v0.5.7: guard dumps block-header math + 16-word window; vt content verify; shadow marker

The klog -t 2 crash drops a 126-byte String (the vt verify klog line)
whose data ptr 0x40444970 points into the first-heap-block region whose
content is the firmware 0x00AAAAAA scrub — a stale pointer, not a real
allocation (back-pointer slot never written).  Upgrades so the next
real-hardware crash shows the full picture:
- guard: explicit candidate block bases (b=ptr-24 / b16=ptr-32) with
  their size/free fields, plus a 16-word window (mem..mem4) from
  ptr-0x30 instead of the old 8 words
- vt::debug_verify: content probe of the cells grid (must be all-BLANK
  at shell entry) — catches a stale in-heap cells pointer that passes
  the range checks
- gop: on-screen marker for shadow carved vs NO-SHADOW fallback
  (the scrub content at the crash ptr suggests the shadow was rejected
  and its block stayed free + firmware-scrubbed)

1 files changed, 7 insertions, 0 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 7aeb224..8e804e5 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -293,6 +293,13 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
                         .map(|c| core::str::from_utf8(c).unwrap_or("?"))
                         .collect();
                     dump_lines(&lines);
+                    crate::gop::boot_marker("gop: NO-SHADOW (fallback mode)");
+                } else {
+                    crate::gop::boot_marker(&alloc::format!(
+                        "gop: shadow {:#x} {:.2} MiB",
+                        SHADOW as usize,
+                        swords as f64 * 4.0 / 1048576.0
+                    ));
                 }
             }
         }