fix: report a baseline-absent figure as absent, and correct the allocation comments

A key the frozen baseline predates was reported as current-minus-zero, which reads
as a delta and is not one — mbedtls_peak was claiming 22,236 bytes above a baseline
that has never measured it. Baseline_Load now says which keys the file carried, and
the report prints "-" for the rest.

The allocation comments in FreeRTOSConfig.h and mbedtls_user_config.h still
described xTaskCreate on a 96 KiB heap_4 region and a runtime calloc/free pair.
Both are wrong after this branch, and the code under them is what changed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: DavidCozens

app/config/FreeRTOSConfig.h

@@ -39,12 +39,11 @@
 #define configTIMER_TASK_STACK_DEPTH (configMINIMAL_STACK_SIZE * 2)
 #define configCHECK_FOR_STACK_OVERFLOW 2
 #define configUSE_MALLOC_FAILED_HOOK 1
-/* Static allocation is required by SolidSyslogFreeRtosMutex
- * (xSemaphoreCreateMutexStatic places the StaticSemaphore_t inside the
- * caller-supplied storage). The idle / timer task static-memory hooks it
- * pulls in are satisfied by configKERNEL_PROVIDED_STATIC_MEMORY = 1 — no
- * boilerplate in main.c. Dynamic allocation stays on for the lwIP tcpip /
- * RX tasks and the interactive / service tasks created via xTaskCreate. */
+/* Every task, stack and semaphore this application creates is static, and the
+ * idle / timer static-memory hooks are satisfied by
+ * configKERNEL_PROVIDED_STATIC_MEMORY = 1 — no boilerplate in main.c. Dynamic
+ * allocation stays on only for lwIP's tcpip thread and mailboxes, created inside
+ * its FreeRTOS port, which offers no static variants. */
 #define configSUPPORT_STATIC_ALLOCATION 1
 #define configSUPPORT_DYNAMIC_ALLOCATION 1
 #define configKERNEL_PROVIDED_STATIC_MEMORY 1

app/config/mbedtls_user_config.h

@@ -69,15 +69,9 @@
  * injected Sleep callback, so MBEDTLS_TIMING_C is unused. */
 #undef MBEDTLS_TIMING_C
 
-/* Route mbedTLS allocations through a runtime-installed calloc/free pair. By
- * default mbedTLS calls libc calloc/free, which on this target funnels through
- * newlib into the small 4 KiB syscall heap in Bdd/Targets/FreeRtos/Common/
- * Syscalls.c (shared with this target) — far too small for mbedTLS's
- * per-context allocations (IN/OUT buffers plus handshake state run ~10–20 KiB).
- * Enabling MBEDTLS_PLATFORM_MEMORY lets BddTargetTlsSender_MbedTls_LwipRawTcp.c
- * call mbedtls_platform_set_calloc_free(...) to redirect those allocations to
- * pvPortMalloc, which uses the 96 KiB heap_4 region — the textbook
- * FreeRTOS+mbedTLS integration. */
+/* Route mbedTLS allocations away from libc calloc/free, which on this target
+ * funnels through newlib into a 4 KiB syscall heap — far too small for mbedTLS's
+ * per-context allocations. Required by MBEDTLS_MEMORY_BUFFER_ALLOC_C below. */
 #define MBEDTLS_PLATFORM_MEMORY
 
 /* mbedTLS sub-allocates from one static buffer the device hands it, rather than

app/measure/Baseline.c

@@ -12,23 +12,25 @@
 /* Big enough for the handful of `key,value` lines the baseline holds. */
 #define BASELINE_BUFFER_SIZE 1024
 
-static void Baseline_Apply(MeasureValues* out, const char* key, const char* value)
+static void Baseline_Apply(MeasureValues* out, bool* present, const char* key, const char* value)
 {
     for (int i = 0; i < MEASURE_KEY_COUNT; i++)
     {
         if (strcmp(key, MEASURE_KEYS[i]) == 0)
         {
             out->value[i] = (int32_t) strtol(value, NULL, 10);
+            present[i] = true;
             return;
         }
     }
 }
 
-bool Baseline_Load(MeasureValues* out)
+bool Baseline_Load(MeasureValues* out, bool* present)
 {
     for (int i = 0; i < MEASURE_KEY_COUNT; i++)
     {
         out->value[i] = 0;
+        present[i] = false;
     }
 
     static char buffer[BASELINE_BUFFER_SIZE];
@@ -58,7 +60,7 @@ bool Baseline_Load(MeasureValues* out)
             if (comma != NULL)
             {
                 *comma = '\0';
-                Baseline_Apply(out, line, comma + 1);
+                Baseline_Apply(out, present, line, comma + 1);
             }
         }
 

app/measure/Baseline.h

@@ -15,7 +15,9 @@ extern "C"
      * every field first, so a missing file yields an all-zero baseline and
      * returns false — which the report renders as "no baseline yet, commit
      * these absolutes". Returns true if the file was read. */
-    bool Baseline_Load(MeasureValues* out);
+    /* `present[i]` says whether the file actually carried MEASURE_KEYS[i]. A key a
+     * frozen baseline predates must not be reported as a delta against zero. */
+    bool Baseline_Load(MeasureValues* out, bool* present);
 
 #ifdef __cplusplus
 }

app/measure/Measure.c

@@ -62,13 +62,21 @@ bool Measure_Report(void)
     Measure_Current(&current);
 
     MeasureValues baseline;
-    bool haveBaseline = Baseline_Load(&baseline);
+    bool present[MEASURE_KEY_COUNT];
+    bool haveBaseline = Baseline_Load(&baseline, present);
 
     (void) printf("[report] --- SolidSyslog cost above baseline (simulated existing application) ---\n");
     (void) printf("[report] key,current,baseline,used_above_baseline\n");
     for (int i = 0; i < MEASURE_KEY_COUNT; i++)
     {
         int32_t currentValue = current.value[i];
+        if (haveBaseline && !present[i])
+        {
+            /* The frozen baseline predates this key. Reporting current-minus-zero
+             * would look like a delta and be read as one. */
+            (void) printf("[report] %s,%ld,-,-\n", MEASURE_KEYS[i], (long) currentValue);
+            continue;
+        }
         int32_t baselineValue = haveBaseline ? baseline.value[i] : 0;
         int32_t usedAbove = currentValue - baselineValue;
         (void) printf(

run-report.txt

@@ -7,19 +7,19 @@
 [device]   first record logged: yes
 [report] --- SolidSyslog cost above baseline (simulated existing application) ---
 [report] key,current,baseline,used_above_baseline
-[report] flash_text,361616,345832,15784
+[report] flash_text,361736,345832,15904
 [report] flash_data,656,236,420
 [report] static_bss,133152,164508,-31356
 [report] heap_used,4440,39224,-34784
-[report] mbedtls_peak,22132,0,22132
+[report] mbedtls_peak,22236,-,-
 [report] stack_log,832,120,712
 [report] stack_service,3852,56,3796
 [report] --- end ---
 [device] ready
 
   size cross-check:
        text	   data	    bss	    dec	    hex	filename
-     361608	    664	 133152	 495424	  78f40	/w/build/baseline-cross/baseline.elf
+     361728	    664	 133152	 495544	  78fb8	/w/build/baseline-cross/baseline.elf
 
 --- Oracle listeners (proved before the device ran) ---
   OK    udp   5514
@@ -29,8 +29,8 @@
   OK    mtls  6515 — refused a client with no certificate
 
 --- Collector (syslog-ng) received ---
-  wire   <134>1 2026-07-28T16:17:19.100000Z 10.0.2.15 solid-syslog-example - BOOT [meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] device started
-  parsed PRIORITY=134 TIMESTAMP=2026-07-28T16:17:19+00:00 HOSTNAME=10.0.2.15 APP_NAME=solid-syslog-example PROCID= MSGID=BOOT STRUCTURED_DATA=[meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] MSG=device started
+  wire   <134>1 2026-07-28T18:22:03.100000Z 10.0.2.15 solid-syslog-example - BOOT [meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] device started
+  parsed PRIORITY=134 TIMESTAMP=2026-07-28T18:22:03+00:00 HOSTNAME=10.0.2.15 APP_NAME=solid-syslog-example PROCID= MSGID=BOOT STRUCTURED_DATA=[meta sequenceId="1" sysUpTime="210"][timeQuality tzKnown="1" isSynced="0"][origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473" ip="10.0.2.15"][logPipeline@32473 transport="mtls" atRest="aes-256-gcm"] MSG=device started
 
 --- Baseline self-check (vs measurements/Secure.csv, tolerance 64 B) ---
   (no committed measurements/Secure.csv yet — rerun with CAPTURE=1 to freeze it)