pureboot: every libavr chip — 37 loaders, the m48 class, the 644 geometry

The chip table becomes family blocks covering all 37 targets. The m48s
are a new deployment class: no boot section, so the tiny profile spoken
over the hardware USART — host-patched reset vector, trampoline
hand-over, a 510-byte budget (474 B built), no fuse preflight — while
their RWWSRE store stays the buffer discard (Atmel-8271 §26.2); the
device keys the patch flag and the CPU-halt waits on the curated
boot-section capability and the discard on the RWWSRE bit itself. The
644s' 64 KiB is exactly the 16-bit byte space: plain LPM, byte wire
addresses, 498 B in a 512-byte slot — and their 1 KiB minimum boot
section holds the resident and staging slots together, so self-update
needs no fuse step (the update test's slot pick now keys word-flash on
base >= 64 KiB; base + slot merely touching the boundary stays
byte-addressed). The 1284 joins the 1284P's word-addressed 1 KiB slot at
558 B. BOOT_FUSE gains every boot-sectioned family's ladder and fuse
byte; the planner exercises them all. The sim scaffolding keys
patch-vector-ness instead of the atmega name prefix, the fixture app
picks its clock by family (the tiny25/45/13 builds surfaced the 16 MHz
fallthrough as garbled banners), and the runner's wrapped flash ioctl
performs the m48 discard simavr's no-RWW cores turn into a stray buffer
fill. Sizes across the fleet: 466-504 B megas, 474 B m48s, 498 B 644s,
488-502 B tinies, 558 B 1284s — every chip passing
size/pi/planner/protocol/reloc/update.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/pbupdate.py

@@ -5,12 +5,13 @@ replaces itself with a re-timed build through the host tool's
 killing the simulated device mid-write, restarting it from its flash dump,
 and letting a re-run complete the update.
 
-The mega runs the BOOTRST-unprogrammed profile (reset boots the application;
-the fixture application's 'L' jump is the application-owned loader entry),
-with --assume-fuses standing in for the fuse read simavr cannot model. The
-tinies reset into a loader at every phase by construction — the t13a because
-its staging slot carries the reset vector itself, the t85 through the word-0
-redirect the tool plants around the resident rewrite.
+The boot-sectioned megas run the BOOTRST-unprogrammed profile (reset boots
+the application; the fixture application's 'L' jump is the application-owned
+loader entry), with --assume-fuses standing in for the fuse read simavr
+cannot model. The patched-vector chips — the tinies and the m48s — reset
+into a loader at every phase by construction: the t13a because its staging
+slot carries the reset vector itself, the others through the word-0 redirect
+the tool plants around the resident rewrite.
 
 Usage: pbupdate.py <device_bin> <pureboot_elf> <update_elf> <mcu> <hz>
                    <base_hex> <page> <baud> <app_bin> <tool_py> <workdir>
@@ -89,8 +90,14 @@ def main():
     (device_bin, elf, update_elf, mcu, hz, base_hex, page, baud, app_bin, tool, workdir) = sys.argv[1:]
     base, page, baud = int(base_hex, 0), int(page), int(baud)
     mega = mcu.startswith("atmega")
-    slot = 1024 if base + 1024 > 0x10000 and mega else 512  # word-addressed chips use the 1 KiB slot
-    reset_hex = "0" if mega else None  # the mega runs BOOTRST-unprogrammed here
+    # The m48s are megas without a boot section: patched vector, no fuse
+    # preflight, and the same reset-to-0 the tinies get.
+    patch = not mega or mcu.startswith("atmega48")
+    # Word-addressed (>64 KiB) chips use the 1 KiB slot; their loader base
+    # itself sits beyond the 16-bit byte space — the 644's base + slot only
+    # touches the 64 KiB boundary and stays byte-addressed.
+    slot = 1024 if base >= 0x10000 and mega else 512
+    reset_hex = "0" if mega else None  # the boot-sectioned mega runs BOOTRST-unprogrammed here
     sys.path.insert(0, os.path.dirname(os.path.abspath(tool)))
     sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
     import pbsim
@@ -107,7 +114,7 @@ def main():
         fail("the update image is byte-identical to the resident build")
     dump = os.path.join(workdir, "dump.bin")
     state = os.path.join(workdir, "update.pbstate")
-    fuses = assumed_fuses(pb, images["v0"]) if mega else None
+    fuses = assumed_fuses(pb, images["v0"]) if mega and not patch else None
 
     def connect(device):
         port = pb.Port(device.pty, baud)
@@ -147,7 +154,7 @@ def main():
 
         # A clean CLI update, resident -> v9.
         args = ["--update-loader", os.path.join(workdir, "v9.bin"), "--state", state, "--stay"]
-        if mega:
+        if fuses:
             args += ["--assume-fuses", fuses.hex()]
         out = pbsim.run_tool(tool, device.pty, baud, *args)
         if "loader updated" not in out:
@@ -172,7 +179,7 @@ def main():
         # cost of that profile (README).
         for kill_region, kill_hits, kill_device in (
             ("stage", 2, True),
-            ("resident", 1, not mega),
+            ("resident", 1, patch),
             ("stage_restore", 2, True),
         ):
             device.reset()  # the previous round left the application running
@@ -203,11 +210,11 @@ def main():
         device.stop()
 
     # Ground truth: the simulator's own flash against the final state, and
-    # on the tinies an independent decode of the reset routing.
+    # on the patched-vector chips an independent decode of the reset routing.
     flash = open(dump, "rb").read()
     if flash[base : base + slot] != padded(images[final]):
         fail("ground-truth resident region does not match the final image")
-    if not mega:
+    if patch:
         flash_words = (base + slot) // 2
         word0 = flash[0] | (flash[1] << 8)
         if rjmp_decode(word0, 0, flash_words) != base // 2: