feat: give the baseline a real mutual-TLS session

CMakeLists.txt

@@ -141,6 +141,7 @@ endforeach()
 add_executable(baseline
     ${APP_DIR}/main.c
     ${APP_DIR}/sim/SimulatedExistingApp.c
+    ${APP_DIR}/sim/SimulatedBrokerSession.c
     ${APP_DIR}/tasks/LogTask.c
     ${APP_DIR}/tasks/ServiceTask.c
     ${APP_DIR}/measure/Measure.c
@@ -187,8 +188,8 @@ target_include_directories(baseline PRIVATE
     ${FATFS_STAGE_DIR}
 )
 
-# sim/SimulatedExistingApp.c includes <mbedtls/ssl.h> — it MUST see the same user
-# config as the library, or context struct sizes diverge between consumer and library.
+# app/sim includes <mbedtls/ssl.h> — it MUST see the same user config as the
+# library, or context struct sizes diverge between consumer and library.
 target_compile_definitions(baseline PRIVATE MBEDTLS_USER_CONFIG_FILE=${MBEDTLS_USER_CONFIG_HEADER})
 
 # SolidSyslog is the Core library (a real .a); the SolidSyslog::* packs are

app/AppConfig.h

@@ -42,9 +42,12 @@
  * the report prints absolutes for us to commit as the baseline. */
 #define BASELINE_FILE_PATH "measurements/Baseline.csv"
 
-/* The static buffer mbedTLS sub-allocates from. Sized from the high-water mark the
- * device reports, so a step that asks more of mbedTLS grows this and is charged for
- * it — the baseline holds no spare capacity on a later step's behalf. */
-#define SIMULATED_APP_MBEDTLS_HEAP_BYTES (32 * 1024)
+/* The static buffer mbedTLS sub-allocates from. Sized at the high-water mark the
+ * device reports times 1.5, rounded up to the next KiB — buffer_alloc hands out
+ * contiguous space, so a buffer only a little over the peak fails on
+ * fragmentation rather than on capacity. One rule, applied again at every step
+ * that asks more of mbedTLS, so the baseline holds no spare capacity on a later
+ * step's behalf and each step is charged what it actually added. */
+#define SIMULATED_APP_MBEDTLS_HEAP_BYTES (55 * 1024)
 
 #endif /* APP_CONFIG_H */

app/main.c

@@ -2,8 +2,8 @@
  * with ZERO SolidSyslog.
  *
  * This is the "simulated existing application": a device that already networks,
- * already uses storage, and has TLS on board — the frozen platform SolidSyslog's
- * footprint deltas are measured against. main() is deliberately thin: it starts
+ * already uses storage, and already holds a TLS session — the frozen platform
+ * SolidSyslog's footprint deltas are measured against. main() is deliberately thin: it starts
  * the console, creates the two idle application seams (a log source and a service
  * worker), and hands off to a harness task that brings up the simulated existing
  * application, measures the cost above the frozen baseline, and exits.
@@ -68,7 +68,7 @@ static void HarnessTask(void* parameters)
     (void) printf("[device] starting simulated existing application...\n");
     bool simReady = SimulatedExistingApp_Start();
     (void) printf(
-        "[device]   sim app (lwIP up, FatFs mounted, mTLS credentials loaded, mbedTLS linked): %s\n",
+        "[device]   sim app (lwIP up, FatFs mounted, broker session held over mTLS): %s\n",
         simReady ? "ready" : "FAILED"
     );