build: the libavr pin advances past the audit sweep, and two gates start meaning something

The pin crosses libavr's phase-6 close and the guideline sweep behind it.
All 37 chips green, 43 tests each, the README size table matching every
built image, and all 13602 flash images byte-identical to the previous pin.

The bump broke one gate and exposed another as ornamental.

`check_unit.cmake` matched the autobaud loader's measured unit by the symbol
`unit_E`; libavr's rule-46 sweep renamed the member to `m_unit`, which the
mangling spells `6m_unitE`. On the RAM-home chips the check went red and said
so. On the GPIOR chips it went green - the branch that asserts the unit is
*not* in RAM passes on an empty match, and an empty match is what a stale
regex returns for every image. Both branches mean something again.

`tools/check.sh` ran the 37-chip loop under `set -e`, so the first red chip
ended the gate and the 36 behind it were never built - a stale size canary on
attiny13 would have been an alibi for every loader after it. It accumulates
now and fails at the end naming every red preset, which is the shape libavr's
own check.sh carries and the reason it carries it.

The port's own sweep, verified by byte identity: the four TSB tiers' 16-byte
info block is `std::to_array` rather than an extent written beside the
sixteen elements the compiler can count, the three-member serial and loader
configs break one member per line, the turn-around loops are braced, and the
test fixture's config pair is a deduced `std::array` (rules 36, 40, 34). Two
comments stop narrating how the code came to be and one stops citing a repro
at a path it left two phases ago (rules 12, 13).

pureboot's identity stamp stays the raw array rule 36 bans, and now says why:
its reads must fold to immediates because the bytes are in program memory and
a formed address is dereferenced as data space. As a `std::array` the read
loop stopped unrolling and emitted exactly that - measured at +8 B and a
wrong answer on the wire.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CMakeLists.txt

@@ -83,7 +83,7 @@ endfunction()
 # All four implement the full oracle feature set (see oracle/README.md):
 # watchdog bail, one-wire half-duplex, config-page activation timeout, password
 # gate, emergency erase, config/flash/EEPROM read-write. They differ only in how,
-# and the size gradient is the cost of that "how" - see dev/lessons.md.
+# and the size gradient is the cost of that "how".
 #   tsb_asm   - the tricks tier's C++ with exactly two routines in asm (the
 #                 bounded rx and the page-store loop - the two whose remaining
 #                 cost is the C ABI itself): 510 B in the 512 B section the

pureboot/pureboot.cpp

@@ -127,8 +127,13 @@ constexpr std::uint8_t version = 9;
 //
 // Never read from flash by the loader - 'b' answers out of this array, but at
 // constant indices, so those fold to immediates and no runtime address of it
-// is ever formed. `used` keeps the compiler from dropping the copy the host
+// is ever formed. That folding is a correctness property, not a size one: the
-// needs and `retain` keeps --gc-sections from collecting it.
+// bytes live in program memory and a formed address would be dereferenced as
+// *data* space, which is why this is the raw array rule 36 otherwise bans - a
+// `std::array` here stops the read loop unrolling and emits exactly that
+// `ld` (measured: +8 B and a wrong answer on the wire). `used` keeps the
+// compiler from dropping the copy the host needs and `retain` keeps
+// --gc-sections from collecting it.
 // clang-format off
 [[gnu::used, gnu::retain, gnu::section(".text.stamp")]]
 inline constexpr std::uint8_t identity_stamp[]{
@@ -220,7 +225,12 @@ struct hardware_link {
 	// the fleet, and the datasheet's stricter per-frame tolerance table would
 	// refuse the stock 115200 at 16 MHz (+2.1 %) that every deployed board
 	// runs. .allow_baud_error states that this is meant.
-	using uart = avr::uart::usart<usart_unit, C, {.baud = B, .allow_baud_error = true, .half_duplex = hw_half_duplex}>;
+	using uart = avr::uart::usart<usart_unit, C,
+	                              {
+	                                  .baud = B,
+	                                  .allow_baud_error = true,
+	                                  .half_duplex = hw_half_duplex,
+	                              }>;
 
 	// The compiled idle poll around the window's narrow (uint24_t) countdown:
 	// the RXC test, then sbiw + sbci + brne (5). The test's cost follows the

test/check_unit.cmake

@@ -11,26 +11,26 @@ if(NOT _res EQUAL 0)
 	message(FATAL_ERROR "${OBJDUMP} -t ${ELF} failed")
 endif()
 
-# The symbol line: "00800100 l     O .noinit  00000002 <mangled>unit_E".
+# The symbol line: "00800100 l     O .noinit  00000002 <mangled>6m_unitE".
-string(REGEX MATCH "\n0*([0-9a-f]+)[^\n]+[ \t][^ \t\n]*unit_E\n" _line "${_syms}")
+string(REGEX MATCH "\n0*([0-9a-f]+)[^\n]+[ \t][^ \t\n]*6m_unitE\n" _line "${_syms}")
 
 if(GPIOR)
 	if(_line)
-		message(FATAL_ERROR "unit_ RAM symbol present although the unit's home is GPIOR ${GPIOR} - "
+		message(FATAL_ERROR "m_unit RAM symbol present although the unit's home is GPIOR ${GPIOR} - "
 		                    "the host peeks the pair, and a RAM copy would be dead weight")
 	endif()
-	message(STATUS "no unit_ RAM object - the unit lives in the GPIOR pair at ${GPIOR}")
+	message(STATUS "no m_unit RAM object - the unit lives in the GPIOR pair at ${GPIOR}")
 	return()
 endif()
 
 if(NOT _line)
-	message(FATAL_ERROR "no unit_ symbol in ${ELF} - is this the autobaud loader?")
+	message(FATAL_ERROR "no m_unit symbol in ${ELF} - is this the autobaud loader?")
 endif()
 
 # AVR data-space symbols carry the 0x800000 VMA offset.
 math(EXPR _want "0x800000 + ${RAM_START}" OUTPUT_FORMAT HEXADECIMAL)
 math(EXPR _have "0x${CMAKE_MATCH_1}" OUTPUT_FORMAT HEXADECIMAL)
 if(NOT _have STREQUAL _want)
-	message(FATAL_ERROR "unit_ sits at ${_have}, ram_start is ${_want} - the host peeks ram_start")
+	message(FATAL_ERROR "m_unit sits at ${_have}, ram_start is ${_want} - the host peeks ram_start")
 endif()
-message(STATUS "unit_ at ${_have} == ram_start")
+message(STATUS "m_unit at ${_have} == ram_start")

test/device.cpp

@@ -95,7 +95,7 @@ int main(int argc, char *argv[])
 	if (cfg) {
 		std::uint32_t app_end = boot_base - 128; // config page sits directly below the boot code
 		for (int i = 0; cfg[i] && cfg[i + 1]; i += 2) {
-			const std::array<char, 3> pair = {cfg[i], cfg[i + 1], 0};
+			const std::array pair{cfg[i], cfg[i + 1], '\0'};
 			avr->flash[app_end + i / 2] = static_cast<std::uint8_t>(std::strtoul(pair.data(), nullptr, 16));
 		}
 	}

test/pbautobaud.py

@@ -94,12 +94,11 @@ def main():
                 fail(f"{label}: EEPROM read-back mismatch")
 
             if hand_over:
-                # Regression: a calibration pulse with no knock behind it must
+                # A calibration pulse with no knock behind it must not wedge
-                # not wedge the loader. The knock's edge wait used to be
+                # the loader: the whole activation is bounded, including the
-                # unbudgeted, so one stray low pulse - EMI, or a host that opens
+                # knock's edge wait, so one stray low pulse - EMI, or a host
-                # the port and never knocks - held the loader forever and the
+                # that opens the port and never knocks - closes the window and
-                # application never ran. The whole activation is bounded now, so
+                # boots the application. The banner is the proof.
-                # the window closes and the app boots; the banner is the proof.
                 # (The pause lets the loader reach its measurement loop, so the
                 # pulse is genuinely seen and the test cannot pass vacuously.)
                 device.reset()

test/pbreloc.py

@@ -64,11 +64,9 @@ def main():
             fail("EEPROM round-trip through the staged copy")
 
         # The resident slot, written from the copy standing beside it - the
-        # whole point of relocating. pureboot 9 dropped the running-slot guard
+        # whole point of relocating. There is no running-slot guard to probe
-        # that used to sit behind this, so the probe that used to accompany it
+        # against: nothing here refuses an address, and a copy that erases the
-        # (aim a write at the copy's *own* slot and watch it be refused) is
+        # page it is executing from does not come back to report it.
-        # gone with it: there is nothing to refuse now, and a copy that erases
-        # the page it is executing from does not come back to report it.
         # pbselfwrite.py gates that direction on a device it is allowed to
         # destroy.
         marker = bytes((i * 3) & 0xFF for i in range(page))

tools/check.sh

@@ -24,18 +24,32 @@ CHIPS=(attiny13 attiny13a attiny25 attiny45 attiny85
 REFLECT_SPOT=(attiny13a attiny85 atmega8 atmega16a atmega32a atmega48pa
               atmega88 atmega168pa atmega328p atmega164a atmega644p atmega1284)
 
+# Every preset runs even after one goes red, and the gate fails at the end
+# naming all of them: stopping at the first failure turns a red - a stale size
+# canary above all - into an alibi for every chip behind it, and a loader can
+# ship on a chip this gate has not compiled since.
+red=()
+run_preset() {
+	echo "==== $1 ===="
+	cmake --workflow --preset "$1" "${@:2}" || red+=("$1")
+}
+
 for chip in "${CHIPS[@]}"; do
-	echo "==== $chip ===="
+	run_preset "$chip-generated" "$@"
-	cmake --workflow --preset "$chip-generated" "$@"
 done
 
 if ((full)); then
 	for chip in "${REFLECT_SPOT[@]}"; do
-		echo "==== $chip reflect ===="
+		run_preset "$chip-reflect" "$@"
-		cmake --workflow --preset "$chip-reflect" "$@"
 	done
 fi
 
+if ((${#red[@]})); then
+	printf '==== red presets ====\n' >&2
+	printf '  %s\n' "${red[@]}" >&2
+	exit 1
+fi
+
 # Every tree is freshly built now - the one moment the README's size table
 # can be held to what the images measure (a per-preset ctest sees only its
 # own chip; the table needs all of them, and ungated it drifts: a

tsb/tsb_asm.cpp

@@ -4,11 +4,11 @@
 // The complete TinySafeBoot feature set - watchdog-reset bail, one-wire
 // half-duplex UART, a config-page activation timeout, the password gate,
 // emergency erase, and config/flash/EEPROM read-write - at 510 bytes in the
-// 512-byte BOOTSZ=11 section the hand-written oracle occupies (500 B). This tier used to be one
+// 512-byte BOOTSZ=11 section the hand-written oracle occupies (500 B). The
-// monolithic inline-asm routine; it is now the tricks tier's C++ (same
+// body is the tricks tier's C++ (same register protocol, same structure - see
-// register protocol, same structure - see tsb_tricks.cpp, including the
+// tsb_tricks.cpp, including the global-register miscompile rules) with exactly
-// global-register miscompile rules) with exactly two routines kept in
+// two routines kept in assembly, the two whose remaining cost *is* the calling
-// assembly, the two whose remaining cost *is* the calling convention:
+// convention:
 //
 //   rx     the bounded receive: C++ must re-floor the timeout window on every
 //          call (the global-register-store miscompile) and split it across
@@ -75,7 +75,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
 
 // The 16-byte device-info block, streamed out on activation.
 // clang-format off
-[[gnu::progmem]] constexpr std::uint8_t info[16] = {
+[[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
     'T', 'S', 'B',
     build_date & 0xFF, build_date >> 8,
     0xF3,             // status: native-UART fixed-baud lineage
@@ -84,7 +84,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
     (app_end / 2) & 0xFF, (app_end / 2) >> 8,
     eeprom_end & 0xFF, eeprom_end >> 8,
     0xAA, 0xAA,
-};
+});
 // clang-format on
 
 register std::uint16_t g_addr asm("r28");
@@ -141,8 +141,8 @@ const std::uint8_t *flash_ptr(std::uint16_t addr)
 	if (g_receiving) {
 		g_receiving = 0;
 		hw::ucsr0b::write(hw::ucsr0b::txen0(1));
-		for (std::uint8_t guard = 46; guard; --guard)
+		for (std::uint8_t guard = 46; guard; --guard) {
-			;
+		}
 	}
 	hw::udr0::write(byte);
 	std::uint8_t status;
@@ -300,7 +300,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 		std::uint8_t expected = avr::flash_load(flash_ptr(g_addr)) & mask;
 		++g_addr;
 		if (expected == 0xff) {
-			g_addr = reinterpret_cast<std::uint16_t>(&info[0]);
+			g_addr = reinterpret_cast<std::uint16_t>(info.data());
 			g_cnt = sizeof(info);
 			sendf();
 			break;

tsb/tsb_policy.cpp

@@ -35,7 +35,11 @@ using dev = avr::device<{.clock = 16_MHz}>;
 // 115200 at 16 MHz lands +2.1 % off, past the receiver-tolerance table the
 // solver holds rates to - the oracle's own deployment has run there for a
 // decade, so the override states that it is meant.
-using serial_t = dev::uart0<{.baud = 115200_Bd, .allow_baud_error = true, .half_duplex = true}>;
+using serial_t = dev::uart0<{
+    .baud = 115200_Bd,
+    .allow_baud_error = true,
+    .half_duplex = true,
+}>;
 inline constexpr serial_t serial{};
 
 namespace tsb {
@@ -74,7 +78,7 @@ constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 27;
 
 // The 16-byte device-info block, streamed out on activation.
 // clang-format off
-[[gnu::progmem]] constexpr std::uint8_t info[16] = {
+[[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
     'T', 'S', 'B',
     build_date & 0xFF, build_date >> 8,
     0xF3,             // status: native-UART fixed-baud lineage
@@ -83,7 +87,7 @@ constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 27;
     (app_end / 2) & 0xFF, (app_end / 2) >> 8, // app-flash boundary, words
     eeprom_end & 0xFF, eeprom_end >> 8,
     0xAA, 0xAA,       // ATmega processor-type marker (bytes 14 == 15)
-};
+});
 // clang-format on
 
 // The receive window, pre-floored where it is set. In .noinit: there is no
@@ -240,7 +244,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 		std::uint8_t expected = avr::flash_load(flash_ptr(at)) & mask;
 		++at;
 		if (expected == 0xff) {
-			send_block(false, reinterpret_cast<std::uint16_t>(&info[0]), sizeof info);
+			send_block(false, reinterpret_cast<std::uint16_t>(info.data()), info.size());
 			break;
 		}
 		std::uint8_t got = rx();

tsb/tsb_pure.cpp

@@ -23,7 +23,11 @@ using dev = avr::device<{.clock = 16_MHz}>;
 // 115200 at 16 MHz lands +2.1 % off, past the receiver-tolerance table the
 // solver holds rates to - the oracle's own deployment has run there for a
 // decade, so the override states that it is meant.
-using serial_t = dev::uart0<{.baud = 115200_Bd, .allow_baud_error = true, .half_duplex = true}>;
+using serial_t = dev::uart0<{
+    .baud = 115200_Bd,
+    .allow_baud_error = true,
+    .half_duplex = true,
+}>;
 inline constexpr serial_t serial{};
 
 namespace tsb {

tsb/tsb_tricks.cpp

@@ -19,7 +19,7 @@
 // remaining uses all hide inside callees is deleted whenever a CALL follows it
 // before any jump/ret (the backend's liveness walk lumps fixed registers with
 // call-clobbered ones - minimal repro in libavr's
-// local/scratch/probes/gcc-avr-globalreg-repro.cpp, lessons.md entry). Every
+// test/upstream/gcc-avr-globalreg-repro.cpp). Every
 // g_* update below therefore sits where a *local* read or a jump/ret follows
 // it - the helpers advance g_addr immediately before returning, and rx()
 // re-floors the window on every call instead of storing the floored value
@@ -75,7 +75,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
 
 // The 16-byte device-info block, streamed out on activation.
 // clang-format off
-[[gnu::progmem]] constexpr std::uint8_t info[16] = {
+[[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
     'T', 'S', 'B',
     build_date & 0xFF, build_date >> 8,
     0xF3,             // status: native-UART fixed-baud lineage
@@ -84,7 +84,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
     (app_end / 2) & 0xFF, (app_end / 2) >> 8,
     eeprom_end & 0xFF, eeprom_end >> 8,
     0xAA, 0xAA,
-};
+});
 // clang-format on
 
 register std::uint16_t g_addr asm("r28");
@@ -134,8 +134,8 @@ const std::uint8_t *flash_ptr(std::uint16_t addr)
 	if (g_receiving) {
 		g_receiving = 0;
 		hw::ucsr0b::write(hw::ucsr0b::txen0(1));
-		for (std::uint8_t guard = 46; guard; --guard)
+		for (std::uint8_t guard = 46; guard; --guard) {
-			;
+		}
 	}
 	hw::udr0::write(byte);
 	std::uint8_t status;
@@ -279,7 +279,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 		std::uint8_t expected = avr::flash_load(flash_ptr(g_addr)) & mask;
 		++g_addr;
 		if (expected == 0xff) {
-			g_addr = reinterpret_cast<std::uint16_t>(&info[0]);
+			g_addr = reinterpret_cast<std::uint16_t>(info.data());
 			g_cnt = sizeof(info);
 			sendf();
 			break;