J3R452 CLEAR_ON_DESELECT pool was at ~285 B headroom post-M2G.2.
Tighten three M1/M2 conservative sizings to spec-actual values:
- AliroApplet.SALT_VOLATILE_CAPACITY: 200 -> 144
Spec §8.3.1.13 fixes salt_volatile at 141 B. 144 = 141 + 3 B pad.
- StepUpApplet.RESPONSE_BUFFER_LEN: 512 -> 416
Holds 388 B max (372 B canonical DeviceResponse + 16 B GCM tag).
AD is fixed 272 B at personalization, wrapper shape is fixed.
- StepUpApplet.SCRATCH_PLAINTEXT_LEN: 256 -> 192
M2D.1 valid DeviceRequest vector is 85 B, Reader Status request
is 2 B; 192 leaves ~107 B headroom for larger reader requests.
No spec deviation. No security implication (sizes are upper bounds on
buffers, not crypto parameters). All 147 applet tests pass (3 documented
pre-existing GCM errors unchanged).
New pool budget: ~2,619 / ~3,120 B used, ~501 B headroom.
c85ecd2f73