-preset reflect spot set build and size-test
green, 444-466 B, worst case 46 B under budget. Sim suites 100%: 1284P 17/17,
328P 23/23. Only real-hardware acceptance remains (pureboot/autobaud.md).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pureboot/pureboot_autobaud_pure.cpp

@@ -1,3 +1,9 @@
+// SUPERSEDED — kept for the record, not built. With the activation hang fixed
+// (a lone calibration pulse used to wedge the loader, see autobaud.md) this
+// version is 530 B on the 1284P against a 512 B slot. Its 4 B of margin was
+// never spare capacity; it was the space the missing fix should have occupied.
+// pureboot_autobaud_uni.cpp replaces it at 464 B with more features.
+//
 // pureboot autobaud — the software-serial variant that measures the host's bit
 // timing at runtime, so one binary runs at any F_CPU: the image carries no
 // clock. THE PURE VERSION — no inline assembly, no global register variables,
@@ -145,11 +151,12 @@ struct link {
 		return u;
 	}
 
-	static std::uint8_t rx()
+	// The eight data bits, entered just past the falling edge of the start bit.
+	// Split out of rx() so the activation path can wait for that edge under a
+	// budget while the command loop waits for it indefinitely.
+	static std::uint8_t sample()
 	{
 		const std::uint16_t unit = get_unit();
-		while (in_t::read()) // await the start edge
-			;
 		_delay_loop_2(static_cast<std::uint16_t>(unit + (unit >> 1))); // 1.5 bits to the LSB centre
 		std::uint8_t value = 0;
 		for (std::uint8_t bit = 0; bit < 8; ++bit) {
@@ -161,6 +168,27 @@ struct link {
 		return value;
 	}
 
+	static std::uint8_t rx()
+	{
+		while (in_t::read()) // await the start edge
+			;
+		return sample();
+	}
+
+	// A byte under the poll budget, for the activation knock. An expired budget
+	// returns 0, which is not the knock, so the caller falls back into the
+	// budgeted measure() — and a line that stays idle boots the application
+	// there. Without this the knock's edge wait was unbounded, so a single
+	// spurious calibration pulse (EMI, or a host that opens the port and never
+	// knocks) wedged the loader and the application never ran.
+	static std::uint8_t rx_bounded(__uint24 budget)
+	{
+		while (in_t::read())
+			if (!--budget)
+				return 0;
+		return sample();
+	}
+
 	static void tx(std::uint8_t value)
 	{
 		const std::uint16_t unit = get_unit();
@@ -311,7 +339,7 @@ void send_fuses()
 	for (;;) {
 		if (link::measure(autobaud_budget) == 0)
 			run_app();
-		if (link::rx() == 'p')
+		if (link::rx_bounded(autobaud_budget) == 'p')
 			break;
 	}