A new standing rule landed for the whole fleet: everything renders GPU-rasterized first, with a software floor underneath. Not "GPU where convenient" — GPU by default, everywhere, with the CPU path as the fallback that guarantees the floor still boots. Two ships this cycle turned that rule into infrastructure.
gpu_accel_render — every draw path gets a GPU lane
gpu_accel_render.sg (GARENDER-PASS, 9/9 green) gives the whole system a single set of accelerated 2D primitives: gar_fill_rect, gar_blit_rect, gar_composite_rect. Each is hal_accel()-gated — when a GPU is present the call routes through gpu_submit(CAP_ACCEL); when it isn't, it drops to the software floor (fill_span / copy_span / composite_span, the cpuaccel SIMD path). Every draw path in the system can now route through these instead of hand-rolled per-scanline loops.
This is the one-HAL-two-backends pattern made concrete: the same call site is fast on hardware that has a GPU and still correct on a Pi 3 that doesn't.
gpu_login — the login screen leads by example
gpu_login.sg (GPULOGIN-PASS, 8/8) routes the login screen itself through GPU rasterization — and by standing rule it's now the canonical login for every image: every Pi 3B/4B/5 build, every x86 image, and the release sigilos.img. The first thing you see is also the first thing drawn the new way.
The four pillars, in the render path
FAST
The default path submits to the GPU (gpu_submit) instead of looping scanlines on the CPU — the login draws faster, and so does everything built on the primitives.
EFFICIENT
One HAL, two backends. The software floor uses cpuaccel SIMD, so the Pi 3 with no GPU still renders correctly — no separate codebase, no fat runtime.
SECURE
The GPU lane is capability-gated: a draw reaches the hardware through gpu_submit(CAP_ACCEL), an explicit capability — not ambient access to the accelerator.
STABLE
Both shipped green (GARENDER 9/9, GPULOGIN 8/8), and the software fallback means the GPU path can never strand a board that lacks one.
Make it the default, gate it on a capability, and keep a floor that always works. That's how GPU-first stops being an optimization and becomes the way the OS draws.