diff -r 7512ccfa0367 -r 2f6455794aad base/hammerhead-xdm/Xresources
--- a/base/hammerhead-xdm/Xresources	Fri Jul 24 11:11:39 2026 -0500
+++ b/base/hammerhead-xdm/Xresources	Fri Jul 24 11:50:22 2026 -0500
@@ -14,6 +14,10 @@
 	<Key>Return: set-session-argument() finish-field()
 
 xlogin*greeting: Hammerhead - Zygaena
+! The display IS access-controlled (start.sh starts Xorg with a MIT-MAGIC-COOKIE
+! -auth file), but xdm does not track auth for a `foreign` display and would
+! otherwise show its scary "This is an unsecure session". Use the branded text.
+xlogin*unsecureGreeting: Hammerhead - Zygaena
 xlogin*namePrompt: \040\040\040\040\040\040\040Login:
 xlogin*fail: Login incorrect or forbidden by policy
 
@@ -64,11 +68,8 @@
 xlogin*shdColor: black
 xlogin*hiColor: black
 #endif
-#if PLANES >= 8
-xlogin*logoFileName: /usr/local/lib/X11/xdm/pixmaps/xorg.xpm
-#else
-xlogin*logoFileName: /usr/local/lib/X11/xdm/pixmaps/xorg-bw.xpm
-#endif
+! Off-brand XLibre "X" logo hidden for now; a Zygaena mark (XPM) can be dropped
+! in here later. No logoFileName => the greeter shows the login box only.
 xlogin*useShape: true
 xlogin*logoPadding: 10
 
diff -r 7512ccfa0367 -r 2f6455794aad base/hammerhead-xdm/package.toml
--- a/base/hammerhead-xdm/package.toml	Fri Jul 24 11:11:39 2026 -0500
+++ b/base/hammerhead-xdm/package.toml	Fri Jul 24 11:50:22 2026 -0500
@@ -10,7 +10,7 @@
 [package]
 name = "hammerhead-xdm"
 version = "1.0.0"
-release = 6
+release = 7
 description = "Zygaena marine-dark xdm greeter branding, system Xsession/Xservers wiring, and a disabled zyginit xdm service"
 url = "https://git.sharkos.one/zygaena/hammerhead"
 license = "CDDL-1.0"
diff -r 7512ccfa0367 -r 2f6455794aad base/hammerhead-xdm/service.toml
--- a/base/hammerhead-xdm/service.toml	Fri Jul 24 11:11:39 2026 -0500
+++ b/base/hammerhead-xdm/service.toml	Fri Jul 24 11:50:22 2026 -0500
@@ -3,8 +3,9 @@
 # itself drops privileges per session), so NO `user` field. Shipped
 # DISABLED: this port creates no /etc/zyginit/enabled.d/xdm symlink.
 #
-# `conflicts = ["console-login"]` is mutual exclusion: xdm and the console
-# ttymon both want /dev/console, so only one may be enabled at a time.
+# Coexists with console-login: the decoupled X server lives on its own VT
+# (vtdaemon holds vt1, X gets vt2), so it does NOT contend for /dev/console.
+# Ctrl-Alt-F# switches between the greeter (vt2) and the text consoles.
 [service]
 name = "xdm"
 description = "Graphical login (xdm on the console framebuffer)"
@@ -16,7 +17,6 @@
 # which Xorg's VT_WAITACTIVE bring-up hangs (started with no ctty by zyginit).
 requires = ["utmpd", "filesystem", "vtdaemon"]
 after = ["devfs"]
-conflicts = ["console-login"]
 [contract]
 param = ["inherit", "noorphan"]
 fatal = ["hwerr"]