tsb: the protocol the tiers share is written once, and its bytes by name

tsb/tsb.hpp holds the link, the handshake and command bytes, the guard
policy and SPM interlock, the boot geometry, act_min/comm_window and a
consteval builder for the 16-byte info block, whose BUILDSTATE and ATmega
marker bytes are now named rather than commented. Every tier's image is
byte-identical to before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tsb/tsb_policy.cpp

@@ -19,19 +19,15 @@
 // its reply, and releases it (the library's half-duplex choreography)
 // whenever it waits.
 
-#include <libavr/libavr.hpp>
+#include "tsb.hpp"
 
-using namespace avr::literals;
-namespace spm = avr::spm;
-namespace ee = avr::eeprom;
-
-using dev = avr::device<{.clock = 16_MHz}>;
+using dev = avr::device<{.clock = tsb::clock}>;
 // One-wire: RX and TX share the line, exactly as the native-UART TSB expects.
 // 115200 at 16 MHz lands +2.1 % off, past the receiver-tolerance table the
 // solver holds rates to - the oracle's own deployment has run there for a
 // decade, so the override states that it is meant.
 constexpr avr::uart::config link{
-    .baud = 115200_Bd,
+    .baud = tsb::baud_rate,
     .allow_baud_error = true,
     .half_duplex = true,
 };
@@ -41,61 +37,16 @@ inline constexpr serial_t serial{};
 namespace tsb {
 namespace {
 
-// The loader is purely polled - it never enables interrupts - so every SPM and
-// EEPROM lock folds to nothing under this posture.
-constexpr auto off = avr::irq::guard_policy::unused;
-
-// Strict request/response: every SPM operation is waited out before the next
-// byte moves, so no flash operation is ever in flight at an EEPROM access -
-// the write procedure's step 2 has nothing to guard, the omission the
-// datasheet grants (DS40002061B section 8.6.3).
-constexpr auto no_spm = ee::spm_interlock::omitted;
-
-// The handshake bytes, identical across every TSB host.
-constexpr std::uint8_t confirm = '!';
-constexpr std::uint8_t request = '?';
-constexpr std::uint8_t knock = '@';
-
-// Boot geometry for the 1 KB boot section (BOOTSZ=10); the page size and the
-// flash/EEPROM extents are the chip database's to know. app_end is the config
-// page (TSB's LASTPAGE), one page below the boot section.
-constexpr std::uint16_t page = spm::page_bytes;
+// The boot section: 1 KB, BOOTSZ=10.
 constexpr std::uint16_t boot_bytes = 1024;
-constexpr std::uint16_t app_end = spm::flash_bytes - boot_bytes - page;
-constexpr std::uint16_t eeprom_end = avr::hw::db.mem.eeprom_size - 1;
+constexpr std::uint16_t app_end = config_page(boot_bytes);
 
-// Lockout-proof floor for the activation window: the oracle's F_CPU/1MHz, so
-// it follows the clock rather than restating it.
-constexpr auto act_min = static_cast<std::uint8_t>(dev::clock.hz / 1'000'000);
-// Post-activation window: the host gets seconds, not milliseconds, mid-session.
-constexpr std::uint8_t comm_window = 200;
-
-// Firmware version stamp: YY*512 + MM*32 + DD, the encoding the host decodes.
-constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 27;
-
-// The 16-byte device-info block, streamed out on activation.
-// clang-format off
-[[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
-    'T', 'S', 'B',
-    build_date & 0xFF, build_date >> 8,
-    0xF3,             // status: native-UART fixed-baud lineage
-    avr::hw::db.signature[0], avr::hw::db.signature[1], avr::hw::db.signature[2],
-    page / 2,         // page size in words
-    (app_end / 2) & 0xFF, (app_end / 2) >> 8, // app-flash boundary, words
-    eeprom_end & 0xFF, eeprom_end >> 8,
-    0xAA, 0xAA,       // ATmega processor-type marker (bytes 14 == 15)
-});
-// clang-format on
+[[gnu::progmem]] constexpr auto info = info_block(date_stamp(26, 7, 27), app_end);
 
 // The receive window, pre-floored where it is set. In .noinit: there is no
 // crt to clear a .bss image, and run() stores it before the first receive.
 [[gnu::section(".noinit")]] std::uint8_t window;
 
-const std::uint8_t *flash_ptr(std::uint16_t addr)
-{
-	return reinterpret_cast<const std::uint8_t *>(addr);
-}
-
 // Bounded byte receive: poll under nested countdowns, 0 on silence. The 0
 // then falls through every compare - not a knock, not a confirm, not a
 // command - so a silent host unwinds the loader to the application from
@@ -219,23 +170,23 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 		avr::hw::ucsr0a::write(avr::hw::ucsr0a::u2x0(1));
 	}
 
-	// Activation: 3x'@', each inside the config page's timeout window
-	// (floored so a corrupt page cannot lock the loader out); anything else -
-	// including silence - hands over.
-	window = avr::flash_load(flash_ptr(app_end + 2)) | act_min;
-	for (std::uint8_t k = 3; k; --k) {
+	// Activation: activation_knocks '@', each inside the config page's timeout
+	// window (floored so a corrupt page cannot lock the loader out); anything
+	// else - including silence - hands over.
+	window = avr::flash_load(flash_ptr(app_end + timeout_at)) | act_min;
+	for (std::uint8_t k = activation_knocks; k; --k) {
 		if (rx() != knock) {
 			appjump();
 		}
 	}
 	window = comm_window;
 
-	// Password gate (config page from app_end+3, 0xff-terminated; a blank
+	// Password gate (config page from password_at, 0xff-terminated; a blank
 	// page is no password). A wrong byte blanks the comparison and drains the
 	// line forever, so a wrong password can never fall through; a 0 requests
 	// emergency erase behind two confirms. On pass the info block goes out;
 	// the emergency path skips it and drops into the command loop.
-	std::uint16_t at = app_end + 3;
+	std::uint16_t at = app_end + password_at;
 	std::uint8_t mask = 0xff;
 	for (;;) {
 		const std::uint8_t expected = avr::flash_load(flash_ptr(at)) & mask;
@@ -266,9 +217,8 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 
 	for (;;) {
 		tx(confirm); // Mainloop ready
-		const auto command = rx();
-		switch (command) {
-		case 'f': // read application flash, one page per host '!'
+		switch (rx()) {
+		case command::read_flash: // one page per host '!'
 			for (std::uint16_t a = 0; a < app_end; a += page) {
 				if (rx() != confirm) {
 					break;
@@ -276,7 +226,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 				send_block(false, a, page);
 			}
 			break;
-		case 'e': // read EEPROM, one page per host '!', until the host stops
+		case command::read_eeprom: // one page per host '!', until the host stops
 			for (std::uint16_t a = 0;; a += page) {
 				if (rx() != confirm) {
 					break;
@@ -284,14 +234,14 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 				send_block(true, a, page);
 			}
 			break;
-		case 'F': { // erase the application, then take pages behind '?'
+		case command::write_flash: { // erase the application, then take pages behind '?'
 			std::uint16_t a = erase_application();
 			for (; rcnf() == confirm; a += page) {
 				store_flash_page(a);
 			}
 			break;
 		}
-		case 'E': // take EEPROM pages behind '?', each write host-paced
+		case command::write_eeprom: // pages behind '?', each write host-paced
 			for (std::uint16_t a = 0; rcnf() == confirm;) {
 				std::uint8_t count = page;
 				do {
@@ -300,11 +250,11 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 				} while (--count);
 			}
 			break;
-		case 'c': // read the config page
+		case command::read_config:
 		read_config:
 			send_block(false, app_end, page);
 			break;
-		case 'C': // replace the config page, then echo it back to verify
+		case command::write_config: // then echo it back to verify
 			if (rcnf() != confirm) {
 				break;
 			}