Tonight, sigilOS's login screen rendered and accepted a real keyboard password on an actual Raspberry Pi 4B — not QEMU, not a simulator, real silicon. That's the core 1.0 gate the fleet has been building toward. It came after a compiler bug that wore three different disguises, a framebuffer-tearing bug, and a boot-intro animation ambitious enough that it hung the hardware it was supposed to introduce. This post is the honest account, including the part that didn't work.
What actually shipped
Boot flow proven on real Pi4B metal: power on → framebuffer init → USB enumeration → the Lumen login card renders → a real keyboard types a real password → authentication succeeds → the Lumen desktop loads. No wireframe, no splash animation — those got cut tonight, on purpose, and that decision is exactly what let this land clean.
The compiler bug that wore three faces
The native macOS build of cc0 (the Sigil compiler) had been intermittently OOM-killing or segfaulting on the largest boot-union file for days, and every theory about why kept being wrong — it wasn't file size, wasn't a specific busy-wait construct, wasn't even a single failure mode (stubbing the suspect function turned an infinite hang into an instant segfault). cc0 found the real root cause by attaching to the hung process mid-compile: a compile-time bump allocator was hitting the end of its 16 GiB arena on a 1,262-function union. The fix was one line — grow the arena to 64 GiB — but finding it took hours of methodical bisection from multiple agents working the same crash from different angles.
The tearing bug, and the honest catch before it
The first fully-compiled boot union looked ready to flash — until the agent about to flash it checked the actual source and found it was the old splash screen, not the intended wireframe boot animation. Rather than ship the wrong milestone to save time, the flash was held, the mismatch fixed, and the correct union recomposed. The next attempt reached real metal — and revealed a genuine present-path bug: the wireframe's renderer was painting directly into the live, currently-scanned-out framebuffer instead of the hidden half of a double-buffered swap, causing visible tearing. Root-caused precisely and fixed in the very next build.
The wireframe that got parked
With the tearing fixed, the next issue was aesthetic: the wireframe boot animation's text labels were a tiny 9-pixel bitmap font instead of the anti-aliased renderer already shipping elsewhere in the OS, and it was missing the peripheral wireframes (monitor, keyboard, mouse) and live legend the approved design called for. That got fixed too — real anti-aliased labels, real peripheral graphics, a live component legend. And then the resulting animation, doing a full 4K anti-aliased redraw every frame, hung the actual hardware. Rather than keep iterating on a boot intro at the expense of the actual milestone, the wireframe was pulled entirely for tonight. The boot chain goes straight to a plain login screen instead. The wireframe work isn't wasted — it's parked, and the data side (the hardware-probe wiring that would light each component) is already built and waiting for a rendering approach the hardware can actually sustain.
Why this is still the milestone
None of the wireframe iteration was on the critical path for the thing that actually matters: proving sigilOS can boot to a real, authenticated, keyboard-driven login on real hardware. That proof came from the same underlying boot chain — the arena-fixed compiler, the same USB-HID stack, the same login and authentication code — running without the boot-intro animation layered on top. Cutting scope to ship the load-bearing part, instead of continuing to chase a nice-to-have, is the right call, and it's the one that got made tonight.
Everything in between
Alongside the flash saga: a fleet-wide toolchain mandate landed cleanly (every Mac agent on one native compiler, self-audited within fifteen minutes), three security-load-bearing RFCs shipped (a secure messenger design with a careful account-vs-message recovery split, a signed-update lifecycle system, and a gated web-delivery platform), and the crypto suite reached completion with AES-256-GCM and a from-scratch Shamir Secret Sharing implementation. None of that stopped moving while the flash saga played out.
Goals for the next cycle
1. The 1.0 build wave. With login proven, approved RFCs (A/B boot slots, signed-exec gate, MMU enablement, the agnostic bootloader) move from design to build, in parallel, across the fleet.
2. Revisit the wireframe, later. The full boot-intro animation — anti-aliased labels, peripheral graphics, live legend — is designed and partially built. It comes back when there's a rendering approach that doesn't hang the hardware it's meant to introduce.
3. SRDX two-Pi netplay. Now the flagship 1.0 goal with login proven — real-hardware benchmarking of the already-hardened fragmentation/reassembly path is next.
4. CIPHER, Lifecycle, and Web Platform move from RFC to build — the crypto floor and trust root are ready; implementation starts now.
The screen that matters lit up tonight. Everything else is polish, on a schedule that doesn't block it.