pureboot: the activation window gets a behavioral gate, and honest per-poll constants under it

The window's per-poll cycle counts were hand-counted for a uint32_t
countdown, but every default window fits uint24_t, whose decrement chain
is one sbci shorter — so deployed loaders ran 9/10ths of their stated
seconds (a 328P's 8 s was 7.2 s on the wire). No golden-asm pin can hold
this: the loops compile in consumer context. pbwindow.py measures the
behavior instead: it installs a real application beside the loader
through the host tool's own plan_flash (surgery included), starts the
simulator with the line idle, and reads the cycle of the first transmit
— the application's banner, so that cycle is the window. Held at plus or
minus 2 percent per chip (pureboot.window), red at -10.0 percent against
the old constants, green with poll_cycles now counted for the narrow
countdown (hardware 9, software 7; window_polls() solves narrow-first
and adds the wide loop's cycle where the count forces uint32_t — a count
narrow only at the wide cost stays wide, so the choice cannot
oscillate). The autobaud window is its poll budget at the measured ten
cycles a poll, gated the same way (pureboot.window.autobaud), and the
README carries that arithmetic now. No version bump: timing-window
precision is not meaningful behavior, v7 stays.

The gate flushed out two runner gaps. The software bridge accepted any
falling edge as a start bit, so the device's own TX-init glitch decoded
as a stray byte; it re-samples mid-bit now and abandons a false start,
as silicon does. And after avr_reset, the idle-line re-raise was
silently dropped: ioport pin irqs are IRQ_FLAG_FILTERED and the irq's
cached value survives the reset the port latch does not, so the device
read the line stuck low, calibrate() measured reset-to-first-edge as one
wrapping pulse, and the first knock after a reset could boot the
application instead of locking — the intermittent autobaud failure.
bridge_reset forces a real transition (0 then 1, no cycles between).

The README's Autobaud column now carries each chip's worst
configuration — autobaud with OSCCAL baked, on a USART's own pins where
the chip has one (tinies: autobaud + OSCCAL) — the numbers the existing
pureboot_autobaud_osccal[_on_usart0] matrix points already gate;
sizes.py checks the column against exactly those targets. Tool sizes
and window prose updated with it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/sizes.py

@@ -120,7 +120,9 @@ def cmd_max(args) -> int:
 
 
 def cmd_check_readme(args) -> int:
-    """The README's per-chip table, against the stock and autobaud builds."""
+    """The README's per-chip table, against the stock build and the worst
+    autobaud configuration (OSCCAL baked, plus the USART-pin release where
+    the chip has a USART) — the config the Autobaud column documents."""
     readme = (ROOT / "pureboot" / "README.md").read_text()
     measured = collect()
     rows = re.findall(r"^\|\s*(AT\w+[^|]*?)\s*\|[^|]*\|[^|]*\|[^|]*\|\s*(\d+) B\s*\|\s*(\d+) B\s*\|$",
@@ -132,7 +134,9 @@ def cmd_check_readme(args) -> int:
         # "ATmega48, 48A, 48P, 48PA †" — the first name is the family's base.
         chip = re.sub(r"[^a-z0-9]", "", chips.split(",")[0].strip().lower())
         built = {name: text for name, text, _ in measured.get(chip, [])}
-        for target, documented in (("pureboot", stock_doc), ("pureboot_autobaud", auto_doc)):
+        worst = ("pureboot_autobaud_osccal_on_usart0"
+                 if "pureboot_autobaud_osccal_on_usart0" in built else "pureboot_autobaud_osccal")
+        for target, documented in (("pureboot", stock_doc), (worst, auto_doc)):
             if target not in built:
                 skipped += 1
                 continue