v0.5.5: self-diagnosing boot — vt refuses 0x0 geometry, panic band shows last stage

The user's real-hardware boot showed 'PANIC: index out of bounds (len 0,
index 0) at vt.rs:146' — the vt grid was created empty because the
framebuffer geometry was 0x0 at vt::init (GOP missing or the active
mode reporting zero resolution).  The v0.5.4 blank screen was the same
panic, previously invisible (no screen dump in the panic handler).

- vt::init: rows/cols == 0 now halts with a visible white-on-red
  'FATAL: no framebuffer geometry — GOP missing or active mode is 0x0'
  band instead of building an empty grid that panics at the first
  cell write.
- boot_marker records the last boot stage; the panic band appends it
  as a 4th line so a crash shows exactly how far boot got.
- The gop+vt marker now carries the measured geometry ('rsnix: gop
  800x600 vt 100x37 ok') so a good boot is self-confirming on the
  screen.
- All 5 test suites pass; build/clippy clean.

2 files changed, 41 insertions, 0 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 7b97d14..90c24bf 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -71,6 +71,20 @@ pub fn framebuffer_region() -> Option<(usize, usize)> {
 static mut SHADOW: *mut u32 = core::ptr::null_mut();
 static mut SHADOW_WORDS: usize = 0;
 
+/// Last boot-progress stage (set by `boot_marker`); the panic handler
+/// appends it to the on-screen band so a crash shows where boot died.
+static mut LAST_BOOT_STAGE: [u8; 96] = [0; 96];
+static mut LAST_BOOT_STAGE_LEN: usize = 0;
+const STAGE_MAX: usize = 96;
+
+/// The last boot stage string (for the panic band).
+pub fn last_boot_stage() -> alloc::string::String {
+    unsafe {
+        alloc::string::String::from_utf8_lossy(&LAST_BOOT_STAGE[..LAST_BOOT_STAGE_LEN])
+            .into_owned()
+    }
+}
+
 /// Diagnostic: when > 0, every display store busy-waits ~this many
 /// cycles first, simulating the per-write bus cost of an uncached real
 /// GOP framebuffer (QEMU's framebuffer is RAM — instant).  Lets us
@@ -338,6 +352,13 @@ pub fn init_shadow() {
 /// direct-display glyph path (the shadow may not exist yet in early
 /// boot); the shell banner overwrites row 0 at first paint.
 pub fn boot_marker(msg: &str) {
+    // Record the stage so a later panic band can show how far boot got.
+    unsafe {
+        let n = msg.len().min(STAGE_MAX);
+        let dst = core::ptr::addr_of_mut!(LAST_BOOT_STAGE) as *mut u8;
+        core::ptr::copy_nonoverlapping(msg.as_ptr(), dst, n);
+        LAST_BOOT_STAGE_LEN = n;
+    }
     let Some(fb) = fb().as_ref() else {
         return;
     };
diff --git a/rsnix/src/vt.rs b/rsnix/src/vt.rs
index 53821b7..4578f6c 100644
--- a/rsnix/src/vt.rs
+++ b/rsnix/src/vt.rs
@@ -96,6 +96,26 @@ static mut CUR: usize = 0;
 /// Allocate the cell grid.  Call once after `gop::init()`.
 pub fn init() {
     let (cols, rows) = gop::dims();
+    if rows == 0 || cols == 0 {
+        // No usable framebuffer geometry: GOP is missing entirely or the
+        // active mode reports 0x0.  Without a display there is nothing
+        // the shell can do, so stop with a visible explanation instead
+        // of building an empty grid and panicking at the first cell
+        // write (a blank screen on real hardware, which has no serial
+        // console).
+        let lines = [
+            "FATAL: no framebuffer geometry",
+            "GOP missing or active mode is 0x0",
+            "see the 'gop:' boot marker / serial log",
+        ];
+        crate::gop::dump_lines(&lines);
+        crate::serial_println!("FATAL: no framebuffer geometry (GOP missing or 0x0 mode)");
+        loop {
+            unsafe {
+                core::arch::asm!("cli; hlt");
+            }
+        }
+    }
     unsafe {
         ROWS = rows;
         COLS = cols;