pureboot: the unified autobaud loader, and the hang that settled the decision

Hardware testing found that a lone calibration pulse wedged the autobaud loader:
run() budgeted only the start-edge wait in measure(), and the rx() that read the
knock behind it was unbudgeted, so one stray low pulse held an unattended device
in the loader and the application never ran. Bound the whole activation — an
expired knock budget returns a byte that cannot be the knock, so control falls
back into the budgeted measure() and an idle line boots the app there.

That fix costs ~22 B, which neither version under review could absorb: the pure
one goes 508 -> 530 on the 1284P and the register one 512 -> 534, both over a
512 B slot. Their margin was never spare capacity, it was the space the missing
fix should have occupied. So the choice between them is moot; both are kept for
the record and no longer built.

pureboot_autobaud_uni.cpp replaces them at 464 B. It is pureboot 5: one read
command and one write command over named spaces (G/g, sel8, addr16, n8) instead
of four per-memory bodies, which collapses four transfer loops into one. The
selector's high nibble carries flash's bank, so the shared cursor stays 16 bits
and no command speaks word addresses. Three things fall out of the freed space:
RAM read/write — the missing feature, and with it arbitrary I/O access, since
AVR maps peripherals into the data space; host-issued SPM, so W's hardcoded
erase/write/RWW tail becomes three writes to a space and any SPM operation is
reachable; and W on the same selector-and-address decode as everything else.

Strictly pure throughout: no inline asm, no global register variable, and no
GPIOR either — the unit lives in a .noinit static, so the loader claims no chip
resource and the chips without GPIOR stop being a special case.

pureboot.py speaks both generations, keyed on the version, so the fixed-baud
path is untouched; --peek/--poke reach the new data space. pbautobaud.py adds a
RAM round-trip and a regression for the hang: a lone pulse must still let the
app boot. All 37 chips plus the 12-preset reflect spot set build and size-test
green, 444-466 B, worst case 46 B under budget. Sim suites 100%: 1284P 17/17,
328P 23/23. Only real-hardware acceptance remains (pureboot/autobaud.md).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

test/pbautobaud.py

@@ -17,6 +17,7 @@ baked in.
 
 import os
 import sys
+import time
 
 
 def fail(message):
@@ -74,13 +75,53 @@ def main():
                 fail(f"{label}: EEPROM read-back mismatch")
 
             if hand_over:
+                # Regression: a calibration pulse with no knock behind it must
+                # not wedge the loader. The knock's edge wait used to be
+                # unbudgeted, so one stray low pulse — EMI, or a host that opens
+                # the port and never knocks — held the loader forever and the
+                # application never ran. The whole activation is bounded now, so
+                # the window closes and the app boots; the banner is the proof.
+                # (The pause lets the loader reach its measurement loop, so the
+                # pulse is genuinely seen and the test cannot pass vacuously.)
+                device.reset()
+                port = pb.Port(device.pty, baud)
+                try:
+                    time.sleep(0.2)
+                    port.write(bytes((pb.CALIBRATE,)))
+                    # Accumulate rather than match exactly: the reset leaves the
+                    # idle line a framing artefact ahead of the banner, which is
+                    # noise here — the question is only whether the app ran.
+                    seen = b""
+                    deadline = time.monotonic() + 180.0
+                    while b"APP" not in seen and time.monotonic() < deadline:
+                        seen += port.read_available(1.0)
+                    if b"APP" not in seen:
+                        fail(f"{label}: lone calibration pulse wedged the loader — app never bannered, saw {seen!r}")
+                    print(f"  {label}: lone calibration pulse does not wedge the loader")
+                finally:
+                    port.close()
+
                 device.reset()
                 port = pb.Port(device.pty, baud)
                 try:
                     loader = pb.Loader(port)
                     live = loader.connect_autobaud(15)
-                    if live.version != pb.NEWEST_LOADER:
+                    if not pb.OLDEST_LOADER <= live.version <= pb.NEWEST_LOADER:
                         fail(f"{label}: loader reports pureboot {live.version}")
+                    if loader.unified:
+                        # pureboot 5's data space. 0x0200 is clear of the
+                        # loader's own .noinit unit at the bottom of SRAM and of
+                        # the stack at the top. Reading it back over the same
+                        # locked link proves both directions of the new space.
+                        probe = bytes(range(0x30, 0x40))
+                        loader.write_ram(0x0200, probe)
+                        if loader.read_ram(0x0200, len(probe)) != probe:
+                            fail(f"{label}: RAM round-trip mismatch")
+                        # The register file and the I/O space share the data
+                        # address space on AVR, so the same command reaches a
+                        # peripheral register. SPMCSR reads back as idle here.
+                        verbose_ram = loader.read_ram(0x0200, 4)
+                        print(f"  {label}: RAM read/write ok ({verbose_ram.hex()})")
                     loader.run_application()
                     banner = port.read_exact(3, 5.0)
                     if banner != b"APP":