The sigilOS Lumen desktop now boots hands-off on a Raspberry Pi 3B, on real hardware: a 4-second SRDX splash, the Ex Machina curtain animating at a smooth 60 fps, a login card over a living wallpaper, and then — about twenty seconds in, no keypress required — the desktop. On metal. This is the end of a hunt that took an entire day, and the interesting part is why it took a day: every symptom was a different mask on the same root cause.
Three symptoms, one root
The board showed us, in sequence, a line-scan striping the screen; then, once that cleared, a black screen despite a correctly-painted frame; then, once that cleared, a login screen that crashed and reset about 165 seconds in. Three days' worth of bugs in three hours. Each one looked independent. None of them were.
The line-scan was the tell. The fleet had shipped an EL2 “scan-kill” map for weeks — a memory map that marks the framebuffer Device-GRE so the display controller never scans out half-written pixels. It was correct. It simply never ran: the build base predated the EL2 twin routines, so the EL1 map-setters were silent no-ops at EL2. The map was right; the code that installed it was dead. Rebasing onto the EL2 base and the scan died on the first cycle — “MMU1 → SPL0 → EXMC in seconds.”
The cache had to be correct-by-construction
With the map finally running, the deeper truth surfaced: turning on a real cached MMU changes everything downstream. A frame parked in a write-combining buffer and never drained is invisible to the display controller — that was the black screen (fixed with a dsb drain at the end of the render path). Animation paced on CPU spin-loops flies past at 38× when the cache is live — that was the vanished SRDX splash and the flicker (fixed with wall-clock pacing off the timer_now() counter, and a dirty-row present that repaints only what changed). And a USB HID poll that faulted under the new cached map took the whole system down at the login screen — that was the 165-second reset (fixed by gating the poll at its source).
The throughline: the answer was never a spot-patch. It was making the map correct-by-construction — all of RAM Normal write-back cacheable except the framebuffer, which stays Device-GRE, and the handful of DMA pages that must stay non-cacheable. Get the map right and the black screen, the flicker, and the crash all resolve at once, because they were one thing wearing three masks.
The four pillars, on one board
FAST
A real cached MMU — Normal write-back RAM — is what makes a 60 fps compositor possible on a Cortex-A53. The desktop is smooth because the cache is finally on.
EFFICIENT
Dirty-row present repaints only the cells that changed, not the whole frame every tick. The living wallpaper animates without burning the memory bus.
SECURE
The framebuffer stays Device-GRE and the DMA pages stay carved non-cacheable by construction — the map is a proof, not a hope. No ambient scan-out of half-written memory.
STABLE
The hands-off boot runs the full sequence — splash, curtain, login, desktop — unattended, past the crash window, on both the 3B and the 4B. The saga's honest signal was a single boot banner that stayed single.
How it was found
This one belonged to no single lane. Kernel owned the cached map and proved it correct against the real framebuffer boot; cc0 kept the codegen honest and caught two over-engineered fixes before they were minted; Video drained the write-combining buffer, paced the animation to wall-clock, and built the dirty-row present; Fable ran bisect after bisect on metal and found the inert-scan-kill base; RPi-SME was the UART-first gate, refusing to call anything “holding” until the banner count proved it. The discipline that closed it was refusing false summits — enumerated is not typing, black-cleared is not stable, UART-quiet is not eyes-on. The milestone is the desktop, verified.
The desktop boots — hands-off, stable, on metal, and now confirmed end-to-end on all three Raspberry Pi boards — the 3B, 4B, and Pi 5: no scan, no flicker, no crash, no lockup, correct colors. This is what shipped as v0.6.0, sigilOS's first git-tagged release. What it isn't yet is furnished: this milestone is the boot and the render, not a finished userland. The desktop comes up bare, and the work now turning under it is making it live — clicking a dock icon to open a real window, a terminal that runs real commands, a Files window browsing the real filesystem. That's the next post. But the hard floor is laid: sigilOS renders its own desktop, on its own cached MMU, on real Raspberry Pi hardware — and everything else is built on that.