A fourth platform: pardes as ESP32-P4 firmware, bytes in and bytes out

`-Dplatform=p4 -Dtarget=riscv32-freestanding` emits a single freestanding OBJECT
exporting a seven-function C ABI, not an executable. The board's toolchain
(../05-zig-p4) owns `_start`, the linker script and the UART driver and links this
in. The seam is bytes rather than types, so neither side can accidentally depend
on the other's internals, and a signature that drifts fails at link time.

The serial line is the whole of the I/O. `src/p4.zig` drives vaxis unchanged over
it: the renderer is a byte writer and `queryTerminalSend` is a byte writer, so the
terminal emulator on the host answers the capability handshake and the firmware
sees a real terminal. Measured going out over the wire on attach: alt screen,
in-band resize, cursor report, kitty keyboard, kitty graphics, DA1.

THREE WORDS EXIST ONLY HERE. `src/board_memory.zig` implements `Peek`, `Poke` and
`Hexdump`, gated on `builtin.os.tag == .freestanding and !isWasm()` - derived from
the TARGET, because they are a property of running with no OS under you rather
than a product option, and because wasm is freestanding too and is exactly what
must be excluded: in a browser an address is an offset into the linear memory this
editor's own heap lives in. Every access goes through `*allowzero volatile`: a
peripheral register is not memory, and address 0 is an ordinary unmapped address
on this bus. One 4 KiB cap per command, set by the console rather than the memory -
an unbounded dump would wedge the only console the board has for eleven hours.

Measured on ESP32-P4 rev v1.3 silicon, driven from a host terminal:

  Peek 0x501101a4              0x0e63ce71, then 0xaeaa6919 on a second read - the
                               RNG register, so the volatile loads are not folded
  Poke 0x5011002c 0xdeadbeef   LP_STORE0; a later Peek returned 0xdeadbeef
  Hexdump 0x5011002c 32        16 bytes a row, hex columns and an ASCII gutter
  Peek 0x50110001              `peek: MisalignedAddress` on the message row

That last line is the one that matters. A misaligned 32-bit access traps, and a
trap in firmware is a watchdog reset that takes the session with it, so the check
that turns it into a message is the reason the file is hand-written rather than a
generic reader.

BARE METAL BOOTS AN EMPTY OUTPUT BUFFER. Every other boot layout in `init` makes a
shell, and on this platform that is not a preference but an impossibility: nothing
to fork, no pty to give a terminal pane. Booting one anyway produced precisely what
that describes - a pane whose tag ends in `Filter`, no gutter, no buffer, and every
keystroke vanishing into the Fallback's silent pty. An output buffer is also what
the platform's own words want, since Peek, Poke and Hexdump each fill one.

Sized for the board rather than for a desktop:

* `allocators.zig` gains a p4 tier that is ALL fallback - every capacity is zero,
  so each arena spills immediately to the 384 KiB heap the firmware hands over,
  and no megabyte-shaped static reservation lands in `.bss`.
* `source_manifest.zig`'s allowlist is EMPTY on p4. The table is ~0.95 MiB of
  rodata against a 1.5 MiB flash partition; the firmware's filesystem is the
  serial host's, through the Host vtable.
* The grid is clamped and the clamp is measured, not guessed: every cell is paid
  for four times (vaxis Screen + InternalScreen, pardes Surface + previous_cells),
  so 40x12 fits and 80x24 exhausts the heap during `Pardes.init`.
* `Vaxis.resize` deinits both screens before allocating replacements, so a failed
  resize leaves vaxis rendering nothing. The p4 shell keeps the previous geometry
  on failure instead of leaving a half-applied one.

Also here: `output_pane_integration_test.zig` had an exhaustive switch over
`Platform` that adding `.p4` left unhandled, which broke `zig build unit-test`
outright - the native test binary is the one consumer no platform build compiles.
346 tests pass again.

1 files changed, 13 insertions, 1 deletions

diff --git a/src/config.zig b/src/config.zig
index 79fd7fc9..c9d414ca 100644
--- a/src/config.zig
+++ b/src/config.zig
@@ -224,10 +224,18 @@ pub const leader_path = paths: {
     // Native-only filesystem theme commands. ThemeFile needs an operand and
     // DumpThemes is intentionally occasional, so both stay word-executed
     // rather than spending leader chords.
-    if (pardes.platform != .web) {
+    if (pardes.hosted) {
         table.set(.ThemeFile, null);
         table.set(.DumpThemes, null);
     }
+    // The bare-metal memory words. Peek, Poke and Hexdump all take an ADDRESS,
+    // so none of them can have a leader path for the reason Theme and Msg have
+    // none: a key path names a builtin and can never carry an operand.
+    if (builtins.Peek.enabled) {
+        table.set(.Peek, null);
+        table.set(.Poke, null);
+        table.set(.Hexdump, null);
+    }
     // The pane-local PDF commands exist only in MuPDF builds through their
     // explicit registry availability, so name their paths inside the same
     // comptime branch. PdfTint/PdfFit retain their display slots and
@@ -787,6 +795,10 @@ pub const pdf_sections_buffer = "+PdfSections";
 pub const hover_buffer = "+Hover";
 pub const lsp_buffer = "+Lsp";
 pub const changelog_buffer = "+Changelog";
+/// The two memory windows a bare-metal build's Peek and Hexdump render. Absent
+/// from every hosted build along with the builtins that name them.
+pub const peek_buffer = "+Peek";
+pub const hexdump_buffer = "+Hexdump";
 /// The empty buffer New and Newcol open: no file behind it yet, so Save asks
 /// for a path (prefilled with the inherited directory).
 pub const scratch_buffer = "+New";