audit: the port's pass — the scan that could not walk, and the drift a generator ends

--scan's walk was unwalkable on POSIX: probe rates have no termios
B-constant, so the first off-nominal probe raised out of the loop. The port
speaks termios2 BOTHER now (red-proven on a pty at 9984 Bd), the probe's
open lives inside the walk's error handling, an fd no longer leaks on an
unmakeable rate, and the swallowed unknown-signature reply is named at
timeout instead of reported as silence. CMakePresets.json's generator emits
the submodule toolchain path it had drifted from — a hand edit on a
generated file, exactly the class rule 10 exists for — and presets.generated
gates the pair from here on (the  marker CMake rejects at the
presets root stayed out; the check is the guard). The over-slot image guard
the tsb runner gained reaches the pureboot runner too; the GPIO bridge's
delivery comment states the hardware truth (RXC at the stop bit's sampling
point); the hardware suite gains the scan check — the one place the rate
physics is real; and the libavr pin advances over both audit rounds.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pureboot/README.md

@@ -48,12 +48,14 @@ it carries the calibration machinery and no clock at all.
 is 510 bytes, since the slot's last word is the trampoline.
 
 The tightest fit in the whole space is the 1284s' autobaud build deployed on a
-USART's own pins, 506 of its 512 — they alone carry the far-flash machinery
-(ELPM reads, RAMPZ page commands), autobaud alone carries the calibration loop,
-and a bit-banged link on a USART's pins alone has to release it (below). The
-same build on the default pins is 502. The flash bank riding in a transfer's
-selector byte keeps even those chips' addressing the same 16-bit form every
-other chip uses, which is why they are no longer the outlier they were.
+USART's own pins with the `OSCCAL` trim baked, 510 of its 512 — they alone
+carry the far-flash machinery (ELPM reads, RAMPZ page commands), autobaud
+alone carries the calibration loop, a bit-banged link on a USART's pins alone
+has to release it (below), and the trim adds its one register write. Without
+the trim that build is 504; on the default pins, 502. The flash bank riding
+in a transfer's selector byte keeps even those chips' addressing the same
+16-bit form every other chip uses, which is why they are no longer the
+outlier they were.
 
 The software UART enables the RX pull-up; TX idles high. All multi-byte wire
 quantities are little-endian.
@@ -123,12 +125,13 @@ window per reset. Measure with an application in place.
 A downstream project brings its usual libavr setup (the `libavr` target, the
 chip via the `LIBAVR_MCU` toolchain preset), consumes this directory, and
 states its deployment — an ATmega328P on its shipped 1 MHz fuses with the
-software UART on hand-picked pins, say:
+software UART on hand-picked pins, say. A submodule pins the loader version
+(the tags name them; this repo pins its own libavr the same way), where
+FetchContent tracks whatever `main` is:
 
 ```cmake
-FetchContent_Declare(bootloader GIT_REPOSITORY git@git.blackmark.me:avr/bootloader.git GIT_TAG main)
-FetchContent_MakeAvailable(bootloader)
-add_subdirectory(${bootloader_SOURCE_DIR}/pureboot pureboot)
+# git submodule add <forge>/avr/bootloader.git bootloader   — or FetchContent
+add_subdirectory(bootloader/pureboot pureboot)
 
 pureboot_add_loader(myboot CLOCK 1000000 SERIAL software TX pb1 RX pb5)
 ```
@@ -512,7 +515,12 @@ Per chip preset, `ctest` runs:
   too. The timeout is a constant and is no axis;
 - `pureboot_autobaud.size` — the clock-free build, which has no clock or baud
   axis of its own: one binary per chip has to serve every point the matrix
-  below sweeps;
+  below sweeps. `pureboot*osccal*.size` add the `OSCCAL` trim on the stock
+  shape and on the tightest image in the space (autobaud on a USART's own
+  pins), holding both of the trim write's addressing encodings to the budget;
+- `pureboot_autobaud.unit` — the measured bit period is the loader's only RAM
+  object and sits exactly at ram_start, where `--info` reads it: wire
+  contract, not layout accident;
 - `pbm_*.size` — with `PUREBOOT_FULL_MATRIX=1`, the exhaustive cross product
   replacing that compact matrix, on **every** chip: every plausible oscillator
   (the internal ones, the CKDIV8 floor, the plain and the UART crystals) ×
@@ -535,6 +543,13 @@ Per chip preset, `ctest` runs:
   recovery properties, the surgery, the staging composition, the boot-fuse
   decode, the update preflight over synthetic fuse bytes, and the repairing
   verify against a fake device;
+- `pureboot.scan` — `--scan`'s walk and report logic: the probe order, the
+  rate arithmetic, and the trim advice's direction. A pty carries bytes at
+  any termios rate, so the rate physics itself belongs to the hardware
+  harness, and what the wire would arbitrate is pinned as logic;
+- `presets.generated` — CMakePresets.json matches its generator
+  (`tools/make_presets.py --check`), so a hand edit or a generator change
+  cannot drift the pair apart;
 - `pureboot.protocol` — end to end against a simavr device
   (`test/pureboot_device.c`: a hardware USART as a pty, or a cycle-timed
   GPIO⇄pty bridge for a software-UART build, plus the SPM/NVM module simavr's
@@ -567,15 +582,21 @@ Per chip preset, `ctest` runs:
 - `pureboot.update` — the full `--update-loader` flow, then every power-fail
   phase: the device is killed mid-write, restarted from its flash dump, and a
   re-run must complete the update with the application intact;
+- `pureboot.osccal` (328P, t85) — a loader built with the `OSCCAL` axis holds
+  the trim register at the built byte from its first prompt, observed through
+  the wire on one chip per addressing encoding (`sts` and low-I/O `out`);
 - `pureboot.autobaud` (328P, 1284P) — the clock-free build over the GPIO⇄pty
   bridge: the calibration handshake, a flash + EEPROM + fuse round trip against
   the simulator's own memory, a data-space round trip, the hand-over — then the
   same binary again at double the clock, which is the property the backend
-  exists for. A lone calibration pulse with no knock behind it must still let
+  exists for. The measured clock `--info` prints is asserted against the
+  simulator's exact clock, inside the unit encoding's own envelope, at both
+  points. A lone calibration pulse with no knock behind it must still let
   the application boot, so no wait in activation can be unbounded.
 
-`size`, `pi`, `planner` and `handshake` are host logic and run anywhere; the
-simulator-driven targets need simavr and a pty, so they are POSIX-only.
+`size`, `unit`, `pi`, `planner`, `scan` and `handshake` are host logic and run
+anywhere; the simulator-driven targets need simavr and a pty, so they are
+POSIX-only.
 
 ## Hardware