tsb: one spelling of the clock and the baud, and the asm's bits by name

The tricks and asm tiers spelled 16_MHz three times each and now name it once;
the policy tier's lean bring-up solves the baud from the link config the
serial unit is declared with instead of restating 115200 8N1. The asm tier's
immediates - RXEN0, RXC0's bit, SPMEN, PGWRT|SPMEN and the three UART
addresses - are operands read from the chip database rather than numbers with
comments beside them, so avr/io.h is left for SPMCSR's I/O address alone; pure
and tricks drop an include nothing used. Headers that described the code as it
was are corrected (pure's "only attribute", the policy tier's history), the
rule references leave the comments, and locals are const auto.

All four images are byte-identical to before, in both modes for tsb_asm.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tsb/tsb_policy.cpp

@@ -2,23 +2,17 @@
 //
 // The full TinySafeBoot feature set - watchdog bail, one-wire half-duplex,
 // config-page activation timeout, password gate, emergency erase, and
-// config/flash/EEPROM read-write - under philosophy #5 exactly as pureboot
-// obeys it: no assembly, no register variables; code, attributes, and flags
-// only. Every lesson pureboot's development produced is applied - the
+// config/flash/EEPROM read-write - with no assembly and no register variables:
+// code, attributes and flags only. It applies pureboot's size techniques - the
 // library's half-duplex serial and startup entry, lean bring-up from reset
 // state, one merged send loop over both memories, oracle-shaped loop bounds,
-// locals threaded through noinline primitives, pureboot's codegen flags  -
-// and the result sits below the idiomatic tier and above the 512 B boot
-// section the tricks/asm tiers reach with the banned mechanisms
-// (oracle/README.md holds all four). This tier exists to keep that gap an
-// artifact
-// rather than a claim: the gap to 512 is the rent of policy-clean C++  -
-// helpers that hold a cursor across rx()/tx() pay push/pop and argument
-// threading where a global-register protocol pays nothing, and both
-// control-flow merges tried (a parametrized paged session, a merged store
-// loop) measured larger than the split cases they replaced. TSB's wire fixes
-// the per-command loop shapes on the device, so pureboot 5's one-transfer-
-// loop collapse has no purchase here.
+// locals threaded through noinline primitives, pureboot's codegen flags - and
+// lands between the idiomatic tier and the 512 B section the tricks/asm tiers
+// reach with the banned mechanisms (oracle/README.md holds all four). The gap
+// to 512 is the rent of policy-clean C++: helpers that hold a cursor across
+// rx()/tx() pay push/pop and argument threading where a global-register
+// protocol pays nothing, and both control-flow merges tried (a parametrized
+// paged session, a merged store loop) measured larger than the split cases.
 //
 // The wire protocol is strict request/response, which is what makes the
 // shared line safe: the device drives it only between a received command and
@@ -36,11 +30,12 @@ using dev = avr::device<{.clock = 16_MHz}>;
 // 115200 at 16 MHz lands +2.1 % off, past the receiver-tolerance table the
 // solver holds rates to - the oracle's own deployment has run there for a
 // decade, so the override states that it is meant.
-using serial_t = dev::uart0<{
+constexpr avr::uart::config link{
     .baud = 115200_Bd,
     .allow_baud_error = true,
     .half_duplex = true,
-}>;
+};
+using serial_t = dev::uart0<link>;
 inline constexpr serial_t serial{};
 
 namespace tsb {
@@ -70,7 +65,7 @@ constexpr std::uint16_t app_end = spm::flash_bytes - boot_bytes - page;
 constexpr std::uint16_t eeprom_end = avr::hw::db.mem.eeprom_size - 1;
 
 // Lockout-proof floor for the activation window: the oracle's F_CPU/1MHz, so
-// it follows the clock rather than restating it (rule 41).
+// it follows the clock rather than restating it.
 constexpr auto act_min = static_cast<std::uint8_t>(dev::clock.hz / 1'000'000);
 // Post-activation window: the host gets seconds, not milliseconds, mid-session.
 constexpr std::uint8_t comm_window = 200;
@@ -166,8 +161,8 @@ const std::uint8_t *flash_ptr(std::uint16_t addr)
 {
 	const auto open = spm::page::begin<spm::from::boot_section, off>(at);
 	do {
-		std::uint8_t low = rx();
-		std::uint8_t high = rx();
+		const auto low = rx();
+		const auto high = rx();
 		spm::fill<off>(open, at, std::bit_cast<std::uint16_t>(std::array{low, high}));
 		at += 2;
 	} while (static_cast<std::uint8_t>(at) & (page - 1));
@@ -214,18 +209,18 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 	}
 
 	// Lean bring-up from reset state: UCSR0C already reads 8N1, UBRR0H reads
-	// 0, and the half-duplex write()/read() raise TXEN0/RXEN0 on first use  -
+	// 0, and the half-duplex write()/read() raise TXEN0/RXEN0 on first use -
 	// only the divisor low byte and U2X0 need a store. The solver still does
 	// the datasheet work; the asserts pin the reset-state assumptions.
 	{
-		constexpr auto sol = avr::uart::solve_baud(dev::clock, 115200_Bd, 8, avr::uart::parity::none);
+		constexpr auto sol = avr::uart::solve_baud(dev::clock, link.baud, link.data_bits, link.par);
 		static_assert(sol.u2x && sol.ubrr < 256, "lean bring-up writes UBRR0L only, with U2X0");
 		avr::hw::ubrr0::write(static_cast<std::uint8_t>(sol.ubrr));
 		avr::hw::ucsr0a::write(avr::hw::ucsr0a::u2x0(1));
 	}
 
 	// Activation: 3x'@', each inside the config page's timeout window
-	// (floored so a corrupt page cannot lock the loader out); anything else  -
+	// (floored so a corrupt page cannot lock the loader out); anything else -
 	// including silence - hands over.
 	window = avr::flash_load(flash_ptr(app_end + 2)) | act_min;
 	for (std::uint8_t k = 3; k; --k) {
@@ -243,13 +238,13 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 	std::uint16_t at = app_end + 3;
 	std::uint8_t mask = 0xff;
 	for (;;) {
-		std::uint8_t expected = avr::flash_load(flash_ptr(at)) & mask;
+		const std::uint8_t expected = avr::flash_load(flash_ptr(at)) & mask;
 		++at;
 		if (expected == 0xff) {
 			send_block(false, reinterpret_cast<std::uint16_t>(info.data()), info.size());
 			break;
 		}
-		std::uint8_t got = rx();
+		const auto got = rx();
 		if (got == 0) {
 			if (mask == 0) {
 				continue;
@@ -271,7 +266,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 
 	for (;;) {
 		tx(confirm); // Mainloop ready
-		const std::uint8_t command = rx();
+		const auto command = rx();
 		switch (command) {
 		case 'f': // read application flash, one page per host '!'
 			for (std::uint16_t a = 0; a < app_end; a += page) {