tsb: drive each tier to its size floor

asm 502->498 B (below the oracle's 500): the stack bring-up moves to plain C++,
and a register is reserved for the config-page high byte instead of reloading it
at each app-flash-boundary compare. tricks 808->778 B: shared erase/rww helpers
plus the libavr half-duplex W1C fix. pure 950->896 B and no SRAM: streams
rx->SPM/EEPROM instead of staging a 128 B page buffer. All three keep full oracle
feature parity and stay byte-identical across modes; protocol tests (round-trip +
password + emergency erase) green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -47,11 +47,18 @@ endif()
 # size; the linker section-start and the source's boot_bytes agree.
 # All three implement the full oracle feature set (see oracle/README.md):
 # watchdog bail, one-wire half-duplex, config-page activation timeout, password
-# gate, emergency erase, config/flash/EEPROM read-write. They differ only in how.
-#   tsb_asm   — minimal inline asm, the headline: 502 B in the 512 B section,
-#                 matching the hand-written oracle's size and features.
-#   tsb_tricks — compiler trickery, no asm: 808 B in the 1 KB section (BOOTSZ=10).
-#   tsb_pure  — pure idiomatic libavr: 950 B in the 1 KB section.
+# gate, emergency erase, config/flash/EEPROM read-write. They differ only in how,
+# and the size gradient is the cost of that "how" — see dev/lessons.md.
+#   tsb_asm   — dense inline asm for the loader core, libavr for every geometry/
+#                 baud/info constant and the stack bring-up: 498 B in the 512 B
+#                 section, beating the hand-written oracle (500 B) at its own
+#                 feature set. The core is asm because C++ cannot reach it under
+#                 512 (the tricks tier is the proof).
+#   tsb_tricks — compiler trickery, no asm (global-register page walk, forced
+#                 flash/EEPROM path sharing, streaming stores, arithmetic command
+#                 decode): 778 B in the 1 KB section (BOOTSZ=10).
+#   tsb_pure  — pure idiomatic libavr, one function per command, streaming (no
+#                 SRAM page buffer): 896 B in the 1 KB section.
 #
 # add_tsb_variant(<name> <boot-section-bytes>)
 function(add_tsb_variant name bytes)