feat: switch to the allocate-only heap now nothing frees

heap_1 replaces heap_4. Every allocation the device makes now happens once during
bring-up and is never returned, so an allocator that cannot free is sufficient —
and fragmentation stops being possible rather than merely unlikely.

  flash_text  362,032 -> 361,616   (-416)
  heap_used     4,488 ->   4,440

heap_1's vPortFree is configASSERT(pv == NULL), so the invariant is enforced rather
than assumed: anything that frees stops the device instead of quietly leaking.

heap_peak goes with it. heap_1 only moves a pointer forward, so free memory
decreases monotonically and the current figure is the high-water mark by
construction — a separate peak would be the same number with a different name.
mbedtls_peak stays, because buffer_alloc does free internally.

What this constrains: nothing in this device may ever free, including anything
built on it. Creating and destroying a netif, or deleting a task, would assert.
That is a deliberate trade for a device whose allocation is all at init.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: DavidCozens

CMakeLists.txt

@@ -92,7 +92,7 @@ add_library(baseline_upstream OBJECT
     ${FREERTOS_KERNEL_PATH}/timers.c
     ${FREERTOS_KERNEL_PATH}/event_groups.c
     ${FREERTOS_PORT_DIR}/port.c
-    ${FREERTOS_KERNEL_PATH}/portable/MemMang/heap_4.c
+    ${FREERTOS_KERNEL_PATH}/portable/MemMang/heap_1.c
     ${lwipcore_SRCS}
     ${lwipcore4_SRCS}
     ${lwipapi_SRCS}

app/measure/Measure.c

@@ -31,7 +31,6 @@ const char* const MEASURE_KEYS[MEASURE_KEY_COUNT] = {
     "flash_data",
     "static_bss",
     "heap_used",
-    "heap_peak",
     "mbedtls_peak",
     "stack_log",
     "stack_service",
@@ -52,10 +51,6 @@ void Measure_Current(MeasureValues* out)
     out->value[MEASURE_FLASH_DATA] = (int32_t) ((uintptr_t) _edata - (uintptr_t) _sdata);
     out->value[MEASURE_STATIC_BSS] = (int32_t) ((uintptr_t) _ebss - (uintptr_t) _sbss);
     out->value[MEASURE_HEAP_USED] = (int32_t) ((uint32_t) configTOTAL_HEAP_SIZE - (uint32_t) xPortGetFreeHeapSize());
-    /* What the device must actually provision: a TLS handshake frees working state
-     * on completion, so the figure above understates what was needed to reach it. */
-    out->value[MEASURE_HEAP_PEAK] =
-        (int32_t) ((uint32_t) configTOTAL_HEAP_SIZE - (uint32_t) xPortGetMinimumEverFreeHeapSize());
     out->value[MEASURE_MBEDTLS_PEAK] = (int32_t) SimulatedExistingApp_MbedTlsPeak();
     out->value[MEASURE_STACK_LOG] = Measure_StackUsedBytes(LogTask_Handle(), LOG_TASK_STACK_WORDS);
     out->value[MEASURE_STACK_SERVICE] = Measure_StackUsedBytes(ServiceTask_Handle(), SERVICE_TASK_STACK_WORDS);

app/measure/Measure.h

@@ -17,8 +17,7 @@ extern "C"
         MEASURE_FLASH_TEXT = 0, /* .text + .rodata + init arrays (bytes) */
         MEASURE_FLASH_DATA, /* .data (bytes) */
         MEASURE_STATIC_BSS, /* .bss (bytes; includes the reserved FreeRTOS heap array) */
-        MEASURE_HEAP_USED, /* configTOTAL_HEAP_SIZE - free heap (bytes) */
-        MEASURE_HEAP_PEAK, /* configTOTAL_HEAP_SIZE - lowest free heap ever (bytes) */
+        MEASURE_HEAP_USED, /* configTOTAL_HEAP_SIZE - free heap; heap_1 never frees, so also the peak */
         MEASURE_MBEDTLS_PEAK, /* high-water mark of the static mbedTLS buffer (bytes) */
         MEASURE_STACK_LOG, /* log task peak stack used (bytes) */
         MEASURE_STACK_SERVICE, /* service task peak stack used (bytes) */

run-report.txt

@@ -7,20 +7,19 @@
 [device]   first record logged: yes
 [report] --- SolidSyslog cost above baseline (simulated existing application) ---
 [report] key,current,baseline,used_above_baseline
-[report] flash_text,362032,345832,16200
+[report] flash_text,361616,345832,15784
 [report] flash_data,656,236,420
-[report] static_bss,133172,164508,-31336
-[report] heap_used,4488,39224,-34736
-[report] heap_peak,4488,0,4488
-[report] mbedtls_peak,22152,0,22152
+[report] static_bss,133152,164508,-31356
+[report] heap_used,4440,39224,-34784
+[report] mbedtls_peak,22132,0,22132
 [report] stack_log,832,120,712
 [report] stack_service,3852,56,3796
 [report] --- end ---
 [device] ready
 
   size cross-check:
        text	   data	    bss	    dec	    hex	filename
-     362024	    664	 133172	 495860	  790f4	/w/build/baseline-cross/baseline.elf
+     361608	    664	 133152	 495424	  78f40	/w/build/baseline-cross/baseline.elf
 
 --- Oracle listeners (proved before the device ran) ---
   OK    udp   5514
@@ -30,8 +29,8 @@
   OK    mtls  6515 — refused a client with no certificate
 
 --- Collector (syslog-ng) received ---
-  wire   <134>1 2026-07-28T16:10:04.100000Z 10.0.2.15 solid-syslog-example - BOOT [meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] device started
-  parsed PRIORITY=134 TIMESTAMP=2026-07-28T16:10:04+00:00 HOSTNAME=10.0.2.15 APP_NAME=solid-syslog-example PROCID= MSGID=BOOT STRUCTURED_DATA=[meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] MSG=device started
+  wire   <134>1 2026-07-28T16:17:19.100000Z 10.0.2.15 solid-syslog-example - BOOT [meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] device started
+  parsed PRIORITY=134 TIMESTAMP=2026-07-28T16:17:19+00:00 HOSTNAME=10.0.2.15 APP_NAME=solid-syslog-example PROCID= MSGID=BOOT STRUCTURED_DATA=[meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] MSG=device started
 
 --- Baseline self-check (vs measurements/Secure.csv, tolerance 64 B) ---
   (no committed measurements/Secure.csv yet — rerun with CAPTURE=1 to freeze it)