build: the pin advances over the bounded calibration

libavr's calibrate() now bounds its measurement loop, starts the pulse
on an observed edge, and re-arms a rejected pulse on the remaining
budget instead of one-strike booting the application. The autobaud
images pay +16..20 B — every slot still fits, the worst now the 1284s'
502 of 512 — and the stock images are byte-identical, kept so by
fitting the loader's flag set per backend: -fno-ivopts stays on the
fixed-baud bodies it shrinks and comes off the autobaud body, where it
duplicated the calibration countdown into a 9-cycle loop against the
contracted seven.

One deployed constant moved and its gate caught it: the calibrate
wait's budget poll re-laid from ten cycles to nine (the exit branches
land where block layout puts them), so pureboot.window.autobaud
measured -10 % until AUTOBAUD_POLL_CYCLES and the README's derived
seconds were re-measured — the default autobaud window is 36 M cycles,
4.5 s at 8 MHz. Full gate green on all 37 chips; the README's autobaud
column carries each chip's rebuilt worst configuration, machine-checked
against the built trees.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CMakeLists.txt

@@ -22,15 +22,17 @@ if(PROJECT_IS_TOP_LEVEL)
 
 	# The behavioral tests drive the real wire protocols over a simavr pty
 	# (as the host tools do) and actually flash the device. The runners are
-	# host programs built at configure time against libsimavr; if they or
+	# host programs built at configure time against libsimavr (C++23 — what
-	# Python are missing, only the size tests run.
+	# the distribution's compiler speaks in full); if they or Python are
-	find_program(_host_cc NAMES cc gcc)
+	# missing, only the size tests run.
+	find_program(_host_cxx NAMES c++ g++)
 	find_package(Python3 COMPONENTS Interpreter)
-	if(_host_cc AND Python3_FOUND)
+	if(_host_cxx AND Python3_FOUND)
 		set(PB_DEVICE ${CMAKE_BINARY_DIR}/pureboot_device)
 		execute_process(
-		    COMMAND ${_host_cc} -O2 -I/usr/include/simavr -I/usr/include/simavr/parts
+		    COMMAND ${_host_cxx} -std=c++23 -Wall -Wextra -O2
-		            -o ${PB_DEVICE} ${CMAKE_CURRENT_SOURCE_DIR}/test/pureboot_device.c
+		            -I/usr/include/simavr -I/usr/include/simavr/parts
+		            -o ${PB_DEVICE} ${CMAKE_CURRENT_SOURCE_DIR}/test/pureboot_device.cpp
 		            -lsimavr -lsimavrparts -lelf -lutil
 		    RESULT_VARIABLE _pbdev_res ERROR_VARIABLE _pbdev_err)
 		if(NOT _pbdev_res EQUAL 0)
@@ -40,8 +42,9 @@ if(PROJECT_IS_TOP_LEVEL)
 		if(LIBAVR_MCU STREQUAL "atmega328p")
 			set(TSB_DEVICE ${CMAKE_BINARY_DIR}/tsb_device)
 			execute_process(
-			    COMMAND ${_host_cc} -O2 -I/usr/include/simavr -I/usr/include/simavr/parts
+			    COMMAND ${_host_cxx} -std=c++23 -Wall -Wextra -O2
-			            -o ${TSB_DEVICE} ${CMAKE_CURRENT_SOURCE_DIR}/test/device.c
+			            -I/usr/include/simavr -I/usr/include/simavr/parts
+			            -o ${TSB_DEVICE} ${CMAKE_CURRENT_SOURCE_DIR}/test/device.cpp
 			            -lsimavr -lsimavrparts -lelf
 			    RESULT_VARIABLE _dev_res ERROR_VARIABLE _dev_err)
 			if(NOT _dev_res EQUAL 0)
@@ -199,6 +202,21 @@ if(PROJECT_IS_TOP_LEVEL)
 		                 ${CMAKE_BINARY_DIR}/pbtest-work)
 		set_tests_properties(pureboot.protocol PROPERTIES TIMEOUT 180)
 
+		# The activation window as a measured duration: application installed,
+		# line idle, the first transmit is the application's banner — its
+		# cycle is the window the source declares, held to ±2 % (one
+		# mis-counted cycle per poll is a 10 % shift).
+		add_test(NAME pureboot.window
+		         COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/test/pbwindow.py
+		                 --device ${PB_DEVICE} --loader $<TARGET_FILE:pureboot>
+		                 --mcu ${PUREBOOT_SIM_MCU} --hz ${_pb_stock_hz}
+		                 --base ${PUREBOOT_BASE_HEX} --page ${PUREBOOT_PAGE}
+		                 --baud ${_pb_stock_baud} --app $<TARGET_FILE:pbapp>.bin
+		                 --seconds ${PUREBOOT_TIMEOUT}
+		                 --tool ${CMAKE_CURRENT_SOURCE_DIR}/pureboot/pureboot.py
+		                 --workdir ${CMAKE_BINARY_DIR}/pbwindow-work)
+		set_tests_properties(pureboot.window PROPERTIES TIMEOUT 300)
+
 		# The position-independence acceptance test: the identical image,
 		# installed one slot lower, must serve the full command set.
 		add_test(NAME pureboot.reloc
@@ -280,12 +298,14 @@ if(PROJECT_IS_TOP_LEVEL)
 	add_test(NAME pureboot_autobaud.size
 	         COMMAND ${CMAKE_COMMAND} -DSIZE_TOOL=${CMAKE_SIZE} -DELF=$<TARGET_FILE:pureboot_autobaud>
 	                 -DLIMIT=${PUREBOOT_LIMIT} -P ${CMAKE_CURRENT_SOURCE_DIR}/test/check_size.cmake)
-	# The measured unit is the loader's only RAM object and sits at the very
+	# The measured unit's home is wire contract, not layout accident: the
-	# start of SRAM — where the host reads the bit period from (--info's
+	# host reads the bit period from it (--info's measured clock). In the
-	# measured clock), so the address is wire contract, not layout accident.
+	# GPIOR home the image must carry no RAM copy at all; in the RAM home it
+	# is the loader's only RAM object, at the very start of SRAM.
 	add_test(NAME pureboot_autobaud.unit
 	         COMMAND ${CMAKE_COMMAND} -DOBJDUMP=${CMAKE_OBJDUMP} -DELF=$<TARGET_FILE:pureboot_autobaud>
-	                 -DRAM_START=${PUREBOOT_RAM_START} -P ${CMAKE_CURRENT_SOURCE_DIR}/test/check_unit.cmake)
+	                 -DRAM_START=${PUREBOOT_RAM_START} -DGPIOR=${PUREBOOT_UNIT_GPIOR}
+	                 -P ${CMAKE_CURRENT_SOURCE_DIR}/test/check_unit.cmake)
 
 	# One point of the exhaustive matrix, named from its resolved parameters
 	# so the enumeration cannot collide with itself. `pins` is empty for the
@@ -538,5 +558,19 @@ if(PROJECT_IS_TOP_LEVEL)
 		                 1000000 9600 ${CMAKE_CURRENT_SOURCE_DIR}/pureboot/pureboot.py
 		                 ${CMAKE_BINARY_DIR}/pbautobaud-work)
 		set_tests_properties(pureboot.autobaud PROPERTIES TIMEOUT 240)
+
+		# The autobaud window: the calibration poll budget, at the measured
+		# 10 cycles a poll (pbwindow.py pins the constant the README's
+		# seconds arithmetic uses; the budget itself is the clock-free knob).
+		add_test(NAME pureboot.window.autobaud
+		         COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/test/pbwindow.py
+		                 --device ${PB_DEVICE} --loader $<TARGET_FILE:pureboot_autobaud>
+		                 --mcu ${PUREBOOT_SIM_MCU} --hz 1000000
+		                 --base ${PUREBOOT_BASE_HEX} --page ${PUREBOOT_PAGE}
+		                 --baud 9600 --app $<TARGET_FILE:pbapp_autobaud>.bin
+		                 --autobaud-polls 4000000 --link sw
+		                 --tool ${CMAKE_CURRENT_SOURCE_DIR}/pureboot/pureboot.py
+		                 --workdir ${CMAKE_BINARY_DIR}/pbwindow-autobaud-work)
+		set_tests_properties(pureboot.window.autobaud PROPERTIES TIMEOUT 300)
 	endif()
 endif()

ide/README.md

@@ -2,7 +2,7 @@
 
 `master` carries `bootloader.atsln`, so this branch does too: `ide/bootloader.atsln`
 builds the loaders from the same sources Ninja does, to a **byte-identical
-`.text`** — 404 B for the 328P pureboot loader, 510 B for the `tsb_asm` tier in
+`.text`** — 390 B for the 328P pureboot loader, 510 B for the `tsb_asm` tier in
 its 512-byte section. CMake remains the build system; the solution is here so the
 port opens in Studio as its predecessor did.
 

pureboot/CMakeLists.txt

@@ -138,15 +138,24 @@ endif()
 
 # Where SRAM begins: the classic megas keep it right after the plain I/O
 # registers, the x8/x4 generations push it past their extended I/O file, and
-# the tinies match the classics. An autobaud loader's measured unit lives at
+# the tinies match the classics. An autobaud loader keeps its measured unit
-# exactly this address (the host reads it there — pureboot.py), and the
+# in GPIOR2:GPIOR1 wherever the chip has the pair (data 0x32 on the
-# unit-position test holds the layout to it.
+# t25/45/85, 0x4A from the x8 generation on) and as the first RAM object at
+# SRAM start where it does not (the t13s and classic megas). The host reads
+# whichever home applies (pureboot.py's geometry), and the unit-position
+# test holds the image to the same split.
 if(LIBAVR_MCU MATCHES "^atmega(8|16|32)a?$")
 	set(_pb_ram 0x60)
+	set(_pb_unit_gpior "")
 elseif(LIBAVR_MCU MATCHES "^atmega")
 	set(_pb_ram 0x100)
+	set(_pb_unit_gpior 0x4A)
+elseif(LIBAVR_MCU MATCHES "^attiny13")
+	set(_pb_ram 0x60)
+	set(_pb_unit_gpior "")
 else()
 	set(_pb_ram 0x60)
+	set(_pb_unit_gpior 0x32)
 endif()
 
 # The function runs in its caller's scope, so everything it needs crosses
@@ -169,6 +178,7 @@ set(PUREBOOT_LIMIT ${_pb_limit} PARENT_SCOPE)
 set(PUREBOOT_EEPROM ${_pb_eeprom} PARENT_SCOPE)
 set(PUREBOOT_DEFAULT_HZ ${_pb_hz} PARENT_SCOPE)
 set(PUREBOOT_RAM_START ${_pb_ram} PARENT_SCOPE)
+set(PUREBOOT_UNIT_GPIOR "${_pb_unit_gpior}" PARENT_SCOPE)
 set(PUREBOOT_HAS_USART ${_pb_has_usart} PARENT_SCOPE)
 set(PUREBOOT_HAS_USART1 ${_pb_has_usart1} PARENT_SCOPE)
 set(PUREBOOT_SIM_MCU ${_pb_sim_mcu} PARENT_SCOPE)
@@ -366,9 +376,18 @@ function(pureboot_add_loader name)
 	# load-immediate it saves. The set is fitted to the loader's body and has to
 	# be re-measured when that body changes: -fno-move-loop-invariants belonged
 	# here while the command loop carried four transfer bodies and costs bytes
-	# now that it carries one.
+	# now that it carries one, and -fno-ivopts is fitted per backend — an
-	target_compile_options(${name} PRIVATE
+	# autobaud body needs ivopts to keep the calibration countdown a single
-	    -fno-ivopts -fira-algorithm=priority -fno-tree-ter -fno-split-wide-types)
+	# induction variable (without it the counter is duplicated and the
+	# measurement loop runs 9 cycles instead of its contracted 7), while the
+	# fixed-baud bodies still measure smaller with it off.
+	if(PB_SERIAL STREQUAL "autobaud")
+		target_compile_options(${name} PRIVATE
+		    -fira-algorithm=priority -fno-tree-ter -fno-split-wide-types)
+	else()
+		target_compile_options(${name} PRIVATE
+		    -fno-ivopts -fira-algorithm=priority -fno-tree-ter -fno-split-wide-types)
+	endif()
 	target_link_options(${name} PRIVATE -nostartfiles -Wl,--section-start=.text=${_base_hex}
 	                    -Wl,--defsym=pureboot_app=${_app} ${_wrap})
 	add_custom_command(TARGET ${name} POST_BUILD COMMAND ${CMAKE_SIZE} $<TARGET_FILE:${name}>)

pureboot/README.md

@@ -2,8 +2,8 @@
 
 A serial bootloader on [libavr](https://git.blackmark.me/avr/libavr), pure by
 constraint: one C++ source, no inline assembly, no global register variables
-(attributes and compiler flags allowed), **512 bytes on every chip libavr
+(attributes and compiler flags allowed), **a 512-byte slot on every chip
-targets — all 37**. The device speaks primitives; every composite — verify,
+libavr targets — all 37**. The device speaks primitives; every composite — verify,
 erase, reset-vector surgery, updating the loader itself — lives in the host
 tool (`pureboot.py`).
 
@@ -19,42 +19,42 @@ come out byte-identical linked at a different base.
 
 ## Chips
 
-Sizes are the default configuration: the hardware USART0 at 115200 8N1 on a
+The Stock column is the default configuration: the hardware USART0 at 115200
-16 MHz crystal, or the software UART on RX = PB0 / TX = PB1 at 57600 8N1 on
+8N1 on a 16 MHz crystal, or the software UART on RX = PB0 / TX = PB1 at
-the tinies' RC oscillator (9.6 MHz on the t13s, 8 MHz above). Every axis moves
+57600 8N1 on the tinies' RC oscillator (9.6 MHz on the t13s, 8 MHz above).
-per build — see *Configuration*. The autobaud column is the clock-free build,
+Every axis moves per build — see *Configuration*. The Autobaud column is the
-which is the largest the space produces and the tightest fit in the matrix;
+worst configuration the space produces for the chip: the clock-free build —
-it carries the calibration machinery and no clock at all.
+it alone carries the calibration machinery — with the `OSCCAL` trim baked
+and, where the chip has a USART, the link deployed on that USART's own pins,
+which the loader then has to release (*Pin ownership*). On default pins
+without the trim the same loaders run 4–10 B smaller.
 
 | Chip | Flash | Loader at | Link | Stock | Autobaud |
 |---|---|---|---|---|---|
-| ATtiny13, ATtiny13A † | 1 KiB | 0x0200 | software | 394 B | 464 B |
+| ATtiny13, ATtiny13A † | 1 KiB | 0x0200 | software | 384 B | 474 B |
-| ATtiny25 † | 2 KiB | 0x0600 | software | 398 B | 468 B |
+| ATtiny25 † | 2 KiB | 0x0600 | software | 388 B | 466 B |
-| ATtiny45 † | 4 KiB | 0x0e00 | software | 402 B | 472 B |
+| ATtiny45 † | 4 KiB | 0x0e00 | software | 388 B | 466 B |
-| ATtiny85 † | 8 KiB | 0x1e00 | software | 402 B | 472 B |
+| ATtiny85 † | 8 KiB | 0x1e00 | software | 388 B | 466 B |
-| ATmega8, 8A | 8 KiB | 0x1e00 | USART0 | 364 B | 478 B |
+| ATmega8, 8A | 8 KiB | 0x1e00 | USART0 | 362 B | 494 B |
-| ATmega16, 16A | 16 KiB | 0x3e00 | USART0 | 366 B | 482 B |
+| ATmega16, 16A | 16 KiB | 0x3e00 | USART0 | 364 B | 496 B |
-| ATmega32, 32A | 32 KiB | 0x7e00 | USART0 | 366 B | 482 B |
+| ATmega32, 32A | 32 KiB | 0x7e00 | USART0 | 364 B | 496 B |
-| ATmega48, 48A, 48P, 48PA † | 4 KiB | 0x0e00 | USART0 | 392 B | 468 B |
+| ATmega48, 48A, 48P, 48PA † | 4 KiB | 0x0e00 | USART0 | 378 B | 468 B |
-| ATmega88, 88A, 88P, 88PA | 8 KiB | 0x1e00 | USART0 | 402 B | 478 B |
+| ATmega88, 88A, 88P, 88PA | 8 KiB | 0x1e00 | USART0 | 388 B | 478 B |
-| ATmega168, 168A, 168P, 168PA | 16 KiB | 0x3e00 | USART0 | 404 B | 482 B |
+| ATmega168, 168A, 168P, 168PA | 16 KiB | 0x3e00 | USART0 | 390 B | 480 B |
-| ATmega328, 328P | 32 KiB | 0x7e00 | USART0 | 404 B | 482 B |
+| ATmega328, 328P | 32 KiB | 0x7e00 | USART0 | 390 B | 480 B |
-| ATmega164A, 164P, 164PA | 16 KiB | 0x3e00 | USART0 | 404 B | 482 B |
+| ATmega164A, 164P, 164PA | 16 KiB | 0x3e00 | USART0 | 390 B | 480 B |
-| ATmega324A, 324P, 324PA | 32 KiB | 0x7e00 | USART0 | 404 B | 482 B |
+| ATmega324A, 324P, 324PA | 32 KiB | 0x7e00 | USART0 | 390 B | 480 B |
-| ATmega644, 644A, 644P, 644PA | 64 KiB | 0xfe00 | USART0 | 398 B | 476 B |
+| ATmega644, 644A, 644P, 644PA | 64 KiB | 0xfe00 | USART0 | 384 B | 474 B |
-| ATmega1284, 1284P | 128 KiB | 0x1fe00 | USART0 | 424 B | 502 B |
+| ATmega1284, 1284P | 128 KiB | 0x1fe00 | USART0 | 410 B | 502 B |
 
 † No hardware boot section: the host patches the reset vector, and the budget
 is 510 bytes, since the slot's last word is the trampoline.
 
-The tightest fit in the whole space is the 1284s' autobaud build deployed on a
+The tightest fit in the whole space is therefore the 1284s' 502 of their
-USART's own pins with the `OSCCAL` trim baked, 510 of its 512 — they alone
+512: they alone carry the far-flash machinery (ELPM reads, RAMPZ page
-carry the far-flash machinery (ELPM reads, RAMPZ page commands), autobaud
+commands) on top of everything the column already stacks. The flash bank
-alone carries the calibration loop, a bit-banged link on a USART's pins alone
+riding in a transfer's selector byte keeps even those chips' addressing the
-has to release it (below), and the trim adds its one register write. Without
+same 16-bit form every other chip uses, which is why they are no longer the
-the trim that build is 504; on the default pins, 502. The flash bank riding
-in a transfer's selector byte keeps even those chips' addressing the same
-16-bit form every other chip uses, which is why they are no longer the
 outlier they were.
 
 The software UART enables the RX pull-up; TX idles high. All multi-byte wire
@@ -88,7 +88,8 @@ the usual one where a board's USB bridge is wired to RXD/TXD: the link's `init`
 clears that USART's `UCSRnB` first, because while its `TXEN` is set the USART —
 not the port register — owns the TX pin, and a loader entered from an
 application that left it enabled would receive and obey while answering nothing
-(§20.2). It costs four bytes, and only on those pins.
+(§20.6.3). It costs one store — four bytes on the extended-I/O chips, two on
+the classic megas — and only on those pins.
 
 `SERIAL autobaud` takes neither: the loader **measures** the host's bit timing
 at run time, so `CLOCK` and `BAUD` are not build parameters there and one
@@ -99,7 +100,10 @@ where a fixed-baud software build has to be rebuilt per clock and still drifts
 out of tolerance. The cost is that it is software-serial only (a hardware USART
 needs its divisor programmed) and that activation counts poll iterations rather
 than seconds, since there is no clock to convert them against
-(`PUREBOOT_AUTOBAUD_POLLS`, default 4,000,000).
+(`PUREBOOT_AUTOBAUD_POLLS`, default 4,000,000). The wait spends nine cycles a
+poll (measured, and held by the `pureboot.window.autobaud` gate), so the
+default window is 36 M cycles: 4.5 s at 8 MHz, 3.75 s at 9.6 MHz, 36 s at
+1 MHz.
 
 **Pick the rate by cycles a bit, and leave the oscillator room.** What the
 calibration can measure is bounded by how many clock cycles one bit lasts, so a
@@ -187,8 +191,10 @@ reply, repeat.
 
 Addresses are **byte addresses within a 64 KiB bank**, and the bank rides in
 the command's selector byte, so no command has to speak word addresses. `J` is
-the exception: it takes a word address, because that is what the hardware's own
+the exception: its address is a word address, because that is what the
-jump takes. EEPROM and data-space addresses and all counts are bytes.
+hardware's own jump takes — it still carries a selector byte (reserved,
+ignored) so its decode is the same three reads as every other command's.
+EEPROM and data-space addresses and all counts are bytes.
 
 The loader trusts the host to keep addresses in range: it does not bound them
 against the chip. **Gotcha:** a write (or read) that runs past `E2END` wraps —
@@ -203,7 +209,7 @@ better spent on features than on re-checking a bound the host already holds.
 | `G` | sel8, addr16, n8 | n bytes from the selected space (n = 0 means 256) |
 | `g` | sel8, addr16, n8, then n data bytes | `+` per byte, sent once its write has begun |
 | `W` | sel8, addr16, then one page of data | — (completion = next prompt) |
-| `J` | word address (16-bit) | `+`, then execution continues there |
+| `J` | sel8 (reserved), word address (16-bit) | `+`, then execution continues there |
 | other | — | ignored; the loop re-prompts (send a junk byte, await `+`, to resync) |
 
 `G` and `g` are one letter in two cases, which is the whole command set for
@@ -291,7 +297,12 @@ from `b`, and a command per memory (`R`/`W` flash, `r`/`w` EEPROM, `F` fuses).
 above; the shipped tool speaks both, choosing on the version it reads, so a
 deployed pureboot 4 stays drivable and self-updatable to 5. **6** changes
 nothing on the wire: it marks the builds that may carry a baked `OSCCAL` trim
-(Configuration), so a tool driving an update knows such images exist.
+(Configuration), so a tool driving an update knows such images exist. **7**
+moves `J` onto the unified decode — it gains the selector byte the table
+shows, which older loaders do not read, so the tool sends each form to the
+version that speaks it — and re-homes the autobaud unit into the GPIOR pair
+on the chips that have one (Session: what must not be written), which is
+where `--info`'s measured clock now reads it on those parts.
 
 Every closed generation is tagged in this repo at its era's last commit — the
 commit just before the next version bump, so a tag holds everything its
@@ -476,11 +487,14 @@ Reads are safe anywhere; **two small regions cannot be written without ending th
 session,** because they are what the loader is standing on:
 
 - the **top of SRAM**, where its stack lives — a handful of bytes below RAMEND;
-- on an **autobaud** build, the **two bytes at RAMSTART**: the measured bit
+- on an **autobaud** build, the **measured bit period**: two bytes in
-  period, in `.noinit`, which is the whole of that loader's static RAM. Overwrite
+  GPIOR2:GPIOR1 where the chip has the pair (data `0x32..0x33` on the
-  it and its next reply is timed against garbage. On an ATtiny13A that is
+  t25/45/85, `0x4A..0x4B` from the x8 generation on — such a loader has *no*
-  `0x60..0x61`, and the symptom is a mangled prompt byte rather than any error —
+  static RAM at all), and the two bytes at RAMSTART on the chips without one
-  the loader is fine, it simply is no longer speaking the agreed rate.
+  (the t13s and classic megas), where they are the whole of the loader's
+  static RAM. Overwrite either home and the next reply is timed against
+  garbage — the symptom is a mangled prompt byte rather than any error; the
+  loader is fine, it simply is no longer speaking the agreed rate.
 
 Both are self-inflicted rather than defects, and a reset clears them. Note also
 that `--poke` can write OSCCAL, which does take effect — but a session can only
@@ -518,9 +532,10 @@ Per chip preset, `ctest` runs:
   below sweeps. `pureboot*osccal*.size` add the `OSCCAL` trim on the stock
   shape and on the tightest image in the space (autobaud on a USART's own
   pins), holding both of the trim write's addressing encodings to the budget;
-- `pureboot_autobaud.unit` — the measured bit period is the loader's only RAM
+- `pureboot_autobaud.unit` — the measured bit period sits where `--info`
-  object and sits exactly at ram_start, where `--info` reads it: wire
+  reads it (wire contract, not layout accident): in the GPIOR pair, with no
-  contract, not layout accident;
+  RAM object at all, on the chips that have one; as the loader's only RAM
+  object at exactly ram_start elsewhere;
 - `pbm_*.size` — with `PUREBOOT_FULL_MATRIX=1`, the exhaustive cross product
   replacing that compact matrix, on **every** chip: every plausible oscillator
   (the internal ones, the CKDIV8 floor, the plain and the UART crystals) ×
@@ -551,7 +566,7 @@ Per chip preset, `ctest` runs:
   (`tools/make_presets.py --check`), so a hand edit or a generator change
   cannot drift the pair apart;
 - `pureboot.protocol` — end to end against a simavr device
-  (`test/pureboot_device.c`: a hardware USART as a pty, or a cycle-timed
+  (`test/pureboot_device.cpp`: a hardware USART as a pty, or a cycle-timed
   GPIO⇄pty bridge for a software-UART build, plus the SPM/NVM module simavr's
   tiny cores lack) driven by the real host tool through knock-from-reset,
   program + verify of both memories, session reconnect, an external reset

pureboot/pureboot.cpp

@@ -1,6 +1,6 @@
 // pureboot — a serial bootloader on libavr: one C++ source, no inline
-// assembly, no global register variables, 512 bytes on every chip libavr
+// assembly, no global register variables, a 512-byte slot on every chip
-// targets. The device speaks primitives; every composite (verify, erase,
+// libavr targets. The device speaks primitives; every composite (verify, erase,
 // reset-vector surgery, self-update) lives in the host tool. Protocol,
 // deployment and configuration: README.md next to this file.
 //
@@ -10,6 +10,8 @@
 // is what makes a copy one slot below able to rewrite the resident one, and
 // every change here has to keep it (test/check_pi.py).
 
+#include <chrono>
+
 #include <libavr/libavr.hpp>
 
 using namespace avr::literals;
@@ -38,13 +40,6 @@ using dev = avr::device<{.clock = avr::hertz_t{PUREBOOT_CLOCK_HZ}}>;
 constexpr avr::baud_t wire_baud{PUREBOOT_BAUD};
 #endif
 
-// The watchdog reset flag's home: MCUSR, or the classic megas' MCUCSR.
-consteval std::int16_t wdrf_field()
-{
-	auto reg = std::string_view{avr::hw::db.regs[static_cast<std::size_t>(avr::power::detail::reset_reg())].name};
-	return avr::hw::db.field_index(reg, "WDRF");
-}
-
 // The loader owns the top 512 bytes; a staging copy goes in the slot below.
 // Chips without a hardware boot section — the tinies and the m48s, whose SPM
 // runs from anywhere (Atmel-8271 §26) — keep the application's relocated
@@ -82,7 +77,7 @@ static_assert(PUREBOOT_OSCCAL >= 0 && PUREBOOT_OSCCAL <= 0xff, "PUREBOOT_OSCCAL
 
 // The loader's one identity number. The protocol carries none of its own —
 // a version implies it, and the host tool holds that map (README.md).
-constexpr std::uint8_t version = 6;
+constexpr std::uint8_t version = 7;
 
 // The image's identity stamp, for the host tool rather than for the wire: an
 // update image is a bare 512-byte slot, and without this nothing in it says
@@ -169,39 +164,30 @@ constexpr std::uint8_t bank_shift = 16 - slot_shift;
 #define PUREBOOT_TX pb1
 #endif
 #if defined(PUREBOOT_USART)
-constexpr char usart_digit = '0' + PUREBOOT_USART;
+constexpr int usart_unit = PUREBOOT_USART;
 #else
-constexpr char usart_digit = '0';
+constexpr int usart_unit = 0;
 #endif
 
-// Release a hardware USART the application may have left enabled onto a
-// bit-banged link's pins. A software transmitter drives its TX pin through the
-// port register, but while that USART's TXEN is set the USART owns the pin and
-// the port write does nothing — the loader would receive and obey yet never
-// answer. Writing UCSRnB zero hands the pin back to the port. Guarded on the
-// pin actually being a USART's TXD, so a link on non-USART pins emits nothing.
-template <char Inst, avr::io::pin Tx>
-[[gnu::always_inline]] inline void release_usart_on()
-{
-	if constexpr (avr::uart::has_usart<Inst>())
-		if constexpr (avr::uart::detail::usart_pin<Inst>("TXD") == Tx)
-			avr::hw::reg_impl<avr::uart::detail::ureg<Inst, "UCSR#B">()>::write(0);
-}
-
-template <avr::io::pin Tx>
-[[gnu::always_inline]] inline void release_usarts_on()
-{
-	release_usart_on<'0', Tx>();
-	release_usart_on<'1', Tx>();
-}
-
 template <avr::hertz_t C, avr::baud_t B>
 struct hardware_link {
-	using uart = avr::uart::usart<usart_digit, C, {.baud = B, .max_baud_error = 2.5_pct}>;
+	using uart = avr::uart::usart<usart_unit, C, {.baud = B, .max_baud_error = 2.5_pct}>;
 
-	// The compiled idle poll: lds UCSR0A (2), sbrc skipping the exit (2),
+	// The compiled idle poll around the window's narrow (uint24_t) countdown:
-	// sbiw + sbci + sbci + brne (6).
+	// the RXC test, then sbiw + sbci + brne (5). The test's cost follows the
-	static constexpr std::uint8_t poll_cycles = 10;
+	// status register's home — a 2-cycle bit-skip where UCSRnA sits in
+	// bit-addressable I/O (the classic megas), lds + skip (4) in extended
+	// I/O. A uint32_t countdown pays one more sbci — window_polls() adds it
+	// where the count forces the wide type. Held by the pureboot.window gate.
+	// The lookup rides the baud parameter so it stays dependent: the trait is
+	// an incomplete type on the USART-less chips, which parse this template
+	// without ever instantiating it.
+	template <avr::baud_t Baud, typename U = avr::hw::usart_of<usart_unit>>
+	static consteval std::uint8_t poll_cost()
+	{
+		return U::ucsra::addr < 0x40 ? 7 : 9;
+	}
+	static constexpr std::uint8_t poll_cycles = poll_cost<B>();
 
 	static void init()
 	{
@@ -225,7 +211,10 @@ struct hardware_link {
 
 	static void drain()
 	{
-		uart::drain();
+		// A drain here always follows this link's own write — the frame is
+		// in flight by construction, so the completion the wait needs is
+		// guaranteed and the bounded default's countdown would be dead bytes.
+		uart::drain_unbounded();
 	}
 };
 
@@ -234,14 +223,15 @@ struct software_link {
 	using rx_t = avr::uart::software_rx_polled<C, avr::PUREBOOT_RX, B>;
 	using tx_t = avr::uart::software_tx<C, avr::PUREBOOT_TX, B>;
 
-	// The compiled idle poll: sbis skipping the exit (2), sbiw + sbci +
+	// The compiled idle poll around the window's narrow (uint24_t) countdown:
-	// sbci + brne (6).
+	// sbis skipping the exit (2), sbiw + sbci + brne (5). A uint32_t
-	static constexpr std::uint8_t poll_cycles = 8;
+	// countdown pays one more sbci — window_polls() adds it where the count
+	// forces the wide type. Held by the pureboot.window gate.
+	static constexpr std::uint8_t poll_cycles = 7;
 
 	static void init()
 	{
 		avr::init<rx_t, tx_t>();
-		release_usarts_on<avr::PUREBOOT_TX>();
 	}
 
 	static bool pending()
@@ -270,12 +260,14 @@ struct software_link {
 // every rate. Activation differs in kind from the other two — there is no
 // clock to time a window against — so this backend brings its own, below.
 struct autobaud_link {
-	using uart = avr::uart::software_autobaud<avr::PUREBOOT_RX, avr::PUREBOOT_TX>;
+	// The unit in GPIOR2:GPIOR1 where the chip has them: the loader owns the
+	// whole chip while it runs, and the pair costs one word per access where
+	// the RAM word costs two — six words across the image.
+	using uart = avr::uart::software_autobaud<avr::PUREBOOT_RX, avr::PUREBOOT_TX, avr::uart::unit_home::gpior>;
 
 	static void init()
 	{
 		avr::init<uart>();
-		release_usarts_on<avr::PUREBOOT_TX>();
 	}
 
 	static std::uint8_t rx()
@@ -290,19 +282,22 @@ struct autobaud_link {
 
 	static void drain()
 	{
-		uart::drain();
+		// A drain here always follows this link's own write — the frame is
+		// in flight by construction, so the completion the wait needs is
+		// guaranteed and the bounded default's countdown would be dead bytes.
+		uart::drain_unbounded();
 	}
 };
 
 #if defined(PUREBOOT_AUTOBAUD)
 using link = autobaud_link;
 #elif defined(PUREBOOT_USART)
-static_assert(avr::uart::has_usart<usart_digit>(), "PUREBOOT_USART selects a hardware USART this chip does not have");
+static_assert(avr::uart::has_usart<usart_unit>(), "PUREBOOT_USART selects a hardware USART this chip does not have");
 using link = hardware_link<dev::clock, wire_baud>;
 #elif defined(PUREBOOT_SOFT_SERIAL)
 using link = software_link<dev::clock, wire_baud>;
 #else
-using link = std::conditional_t<avr::uart::has_usart<usart_digit>(), hardware_link<dev::clock, wire_baud>,
+using link = std::conditional_t<avr::uart::has_usart<usart_unit>(), hardware_link<dev::clock, wire_baud>,
                                 software_link<dev::clock, wire_baud>>;
 #endif
 
@@ -318,7 +313,7 @@ extern "C" [[noreturn]] void pureboot_app();
 	__builtin_unreachable();
 }
 
-[[gnu::noinline, noreturn]] void run_app()
+[[noreturn]] void run_app()
 {
 	jump(pureboot_app);
 }
@@ -344,16 +339,39 @@ void await_host()
 	}
 }
 #else
-// The window as one 32-bit countdown, divided by the backend's counted
+// The window as one countdown, divided by the backend's counted poll-loop
-// poll-loop cycles. Whole seconds is all it promises.
+// cycles. Whole seconds is all it promises. The per-poll cost depends on the
+// countdown's own width (a uint32_t decrement chain is one sbci longer), and
+// the width depends on the poll count — solved narrow-first: a count that
+// fits 24 bits at the narrow cost keeps the narrow loop, anything else takes
+// the wide loop at its own cost. A count fitting 24 bits only at the wide
+// cost stays wide, so the choice cannot oscillate on the boundary.
+consteval std::uint32_t polls_at(std::uint32_t per_poll)
+{
+	// Whole-window cycles first, then the per-poll division: one truncation
+	// instead of one per second. Same instructions either way — only the
+	// countdown's immediate moves.
+	return static_cast<std::uint32_t>(dev::cycles_for<std::chrono::seconds{timeout_seconds}>() / per_poll);
+}
+
+consteval bool narrow_window()
+{
+	return polls_at(link::poll_cycles) <= 0xffffff;
+}
+
 consteval std::uint32_t window_polls()
 {
-	return timeout_seconds * static_cast<std::uint32_t>(dev::clock.hz / link::poll_cycles);
+	return polls_at(narrow_window() ? link::poll_cycles : link::poll_cycles + 1u);
 }
 
+// The countdown in the narrowest type that holds it: a fourth byte would
+// cost a wider decrement chain at every poll for range most windows never
+// use (the autobaud budget makes the same choice).
+using window_t = std::conditional_t<narrow_window(), avr::uint24_t, std::uint32_t>;
+
 bool pending_before_deadline()
 {
-	std::uint32_t polls = window_polls();
+	window_t polls = window_polls();
 	do {
 		if (link::pending())
 			return true;
@@ -493,7 +511,7 @@ void fill_page(std::uint8_t bank, std::uint16_t at)
 #endif
 	// A watchdog reset belongs to the application, whose watchdog stays forced
 	// on until it clears WDRF — no activation window in its way.
-	if (avr::hw::field_impl<wdrf_field()>::test())
+	if (avr::power::peek_reset_cause().watchdog)
 		run_app();
 
 	link::init();
@@ -513,12 +531,6 @@ void fill_page(std::uint8_t bank, std::uint16_t at)
 		tx_ack();
 		const std::uint8_t command = link::rx();
 		switch (command) {
-		case 'J': { // jump to a wire word address: hand-over and staging transfer
-			auto target = reinterpret_cast<void (*)()>(rx16());
-			tx_ack();
-			link::drain();
-			jump(target);
-		}
 		case 'b': // identity: the version, then the three signature bytes
 			// Straight out of the stamp, so the wire and the image can never
 			// disagree about what this loader is. The indices are constant and
@@ -527,18 +539,26 @@ void fill_page(std::uint8_t bank, std::uint16_t at)
 			for (std::uint8_t at = stamp_identity; at != sizeof identity_stamp; ++at)
 				link::tx(identity_stamp[at]);
 			break;
+		case 'J':   // jump:  sel8 (reserved), addr16 as a wire word address
 		case 'W':   // fill one flash page buffer: sel8, addr16, then page bytes
 		case 'G':   // read:  sel8, addr16, n8 (0 = 256)
 		case 'g': { // write: sel8, addr16, n8, then n bytes, each acked
-			// One decode, one cursor and one loop for every space and both
+			// One decode, one cursor and one loop for every space, both
-			// directions: a command per memory would carry a copy of all three
+			// directions and the jump: a command per memory would carry a copy
-			// each. 'W' joins the same decode rather than keeping an address
+			// of all three each. 'J' — the hand-over and staging transfer —
-			// form of its own, so flash addressing is uniform across every
+			// carries a selector it ignores so its address rides the same two
-			// command that names it.
+			// reads as everything else; 'W' joins the same decode rather than
+			// keeping an address form of its own, so flash addressing is
+			// uniform across every command that names it.
 			const std::uint8_t selector = link::rx();
 			const std::uint8_t space = space_of(selector);
 			const std::uint8_t bank = bank_of(selector);
 			std::uint16_t at = rx16();
+			if (command == 'J') {
+				tx_ack();
+				link::drain();
+				jump(reinterpret_cast<void (*)()>(at));
+			}
 			if (command == 'W') {
 				fill_page(bank, at);
 				break;
@@ -565,4 +585,7 @@ void fill_page(std::uint8_t bank, std::uint16_t at)
 } // namespace
 } // namespace pureboot
 
-template struct avr::startup::entry<pureboot::run>;
+// stack::hardware: activation is reset-only, so the reset logic's own
+// SP = RAMEND stands wherever the datasheet guarantees it (the classic
+// megas still get the write); a 'J' entry runs on the caller's live stack.
+template struct avr::startup::entry<pureboot::run, avr::startup::stack::hardware>;

pureboot/pureboot.py

@@ -26,7 +26,7 @@ else:
     import termios
 
 PROMPT = b"+"
-VERSION = 6  # this tool's own version — free to drift from a loader's
+VERSION = 8  # this tool's own version — free to drift from a loader's
 # The loader versions this tool can drive. A pureboot version implies its wire
 # protocol, which carries no number of its own, so this window is where that
 # map lives: the tool keeps a decoder for every generation in it (1–4 speak
@@ -34,7 +34,7 @@ VERSION = 6  # this tool's own version — free to drift from a loader's
 # builds and changes nothing on the wire), and a version it has no decoder
 # for moves the floor.
 OLDEST_LOADER = 1
-NEWEST_LOADER = 6
+NEWEST_LOADER = 7
 SLOT = 512  # the loader slot, on every chip
 RETRIES = 3  # rewrites of a page that reads back wrong, before the run stops
 
@@ -42,14 +42,20 @@ RETRIES = 3  # rewrites of a page that reads back wrong, before the run stops
 # 'g' writes, each taking a selector byte, a 16-bit address and a count, over
 # the spaces below. The loader carries one transfer loop instead of four bodies
 # — which is what buys the data space and the host-issued SPM operations.
+# 6 marks the builds that may carry a baked OSCCAL trim, nothing on the wire;
+# 7 gives 'J' a selector byte (older loaders take the bare address — jump()
+# sends each form to the version that speaks it) and re-homes the autobaud
+# unit into the GPIOR pair where the chip has one.
 UNIFIED_LOADER = 5
 SP_FLASH, SP_EEPROM, SP_RAM, SP_FUSE, SP_SPM = 0, 1, 2, 3, 4
 
-# A v5+ autobaud loader keeps its measured bit period at ram_start, encoded
+# An autobaud loader keeps its measured bit period readable, encoded as
-# as delay-loop counts: (bit cycles − UNIT_DISCOUNT) / UNIT_LOOP_CYCLES,
+# delay-loop counts: (bit cycles − UNIT_DISCOUNT) / UNIT_LOOP_CYCLES,
 # floored — the spin granule and per-bit overhead of libavr's software UART.
-# --info undoes the encoding to report the true clock, which therefore sits
+# v5/v6 keep it at ram_start; v7 moves it into GPIOR2:GPIOR1 on the chips
-# within one granule below it.
+# that have the pair (their data addresses are in the geometry) and keeps
+# ram_start only where they do not exist. --info undoes the encoding to
+# report the true clock, which therefore sits within one granule below it.
 UNIT_LOOP_CYCLES, UNIT_DISCOUNT = 4, 8
 
 # A selector's high nibble is the flash bank — the address bits above the 16-bit
@@ -77,36 +83,40 @@ CALIBRATE = 0xC0
 # from its chip database at build time). Die revisions that share a signature
 # share this row, as they share the silicon.
 CHIP_GEOMETRY = {
-    #  signature  : (flash, page, eeprom, patch_vector, ram_start)
+    #  signature  : (flash, page, eeprom, patch_vector, ram_start, gpior1)
     # ram_start is where SRAM begins in data space: the classic megas and the
     # tinies keep it right after the plain I/O registers (0x60), the x8/x4
-    # generations past their extended I/O file (0x100). An autobaud loader's
+    # generations past their extended I/O file (0x100). gpior1 is GPIOR1's
-    # measured bit period lives at exactly ram_start (its only RAM object;
+    # data address — 0x32 on the t25/45/85, 0x4A from the x8 generation on,
-    # the loader's own build pins the layout), which is what --info reads.
+    # None where the chip has no pair (t13, classic megas). A v7 autobaud
-    (0x1E, 0x90, 0x07): (1024, 32, 64, True, 0x60),      # ATtiny13/13A
+    # loader's measured bit period lives in GPIOR2:GPIOR1 where they exist
-    (0x1E, 0x91, 0x08): (2048, 32, 128, True, 0x60),     # ATtiny25
+    # and at exactly ram_start elsewhere (its only RAM object; the loader's
-    (0x1E, 0x92, 0x06): (4096, 64, 256, True, 0x60),     # ATtiny45
+    # own build pins the layout); v5/v6 always used ram_start. --info reads
-    (0x1E, 0x93, 0x0B): (8192, 64, 512, True, 0x60),     # ATtiny85
+    # whichever home the answering version implies.
-    (0x1E, 0x92, 0x05): (4096, 64, 256, True, 0x100),    # ATmega48/48A
+    (0x1E, 0x90, 0x07): (1024, 32, 64, True, 0x60, None),       # ATtiny13/13A
-    (0x1E, 0x92, 0x0A): (4096, 64, 256, True, 0x100),    # ATmega48P/48PA
+    (0x1E, 0x91, 0x08): (2048, 32, 128, True, 0x60, 0x32),      # ATtiny25
-    (0x1E, 0x93, 0x07): (8192, 64, 512, False, 0x60),    # ATmega8/8A
+    (0x1E, 0x92, 0x06): (4096, 64, 256, True, 0x60, 0x32),      # ATtiny45
-    (0x1E, 0x93, 0x0A): (8192, 64, 512, False, 0x100),   # ATmega88/88A
+    (0x1E, 0x93, 0x0B): (8192, 64, 512, True, 0x60, 0x32),      # ATtiny85
-    (0x1E, 0x93, 0x0F): (8192, 64, 512, False, 0x100),   # ATmega88P/88PA
+    (0x1E, 0x92, 0x05): (4096, 64, 256, True, 0x100, 0x4A),     # ATmega48/48A
-    (0x1E, 0x94, 0x03): (16384, 128, 512, False, 0x60),  # ATmega16/16A
+    (0x1E, 0x92, 0x0A): (4096, 64, 256, True, 0x100, 0x4A),     # ATmega48P/48PA
-    (0x1E, 0x94, 0x06): (16384, 128, 512, False, 0x100), # ATmega168/168A
+    (0x1E, 0x93, 0x07): (8192, 64, 512, False, 0x60, None),     # ATmega8/8A
-    (0x1E, 0x94, 0x0B): (16384, 128, 512, False, 0x100), # ATmega168P/168PA
+    (0x1E, 0x93, 0x0A): (8192, 64, 512, False, 0x100, 0x4A),    # ATmega88/88A
-    (0x1E, 0x94, 0x0A): (16384, 128, 512, False, 0x100), # ATmega164P/164PA
+    (0x1E, 0x93, 0x0F): (8192, 64, 512, False, 0x100, 0x4A),    # ATmega88P/88PA
-    (0x1E, 0x94, 0x0F): (16384, 128, 512, False, 0x100), # ATmega164A
+    (0x1E, 0x94, 0x03): (16384, 128, 512, False, 0x60, None),   # ATmega16/16A
-    (0x1E, 0x95, 0x02): (32768, 128, 1024, False, 0x60),  # ATmega32/32A
+    (0x1E, 0x94, 0x06): (16384, 128, 512, False, 0x100, 0x4A),  # ATmega168/168A
-    (0x1E, 0x95, 0x0F): (32768, 128, 1024, False, 0x100), # ATmega328P
+    (0x1E, 0x94, 0x0B): (16384, 128, 512, False, 0x100, 0x4A),  # ATmega168P/168PA
-    (0x1E, 0x95, 0x14): (32768, 128, 1024, False, 0x100), # ATmega328
+    (0x1E, 0x94, 0x0A): (16384, 128, 512, False, 0x100, 0x4A),  # ATmega164P/164PA
-    (0x1E, 0x95, 0x08): (32768, 128, 1024, False, 0x100), # ATmega324P
+    (0x1E, 0x94, 0x0F): (16384, 128, 512, False, 0x100, 0x4A),  # ATmega164A
-    (0x1E, 0x95, 0x11): (32768, 128, 1024, False, 0x100), # ATmega324PA
+    (0x1E, 0x95, 0x02): (32768, 128, 1024, False, 0x60, None),  # ATmega32/32A
-    (0x1E, 0x95, 0x15): (32768, 128, 1024, False, 0x100), # ATmega324A
+    (0x1E, 0x95, 0x0F): (32768, 128, 1024, False, 0x100, 0x4A), # ATmega328P
-    (0x1E, 0x96, 0x09): (65536, 256, 2048, False, 0x100), # ATmega644/644A
+    (0x1E, 0x95, 0x14): (32768, 128, 1024, False, 0x100, 0x4A), # ATmega328
-    (0x1E, 0x96, 0x0A): (65536, 256, 2048, False, 0x100), # ATmega644P/644PA
+    (0x1E, 0x95, 0x08): (32768, 128, 1024, False, 0x100, 0x4A), # ATmega324P
-    (0x1E, 0x97, 0x05): (131072, 256, 4096, False, 0x100),# ATmega1284P
+    (0x1E, 0x95, 0x11): (32768, 128, 1024, False, 0x100, 0x4A), # ATmega324PA
-    (0x1E, 0x97, 0x06): (131072, 256, 4096, False, 0x100),# ATmega1284
+    (0x1E, 0x95, 0x15): (32768, 128, 1024, False, 0x100, 0x4A), # ATmega324A
+    (0x1E, 0x96, 0x09): (65536, 256, 2048, False, 0x100, 0x4A), # ATmega644/644A
+    (0x1E, 0x96, 0x0A): (65536, 256, 2048, False, 0x100, 0x4A), # ATmega644P/644PA
+    (0x1E, 0x97, 0x05): (131072, 256, 4096, False, 0x100, 0x4A),# ATmega1284P
+    (0x1E, 0x97, 0x06): (131072, 256, 4096, False, 0x100, 0x4A),# ATmega1284
 }
 
 VERBOSE = False
@@ -450,7 +460,7 @@ class Info:
         if geometry is None:
             sig = " ".join(f"{b:02x}" for b in signature)
             raise Error(f"unknown signature {sig} — this tool has no geometry for it")
-        flash, page, eeprom, patch, _ = geometry
+        flash, page, eeprom, patch, _, _ = geometry
         base = flash - SLOT
         word_flash = flash > 0x10000
         wire_base = base // 2 if word_flash else base
@@ -491,6 +501,11 @@ class Info:
         # permits where from_identity refuses.
         geometry = CHIP_GEOMETRY.get(tuple(self.signature))
         self.ram = geometry[4] if geometry else None
+        # Where this loader keeps the measured bit period (None when a fixed
+        # signature row is missing): the GPIOR pair from v7 where the chip
+        # has one, ram_start before that and everywhere without the pair.
+        gpior1 = geometry[5] if geometry else None
+        self.unit_home = gpior1 if self.version >= 7 and gpior1 is not None else self.ram
 
     def describe(self):
         sig = " ".join(f"{b:02x}" for b in self.signature)
@@ -531,6 +546,11 @@ class Loader:
         # Set once a session is established over an autobaud link, so a
         # re-entry after 'J' repeats the handshake that worked.
         self.autobaud = False
+        # The pre-knock drain runs once per port: the bytes it exists for are
+        # leftovers from before this process opened the port. Re-knocks later
+        # in the same session must not pay it — a fresh activation window is
+        # already burning while they wait.
+        self._line_drained = False
         # The link this session is speaking. It moves when the host follows a
         # staging copy built for another one (enter_copy).
         self.baud = getattr(port, "baud", None)
@@ -540,10 +560,16 @@ class Loader:
         """The 'b' reply, in either of the two layouts a loader may send.
         pureboot 5 answers with its version and the signature; older loaders
         answer with a 12-byte block. The version byte cannot be mistaken for
-        the older block's 'P', so four bytes are enough to tell them apart."""
+        the older block's 'P', so four bytes are enough to tell them apart.
-        head = self.port.read_exact(4, 2.0)
+
+        The timeout is short on purpose: a real answer follows the prompt
+        within a frame time or two, so half a second is dozens of times the
+        worst case — while a *false* prompt match (a stale byte, reset
+        garbage) makes this read collect noise, and every second spent on it
+        comes out of the activation window the retry needs."""
+        head = self.port.read_exact(4, 0.5)
         if head[0:2] == b"PB":
-            return Info(head + self.port.read_exact(8, 2.0))
+            return Info(head + self.port.read_exact(8, 0.5))
         return Info.from_identity(head)
 
     def _handshake(self, wait, knock, what):
@@ -554,8 +580,23 @@ class Loader:
         into a fresh window, where a command without its knock is discarded.
         Each attempt is therefore the whole handshake. This also converges into
         an already-live session: the knock bytes are ignored there and the
-        drain absorbs whatever they produced."""
+        drain absorbs whatever they produced.
+
+        Before the port's first knock ever, the line is drained until quiet: a
+        prompt from a previous session (`--stay`) can still be in the USB
+        pipeline when the port opens, where a flush cannot clear what has not
+        arrived yet — and on a board that resets when its port opens, trusting
+        that stale byte would spend the fresh activation window reading noise
+        from a device that never heard the knock. Once only, and bounded:
+        later re-knocks in this session face no foreign leftovers, and their
+        own window is already burning."""
         deadline = time.monotonic() + wait
+        if not self._line_drained:
+            self._line_drained = True
+            drain = time.monotonic() + 0.25
+            while self.port.read_available(0.05):
+                if time.monotonic() > drain:
+                    break
         knocks = 0
         refusal = None
         while True:
@@ -745,8 +786,13 @@ class Loader:
         return self._command(b"F", 4, 2.0)
 
     def jump(self, word_address):
-        """The device acks, then execution continues at the word address."""
+        """The device acks, then execution continues at the word address.
-        self.port.write(bytes((ord("J"), word_address & 0xFF, word_address >> 8)))
+        From v7 'J' rides the unified decode, so it carries a selector byte
+        the loader ignores; older loaders take the bare address."""
+        if self.info.version >= 7:
+            self.port.write(bytes((ord("J"), 0, word_address & 0xFF, word_address >> 8)))
+        else:
+            self.port.write(bytes((ord("J"), word_address & 0xFF, word_address >> 8)))
         self._expect_prompt()
 
     def enter_copy(self, byte_address, wait, link=None):
@@ -1541,14 +1587,14 @@ def main():
             print("device:")
             for line in info.lines():
                 print(f"  {line}")
-            if args.autobaud and info.ram is not None:
+            if args.autobaud and info.unit_home is not None:
-                # The whole of the loader's RAM is the measured bit period at
+                # The measured bit period, from wherever this version keeps it
-                # ram_start; decoded and times the rate this session drives,
+                # (unit_home); decoded and times the rate this session drives,
                 # that is the true clock — the number to hold an OSCCAL bake
                 # or a fixed-baud build against (README.md: deployment). The
-                # autobaud identity path refuses unknown signatures, so ram is
+                # autobaud identity path refuses unknown signatures, so the
-                # always known here; the guard states that dependency.
+                # home is always known here; the guard states that dependency.
-                unit = int.from_bytes(loader.read_ram(info.ram, 2), "little")
+                unit = int.from_bytes(loader.read_ram(info.unit_home, 2), "little")
                 cycles = unit * UNIT_LOOP_CYCLES + UNIT_DISCOUNT
                 clock = cycles * args.baud
                 offset = f", {(clock / args.clock - 1) * 100:+.1f} % of {args.clock}" if args.clock else ""

test/check_unit.cmake

@@ -1,7 +1,10 @@
-# Asserts the autobaud loader's measured unit is the first RAM object: the
+# Asserts the autobaud loader's measured unit sits where the host will read
-# host tool reads the bit period from ram_start (--info's measured clock), so
+# it (--info's measured clock — the address is wire contract). Two homes: on
-# the unit's address is wire contract. Run as
+# a chip with the GPIOR pair the unit lives there and the image must carry no
-#   cmake -DOBJDUMP=... -DELF=... -DRAM_START=<data address> -P check_unit.cmake
+# RAM word for it at all; elsewhere it is the first RAM object at SRAM start.
+# Run as
+#   cmake -DOBJDUMP=... -DELF=... -DRAM_START=<data address> [-DGPIOR=<data address>]
+#         -P check_unit.cmake
 
 execute_process(COMMAND ${OBJDUMP} -t ${ELF} OUTPUT_VARIABLE _syms RESULT_VARIABLE _res)
 if(NOT _res EQUAL 0)
@@ -9,7 +12,17 @@ if(NOT _res EQUAL 0)
 endif()
 
 # The symbol line: "00800100 l     O .noinit  00000002 <mangled>unit_E".
-string(REGEX MATCH "\n0*([0-9a-f]+)[^\n]+[ \t][^ \t\n]*unit_[^ \t\n]*\n" _line "${_syms}")
+string(REGEX MATCH "\n0*([0-9a-f]+)[^\n]+[ \t][^ \t\n]*unit_E\n" _line "${_syms}")
+
+if(GPIOR)
+	if(_line)
+		message(FATAL_ERROR "unit_ RAM symbol present although the unit's home is GPIOR ${GPIOR} — "
+		                    "the host peeks the pair, and a RAM copy would be dead weight")
+	endif()
+	message(STATUS "no unit_ RAM object — the unit lives in the GPIOR pair at ${GPIOR}")
+	return()
+endif()
+
 if(NOT _line)
 	message(FATAL_ERROR "no unit_ symbol in ${ELF} — is this the autobaud loader?")
 endif()

test/device.cpp

@@ -7,62 +7,71 @@
 // SPM genuinely writes avr->flash on the mega cores, so on exit (or SIGTERM)
 // we dump the flash image to a file for a ground-truth cross-check against
 // what the client read back through the bootloader.
-#include <signal.h>
+#include <csignal>
-#include <stdint.h>
+#include <cstdint>
-#include <stdio.h>
+#include <cstdio>
-#include <stdlib.h>
+#include <cstdlib>
-#include <string.h>
+#include <cstring>
+#include <print>
+
 #include <unistd.h>
 
+// The parts headers (uart_pty.h) carry no C++ linkage guards of their own,
+// unlike simavr's core headers — the block covers both harmlessly.
+extern "C" {
 #include "avr_uart.h"
 #include "sim_avr.h"
 #include "sim_elf.h"
 #include "uart_pty.h"
+}
 
-static avr_t *avr;
+namespace {
-static uart_pty_t uart_pty;
-static const char *dump_path;
 
-static void finish(int sig)
+avr_t *avr;
+uart_pty_t uart_pty;
+const char *dump_path;
+
+[[noreturn]] void finish(int)
 {
-	(void)sig;
 	if (dump_path) {
-		FILE *f = fopen(dump_path, "wb");
+		std::FILE *f = std::fopen(dump_path, "wb");
 		if (f) {
-			fwrite(avr->flash, 1, avr->flashend + 1, f);
+			std::fwrite(avr->flash, 1, avr->flashend + 1, f);
-			fclose(f);
+			std::fclose(f);
 		}
 	}
 	uart_pty_stop(&uart_pty);
 	_exit(0);
 }
 
+} // namespace
+
 int main(int argc, char *argv[])
 {
 	if (argc < 3) {
-		fprintf(stderr, "usage: %s <tsb.elf> <boot_base_hex> [flash_dump.bin]\n", argv[0]);
+		std::println(stderr, "usage: {} <tsb.elf> <boot_base_hex> [flash_dump.bin]", argv[0]);
 		return 2;
 	}
-	uint32_t boot_base = (uint32_t)strtoul(argv[2], NULL, 0);
+	auto boot_base = static_cast<std::uint32_t>(std::strtoul(argv[2], nullptr, 0));
-	dump_path = argc >= 4 ? argv[3] : NULL;
+	dump_path = argc >= 4 ? argv[3] : nullptr;
 
 	avr = avr_make_mcu_by_name("atmega328p");
 	if (!avr) {
-		fprintf(stderr, "device: no ATmega328P core\n");
+		std::println(stderr, "device: no ATmega328P core");
 		return 1;
 	}
 	avr_init(avr);
 	avr->frequency = 16000000;
 	// Real flash powers up erased (0xff); the app region must look erased
 	// before the bootloader programs it.
-	memset(avr->flash, 0xff, avr->flashend + 1);
+	std::memset(avr->flash, 0xff, avr->flashend + 1);
 
 	// simavr's ELF loader flattens the flash base to 0 (it expects an app at
 	// 0x0), but it hands back the boot code in fw.flash; place it at the boot
 	// section base ourselves and enter there (BOOTRST is not modelled).
-	elf_firmware_t fw = {0};
+	elf_firmware_t fw{};
 	if (elf_read_firmware(argv[1], &fw) != 0) {
-		fprintf(stderr, "device: cannot read %s\n", argv[1]);
+		std::println(stderr, "device: cannot read {}", argv[1]);
 		return 1;
 	}
 	// An image that runs past flash end cannot execute on hardware, and a
@@ -70,23 +79,23 @@ int main(int argc, char *argv[])
 	// the simulation misbehaves in ways that point everywhere but here.
 	// Refuse it loudly instead.
 	if (boot_base + fw.flashsize > avr->flashend + 1) {
-		fprintf(stderr, "device: %u B at 0x%x runs past flash end 0x%x — image does not fit its slot\n",
+		std::println(stderr, "device: {} B at {:#x} runs past flash end {:#x} — image does not fit its slot",
-		        (unsigned)fw.flashsize, boot_base, avr->flashend);
+		             fw.flashsize, boot_base, avr->flashend);
 		return 1;
 	}
-	memcpy(avr->flash + boot_base, fw.flash, fw.flashsize);
+	std::memcpy(avr->flash + boot_base, fw.flash, fw.flashsize);
 	avr->pc = boot_base;
 	avr->codeend = avr->flashend;
 
 	// Optional: seed the config page (one page below the boot section) with a
 	// hex byte string, so the password gate and emergency erase can be tested.
 	// Layout: [appjump lo][appjump hi][timeout][password...][0xff].
-	const char *cfg = getenv("TSB_CONFIG");
+	const char *cfg = std::getenv("TSB_CONFIG");
 	if (cfg) {
-		uint32_t app_end = boot_base - 128; // config page sits directly below the boot code
+		std::uint32_t app_end = boot_base - 128; // config page sits directly below the boot code
 		for (int i = 0; cfg[i] && cfg[i + 1]; i += 2) {
 			char b[3] = {cfg[i], cfg[i + 1], 0};
-			avr->flash[app_end + i / 2] = (uint8_t)strtoul(b, NULL, 16);
+			avr->flash[app_end + i / 2] = static_cast<std::uint8_t>(std::strtoul(b, nullptr, 16));
 		}
 	}
 
@@ -95,18 +104,18 @@ int main(int argc, char *argv[])
 	// tight-polling loader (one that releases TX between bytes, as one-wire does)
 	// in real time, distorting protocol timing. Clear it so the loader runs at
 	// true cycle speed.
-	uint32_t uflags = 0;
+	std::uint32_t uflags = 0;
 	avr_ioctl(avr, AVR_IOCTL_UART_GET_FLAGS('0'), &uflags);
 	uflags &= ~AVR_UART_FLAG_POLL_SLEEP;
 	avr_ioctl(avr, AVR_IOCTL_UART_SET_FLAGS('0'), &uflags);
 
 	uart_pty_init(avr, &uart_pty);
 	uart_pty_connect(&uart_pty, '0');
-	printf("TSB_PTY %s\n", uart_pty.pty.slavename);
+	std::println("TSB_PTY {}", uart_pty.pty.slavename);
-	fflush(stdout);
+	std::fflush(stdout);
 
-	signal(SIGTERM, finish);
+	std::signal(SIGTERM, finish);
-	signal(SIGINT, finish);
+	std::signal(SIGINT, finish);
 
 	for (;;) {
 		int state = avr_run(avr);
@@ -114,5 +123,4 @@ int main(int argc, char *argv[])
 			break;
 	}
 	finish(0);
-	return 0;
 }

test/pbapp.cpp

@@ -50,7 +50,7 @@ consteval bool use_hardware()
 #if defined(PUREBOOT_SOFT_SERIAL)
 	return false;
 #else
-	return avr::hw::db.has_instance("USART0") || avr::hw::db.has_instance("USART");
+	return avr::uart::has_usart<0>();
 #endif
 }
 
@@ -63,7 +63,7 @@ struct link {
 #else
 	static constexpr avr::baud_t baud{115200};
 #endif
-	using tx_t = avr::uart::usart<'0' + PUREBOOT_USART, C, {.baud = baud, .max_baud_error = 2.5_pct}>;
+	using tx_t = avr::uart::usart<PUREBOOT_USART, C, {.baud = baud, .max_baud_error = 2.5_pct}>;
 	static void tx(char c)
 	{
 		tx_t::write(static_cast<std::uint8_t>(c));

test/pbautobaud.py

@@ -64,8 +64,9 @@ def main():
             for needed in ("version", "signature", "fuses", "verify:", "stays"):
                 if needed not in out:
                     fail(f"{label}: session output lacks {needed!r}\n{out}")
-            # The measured clock, decoded from the unit at ram_start. The
+            # The measured clock, decoded from the unit at whichever home this
-            # runner's clock is exact, so the figure must land inside the
+            # version keeps it in. The runner's clock is exact, so the figure
+            # must land inside the
             # encoding's own envelope: the loader floors the bit period to
             # 4-cycle spin granules after an 8-cycle discount, and the edge
             # poll can shave a few cycles more — one granule of slack below

test/pbmute.py

@@ -10,7 +10,7 @@ The state is reached the way silicon reaches it — an application that sets up
 its USART and jumps in with no reset between, so nothing clears UCSRnB for it.
 The pin ownership itself is modelled by the device runner: simavr wires a
 USART through IRQs alone and never takes the pin from the port, so without
-that the mute could not happen here at all (test/pureboot_device.c).
+that the mute could not happen here at all (test/pureboot_device.cpp).
 
 Usage: pbmute.py <device_bin> <pureboot_elf> <mcu> <hz> <base_hex> <page>
                  <baud> <app_bin> <tool_py> <workdir> <link>

test/pbsim.py

@@ -8,10 +8,13 @@ import subprocess
 
 
 class Device:
-    def __init__(self, binary, elf, mcu, hz, base_hex, page, baud, dump, reset_hex=None, resume=None, link=None):
+    def __init__(self, binary, elf, mcu, hz, base_hex, page, baud, dump, reset_hex=None, resume=None, link=None,
+                 window=False):
         cmd = [binary]
         if link:
             cmd += ["-l", link]
+        if window:
+            cmd.append("-w")  # report the first-transmit cycle, free-run idle
         cmd += [elf, mcu, hz, base_hex, str(page), str(baud), dump]
         if reset_hex is not None or resume is not None:
             # Chips without a hardware boot section — the tinies and the

test/pbwindow.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""The activation window as a behavioral duration gate.
+
+The loader's window is a counted poll loop whose per-poll cost is hand-counted
+in the source (`link::poll_cycles`) — but the loop compiles in consumer
+context, so only the running image can prove the count. This test installs a
+real application beside the loader (the host tool's own `plan_flash` supplies
+the reset-vector surgery), starts the simulator with the line idle, and reads
+the cycle of the first transmit activity: nothing talks until the window
+closes and the application banners, so that cycle *is* the window, give or
+take a banner lead measured in microseconds. Asserted at ±2 % — one
+mis-counted cycle per poll shifts a window by 10 % and more.
+
+Fixed-baud loaders declare their window in seconds (--seconds, the build's
+TIMEOUT). The autobaud loader's window is its calibration poll budget
+(--autobaud-polls); the seconds it amounts to are budget × 10 / f_cpu, the
+measured cost of the calibrate() wait loop this gate pins.
+"""
+import argparse
+import importlib.util
+import pathlib
+import select
+import sys
+import time
+
+sys.path.insert(0, str(pathlib.Path(__file__).resolve().parent))
+from pbsim import Device
+
+# The calibrate() budget loop's cycles per poll in the built image — what the
+# README's window arithmetic rests on, verified here. A measured fact, not a
+# design constant: the wait's exit branches land where the compiler's block
+# layout puts them, and the bounded-calibration rework moved the loop from
+# ten cycles to nine.
+AUTOBAUD_POLL_CYCLES = 9
+
+
+def load_tool(path):
+    spec = importlib.util.spec_from_file_location("pureboot", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def compose_flash(pb, loader_bytes, app_bytes, mcu, base, page):
+    """The flash image a completed programming session leaves: application
+    (with the tinies' vector surgery), loader at base — built through the
+    host tool's own planner so the surgery is the shipped one, not a copy."""
+    flash_size = base + pb.SLOT
+    patch = not mcu.startswith("atmega") or mcu.startswith("atmega48")
+    word_flash = flash_size > 0x10000
+    wire_base = base // 2 if word_flash else base
+    flags = (1 if patch else 0) | (2 if word_flash else 0)
+    raw = bytes((ord("P"), ord("B"), 5, 0, 0, 0, page & 0xFF,
+                 wire_base & 0xFF, wire_base >> 8, 0, 0, flags))
+    info = pb.Info(raw)
+
+    flash = bytearray(b"\xff" * flash_size)
+    for address, content in pb.plan_flash(app_bytes, info).items():
+        flash[address:address + len(content)] = content
+    flash[base:base + len(loader_bytes)] = loader_bytes
+    return bytes(flash)
+
+
+def first_tx_cycle(device, deadline):
+    """The PB_WINDOW_TX report, or None. The runner prints it once."""
+    stream = device.proc.stdout
+    while True:
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            return None
+        ready, _, _ = select.select([stream], [], [], remaining)
+        if not ready:
+            return None
+        line = stream.readline()
+        if not line:
+            return None
+        if line.startswith("PB_WINDOW_TX"):
+            return int(line.split()[1])
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--device", required=True)
+    parser.add_argument("--loader", required=True)
+    parser.add_argument("--mcu", required=True)
+    parser.add_argument("--hz", type=int, required=True)
+    parser.add_argument("--base", required=True)
+    parser.add_argument("--page", type=int, required=True)
+    parser.add_argument("--baud", type=int, required=True)
+    parser.add_argument("--app", required=True)
+    parser.add_argument("--tool", required=True)
+    parser.add_argument("--workdir", required=True)
+    parser.add_argument("--link", default=None)
+    parser.add_argument("--seconds", type=float, default=None)
+    parser.add_argument("--autobaud-polls", type=int, default=None)
+    args = parser.parse_args()
+    if (args.seconds is None) == (args.autobaud_polls is None):
+        parser.error("exactly one of --seconds / --autobaud-polls")
+
+    pb = load_tool(args.tool)
+    base = int(args.base, 0)
+    expected = (args.seconds if args.seconds is not None
+                else args.autobaud_polls * AUTOBAUD_POLL_CYCLES / args.hz)
+
+    work = pathlib.Path(args.workdir)
+    work.mkdir(parents=True, exist_ok=True)
+    # Every loader target objcopies its slot content beside the ELF (.bin).
+    loader_bytes = pathlib.Path(args.loader + ".bin").read_bytes()
+    app_bytes = pathlib.Path(args.app).read_bytes()
+    flash_file = work / "window-flash.bin"
+    flash_file.write_bytes(compose_flash(pb, loader_bytes, app_bytes, args.mcu, base, args.page))
+
+    device = Device(args.device, args.loader, args.mcu, str(args.hz), args.base, args.page,
+                    args.baud, str(work / "window-dump.bin"), resume=str(flash_file),
+                    link=args.link, window=True)
+    try:
+        # Simulation speed is machine-dependent; a few hundred thousand
+        # cycles per wall second is the pessimistic floor.
+        budget = max(60.0, expected * args.hz / 300000)
+        cycle = first_tx_cycle(device, time.monotonic() + budget)
+    finally:
+        device.stop()
+
+    if cycle is None:
+        print(f"  [FAIL] no transmit activity within {budget:.0f} s wall "
+              f"(expected a {expected:.2f} s window)")
+        return 1
+    measured = cycle / args.hz
+    error = (measured - expected) / expected
+    ok = abs(error) <= 0.02
+    print(f"  [{'PASS' if ok else 'FAIL'}] window {measured:.3f} s vs declared "
+          f"{expected:.3f} s ({error:+.1%}, gate ±2%)")
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

test/pureboot_device.cpp

@@ -23,16 +23,22 @@
 //
 // On exit (or SIGTERM) the flash and EEPROM are dumped to files for a
 // ground-truth cross-check against what the host read back.
+#include <csignal>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <print>
+#include <string_view>
+
 #include <fcntl.h>
 #include <pty.h>
-#include <signal.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <termios.h>
 #include <unistd.h>
 
+// The parts headers (uart_pty.h) carry no C++ linkage guards of their own,
+// unlike simavr's core headers — the block covers both harmlessly.
+extern "C" {
 #include "avr_eeprom.h"
 #include "avr_flash.h"
 #include "avr_ioport.h"
@@ -41,31 +47,58 @@
 #include "sim_elf.h"
 #include "sim_io.h"
 #include "uart_pty.h"
+}
 
-static avr_t *avr;
+namespace {
-static uart_pty_t uart_pty;
-static int link_software;
-static char uart_digit = '0';
-static char sw_rx_port = 'B', sw_tx_port = 'B';
-static int sw_rx_bit = 0, sw_tx_bit = 1;
-static char sw_tx_owner = 0; // the USART whose TXD the software link sits on
-static const char *dump_path;
-static uint32_t reset_pc;
-static volatile sig_atomic_t reset_requested;
 
-static int parse_link(const char *spec)
+avr_t *avr;
+uart_pty_t uart_pty;
+bool link_software;
+char uart_digit = '0';
+char sw_rx_port = 'B', sw_tx_port = 'B';
+int sw_rx_bit = 0, sw_tx_bit = 1;
+char sw_tx_owner = 0; // the USART whose TXD the software link sits on
+const char *dump_path;
+std::uint32_t reset_pc;
+volatile std::sig_atomic_t reset_requested;
+
+// -w: report the cycle of the first transmit activity, once. What the
+// activation-window gate reads — with an idle line and an application
+// installed, the first thing that ever talks is the application's banner,
+// so this cycle *is* the loader's window plus a banner lead measured in
+// microseconds. Idle pacing is skipped in this mode: there is no real-time
+// host in the loop, and a paced multi-second window would take hours.
+bool window_report;
+bool window_tx_seen;
+
+void window_first_tx()
 {
-	if (strcmp(spec, "usart0") == 0 || strcmp(spec, "usart1") == 0) {
+	if (!window_report || window_tx_seen)
-		link_software = 0;
+		return;
+	window_tx_seen = true;
+	std::println("PB_WINDOW_TX {}", avr->cycle);
+	std::fflush(stdout);
+}
+
+void window_uart_hook(avr_irq_t *, std::uint32_t, void *)
+{
+	window_first_tx();
+}
+
+int parse_link(std::string_view spec)
+{
+	if (spec == "usart0" || spec == "usart1") {
+		link_software = false;
 		uart_digit = spec[5];
 		return 0;
 	}
-	if (strncmp(spec, "sw", 2) == 0) {
+	if (spec.starts_with("sw")) {
-		link_software = 1;
+		link_software = true;
-		if (spec[2] == '\0')
+		if (spec.size() == 2)
 			return 0;
 		char owner = 0;
-		int fields = sscanf(spec + 2, ":%c%d,%c%d@%c", &sw_rx_port, &sw_rx_bit, &sw_tx_port, &sw_tx_bit, &owner);
+		int fields =
+		    std::sscanf(spec.data() + 2, ":%c%d,%c%d@%c", &sw_rx_port, &sw_rx_bit, &sw_tx_port, &sw_tx_bit, &owner);
 		if (fields == 4 || fields == 5) {
 			sw_tx_owner = owner;
 			return 0;
@@ -87,19 +120,19 @@ static int parse_link(const char *spec)
 // core — so the discard store falls through into the buffer-fill branch and
 // plants whatever Z/R1:R0 happen to hold. Perform the silicon's discard
 // here instead.
-static avr_flash_t *mega_flash;
+avr_flash_t *mega_flash;
-static int (*mega_flash_ioctl)(avr_io_t *io, uint32_t ctl, void *param);
+int (*mega_flash_ioctl)(avr_io_t *io, std::uint32_t ctl, void *param);
 
-static int fixed_flash_ioctl(avr_io_t *io, uint32_t ctl, void *param)
+int fixed_flash_ioctl(avr_io_t *io, std::uint32_t ctl, void *param)
 {
 	if (ctl == AVR_IOCTL_FLASH_SPM && avr_regbit_get(io->avr, mega_flash->pgers)) {
-		uint16_t z = (uint16_t)(io->avr->data[30] | (io->avr->data[31] << 8));
+		auto z = static_cast<std::uint16_t>(io->avr->data[30] | (io->avr->data[31] << 8));
-		uint16_t masked = (uint16_t)(z & ~(mega_flash->spm_pagesize - 1));
+		auto masked = static_cast<std::uint16_t>(z & ~(mega_flash->spm_pagesize - 1));
-		io->avr->data[30] = (uint8_t)masked;
+		io->avr->data[30] = static_cast<std::uint8_t>(masked);
-		io->avr->data[31] = (uint8_t)(masked >> 8);
+		io->avr->data[31] = static_cast<std::uint8_t>(masked >> 8);
 		int result = mega_flash_ioctl(io, ctl, param);
-		io->avr->data[30] = (uint8_t)z;
+		io->avr->data[30] = static_cast<std::uint8_t>(z);
-		io->avr->data[31] = (uint8_t)(z >> 8);
+		io->avr->data[31] = static_cast<std::uint8_t>(z >> 8);
 		return result;
 	}
 	if (ctl == AVR_IOCTL_FLASH_SPM && !(mega_flash->flags & AVR_SELFPROG_HAVE_RWW) &&
@@ -114,46 +147,44 @@ static int fixed_flash_ioctl(avr_io_t *io, uint32_t ctl, void *param)
 	return mega_flash_ioctl(io, ctl, param);
 }
 
-static void fix_mega_flash_erase(void)
+void fix_mega_flash_erase()
 {
 	for (avr_io_t *io = avr->io_port; io; io = io->next) {
-		if (io->kind && strcmp(io->kind, "flash") == 0) {
+		if (io->kind && std::string_view{io->kind} == "flash") {
-			mega_flash = (avr_flash_t *)io;
+			mega_flash = reinterpret_cast<avr_flash_t *>(io);
 			mega_flash_ioctl = io->ioctl;
 			io->ioctl = fixed_flash_ioctl;
 			return;
 		}
 	}
-	fprintf(stderr, "device: no flash module to fix — SPM page erases may misalign\n");
+	std::println(stderr, "device: no flash module to fix — SPM page erases may misalign");
 }
 
-static void request_reset(int sig)
+void request_reset(int)
 {
-	(void)sig;
 	reset_requested = 1;
 }
 
 // ------------------------------------------------------------- tiny NVM ---
 
-typedef struct {
+struct tiny_nvm_t {
 	avr_io_t io;
-	uint8_t buffer[128];
+	std::uint8_t buffer[128];
-	uint8_t used[128]; // a buffer word loads once until erased — like silicon
+	std::uint8_t used[128]; // a buffer word loads once until erased — like silicon
 	unsigned page;
-} tiny_nvm_t;
+};
 
-static tiny_nvm_t nvm;
+tiny_nvm_t nvm;
 
-static int nvm_ioctl(avr_io_t *io, uint32_t ctl, void *param)
+int nvm_ioctl(avr_io_t *io, std::uint32_t ctl, void *)
 {
-	(void)param;
 	if (ctl != AVR_IOCTL_FLASH_SPM)
 		return -1;
-	tiny_nvm_t *n = (tiny_nvm_t *)io;
+	auto *n = reinterpret_cast<tiny_nvm_t *>(io);
 	avr_t *mcu = io->avr;
-	uint8_t command = mcu->data[0x57] & 0x1f; // SPMCSR, both tinies
+	std::uint8_t command = mcu->data[0x57] & 0x1f; // SPMCSR, both tinies
-	uint16_t z = (uint16_t)(mcu->data[30] | (mcu->data[31] << 8));
+	auto z = static_cast<std::uint16_t>(mcu->data[30] | (mcu->data[31] << 8));
-	uint32_t page_base = (uint32_t)(z & ~(n->page - 1)) % (mcu->flashend + 1);
+	std::uint32_t page_base = static_cast<std::uint32_t>(z & ~(n->page - 1)) % (mcu->flashend + 1);
 	if (command == 0x01) { // SPMEN alone: buffer fill from r1:r0
 		unsigned offset = z & (n->page - 1) & ~1u;
 		if (!n->used[offset]) { // first write wins until the buffer clears
@@ -162,46 +193,58 @@ static int nvm_ioctl(avr_io_t *io, uint32_t ctl, void *param)
 			n->used[offset] = 1;
 		}
 	} else if (command == 0x03) { // PGERS
-		memset(mcu->flash + page_base, 0xff, n->page);
+		std::memset(mcu->flash + page_base, 0xff, n->page);
 	} else if (command == 0x05) { // PGWRT: programming only clears bits
 		for (unsigned i = 0; i < n->page; i++)
 			mcu->flash[page_base + i] &= n->buffer[i];
-		memset(n->buffer, 0xff, n->page);
+		std::memset(n->buffer, 0xff, n->page);
-		memset(n->used, 0, n->page);
+		std::memset(n->used, 0, n->page);
 	} else if (command == 0x11) { // CTPB
-		memset(n->buffer, 0xff, n->page);
+		std::memset(n->buffer, 0xff, n->page);
-		memset(n->used, 0, n->page);
+		std::memset(n->used, 0, n->page);
 	}
-	mcu->data[0x57] &= (uint8_t)~0x1f; // the operation completes instantly
+	mcu->data[0x57] &= static_cast<std::uint8_t>(~0x1f); // the operation completes instantly
 	return 0;
 }
 
 // ----------------------------------------------------------- GPIO bridge ---
 
-static int pty_master = -1;
+int pty_master = -1;
-static avr_irq_t *rx_pin; // the loader's RX (PB0), driven from the pty
+avr_irq_t *rx_pin; // the loader's RX (PB0), driven from the pty
-static avr_cycle_count_t bit_cycles;
+avr_cycle_count_t bit_cycles;
 
-static int tx_level = 1, tx_active, tx_bit;
+int tx_level = 1, tx_active, tx_bit;
-static uint8_t tx_shift;
+std::uint8_t tx_shift;
 
-static avr_cycle_count_t tx_sample(avr_t *mcu, avr_cycle_count_t when, void *param)
+avr_cycle_count_t tx_sample(avr_t *, avr_cycle_count_t when, void *)
 {
-	(void)mcu;
+	if (tx_bit < 0) {
-	(void)param;
+		// Half a bit into the start bit: a real receiver re-samples here and
+		// abandons a false start. The device's own init produces one — DDR
+		// drives the pin low for the instructions until the idle level is
+		// written — and without this check that glitch decodes as a stray
+		// byte (and would read as first transmit activity under -w).
+		if (tx_level) {
+			tx_active = 0;
+			return 0;
+		}
+		window_first_tx();
+		tx_bit = 0;
+		return when + bit_cycles;
+	}
 	if (tx_bit < 8) {
-		tx_shift = (uint8_t)((tx_shift >> 1) | (tx_level ? 0x80 : 0));
+		tx_shift = static_cast<std::uint8_t>((tx_shift >> 1) | (tx_level ? 0x80 : 0));
 		if (++tx_bit < 8)
 			return when + bit_cycles;
-		/* The byte is delivered at the stop bit's sampling point (9.5 bit
+		// The byte is delivered at the stop bit's sampling point (9.5 bit
-		 * times), where a hardware receiver raises its RXC — not sooner: a
+		// times), where a hardware receiver raises its RXC — not sooner: a
-		 * host answering before the stop bit would put its start bit on the
+		// host answering before the stop bit would put its start bit on the
-		 * wire while the device is still driving, which the device,
+		// wire while the device is still driving, which the device,
-		 * transmitting, is not watching for. */
+		// transmitting, is not watching for.
 		return when + bit_cycles;
 	}
 	if (write(pty_master, &tx_shift, 1) != 1)
-		fprintf(stderr, "device: pty write lost a byte\n");
+		std::println(stderr, "device: pty write lost a byte");
 	tx_active = 0;
 	return 0;
 }
@@ -213,9 +256,9 @@ static avr_cycle_count_t tx_sample(avr_t *mcu, avr_cycle_count_t when, void *par
 // model, so the ownership does not exist there and the mute cannot happen:
 // supply it, or the very state this models is untestable. The link spec's
 // trailing @n names the USART; without one the pins are nobody's.
-static avr_uart_t *tx_owner;
+avr_uart_t *tx_owner;
 
-static int tx_pin_taken(void)
+bool tx_pin_taken()
 {
 	return tx_owner && avr_regbit_get(avr, tx_owner->txen);
 }
@@ -225,51 +268,48 @@ static int tx_pin_taken(void)
 // enabled, making a freshly reset chip mute for reasons hardware does not
 // have. Reset it the way the datasheet does, so the ownership starts from
 // nobody's and only an application that really enables the USART takes it.
-static void reset_tx_owner(void)
+void reset_tx_owner()
 {
 	if (tx_owner)
 		avr_regbit_clear(avr, tx_owner->txen);
 }
 
-static void find_tx_owner(void)
+void find_tx_owner()
 {
 	for (avr_io_t *io = avr->io_port; io; io = io->next)
-		if (io->kind && strcmp(io->kind, "uart") == 0 && ((avr_uart_t *)io)->name == sw_tx_owner) {
+		if (io->kind && std::string_view{io->kind} == "uart" &&
-			tx_owner = (avr_uart_t *)io;
+		    reinterpret_cast<avr_uart_t *>(io)->name == sw_tx_owner) {
+			tx_owner = reinterpret_cast<avr_uart_t *>(io);
 			reset_tx_owner();
 			return;
 		}
-	fprintf(stderr, "device: no USART%c to own the software link's TX pin\n", sw_tx_owner);
+	std::println(stderr, "device: no USART{} to own the software link's TX pin", sw_tx_owner);
 }
 
-static void tx_hook(avr_irq_t *irq, uint32_t value, void *param)
+void tx_hook(avr_irq_t *, std::uint32_t value, void *)
 {
-	(void)irq;
-	(void)param;
 	if (tx_pin_taken()) { // the USART holds the line; the port write goes nowhere
 		tx_level = 1;
 		return;
 	}
 	int level = value & 1;
-	if (!tx_active && tx_level == 1 && level == 0) { // start edge
+	if (!tx_active && tx_level == 1 && level == 0) { // start edge, confirmed mid-bit
 		tx_active = 1;
-		tx_bit = 0;
+		tx_bit = -1;
-		avr_cycle_timer_register(avr, bit_cycles + bit_cycles / 2, tx_sample, NULL);
+		avr_cycle_timer_register(avr, bit_cycles / 2, tx_sample, nullptr);
 	}
 	tx_level = level;
 }
 
-static uint8_t rx_queue[8192];
+std::uint8_t rx_queue[8192];
-static unsigned rx_head, rx_tail; // ring: head = next to send
+unsigned rx_head, rx_tail; // ring: head = next to send
-static int rx_active, rx_bit;
+int rx_active, rx_bit;
-static uint8_t rx_byte;
+std::uint8_t rx_byte;
 
-static void rx_start_next(void);
+void rx_start_next();
 
-static avr_cycle_count_t rx_step(avr_t *mcu, avr_cycle_count_t when, void *param)
+avr_cycle_count_t rx_step(avr_t *, avr_cycle_count_t when, void *)
 {
-	(void)mcu;
-	(void)param;
 	if (rx_bit < 8) {
 		avr_raise_irq(rx_pin, (rx_byte >> rx_bit) & 1);
 		rx_bit++;
@@ -285,7 +325,7 @@ static avr_cycle_count_t rx_step(avr_t *mcu, avr_cycle_count_t when, void *param
 	return 0;
 }
 
-static void rx_start_next(void)
+void rx_start_next()
 {
 	if (rx_active || rx_head == rx_tail)
 		return;
@@ -294,7 +334,7 @@ static void rx_start_next(void)
 	rx_active = 1;
 	rx_bit = 0;
 	avr_raise_irq(rx_pin, 0); // start bit
-	avr_cycle_timer_register(avr, bit_cycles, rx_step, NULL);
+	avr_cycle_timer_register(avr, bit_cycles, rx_step, nullptr);
 }
 
 // A reset abandons whatever the bridge was mid-transfer: bytes still queued
@@ -304,20 +344,29 @@ static void rx_start_next(void)
 // output latch, whose falling edge starts a spurious decode before this
 // runs, and a stale tx_sample would then interleave with the loader's first
 // real answer through the shared shift state, corrupting it.
-static void bridge_reset(void)
+void bridge_reset()
 {
-	avr_cycle_timer_cancel(avr, tx_sample, NULL);
+	avr_cycle_timer_cancel(avr, tx_sample, nullptr);
-	avr_cycle_timer_cancel(avr, rx_step, NULL);
+	avr_cycle_timer_cancel(avr, rx_step, nullptr);
 	rx_head = rx_tail = 0;
 	rx_active = 0;
 	tx_active = 0;
 	tx_level = 1;
-	avr_raise_irq(rx_pin, 1); // idle line
+	// Re-drive the idle line through a forced transition: ioport pin irqs are
+	// IRQ_FLAG_FILTERED, and avr_reset zeroes the port latch while the irq
+	// keeps its pre-reset cached value — so a plain raise(1) against a cached
+	// 1 is dropped and the device reads the line stuck low. A loader entering
+	// calibration on that line measures reset-to-first-edge as one giant
+	// pulse and mis-locks or boots the application on the first real knock.
+	// No cycles run between the two raises, so the device only ever sees the
+	// final idle-high.
+	avr_raise_irq(rx_pin, 0);
+	avr_raise_irq(rx_pin, 1);
 }
 
-static void poll_pty(void)
+void poll_pty()
 {
-	uint8_t chunk[256];
+	std::uint8_t chunk[256];
 	ssize_t got = read(pty_master, chunk, sizeof(chunk));
 	for (ssize_t i = 0; i < got; i++) {
 		unsigned next = (rx_tail + 1) % sizeof(rx_queue);
@@ -332,23 +381,22 @@ static void poll_pty(void)
 
 // ------------------------------------------------------------------ main ---
 
-static void finish(int sig)
+[[noreturn]] void finish(int)
 {
-	(void)sig;
 	if (dump_path) {
-		FILE *f = fopen(dump_path, "wb");
+		std::FILE *f = std::fopen(dump_path, "wb");
 		if (f) {
-			fwrite(avr->flash, 1, avr->flashend + 1, f);
+			std::fwrite(avr->flash, 1, avr->flashend + 1, f);
-			fclose(f);
+			std::fclose(f);
 		}
-		avr_eeprom_desc_t ee = {.ee = NULL, .offset = 0, .size = 0};
+		avr_eeprom_desc_t ee = {.ee = nullptr, .offset = 0, .size = 0};
 		if (avr_ioctl(avr, AVR_IOCTL_EEPROM_GET, &ee) == 0 && ee.ee && ee.size) {
 			char path[512];
-			snprintf(path, sizeof(path), "%s.eeprom", dump_path);
+			std::snprintf(path, sizeof(path), "%s.eeprom", dump_path);
-			f = fopen(path, "wb");
+			f = std::fopen(path, "wb");
 			if (f) {
-				fwrite(ee.ee, 1, ee.size, f);
+				std::fwrite(ee.ee, 1, ee.size, f);
-				fclose(f);
+				std::fclose(f);
 			}
 		}
 	}
@@ -357,85 +405,93 @@ static void finish(int sig)
 	_exit(0);
 }
 
+} // namespace
+
 int main(int argc, char *argv[])
 {
-	int link_given = 0;
+	bool link_given = false;
-	for (int opt; (opt = getopt(argc, argv, "l:")) != -1;) {
+	for (int opt; (opt = getopt(argc, argv, "l:w")) != -1;) {
+		if (opt == 'w') {
+			window_report = true;
+			continue;
+		}
 		if (opt != 'l' || parse_link(optarg) != 0) {
-			fprintf(stderr, "device: bad link spec (usart0, usart1, sw, or sw:B0,B1 as RX,TX)\n");
+			std::println(stderr, "device: bad link spec (usart0, usart1, sw, or sw:B0,B1 as RX,TX)");
 			return 2;
 		}
-		link_given = 1;
+		link_given = true;
 	}
 	int args = argc - optind;
 	if (args < 7 || args > 9) {
-		fprintf(stderr,
+		std::print(stderr,
-		        "usage: %s [-l link] <pureboot.elf> <mcu> <hz> <base_hex> <page> <baud> <flash_dump>"
+		           "usage: {} [-l link] [-w] <pureboot.elf> <mcu> <hz> <base_hex> <page> <baud> <flash_dump>"
-		        " [reset_hex] [resume_flash]\n"
+		           " [reset_hex] [resume_flash]\n"
-		        "  -l link:      usart0 | usart1 | sw[:B0,B1[@0]] (RX,TX, then the USART owning\n"
+		           "  -l link:      usart0 | usart1 | sw[:B0,B1[@0]] (RX,TX, then the USART owning\n"
-		        "                them); default: the chip's own\n"
+		           "                them); default: the chip's own\n"
-		        "  reset_hex:    reset vector (default: base with a boot section, else 0)\n"
+		           "  -w:           print PB_WINDOW_TX <cycle> at the first transmit activity and\n"
-		        "  resume_flash: raw full-flash image loaded instead of the ELF — a prior\n"
+		           "                free-run idle time (window measurement mode)\n"
-		        "                run's dump, for power-fail resume tests\n",
+		           "  reset_hex:    reset vector (default: base with a boot section, else 0)\n"
-		        argv[0]);
+		           "  resume_flash: raw full-flash image loaded instead of the ELF — a prior\n"
+		           "                run's dump, for power-fail resume tests\n",
+		           argv[0]);
 		return 2;
 	}
 	argv += optind - 1; // argv[1] is the ELF again, whatever was parsed
-	const char *mcu_name = argv[2];
+	const std::string_view mcu_name = argv[2];
-	uint32_t base = (uint32_t)strtoul(argv[4], NULL, 0);
+	auto base = static_cast<std::uint32_t>(std::strtoul(argv[4], nullptr, 0));
-	unsigned page = (unsigned)atoi(argv[5]);
+	auto page = static_cast<unsigned>(std::atoi(argv[5]));
-	unsigned baud = (unsigned)atoi(argv[6]);
+	auto baud = static_cast<unsigned>(std::atoi(argv[6]));
 	dump_path = argv[7];
-	int is_mega = strncmp(mcu_name, "atmega", 6) == 0;
+	const bool is_mega = mcu_name.starts_with("atmega");
 	if (!link_given)
 		link_software = !is_mega; // the chips' natural links: USART0, or PB0/PB1
 
-	avr = avr_make_mcu_by_name(mcu_name);
+	avr = avr_make_mcu_by_name(mcu_name.data());
 	if (!avr) {
-		fprintf(stderr, "device: no %s core\n", mcu_name);
+		std::println(stderr, "device: no {} core", mcu_name);
 		return 1;
 	}
 	avr_init(avr);
-	avr->frequency = (uint32_t)strtoul(argv[3], NULL, 0);
+	avr->frequency = static_cast<std::uint32_t>(std::strtoul(argv[3], nullptr, 0));
-	memset(avr->flash, 0xff, avr->flashend + 1); // real flash powers up erased
+	std::memset(avr->flash, 0xff, avr->flashend + 1); // real flash powers up erased
 
 	if (args > 8) {
 		// Resume: the full flash image of an interrupted prior run.
-		FILE *f = fopen(argv[9], "rb");
+		std::FILE *f = std::fopen(argv[9], "rb");
-		if (!f || fread(avr->flash, 1, avr->flashend + 1, f) == 0) {
+		if (!f || std::fread(avr->flash, 1, avr->flashend + 1, f) == 0) {
-			fprintf(stderr, "device: cannot read %s\n", argv[9]);
+			std::println(stderr, "device: cannot read {}", argv[9]);
 			return 1;
 		}
-		fclose(f);
+		std::fclose(f);
 	} else {
-		elf_firmware_t fw = {0};
+		elf_firmware_t fw{};
 		if (elf_read_firmware(argv[1], &fw) != 0) {
-			fprintf(stderr, "device: cannot read %s\n", argv[1]);
+			std::println(stderr, "device: cannot read {}", argv[1]);
 			return 1;
 		}
 		// An image past flash end would smash the simulator's heap and turn
 		// into phantom peripheral behavior (lessons: believe the size gate
 		// first) — refuse it loudly instead.
 		if (base + fw.flashsize > avr->flashend + 1) {
-			fprintf(stderr, "device: %u B at 0x%x runs past flash end 0x%x — image does not fit its slot\n",
+			std::println(stderr, "device: {} B at {:#x} runs past flash end {:#x} — image does not fit its slot",
-			        (unsigned)fw.flashsize, base, avr->flashend);
+			             fw.flashsize, base, avr->flashend);
 			return 1;
 		}
-		memcpy(avr->flash + base, fw.flash, fw.flashsize);
+		std::memcpy(avr->flash + base, fw.flash, fw.flashsize);
 	}
 	// The boot-sectioned megas enter the loader in hardware (BOOTRST, not
 	// modeled — the argument picks the modeled fuse's target); the tinies
 	// and the boot-section-less m48s reset to word 0 like silicon — erased
 	// flash walks up into the loader, and after the host's surgery the
 	// patched vector routes there.
-	int boot_section = is_mega && strncmp(mcu_name, "atmega48", 8) != 0;
+	const bool boot_section = is_mega && !mcu_name.starts_with("atmega48");
-	reset_pc = args > 7 ? (uint32_t)strtoul(argv[8], NULL, 0) : (boot_section ? base : 0);
+	reset_pc = args > 7 ? static_cast<std::uint32_t>(std::strtoul(argv[8], nullptr, 0)) : (boot_section ? base : 0);
 	avr->pc = reset_pc;
 	avr->codeend = avr->flashend;
 
 	// Erased EEPROM, as hardware powers up (simavr zeroes it).
-	uint8_t blank[1024];
+	std::uint8_t blank[1024];
-	memset(blank, 0xff, sizeof(blank));
+	std::memset(blank, 0xff, sizeof(blank));
 	avr_eeprom_desc_t seed = {.ee = blank, .offset = 0, .size = 0};
 	if (avr_ioctl(avr, AVR_IOCTL_EEPROM_GET, &seed) == 0 && seed.size <= sizeof(blank)) {
 		seed.ee = blank;
@@ -449,7 +505,7 @@ int main(int argc, char *argv[])
 		fix_mega_flash_erase();
 	} else {
 		nvm.page = page;
-		memset(nvm.buffer, 0xff, sizeof(nvm.buffer));
+		std::memset(nvm.buffer, 0xff, sizeof(nvm.buffer));
 		nvm.io.kind = "tiny_nvm";
 		nvm.io.ioctl = nvm_ioctl;
 		avr_register_io(avr, &nvm.io);
@@ -458,37 +514,41 @@ int main(int argc, char *argv[])
 	if (!link_software) {
 		// POLL_SLEEP paces an idle-polling loader in host real time (a
 		// no-hardware CPU-saving hack); clear it so cycles run free.
-		uint32_t flags = 0;
+		std::uint32_t flags = 0;
 		avr_ioctl(avr, AVR_IOCTL_UART_GET_FLAGS(uart_digit), &flags);
 		flags &= ~AVR_UART_FLAG_POLL_SLEEP;
 		avr_ioctl(avr, AVR_IOCTL_UART_SET_FLAGS(uart_digit), &flags);
 		uart_pty_init(avr, &uart_pty);
 		uart_pty_connect(&uart_pty, uart_digit);
-		printf("PB_PTY %s\n", uart_pty.pty.slavename);
+		if (window_report)
+			avr_irq_register_notify(avr_io_getirq(avr, AVR_IOCTL_UART_GETIRQ(uart_digit), UART_IRQ_OUTPUT),
+			                        window_uart_hook, nullptr);
+		std::println("PB_PTY {}", uart_pty.pty.slavename);
 	} else {
 		bit_cycles = (avr->frequency + baud / 2) / baud; // matches uart.hpp's own rounding exactly
 		if (sw_tx_owner)
 			find_tx_owner();
-		rx_pin = avr_io_getirq(avr, AVR_IOCTL_IOPORT_GETIRQ(sw_rx_port), (unsigned)sw_rx_bit);
+		rx_pin = avr_io_getirq(avr, AVR_IOCTL_IOPORT_GETIRQ(sw_rx_port), static_cast<unsigned>(sw_rx_bit));
-		avr_irq_register_notify(avr_io_getirq(avr, AVR_IOCTL_IOPORT_GETIRQ(sw_tx_port), (unsigned)sw_tx_bit), tx_hook,
+		avr_irq_register_notify(
-		                        NULL);
+		    avr_io_getirq(avr, AVR_IOCTL_IOPORT_GETIRQ(sw_tx_port), static_cast<unsigned>(sw_tx_bit)), tx_hook,
+		    nullptr);
 		avr_raise_irq(rx_pin, 1); // idle line
 
 		int slave;
 		struct termios raw;
 		cfmakeraw(&raw);
-		if (openpty(&pty_master, &slave, NULL, &raw, NULL) != 0) {
+		if (openpty(&pty_master, &slave, nullptr, &raw, nullptr) != 0) {
-			fprintf(stderr, "device: openpty failed\n");
+			std::println(stderr, "device: openpty failed");
 			return 1;
 		}
 		fcntl(pty_master, F_SETFL, O_NONBLOCK);
-		printf("PB_PTY %s\n", ttyname(slave));
+		std::println("PB_PTY {}", ttyname(slave));
 	}
-	fflush(stdout);
+	std::fflush(stdout);
 
-	signal(SIGTERM, finish);
+	std::signal(SIGTERM, finish);
-	signal(SIGINT, finish);
+	std::signal(SIGINT, finish);
-	signal(SIGUSR1, request_reset); // an external reset line, for the tests
+	std::signal(SIGUSR1, request_reset); // an external reset line, for the tests
 
 	long since_poll = 0;
 	for (;;) {
@@ -500,7 +560,7 @@ int main(int argc, char *argv[])
 			avr_reset(avr);
 			avr->pc = reset_pc;
 			if (!link_software) { // reset restores the pacing hack; re-clear it
-				uint32_t flags = 0;
+				std::uint32_t flags = 0;
 				avr_ioctl(avr, AVR_IOCTL_UART_GET_FLAGS(uart_digit), &flags);
 				flags &= ~AVR_UART_FLAG_POLL_SLEEP;
 				avr_ioctl(avr, AVR_IOCTL_UART_SET_FLAGS(uart_digit), &flags);
@@ -519,10 +579,9 @@ int main(int argc, char *argv[])
 			// entirely. Pace the simulation only while the bridge is fully
 			// quiet (nothing decoding, nothing queued); transfers keep full
 			// speed, and a quiet window stretches toward real time.
-			if (!rx_active && !tx_active && rx_head == rx_tail)
+			if (!window_report && !rx_active && !tx_active && rx_head == rx_tail)
 				usleep(200);
 		}
 	}
 	finish(0);
-	return 0;
 }

test/test_handshake.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Host-tool activation handshake: it must not hang on a flooding target.
+"""Host-tool activation handshake: bounded against a line that misbehaves.
 
 `_handshake` drains the line after it sees a prompt, to absorb a real loader's
 trailing bytes before it asks for the identity. That drain must be bounded: a
@@ -8,6 +8,13 @@ this, ~60 reboots/s of UART-reset garbage in which a stray 0x2b reads as a
 prompt — otherwise spins the tool forever. Regression for that hang, plus a
 control that a well-behaved loader still connects.
 
+The handshake must also survive its own leftovers: after `--stay` the loader's
+final prompt can still be in the USB pipeline when the next invocation opens
+the port, and on a board wired to reset on open, that opening starts a fresh
+activation window the stale prompt then betrays — the tool commits to an
+identity read against a device that never heard its knock, and what it finally
+collects is the application's banner. StaleDTRPort is that moment as a port.
+
 Stdlib only, no device: host-tool logic, so it runs on every chip's preset
 beside pureboot.planner.
 """
@@ -49,27 +56,117 @@ class FloodPort:
 
 
 class LoaderPort:
-    """A well-behaved pureboot 5: one prompt to the knock, then quiet, then the
+    """A well-behaved pureboot 5: a prompt to the knock, then quiet, then the
     slim identity (version 5 + m328p signature) and a closing prompt."""
 
     def __init__(self):
-        self.reads = self.exacts = 0
+        self.pending = b""
+        self.exacts = 0
 
     def flush_input(self):
-        pass
+        self.pending = b""
 
     def write(self, data):
-        pass
+        if b"p" in data:
+            self.pending = b"+"  # the prompt answers the knock, nothing else
 
     def read_available(self, wait):
-        self.reads += 1
+        data, self.pending = self.pending, b""
-        return b"+" if self.reads == 1 else b""  # prompt once, then settle quiet
+        return data
 
     def read_exact(self, count, timeout):
         self.exacts += 1
         return b"\x05\x1e\x95\x0f" if self.exacts == 1 else b"+"  # identity, then prompt
 
 
+class StaleDTRPort:
+    """`--stay`, then a fresh invocation on a board that resets when its port
+    opens. Three facts of that moment, all timed from the open: the previous
+    session's final prompt is still in transit and lands only after the
+    opening flush has already run; the reset holds the device off the line
+    at first, eating anything written before it completes; and the fresh
+    window is finite — once it expires the application boots and prints a
+    banner whose bytes are what a pending identity read collects. A
+    handshake that trusts the stale prompt spends the whole window waiting
+    on a device that never heard its knock; one that drains the line first
+    knocks into the real window and connects."""
+
+    STALE_AT = 0.02   # the leftover prompt becomes visible (post-flush)
+    READY_AT = 0.05   # reset complete, activation window opens
+    WINDOW = 1.0      # window length; expiry boots the application
+
+    def __init__(self):
+        self.t0 = time.monotonic()
+        # (visible-from, bytes): the line as a timed queue.
+        self.queue = [(self.t0 + self.STALE_AT, b"+")]
+        self.armed = False  # a 'p' heard inside the window arms 'b'
+        self.booted = False
+
+    def _boot_check(self):
+        if not self.booted and time.monotonic() > self.t0 + self.READY_AT + self.WINDOW:
+            self.booted = True
+            self.queue.append((self.t0 + self.READY_AT + self.WINDOW,
+                               b"W r libavr tempmon\r\n"))
+
+    def _visible(self):
+        self._boot_check()
+        now = time.monotonic()
+        return b"".join(d for t, d in self.queue if t <= now)
+
+    def _consume(self, n):
+        now = time.monotonic()
+        left = []
+        for t, d in self.queue:
+            if t <= now and n:
+                take = min(n, len(d))
+                d = d[take:]
+                n -= take
+            if d:
+                left.append((t, d))
+        self.queue = left
+
+    def flush_input(self):
+        self._consume(len(self._visible()))
+
+    def write(self, data):
+        self._boot_check()
+        now = time.monotonic()
+        if now < self.t0 + self.READY_AT or self.booted:
+            return  # still in reset, or the application owns the line
+        if b"p" in data:
+            self.armed = True
+            self.queue.append((now + 0.01, b"+"))
+        if b"b" in data and self.armed:
+            # The slim identity (version 5 + m328p signature) and a prompt.
+            self.queue.append((now + 0.01, b"\x05\x1e\x95\x0f+"))
+
+    def read_available(self, wait):
+        deadline = time.monotonic() + wait
+        while True:
+            data = self._visible()
+            if data:
+                self._consume(len(data))
+                return data
+            if time.monotonic() >= deadline:
+                return b""
+            time.sleep(0.005)
+
+    def read_exact(self, count, timeout):
+        deadline = time.monotonic() + timeout
+        data = b""
+        while len(data) < count:
+            visible = self._visible()
+            if visible:
+                take = visible[:count - len(data)]
+                self._consume(len(take))
+                data += take
+            elif time.monotonic() >= deadline:
+                raise pb.Error(f"timeout: got {len(data)} of {count} bytes")
+            else:
+                time.sleep(0.005)
+        return data
+
+
 def terminates(port, wait, budget):
     """Run connect_autobaud in a thread; True if it returns/raises within
     `budget` seconds rather than hanging."""
@@ -97,6 +194,16 @@ def main():
     info = pb.Loader(LoaderPort()).connect_autobaud(2.0)
     check("well-behaved loader still connects (version 5)", info.version == 5)
 
+    # the stale prompt: a --stay leftover plus reset-on-open must not burn the
+    # fresh window — the pre-knock drain absorbs it and the first real knock
+    # lands inside the window.
+    try:
+        stale_ok = pb.Loader(StaleDTRPort()).connect(2.5).version == 5
+    except pb.Error as failed:
+        print(f"        ({failed})")
+        stale_ok = False
+    check("stale --stay prompt + reset-on-open: connects in the fresh window", stale_ok)
+
     print(f"\n  {P} passed, {F} failed")
     return 1 if F else 0
 

tools/check.sh

@@ -36,4 +36,10 @@ if ((full)); then
 	done
 fi
 
+# Every tree is freshly built now — the one moment the README's size table
+# can be held to what the images measure (a per-preset ctest sees only its
+# own chip; the table needs all of them, and ungated it drifts: a
+# common-code shave moves every row at once with nothing over budget).
+python3 tools/sizes.py check-readme
+
 echo "check: every chip green"

tools/sizes.py

@@ -84,6 +84,20 @@ def collect() -> dict[str, list[tuple[str, int, int]]]:
         for match in SIZE_TEST.finditer((tree / "CTestTestfile.cmake").read_text()):
             found.setdefault(chip, []).append((match["name"], match["elf"], int(match["limit"])))
     sizes = measure([elf for rows in found.values() for _, elf, _ in rows], tool)
+    # A chip's generated and reflect trees must answer with the same bytes
+    # (the identity invariant), so the same target measuring two sizes means
+    # a stale tree — or an identity breach. Either is a finding; picking one
+    # silently is how a gate reports another build's numbers as today's.
+    for chip, rows in found.items():
+        seen: dict[str, tuple[int, str]] = {}
+        for name, elf, _ in rows:
+            if elf not in sizes:
+                continue
+            if name in seen and seen[name][0] != sizes[elf]:
+                sys.exit(f"{chip} {name}: {seen[name][0]} B in {seen[name][1]} but "
+                         f"{sizes[elf]} B in {elf} — a stale tree (rebuild or remove it) "
+                         f"or a cross-mode identity breach")
+            seen.setdefault(name, (sizes[elf], elf))
     measured = {
         chip: sorted(((name, sizes[elf], limit) for name, elf, limit in rows if elf in sizes),
                      key=lambda row: -row[1])
@@ -120,7 +134,9 @@ def cmd_max(args) -> int:
 
 
 def cmd_check_readme(args) -> int:
-    """The README's per-chip table, against the stock and autobaud builds."""
+    """The README's per-chip table, against the stock build and the worst
+    autobaud configuration (OSCCAL baked, plus the USART-pin release where
+    the chip has a USART) — the config the Autobaud column documents."""
     readme = (ROOT / "pureboot" / "README.md").read_text()
     measured = collect()
     rows = re.findall(r"^\|\s*(AT\w+[^|]*?)\s*\|[^|]*\|[^|]*\|[^|]*\|\s*(\d+) B\s*\|\s*(\d+) B\s*\|$",
@@ -132,7 +148,9 @@ def cmd_check_readme(args) -> int:
         # "ATmega48, 48A, 48P, 48PA †" — the first name is the family's base.
         chip = re.sub(r"[^a-z0-9]", "", chips.split(",")[0].strip().lower())
         built = {name: text for name, text, _ in measured.get(chip, [])}
-        for target, documented in (("pureboot", stock_doc), ("pureboot_autobaud", auto_doc)):
+        worst = ("pureboot_autobaud_osccal_on_usart0"
+                 if "pureboot_autobaud_osccal_on_usart0" in built else "pureboot_autobaud_osccal")
+        for target, documented in (("pureboot", stock_doc), (worst, auto_doc)):
             if target not in built:
                 skipped += 1
                 continue

tsb/tsb_asm.cpp

@@ -65,7 +65,7 @@ constexpr std::uint8_t comm_window = 200;
 constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 20;
 
 // Fixed 115200 8N1; the library solves UBRR + U2X from clock and baud.
-constexpr auto baud = avr::uart::detail::solve_baud(16_MHz, 115200_Bd);
+constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd);
 
 // The 16-byte device-info block, streamed out on activation.
 // clang-format off
@@ -263,7 +263,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 	// 0, and rx()/tx() raise RXEN0/TXEN0 on first use — only the divisor low
 	// byte and U2X0 need a store. The library still does the datasheet work.
 	static_assert(baud.u2x && baud.ubrr < 256, "lean bring-up writes UBRR0L only, with U2X0");
-	hw::reg<"UBRR0">::write(static_cast<std::uint8_t>(baud.ubrr));
+	hw::ubrr0::write(static_cast<std::uint8_t>(baud.ubrr));
 	hw::ucsr0a::write(hw::ucsr0a::u2x0(1));
 	// General-purpose registers are undefined at power-on (no crt zeroes them);
 	// the direction latch must start "not receiving" so the first rx() enables

tsb/tsb_policy.cpp

@@ -200,9 +200,9 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 	// only the divisor low byte and U2X0 need a store. The solver still does
 	// the datasheet work; the asserts pin the reset-state assumptions.
 	{
-		constexpr auto sol = avr::uart::detail::solve_baud(dev::clock, 115200_Bd);
+		constexpr auto sol = avr::uart::solve_baud(dev::clock, 115200_Bd);
 		static_assert(sol.u2x && sol.ubrr < 256, "lean bring-up writes UBRR0L only, with U2X0");
-		avr::hw::reg<"UBRR0">::write(static_cast<std::uint8_t>(sol.ubrr));
+		avr::hw::ubrr0::write(static_cast<std::uint8_t>(sol.ubrr));
 		avr::hw::ucsr0a::write(avr::hw::ucsr0a::u2x0(1));
 	}
 

tsb/tsb_tricks.cpp

@@ -65,7 +65,7 @@ constexpr std::uint8_t comm_window = 200;
 constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 20;
 
 // Fixed 115200 8N1; the library solves UBRR + U2X from clock and baud.
-constexpr auto baud = avr::uart::detail::solve_baud(16_MHz, 115200_Bd);
+constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd);
 
 // The 16-byte device-info block, streamed out on activation.
 // clang-format off
@@ -240,7 +240,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
 	// 0, and rx()/tx() raise RXEN0/TXEN0 on first use — only the divisor low
 	// byte and U2X0 need a store. The library still does the datasheet work.
 	static_assert(baud.u2x && baud.ubrr < 256, "lean bring-up writes UBRR0L only, with U2X0");
-	hw::reg<"UBRR0">::write(static_cast<std::uint8_t>(baud.ubrr));
+	hw::ubrr0::write(static_cast<std::uint8_t>(baud.ubrr));
 	hw::ucsr0a::write(hw::ucsr0a::u2x0(1));
 	// General-purpose registers are undefined at power-on (no crt zeroes them);
 	// the direction latch must start "not receiving" so the first rx() enables