rsnix v0.5.1: force the GUI canvas to 800x600 via GOP SetMode

The kernel used to inherit whatever GOP mode the firmware picked
(QEMU/OVMF gave 1280x800). Now every surface derives from a fixed
800x600 canvas:

- uefi: typed EfiGopQueryMode/SetMode/GetMode fn pointers in
  GraphicsOutputProtocol (were raw *mut c_void, never called).
- gop::select_gop_mode: scan the mode list for an exact 800x600
  (32-bit BGR/RGB only, the driver assumes 4 Bpp), SetMode it; fall
  back to the smallest mode that fits the canvas, then to the
  firmware's choice. SetMode may move both the mode info pointer and
  the framebuffer base, so both are re-read after the switch. Boot
  log: 'gop: mode 3 selected — 800x600 (was 1280x800)'.
- tests: relative assertions are resolution-agnostic; test-gfx and
  test-mouse had a boot-log race (shell line prints before the cursor
  task line) — now wait for the cursor line instead of grepping once.
  All four suites pass at 800x600. 0 build warnings.

7 files changed, 124 insertions, 15 deletions

diff --git a/CONTEXT.md b/CONTEXT.md
index bfe0170..375bf57 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -113,10 +113,10 @@ Workspace version is `a.b.c` (single version for all crates):
 
 Bump the workspace version in the root `Cargo.toml` when a change of
 that class lands — do not leave the version to drift.  Current:
-`0.5.0` — the GUI era landed (graphics layer + cursor compositor) as a
-`b` bump from the 0.4.0 input foundation; a future major GUI overhaul
-(graphics windows beyond the text surface) would be the `a` bump
-(1.0.0).
+`0.5.1` — the GUI era landed with 0.5.0 (graphics layer + cursor
+compositor) and the canvas was fixed at 800×600 as a `c` bump; a
+future major GUI overhaul (graphics windows beyond the text surface)
+would be the `a` bump (1.0.0).
 
 ## Project layout
 
@@ -515,6 +515,14 @@ Workspace of four crates, all built for the `x86_64-unknown-uefi` target:
     the cursor tip is white on the display but absent from the shadow
     (overlay purity), and prints PASS/FAIL per stage.
 
+- **Canvas resolution fixed at 800×600** — `gop::init` scans the GOP
+    mode list and calls `SetMode` for an exact 800×600 (BGR/RGB 32-bit;
+    QEMU std-vga lists it as mode 3, real GPUs list it as a standard
+    mode), falling back to the smallest mode that fits, then to the
+    firmware's choice.  Everything derives from it: the vt text grid,
+    the cursor clamp, the demo strip.  `SetMode` may move the info
+    pointer and framebuffer base, so they are re-read after the switch.
+
   Verified in QEMU (`make test-gfx`): `fill_rect/shadow: OK`,
   `display push: OK`, `cursor overlay: OK`, `cursor not in shadow:
   OK`, `gfx check: PASS`; the demo draws; the cursor tracks injected
diff --git a/Cargo.lock b/Cargo.lock
index 19806d4..0d31a3b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "rsdos"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
  "rsnix",
  "shell",
@@ -19,11 +19,11 @@ dependencies = [
 
 [[package]]
 name = "rsnix"
-version = "0.5.0"
+version = "0.5.1"
 
 [[package]]
 name = "shell"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
  "rsdosedit",
  "rsnix",
diff --git a/Cargo.toml b/Cargo.toml
index 273966b..9bf5854 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["rsnix", "shell", "rsdos", "rsdosedit"]
 
 [workspace.package]
-version = "0.5.0"
+version = "0.5.1"
 edition = "2024"
 
 # no_std UEFI kernel: no unwinder available, so panic must abort.
diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 9dedcb8..dad4505 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -4,7 +4,7 @@
 /// module is the low-level rasteriser: glyph blits and pixel shifts on the
 /// linear framebuffer.
 use crate::font;
-use crate::uefi::{GraphicsOutputProtocol, PIXEL_BGR, PIXEL_RGB};
+use crate::uefi::{EFI_SUCCESS, GopModeInfo, GraphicsOutputProtocol, PIXEL_BGR, PIXEL_RGB};
 use alloc::boxed::Box;
 use alloc::vec;
 use alloc::vec::Vec;
@@ -37,8 +37,93 @@ static mut FB: Option<Framebuffer> = None;
 static mut SHADOW: *mut u32 = core::ptr::null_mut();
 static mut SHADOW_WORDS: usize = 0;
 
+/// The GUI canvas.  Every display surface assumes this resolution:
+/// `vt` derives its text grid from it, the compositor's cursor clamps
+/// to it, and the future window manager lays out windows on it.  We
+/// force it through GOP `SetMode` at boot — QEMU's std-vga offers it,
+/// and real GPUs list it as a standard mode — falling back to the
+/// smallest mode that fits, then to whatever the firmware chose.
+const WANTED_W: usize = 800;
+const WANTED_H: usize = 600;
+
+/// Pick a GOP mode: prefer an exact 800×600 (BGR/RGB 32-bit), else the
+/// smallest mode that fits the canvas, else leave the firmware's choice
+/// alone.  Call before reading the framebuffer — `SetMode` may move
+/// both the mode info pointer and the framebuffer base.
+fn select_gop_mode(gop: &mut GraphicsOutputProtocol) {
+    let mode = unsafe { &*gop.mode };
+    let cur = mode.mode;
+    let info = unsafe { &*mode.info };
+    let cur_w = info.horizontal_resolution as usize;
+    let cur_h = info.vertical_resolution as usize;
+    if cur_w == WANTED_W && cur_h == WANTED_H {
+        crate::serial_println!("gop: mode {} — already {}x{}", cur, cur_w, cur_h);
+        return;
+    }
+
+    let mut best: Option<(u32, usize, usize)> = None; // (mode#, w, h)
+    for i in 0..mode.max_mode {
+        let mut size: usize = 0;
+        let mut info_ptr: *mut GopModeInfo = core::ptr::null_mut();
+        let st = unsafe { (gop.query_mode)(gop, i, &mut size, &mut info_ptr) };
+        if st != EFI_SUCCESS || info_ptr.is_null() {
+            continue;
+        }
+        let mi = unsafe { &*info_ptr };
+        if mi.pixel_format != PIXEL_BGR && mi.pixel_format != PIXEL_RGB {
+            continue; // 32-bit BGR/RGB only (the driver assumes 4 Bpp)
+        }
+        let w = mi.horizontal_resolution as usize;
+        let h = mi.vertical_resolution as usize;
+        if w == WANTED_W && h == WANTED_H {
+            best = Some((i, w, h));
+            break;
+        }
+        if w >= WANTED_W && h >= WANTED_H {
+            match best {
+                Some((_, bw, bh)) if bw * bh <= w * h => {}
+                _ => best = Some((i, w, h)),
+            }
+        }
+    }
+
+    match best {
+        Some((n, w, h)) => {
+            let st = unsafe { (gop.set_mode)(gop, n) };
+            if st != EFI_SUCCESS {
+                crate::serial_println!(
+                    "gop: SetMode({}) failed 0x{:x} — keeping current {}x{}",
+                    n,
+                    st,
+                    cur_w,
+                    cur_h
+                );
+                return;
+            }
+            crate::serial_println!(
+                "gop: mode {} selected — {}x{} (was {}x{})",
+                n,
+                w,
+                h,
+                cur_w,
+                cur_h
+            );
+        }
+        None => crate::serial_println!(
+            "gop: no mode ≥ {}x{} — keeping current {}x{}",
+            WANTED_W,
+            WANTED_H,
+            cur_w,
+            cur_h
+        ),
+    }
+}
+
 /// Initialise the framebuffer from GOP. Call *before* ExitBootServices.
 pub fn init(gop: &mut GraphicsOutputProtocol) {
+    // Force the 800×600 canvas first; SetMode may move the info
+    // pointer and framebuffer base, so everything is re-read after.
+    select_gop_mode(gop);
     let mode = unsafe { &*gop.mode };
     let info = unsafe { &*mode.info };
     let base = mode.framebuffer_base as *mut u8;
diff --git a/rsnix/src/uefi.rs b/rsnix/src/uefi.rs
index f947c90..c311ad9 100644
--- a/rsnix/src/uefi.rs
+++ b/rsnix/src/uefi.rs
@@ -321,12 +321,28 @@ pub struct GopMode {
 
 #[repr(C)]
 pub struct GraphicsOutputProtocol {
-    pub query_mode: *mut c_void,
-    pub set_mode: *mut c_void,
-    pub get_current_mode: *mut c_void,
+    pub query_mode: EfiGopQueryMode,
+    pub set_mode: EfiGopSetMode,
+    pub get_current_mode: EfiGopGetMode,
     pub mode: *mut GopMode,
 }
 
+pub type EfiGopQueryMode = unsafe extern "efiapi" fn(
+    *mut GraphicsOutputProtocol,
+    u32,                   // mode number
+    *mut usize,            // out: size of info
+    *mut *mut GopModeInfo, // out: info pointer (firmware-owned)
+) -> Status;
+
+pub type EfiGopSetMode = unsafe extern "efiapi" fn(*mut GraphicsOutputProtocol, u32) -> Status;
+
+pub type EfiGopGetMode = unsafe extern "efiapi" fn(
+    *mut GraphicsOutputProtocol,
+    *mut u32,              // out: current mode
+    *mut u32,              // out: size of info
+    *mut *mut GopModeInfo, // out: info pointer
+) -> Status;
+
 // ---------------------------------------------------------------------------
 // System table
 // ---------------------------------------------------------------------------
diff --git a/scripts/test-gfx.sh b/scripts/test-gfx.sh
index a6e4016..7bee4ee 100755
--- a/scripts/test-gfx.sh
+++ b/scripts/test-gfx.sh
@@ -85,7 +85,7 @@ rm -f "$SOCK" "$LOG"
 echo $! >"$QPID"
 
 wait_log "$LOG" "boot: entering shell" 90 || fail "kernel never reached the shell"
-grep -aq "cursor: task " "$LOG" || fail "cursor task did not spawn"
+wait_log "$LOG" "cursor: task " 10 || fail "cursor task did not spawn"
 
 echo "==> 4/5 in-kernel pixel self-test (gfx check)"
 python3 "$SCRIPT_DIR/sendkeys.py" --sock "$SOCK" \
diff --git a/scripts/test-mouse.sh b/scripts/test-mouse.sh
index e58d474..ea58f91 100755
--- a/scripts/test-mouse.sh
+++ b/scripts/test-mouse.sh
@@ -95,7 +95,7 @@ echo $! >"$QPID"
 
 wait_log "$LOG" "boot: entering shell" 90 || fail "kernel never reached the shell"
 grep -aq "ps2: mouse ready" "$LOG" || fail "mouse driver did not come up at boot"
-grep -aq "cursor: task " "$LOG" || fail "cursor task did not spawn"
+wait_log "$LOG" "cursor: task " 10 || fail "cursor task did not spawn"
 
 echo "==> 4/6 cursor position tracks injected movement"
 INIT=$(cursor_state)
@@ -153,7 +153,7 @@ qemu_hmp "sendkey ctrl-c"
 grep -aq "mouse: routing events to task 3" "$LOG" || fail "mouse 3 did not arm routing"
 grep -aq "msgrecv\[3\]: Mouse(+" "$LOG" || fail "task 3 queue did not receive the routed Mouse event"
 # Watch line: x/y/buttons format (any occurrence after watching started).
-grep -aq "mouse: x=$((X3 + 3)) y=$((Y3 + 2)) buttons=---" "$LOG" || fail "watch did not print the moved cursor (x=$((X3+3)) y=$((Y3+2)))"
+grep -aq "mouse: x=$((X3 + 3)) y=$((Y3 + 2)) buttons=---" "$LOG" || fail "watch did not print the moved cursor (x=$((X3 + 3)) y=$((Y3 + 2)))"
 grep -aq "mouse: stopped" "$LOG" || fail "^C did not stop the mouse watch"
 
 python3 "$SCRIPT_DIR/sendkeys.py" --sock "$SOCK" "poweroff"