fix: the four tiers stop describing features they do not have, and three gates start failing

The reading pass over this repo found the tiers disagreeing with themselves,
and every fix here was measured.

**The turn-around guard is real code.** `tsb_asm` and `tsb_tricks` wrote
`for (std::uint8_t guard = 46; guard; --guard) ;` between taking the one-wire
line and the first UDR0 store, under a comment naming it a turn-around guard.
It has no side effect, so GCC deleted it - `sts UCSR0B` went straight to
`sts UDR0` - while the hand-written oracle spends six bytes on that wait and
libavr's own half-duplex spends them through `delay::cycles`. Two of four
tiers described a feature they did not have, which made the size gradient a
comparison between different loaders. `avr::delay::cycles<one bit time>()`
bottoms out in asm and cannot be deleted.

**The entry belongs to the library, and hand-rolling it was expensive.** Three
tiers wrote their own naked `.vectors` stub with `asm volatile("clr
__zero_reg__")` - which design.md fences to libavr and never a port, and which
`tsb_tricks` denied having in its own title line. `avr::startup::entry` also
keeps the body `noinline` for a stated reason: avr-ld must not shrink a
`.vectors` section, so a loader inlined into one forfeits call relaxation
everywhere. `tsb_pure` came out **836 -> 734** bytes for that alone.
`stack::hardware` - the reset value this part guarantees, with the write kept
where a part does not - saved another four, which is what let `tsb_asm` afford
the guard it had been four bytes short of. It fills its 512-byte section
exactly now, with the whole feature set.

**`tsb_pure` had no receive timeout.** Its `rx()` was `read_blocking()`, so a
silent host wedged the password gate and the command loop forever - the one
fix the oracle's own header lists by name, and one the other three tiers
implement. It is bounded now, and 0-on-silence falls through every compare as
theirs does.

Three gates could pass without proving anything. `sizes.py check-readme`
reported a match when every row's lookup missed; `check_size.cmake` used
`CMAKE_MATCH_1` without checking the match succeeded, which is the guard its
sibling `check_unit.cmake` has and it is the size gate; `check_pi.py` raised
IndexError instead of reporting a position-independence break that changed the
image's length. And `check.sh` spelled the 37-chip list a second time beside
make_presets.py, where a chip added to one and missed in the other is a
silently unbuilt chip - it reads the presets now, and produces the same 37 and
12.

tsbtest.py gains the scenario nothing covered: a wrong password byte must
neither activate the loader nor reach the emergency erase behind it. Red-green
on a tier with the refusal removed.

Smaller, all measured or checked: the signature is `hw::db.signature` in every
tier as the page size and EEPROM end beside it already were; `act_min` derives
from the clock; pureboot.py's `rjmp` helpers refuse a part past rjmp's
4096-word reach rather than silently folding an offset (unreachable today, the
ATtiny85 sits exactly on it); the host tool calls space 2 `data` as the wire
and the loader do; `.clangd` strips the fifth GCC-only flag the build passes;
pbrig's bitclock guard reads its own ladder; pbreloc's unexplained retry is
gone, the write being reliable on five runs without it; and the four tier
sizes live in oracle/README.md's table instead of four file headers and a
CMake comment.

`--poke` before `--peek` turned out to be right - pbtest.py round-trips a poke
through the peek behind it - so the parser order and README say so now.

Every chip green, the README size table matching every image.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tsb/tsb_asm.cpp

@@ -3,8 +3,9 @@
 //
 // The complete TinySafeBoot feature set - watchdog-reset bail, one-wire
 // half-duplex UART, a config-page activation timeout, the password gate,
-// emergency erase, and config/flash/EEPROM read-write - at 510 bytes in the
-// 512-byte BOOTSZ=11 section the hand-written oracle occupies (500 B). The
+// emergency erase, and config/flash/EEPROM read-write - inside the 512-byte
+// BOOTSZ=11 section the hand-written oracle occupies (oracle/README.md holds
+// what each tier measures, in one table rather than four). The
 // body is the tricks tier's C++ (same register protocol, same structure - see
 // tsb_tricks.cpp, including the global-register miscompile rules) with exactly
 // two routines kept in assembly, the two whose remaining cost *is* the calling
@@ -63,8 +64,9 @@ constexpr std::uint16_t boot_bytes = 512;
 constexpr std::uint16_t app_end = spm::flash_bytes - boot_bytes - page;
 constexpr std::uint16_t eeprom_end = avr::hw::db.mem.eeprom_size - 1;
 
-// Lockout-proof floor for the activation window (the oracle's F_CPU/1MHz).
-constexpr std::uint8_t act_min = 16;
+// Lockout-proof floor for the activation window: the oracle's F_CPU/1MHz, so
+// it follows the clock rather than restating it (rule 41).
+constexpr auto act_min = static_cast<std::uint8_t>((16_MHz).hz / 1'000'000);
 // Post-activation window: the host gets seconds, not milliseconds, mid-session.
 constexpr std::uint8_t comm_window = 200;
 
@@ -73,13 +75,18 @@ constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 20;
 // Fixed 115200 8N1; the library solves UBRR + U2X from clock and baud.
 constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::parity::none);
 
+// One bit time on the wire: the turn-around a shared-line peer needs to stop
+// driving before this one starts. Derived from the solved rate, so it follows
+// the link rather than a count measured against one.
+constexpr auto guard_cycles = static_cast<std::uint32_t>((16_MHz).hz / baud.actual);
+
 // The 16-byte device-info block, streamed out on activation.
 // clang-format off
 [[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
     'T', 'S', 'B',
     build_date & 0xFF, build_date >> 8,
     0xF3,             // status: native-UART fixed-baud lineage
-    0x1E, 0x95, 0x0F, // ATmega328P signature
+    avr::hw::db.signature[0], avr::hw::db.signature[1], avr::hw::db.signature[2],
     page / 2,         // page size in words
     (app_end / 2) & 0xFF, (app_end / 2) >> 8,
     eeprom_end & 0xFF, eeprom_end >> 8,
@@ -141,8 +148,7 @@ const std::uint8_t *flash_ptr(std::uint16_t addr)
 	if (g_receiving) {
 		g_receiving = 0;
 		hw::ucsr0b::write(hw::ucsr0b::txen0(1));
-		for (std::uint8_t guard = 46; guard; --guard) {
-		}
+		avr::delay::cycles<guard_cycles>();
 	}
 	hw::udr0::write(byte);
 	std::uint8_t status;
@@ -390,14 +396,6 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 } // namespace
 } // namespace tsb
 
-// Reset lands here: BOOTRST vectors to the boot section base and .vectors is
-// laid first, so this is the first instruction executed. No crt ran, so set
-// the stack pointer before anything is called.
-extern "C" [[gnu::naked, gnu::used, gnu::section(".vectors")]] void __boot_entry()
-{
-	SP = RAMEND;
-	// The one line of crt this loader needs: compiled code assumes
-	// __zero_reg__ (r1) is 0, and power-on registers are undefined.
-	asm volatile("clr __zero_reg__");
-	tsb::run();
-}
+// Reset lands at the boot section base (BOOTRST): the entry stub in .vectors
+// is laid first and does the one line of crt a crt-less image needs.
+template struct avr::startup::entry<tsb::run, avr::startup::stack::hardware>;