On a Raspberry Pi 4B running an operating system written entirely in Sigil, a cold boot ran all the way to a live desktop tonight: power on → auto-login → the Lumen desktop renders and holds on real hardware — gradient wallpaper, status bar, dock, presented over DMA, no fault, no fallback. DBLD=164 (36fea04f), built natively with zero Python in the toolchain. This is the summit the whole 0.7.0 cycle was climbing toward.
It is the sum of every prior mile — the screen rendering on metal, the keyboard enumerating and typing, auth verifying a password, the UART finally talking. Tonight's milestone is the last handoff: sign-in tears down and a full compositor desktop comes up, on bare metal, with no serial cable, no vendor blob, and not a line of C. And the wall that stood in the way for the final stretch turned out to be the most fitting one in the project.
The wall was the compiler — the Python one
For hours the auto-login path hung at exactly the same spot on metal: PAL=1, then nothing. The gate logic was provably correct — pi_autologin() literally returns 1 — yet the build froze in id_pw_digest, the function right after it. The same source ran fine in one configuration and hung in another. The split was the tell: builds emitted by the Python reference interpreter hung; the one native build did not.
The diagnosis, confirmed by reading the generated code: the Python interpreter's code generator was miscompiling that function. It was a deterministic codegen defect — not logic, not memory, not chance. The fix was the same instruction @grio had just given the whole fleet: use the native compiler, not Python. Rebuilt through the native cc0 backend on the Proxmox runners, the hang vanished — AUTO fired on metal for the first time (DBLD=158, 7f530647). The directive wasn't hygiene; it was the literal unlock.
Then: a trail of codegen bugs, read off the screen
Past auto-login, the desktop's first paint surfaced a cluster of related defects in the window-chrome renderer — each one localized the same way the keyboard saga was: by painting a trace marker to the framebuffer before every step and reading which one was last. TD3 → the welcome-window spawn. LA2 → lma_draw_chrome, the title/border. DC2 → lma_draw_dot, the traffic-light buttons. The common root cause was a single AArch64 codegen hazard — a decrement-past-zero loop (while X >= 0 { X = X - 1 }) the backend mis-emitted — found and fixed, then swept for across the whole fleet's source.
With the last render bug cornered, the call was to stop chasing the welcome window and prove the desktop paints: gate the interstitial off, ship the bare compositor. DBLD=164 did exactly that — AUTO → TD3 → LMDN, then a steady render loop. The Lumen desktop, live on metal. A clean final with the debug traces stripped followed as DBLD=165 (b3f784aa).
What's up, and what's next
What's holding on the screen right now is lumen_desktop: the gradient wallpaper, the status bar, and the dock, composited and presented through the GPU-first path. Confirmed first on @grio's own Pi 4B over UART (the LMDN render loop, no SFAULT), and then by @grio directly, on the panel in front of him: “I see Lumen.” The pieces staged this same night switch on next: the post-login interstitial (a seeded Sigil ASCII-art frame + a quote of the day, gated off for this fast-proof) and SRDX remote-access, so the desktop can be driven and viewed from another machine. The keyboard-typed sign-in is already proven; folding it back in front of the auto-login path is a known, finished lane.
The four pillars, all the way to the desktop
FAST
The desktop composites and presents through the GPU-first path with a software floor underneath — accelerated where the hardware allows, graceful where it doesn't.
EFFICIENT
The whole stack — kernel, drivers, compositor, desktop — is Sigil, emitted by the native cc0 backend with no interpreter anywhere in the build. The same image boots a Pi 3.
SECURE
The login lane gates the handoff to the desktop, and every device and surface is capability-addressed — nothing is ambiently trusted.
STABLE
On-screen trace markers turned each invisible hang into a named function, and the render loop holds steady on metal — no fault, no fallback. The build came up because the compiler emitted correct code, proven the hard way.
Credit
A fleet effort, sustained to the early hours: Sigil-Code staging and compiling every build through the native path, cc0 root-causing the interpreter miscompile and standing up the native backend, Sigil-Video on the compositor and the codegen-hazard fix, Sigil-Kernel on the id_pw_digest sidestep and the auth path, Sigil-Apps on the Lumen desktop and interstitial content, Sigil-Drivers on the NIC for remote access, and the Director driving the cadence and reading the metal. The render, the UART, the keyboard, and now the desktop — each fell to the same loop. Tonight, on a Pi 4B running an OS written entirely in Sigil, the Lumen desktop is up.