display: the compositor service — claim, double-buffer, present (D2)

Stand up /system/services/display: a ring-3 process that claims the framebuffer
D1 seeded, maps it write-combining as the front buffer, allocates a cacheable
back buffer, and presents composed frames. The GUI track's compositor, reached
by name over ServiceId.display (= 9).

- protocol.zig: the display wire protocol (info/create_layer/configure_layer/
  destroy_layer/fill_rect/blit_tile/damage/present). `info` and a whole-screen
  `present` are live; the layer ops fail-stub until D3.
- display.zig: enumerate -> claim -> mmio_map(WC) the LFB, mmap a cacheable back
  buffer, clear it and present it (proving the double-buffer path), then serve.
- runtime.display + barrel exports (display, display_protocol): a cached
  `.display` client with info()/present(), the runtime.block shape.
- init spawns "display" in boot_services; build.zig wires the protocol onto the
  runtime, builds the exe, packs it into the initial-ramdisk, installs it.

mmap fix the back buffer forced: systemMmap was capped at 256 pages (1 MiB) by a
fixed kernel-stack scratch array. Rewrote it to map page-by-page with rollback
(no array) and raised the cap to 8192 pages (32 MiB) — enough for a 4K back
buffer. A real limitation met.

Gate: `python3 test/qemu_test.py display-service` matches the service's own
serial heartbeats (display: online WxH / presented frame 0), printed only after
the full claim -> WC-map -> back-buffer -> present chain. Regression-checked
usermem, heap, init, and D1's display.

docs/display-plan.md

@@ -62,30 +62,37 @@ visible fill folds into D2's gate (the service clears the screen through the bac
 Regression-checked: `discovery`, `ioport`, `claim-release`, `supervision`, `device-list`,
 `device-manager` all still pass with the +1 device in the table.
 
-## D2 — Service skeleton, protocol, runtime module
+## D2 — Service skeleton, protocol, runtime module ✅
 
 Stand up the named service and the double-buffer, no layers yet.
 
-- [ ] `system/services/display/protocol.zig`: `Operation{ info, create_layer,
+- [x] `system/services/display/protocol.zig`: `Operation{ info, create_layer,
       configure_layer, destroy_layer, fill_rect, blit_tile, damage, present }`; `extern`
-      `Request`/`Reply`; `message_maximum`/`request_size`/`reply_size` consts. (Model:
-      [block/protocol.zig](../system/services/block/protocol.zig).)
-- [ ] [abi.zig](../system/abi.zig): `ServiceId.display = 9`.
-- [ ] `system/services/display/display.zig`: `main` → enumerate + claim + WC-map the LFB
-      (front) → `mmap` a cacheable back buffer of `height*pitch` → `runtime.service.run(
-      .{ .service = .display, .init, .on_message })`. Implement `info` and a whole-screen
-      `present` (back → front) first.
-- [ ] [library/runtime/display.zig](../library/runtime/runtime.zig) (+ export in
-      `runtime.zig`): `info()`, and a stub `present()`. Cached `.display` lookup with
-      retry (model: [block.zig](../library/runtime/block.zig)).
-- [ ] [init.zig](../system/services/init/init.zig): add `"display"` to `boot_services`.
-- [ ] [build.zig](../build.zig): `display-protocol` module; `display` exe via
-      `addUserBinary`; import the protocol into `runtime` and into the exe; pack into the
-      initial-ramdisk; install to `/system/services/display`.
+      `Request`/`Reply`; size + `maximum_payload` consts. (Model: block/protocol.zig.)
+- [x] [abi.zig](../system/abi.zig): `ServiceId.display = 9`.
+- [x] `system/services/display/display.zig`: `main` → enumerate + claim + WC-map the LFB
+      (front) → `mmap` a cacheable back buffer of `height*pitch` → `runtime.service.run`.
+      `info` and a whole-screen `present` (back → front) are live; layer ops fail-stub
+      until D3. Init clears the back buffer and presents it — the double-buffer path.
+- [x] [library/runtime/display.zig](../library/runtime/runtime.zig) (+ barrel export of
+      `display` and `display_protocol`): `info()` and `present()`, cached `.display`
+      lookup with retry (model: block.zig).
+- [x] [init.zig](../system/services/init/init.zig): `"display"` added to `boot_services`.
+- [x] [build.zig](../build.zig): `display-protocol` module on the runtime; `display` exe
+      via `addUserBinary`; packed into the initial-ramdisk; installed to
+      `/system/services/display`.
+- [x] **Kernel fix the back buffer surfaced:** `mmap` was capped at 256 pages (1 MiB) by
+      a fixed kernel-stack `frames` array. Rewrote `systemMmap` to map page-by-page with
+      rollback (no scratch array) and raised the cap to 8192 pages (32 MiB) — enough for a
+      4K back buffer. A real limitation met, exactly the kind this project chases.
 
-**Gate:** boot; `init` spawns `display`; it logs `display: online {w}x{h}` and clears the
-screen to a colour **through the back buffer → present path** (double buffering proven —
-no direct-to-LFB drawing). Screenshot confirms.
+**Gate (met, automated):** `python3 test/qemu_test.py display-service` spawns the
+compositor and matches its own serial heartbeats — `display: online {w}x{h} pitch …`
+followed by `display: presented frame 0` — which it prints only after the whole
+claim → WC-map → back-buffer → clear → present chain succeeds (matched on serial like the
+fault cases, since a lone blocking service can't reschedule the in-kernel test context to
+poll). Regression-checked: `usermem`, `heap` (the `mmap` rewrite), `init` (the boot-list
+addition), and D1's `display` all still pass.
 
 ## D3 — Layer stack + compositor + damage present