Reduce TLS memory requirements for KOReader sync

Split heap gate into separate free-memory (50KB) and largest-block (20KB) thresholds based on field measurements. Enable wolfSSL single-precision ECC to use fixed 256-bit arrays instead of heap-allocated fast-math bignums, reducing TLS handshake memory footprint. Reclaim ~7KB by right-sizing ESP timer task stacks and move WiFi code out of IRAM to free ~25-30KB for heap. Add memory audit landmarks for font and EPUB allocations.

lib/EpdFont/FontDecompressor.cpp

@@ -369,6 +369,11 @@ int FontDecompressor::prewarmCache(const EpdFontData* fontData, const char* utf8
   }
   stats.pageBufferBytes += totalBytes;
   stats.pageGlyphsBytes += glyphCount * sizeof(PageGlyphEntry);
+  // MEMFIX-PORT: page-slot address landmark for the heap map; portable
+  // Landmark for the heap block map: page slots are the largest flash-font
+  // allocations and otherwise show up as anonymous ~4-20 KB used blocks.
+  LOG_DBG("FDC", "page slot buffer=%p bytes=%u glyphs=%u", static_cast<void*>(slot.buffer), (unsigned)totalBytes,
+          (unsigned)glyphCount);
 
   slot.fontData = fontData;
   slot.glyphCount = glyphCount;

lib/EpdFont/SdCardFont.h

@@ -104,6 +104,7 @@ class SdCardFont {
     uint32_t uniqueGlyphs = 0;
     uint32_t bitmapBytes = 0;
   };
+  // MEMFIX-PORT: SD font resident-bytes audit; portable
   // Log per-style resident heap (full tables + kept-if-fits mini arenas +
   // advance tables + overflow bitmaps) and return the total in bytes. Pure
   // accounting — no allocation, no state change.

lib/EpdFont/SdCardFontManager.h

@@ -32,6 +32,7 @@ class SdCardFontManager {
   // Get name of currently loaded family (empty if none).
   const std::string& currentFamilyName() const { return loadedFamilyName_; };
 
+  // MEMFIX-PORT: font manager audit passthrough; portable
   // Sum of loaded fonts' resident heap (see SdCardFont::reportMemory).
   size_t reportMemory() const;
 

lib/Epub/Epub.h

@@ -44,6 +44,7 @@ class Epub {
   }
   ~Epub() = default;
   std::string& getBasePath() { return contentBasePath; }
+  // MEMFIX-PORT: epub resident-bytes audit accessor; portable
   // Approximate resident heap of the open book (audit): path strings, the CSS
   // file list, and the parsed stylesheet. BookMetadataCache is file-backed
   // (counts + HalFile handles) and contributes little.

lib/Epub/Epub/Section.h

@@ -132,6 +132,7 @@ class Section {
   // (covers finalized sections and partials from a previous session).
   std::optional<uint16_t> findAnchor(const std::string& anchor) const;
 
+  // MEMFIX-PORT: section resident-bytes audit accessor; portable
   // Approximate resident heap for the audit log. Steady state (no build) a
   // Section holds little beyond itself; during a build the page LUT and path
   // strings dominate (the parser's internal footprint is not walked here).

lib/Epub/Epub/css/CssParser.h

@@ -67,6 +67,7 @@ class CssParser {
    */
   [[nodiscard]] static CssStyle parseInlineStyle(std::string_view styleValue);
 
+  // MEMFIX-PORT: stylesheet resident-bytes audit accessor; portable
   // Approximate resident heap of the parsed stylesheet, for the audit log.
   // unordered_map cost model: bucket array + one node per rule (libstdc++ node
   // overhead ~= 2 pointers + hash) + key string capacity when it exceeds SSO.

lib/KOReaderSync/KOReaderSyncClient.cpp

@@ -22,7 +22,21 @@ constexpr char DEVICE_ID[] = "crosspoint-reader";
 // footprint is smaller than mbedTLS's old ~48KB peak, but keep a conservative
 // floor. Check both total free heap and largest contiguous block so fragmented
 // heap does not fall through into a failed TLS allocation path.
-constexpr uint32_t MIN_HEAP_FOR_TLS = 55000;
+// MEMFIX-PORT: TLS heap gate; portable
+// Field data (July 2026): launching sync from a reader session lands at
+// 51.9-58.2 KB free / 42-53 KB maxAlloc after WiFi comes up. wolfSSL handles
+// allocation failure by returning MEMORY_E (no abort under -fno-exceptions),
+// so an optimistic attempt degrades to the same clean "sync failed" as the
+// gate — the gate only needs to keep out states where a doomed handshake
+// would waste tens of seconds, not guarantee success.
+//
+// Free and largest-block have separate requirements: with SP ECC
+// (WOLFSSL_HAVE_SP_ECC) the handshake's crypto uses fixed 256-bit arrays, so
+// the largest single TLS allocation is the ~17 KB wolfSSL record buffer, not
+// a run of fast-math bignums. A handshake was measured succeeding inside a
+// 43 KB largest block; requiring 50 KB contiguous refused syncs that fit.
+constexpr uint32_t MIN_FREE_FOR_TLS = 50000;
+constexpr uint32_t MIN_BLOCK_FOR_TLS = 20000;
 
 // Apply the shared KOSync auth headers after begin(). x-auth-* is the native
 // KOSync scheme; Basic auth is added for Calibre-Web-Automated compatibility.
@@ -39,9 +53,9 @@ void applyAuthHeaders(freeink::SecureHttpClient& http) {
 bool insufficientHeap() {
   const uint32_t freeHeap = ESP.getFreeHeap();
   const uint32_t maxAllocHeap = ESP.getMaxAllocHeap();
-  if (freeHeap < MIN_HEAP_FOR_TLS || maxAllocHeap < MIN_HEAP_FOR_TLS) {
-    LOG_ERR("KOSync", "Insufficient heap for TLS handshake: %u bytes free, %u max alloc (need %u)", freeHeap,
-            maxAllocHeap, MIN_HEAP_FOR_TLS);
+  if (freeHeap < MIN_FREE_FOR_TLS || maxAllocHeap < MIN_BLOCK_FOR_TLS) {
+    LOG_ERR("KOSync", "Insufficient heap for TLS handshake: %u bytes free (need %u), %u max alloc (need %u)", freeHeap,
+            MIN_FREE_FOR_TLS, maxAllocHeap, MIN_BLOCK_FOR_TLS);
     return true;
   }
   return false;