tsb: the protocol the tiers share is written once, and its bytes by name

tsb/tsb.hpp holds the link, the handshake and command bytes, the guard
policy and SPM interlock, the boot geometry, act_min/comm_window and a
consteval builder for the 16-byte info block, whose BUILDSTATE and ATmega
marker bytes are now named rather than commented. Every tier's image is
byte-identical to before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tsb/tsb_pure.cpp

@@ -9,19 +9,15 @@
 // The one-wire wiring, the flash-resident info block, every SPM/EEPROM lock and
 // the crt-free reset entry are libavr's to handle.
 
-#include <libavr/libavr.hpp>
+#include "tsb.hpp"
 
-using namespace avr::literals;
-namespace spm = avr::spm;
-namespace ee = avr::eeprom;
-
-using dev = avr::device<{.clock = 16_MHz}>;
+using dev = avr::device<{.clock = tsb::clock}>;
 // One-wire: RX and TX share the line, exactly as the native-UART TSB expects.
 // 115200 at 16 MHz lands +2.1 % off, past the receiver-tolerance table the
 // solver holds rates to - the oracle's own deployment has run there for a
 // decade, so the override states that it is meant.
 using serial_t = dev::uart0<{
-    .baud = 115200_Bd,
+    .baud = tsb::baud_rate,
     .allow_baud_error = true,
     .half_duplex = true,
 }>;
@@ -30,53 +26,15 @@ inline constexpr serial_t serial{};
 namespace tsb {
 namespace {
 
-// The loader is purely polled - it never enables interrupts - so every SPM and
-// EEPROM lock folds to nothing under this posture.
-constexpr auto off = avr::irq::guard_policy::unused;
-
-// Strict request/response: every SPM operation is waited out before the next
-// byte moves, so no flash operation is ever in flight at an EEPROM access -
-// the write procedure's step 2 has nothing to guard, the omission the
-// datasheet grants (DS40002061B section 8.6.3).
-constexpr auto no_spm = ee::spm_interlock::omitted;
-
-// The handshake bytes, identical across every TSB host.
-constexpr std::uint8_t confirm = '!';
-constexpr std::uint8_t request = '?';
-constexpr std::uint8_t knock = '@';
-
-// Boot geometry for the 1 KB boot section (BOOTSZ=10). The page size and the
-// flash/EEPROM extents are the chip database's to know. app_end is the config
-// page (the LASTPAGE holding the app-jump vector, activation timeout and
-// password), one page below the boot section.
-constexpr std::uint16_t page = spm::page_bytes;
+// The boot section: 1 KB, BOOTSZ=10.
 constexpr std::uint16_t boot_bytes = 1024;
-constexpr std::uint16_t app_end = spm::flash_bytes - boot_bytes - page;
-constexpr std::uint16_t eeprom_end = avr::hw::db.mem.eeprom_size - 1;
+constexpr std::uint16_t app_end = config_page(boot_bytes);
 
-// Firmware version stamp: YY*512 + MM*32 + DD, the encoding the host decodes.
-constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 20;
-
-// The 16-byte device-info block the host reads on activation. A flash_table
-// keeps it in progmem with no .data image (there is no crt to copy one).
-// clang-format off
-inline constexpr auto info_data = std::to_array<std::uint8_t>({
-    'T', 'S', 'B',
-    build_date & 0xFF, build_date >> 8,
-    0xF3,             // status byte (native-UART fixed-baud lineage)
-    avr::hw::db.signature[0], avr::hw::db.signature[1], avr::hw::db.signature[2],
-    page / 2,         // page size in words
-    (app_end / 2) & 0xFF, (app_end / 2) >> 8, // app-flash boundary, words
-    eeprom_end & 0xFF, eeprom_end >> 8,
-    0xAA, 0xAA, // ATmega processor-type marker (bytes 14 == 15)
-});
-// clang-format on
+// A flash_table keeps the info block in progmem with no .data image (there is
+// no crt to copy one).
+inline constexpr auto info_data = info_block(date_stamp(26, 7, 20), app_end);
 using info = avr::flash_table<info_data>;
 
-// The lockout-proof floor for the receive window: the oracle's F_CPU/1MHz, so
-// it follows the clock rather than restating it.
-constexpr auto act_min = static_cast<std::uint8_t>(dev::clock.hz / 1'000'000);
-
 // The receive window, pre-floored where it is set. In .noinit: there is no crt
 // to clear a .bss image, and run() stores it before the first receive.
 [[gnu::section(".noinit")]] std::uint8_t window;
@@ -107,11 +65,6 @@ void tx(std::uint8_t byte)
 	serial.write(byte);
 }
 
-const std::uint8_t *flash_ptr(std::uint16_t addr)
-{
-	return reinterpret_cast<const std::uint8_t *>(addr);
-}
-
 // Stream `count` bytes to the host, from flash (LPM) or from EEPROM.
 void send_flash(std::uint16_t addr, std::uint8_t count)
 {
@@ -187,8 +140,8 @@ extern "C" [[noreturn]] void tsb_app();
 	tsb_app();
 }
 
-// 'f': stream the application flash back, one page per host '!'. Self-terminates
-// at the application boundary; the host normally stops earlier with a non-'!'.
+// Stream the application flash back, one page per host '!'. Self-terminates at
+// the application boundary; the host normally stops earlier with a non-'!'.
 void read_flash()
 {
 	for (std::uint16_t a = 0; a < app_end; a += page) {
@@ -199,7 +152,7 @@ void read_flash()
 	}
 }
 
-// 'e': stream EEPROM back, one page per host '!', until the host stops.
+// Stream EEPROM back, one page per host '!', until the host stops.
 void read_eeprom()
 {
 	for (std::uint16_t a = 0;; a += page) {
@@ -210,8 +163,8 @@ void read_eeprom()
 	}
 }
 
-// 'F': erase the whole application first, then take pages the host offers
-// behind '?'.
+// Erase the whole application first, then take pages the host offers behind
+// '?'.
 void write_flash()
 {
 	erase_application();
@@ -220,7 +173,7 @@ void write_flash()
 	}
 }
 
-// 'E': take pages the host offers behind '?' into EEPROM.
+// Take pages the host offers behind '?' into EEPROM.
 void write_eeprom()
 {
 	for (std::uint16_t a = 0; request_confirm(); a += page) {
@@ -228,7 +181,7 @@ void write_eeprom()
 	}
 }
 
-// 'C': replace the config page, then echo it back for the host to verify.
+// Replace the config page, then echo it back for the host to verify.
 void write_config()
 {
 	if (!request_confirm()) {
@@ -253,7 +206,7 @@ void emergency_erase()
 	spm::rww_enable<off>();
 }
 
-// The password gate. The config page holds the password at app_end+3,
+// The password gate. The config page holds the password at password_at,
 // terminated by 0xff (a blank page means no password). A byte of 0 requests
 // emergency erase; a wrong byte hangs the loader, still draining the line, so a
 // wrong password can never fall through to the erase.
@@ -261,7 +214,7 @@ enum class gate : std::uint8_t { pass, emergency };
 
 gate password_gate()
 {
-	for (const std::uint8_t *pw = flash_ptr(app_end + 3);; ++pw) {
+	for (const std::uint8_t *pw = flash_ptr(app_end + password_at);; ++pw) {
 		const auto expected = avr::flash_load(pw);
 		if (expected == 0xff) {
 			return gate::pass;
@@ -288,14 +241,14 @@ gate password_gate()
 
 	avr::init<serial_t>();
 
-	// Activation: the host knocks three '@' inside a window whose length is the
+	// Activation: the host knocks activation_knocks times inside a window whose length is the
 	// config page's timeout byte, floored so a corrupt page can never lock the
 	// loader out. An idle port times out and boots the application; the same
 	// window then bounds every receive of the session.
-	window = avr::flash_load(flash_ptr(app_end + 2)) | act_min;
+	window = avr::flash_load(flash_ptr(app_end + timeout_at)) | act_min;
 	__uint24 idle = static_cast<__uint24>(window) << 16;
 	std::uint8_t knocks = 0;
-	while (knocks < 3) {
+	while (knocks < activation_knocks) {
 		if (auto byte = serial.read()) {
 			knocks = *byte == knock ? knocks + 1 : 0;
 		} else if (--idle == 0) {
@@ -318,22 +271,22 @@ gate password_gate()
 	for (;;) {
 		tx(confirm); // Mainloop ready
 		switch (rx()) {
-		case 'f':
+		case command::read_flash:
 			read_flash();
 			break;
-		case 'F':
+		case command::write_flash:
 			write_flash();
 			break;
-		case 'e':
+		case command::read_eeprom:
 			read_eeprom();
 			break;
-		case 'E':
+		case command::write_eeprom:
 			write_eeprom();
 			break;
-		case 'c':
+		case command::read_config:
 			send_flash(app_end, page);
 			break;
-		case 'C':
+		case command::write_config:
 			write_config();
 			break;
 		default: