fix(fw): move odometer to its own flash sector (sector 6 bank 2)

The odometer and motion_config (calibration JSON) were both writing to
sector 7 bank 2 (0x081E0000) via `FLASH_USER_START_ADDR`. STM32H7 flash
can only be erased at sector granularity, and both modules call
`Flash_Erase` for the full sector on save. Whichever wrote last wiped
the other tenant's data.

Symptom: flashing the integration branch onto a console that already had
a stored calibration produced "no calibration on device or invalid" on
the next connect, because `Odometer_Init` saw a non-magic block (the
calibration JSON), treated it as first-boot, and erased the sector to
write a fresh zero odometer block.

Fix: dedicate sector 6 bank 2 (0x081C0000) to the odometer.

- STM32H743XX_FLASH.ld + STM32H743VIHX_FLASH.ld: trim FLASH region from
  1920 KB to 1792 KB so the linker reserves both sectors 6 and 7 of
  bank 2 for persistent data. (Code uses 8.5% of the remaining region;
  no risk of crowding.)
- memory_map.h: add FLASH_ODOMETER_START_ADDR alongside FLASH_USER_START_ADDR.
- odometer.h: point ODOMETER_FLASH_BASE_ADDR at the new sector and
  document why the two stores must not co-tenant.

Action for already-flashed consoles: calibration must be re-loaded (or
re-run) once after flashing this build, since the existing calibration
on hardware that ran the buggy firmware was already wiped. After this
flash, calibration and odometer writes are independent — no further
clobbering.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: boringethan

Core/Inc/memory_map.h

@@ -35,8 +35,14 @@
 #define ADDR_FLASH_SECTOR_6_BANK2     ((uint32_t)0x081C0000) /* Base @ of Sector 6, 128 Kbytes */
 #define ADDR_FLASH_SECTOR_7_BANK2     ((uint32_t)0x081E0000) /* Base @ of Sector 7, 128 Kbytes */
 
-#define ADDR_FLASH_END_ADDRESS     ((uint32_t)0x08200000) 
-#define FLASH_USER_START_ADDR ADDR_FLASH_SECTOR_7_BANK2
+#define ADDR_FLASH_END_ADDRESS     ((uint32_t)0x08200000)
+
+/* Reserved persistent-data sectors. Each persists via full-sector erase
+ * (the STM32H7 flash sector is 128 KB and that is the minimum erase
+ * granularity), so two distinct tenants need two distinct sectors. The
+ * linker script reserves both by capping FLASH at 1792 KB. */
+#define FLASH_USER_START_ADDR     ADDR_FLASH_SECTOR_7_BANK2  /* motion_config / calibration */
+#define FLASH_ODOMETER_START_ADDR ADDR_FLASH_SECTOR_6_BANK2  /* system + laser odometer */
 
 #ifdef __cplusplus
 }

Core/Inc/odometer.h

@@ -9,11 +9,18 @@
 #define INC_ODOMETER_H_
 
 #include "stm32h7xx_hal.h"
+#include "memory_map.h"
 #include <stdint.h>
 #include <stdbool.h>
 
-/* Flash memory addresses for odometer storage */
-#define ODOMETER_FLASH_BASE_ADDR    (FLASH_USER_START_ADDR)
+/* Flash memory addresses for odometer storage.
+ *
+ * Lives in its own 128 KB sector (sector 6 bank 2 via FLASH_ODOMETER_START_ADDR),
+ * distinct from FLASH_USER_START_ADDR which is owned by motion_config. The
+ * STM32H7 minimum erase granularity is one 128 KB sector, so the two stores
+ * must not co-tenant — otherwise either Odometer_Persist_Both() or
+ * motion_cfg flash writes would wipe the other tenant. */
+#define ODOMETER_FLASH_BASE_ADDR    (FLASH_ODOMETER_START_ADDR)
 #define SYSTEM_ODO_FLASH_ADDR       (ODOMETER_FLASH_BASE_ADDR)
 #define LASER_ODO_FLASH_ADDR        (ODOMETER_FLASH_BASE_ADDR + 32)
 

STM32H743VIHX_FLASH.ld

@@ -43,8 +43,12 @@ _Min_Stack_Size = 0x400; /* required amount of stack */
 /* Specify the memory areas */
 MEMORY
 {
-  /* Reserve the last 128KB sector (Bank2 Sector7 @ 0x081E0000) for user config. */
-  FLASH (rx)     : ORIGIN = 0x08000000, LENGTH = 1920K
+  /* Reserve the last two 128KB sectors of Bank 2 for persistent data:
+   *   Sector 7 (@ 0x081E0000) — motion_config / calibration JSON
+   *   Sector 6 (@ 0x081C0000) — odometer (system uptime + laser pulses)
+   * Each persists via full-sector erase, so they cannot co-tenant a sector.
+   * Trimming code to 1792 KB still leaves >10x headroom for current build. */
+  FLASH (rx)     : ORIGIN = 0x08000000, LENGTH = 1792K
   DTCMRAM (xrw)  : ORIGIN = 0x20000000, LENGTH = 128K
   RAM_D1 (xrw)   : ORIGIN = 0x24000000, LENGTH = 512K
   RAM_D2 (xrw)   : ORIGIN = 0x30000000, LENGTH = 288K

STM32H743XX_FLASH.ld

@@ -60,8 +60,12 @@ RAM (xrw)      : ORIGIN = 0x24000000, LENGTH = 512K
 RAM_D2 (xrw)      : ORIGIN = 0x30000000, LENGTH = 288K
 RAM_D3 (xrw)      : ORIGIN = 0x38000000, LENGTH = 64K
 ITCMRAM (xrw)      : ORIGIN = 0x00000000, LENGTH = 64K
-/* Reserve the last 128KB sector (Bank2 Sector7 @ 0x081E0000) for user config. */
-FLASH (rx)      : ORIGIN = 0x8000000, LENGTH = 1920K
+/* Reserve the last two 128KB sectors of Bank 2 for persistent data:
+ *   Sector 7 (@ 0x081E0000) — motion_config / calibration JSON
+ *   Sector 6 (@ 0x081C0000) — odometer (system uptime + laser pulses)
+ * Each persists via full-sector erase, so they cannot co-tenant a sector.
+ * Trimming code to 1792 KB still leaves >10x headroom for current build. */
+FLASH (rx)      : ORIGIN = 0x8000000, LENGTH = 1792K
 }
 
 /* Highest address of the user mode stack */