diff -r 99debf19e3ce -r 4bec91d91306 base/hammerhead-desktop/dot-xsession
--- a/base/hammerhead-desktop/dot-xsession	Fri Jul 24 09:16:18 2026 -0500
+++ b/base/hammerhead-desktop/dot-xsession	Fri Jul 24 09:20:54 2026 -0500
@@ -1,3 +1,10 @@
 #!/bin/sh
 # Hammerhead default X session - launch the Openbox desktop.
+#
+# Put the Hammerhead desktop config (/usr/local/etc/xdg) on the XDG search
+# path so openbox/tint2/conky find the branded config without ~/.config.
+# (xdm's Xsession also sets this; repeated here so `startx`/xinit users, who
+# run ~/.xsession directly, get the branded desktop too.)
+export XDG_CONFIG_DIRS="/usr/local/etc/xdg:${XDG_CONFIG_DIRS:-/etc/xdg}"
+export XDG_DATA_DIRS="/usr/local/share:${XDG_DATA_DIRS:-/usr/share}"
 exec /usr/local/bin/openbox-session
diff -r 99debf19e3ce -r 4bec91d91306 base/hammerhead-desktop/package.toml
--- a/base/hammerhead-desktop/package.toml	Fri Jul 24 09:16:18 2026 -0500
+++ b/base/hammerhead-desktop/package.toml	Fri Jul 24 09:20:54 2026 -0500
@@ -7,7 +7,7 @@
 
 [package]
 name = "hammerhead-desktop"
-version = "1.3.0"
+version = "1.4.0"
 release = 1
 description = "Zygaena marine-dark desktop branding: wallpaper, Openbox theme, tint2/conky configs, categorized menu w/ CBPP-style Places/Recent pipemenus, autostart"
 url = "https://git.sharkos.one/zygaena/hammerhead"
diff -r 99debf19e3ce -r 4bec91d91306 base/hammerhead-xdm/Xservers
--- a/base/hammerhead-xdm/Xservers	Fri Jul 24 09:16:18 2026 -0500
+++ b/base/hammerhead-xdm/Xservers	Fri Jul 24 09:20:54 2026 -0500
@@ -1,15 +1,9 @@
 #
 # Xservers file, Hammerhead workstation
 #
-# Launch our own Xorg on the local console the proven M2/M3 way:
-#   - absolute path to /usr/local/bin/Xorg (the xdm default shells out to
-#     "X", which on Hammerhead is not what we want to depend on)
-#   - -nolisten tcp: no TCP transport
-#   - -config /etc/X11/xorg.conf: our framebuffer config
+# DECOUPLED: our zyginit start.sh launches Xorg itself (xdm-managed startup
+# hangs on illumos VT acquisition). xdm therefore manages only the greeter +
+# session on the already-running server, declared FOREIGN — xdm does not
+# start or stop it. See DESKTOP_XLIBRE_XDM_GREETER_PLAN.md.
 #
-# Deliberately NO -dumbSched (patch 0005 makes plain Xorg CPU-sane) and NO
-# vtN argument: console-login is held off via the zyginit `conflicts` edge so
-# the console is free; explicit VT binding is deferred to the multi-VT
-# follow-up.
-#
-:0 local /usr/local/bin/Xorg :0 -nolisten tcp -config /etc/X11/xorg.conf
+:0 foreign
diff -r 99debf19e3ce -r 4bec91d91306 base/hammerhead-xdm/Xsession
--- a/base/hammerhead-xdm/Xsession	Fri Jul 24 09:16:18 2026 -0500
+++ b/base/hammerhead-xdm/Xsession	Fri Jul 24 09:20:54 2026 -0500
@@ -1,6 +1,15 @@
 #!/bin/sh
-# Xsession - runs AS the authenticated user after login. Prefer the user's
-# own ~/.xsession; otherwise start the Hammerhead default Openbox session.
+# Xsession - runs AS the authenticated user after login (xdm sets
+# $USER/$HOME/$DISPLAY/$XAUTHORITY).
+#
+# Put the Hammerhead desktop config (shipped under /usr/local/etc/xdg) on the
+# XDG search path so openbox/tint2/conky find the BRANDED config even for a
+# fresh user with no ~/.config. Exported here so it is inherited by the whole
+# session tree (including a user's own ~/.xsession, if any).
+export XDG_CONFIG_DIRS="/usr/local/etc/xdg:${XDG_CONFIG_DIRS:-/etc/xdg}"
+export XDG_DATA_DIRS="/usr/local/share:${XDG_DATA_DIRS:-/usr/share}"
+
+# Prefer the user's own ~/.xsession; otherwise the Hammerhead Openbox session.
 if [ -x "$HOME/.xsession" ]; then
 	exec "$HOME/.xsession"
 fi
diff -r 99debf19e3ce -r 4bec91d91306 base/hammerhead-xdm/Xsetup_0
--- a/base/hammerhead-xdm/Xsetup_0	Fri Jul 24 09:16:18 2026 -0500
+++ b/base/hammerhead-xdm/Xsetup_0	Fri Jul 24 09:20:54 2026 -0500
@@ -1,6 +1,13 @@
 #!/bin/sh
 # Xsetup_0 - branded backdrop drawn before the xlogin box appears.
 # Runs as root on display :0. Absolute paths only.
+#
+# HOME: xdm's setup env is minimal; feh needs a HOME to read/write its config.
+# XAUTHORITY: connect to the access-controlled (foreign) server started by
+# the zyginit start.sh with our MIT-MAGIC-COOKIE.
+export HOME=/root
+export XAUTHORITY=/var/lib/xdm/authdir/authfiles/A:0
+
 /usr/local/bin/xsetroot -solid "#0d1117"
 [ -r /usr/local/share/backgrounds/hammerhead.png ] && \
 	/usr/local/bin/feh --bg-fill /usr/local/share/backgrounds/hammerhead.png &
diff -r 99debf19e3ce -r 4bec91d91306 base/hammerhead-xdm/package.toml
--- a/base/hammerhead-xdm/package.toml	Fri Jul 24 09:16:18 2026 -0500
+++ b/base/hammerhead-xdm/package.toml	Fri Jul 24 09:20:54 2026 -0500
@@ -10,7 +10,7 @@
 [package]
 name = "hammerhead-xdm"
 version = "1.0.0"
-release = 2
+release = 3
 description = "Zygaena marine-dark xdm greeter branding, system Xsession/Xservers wiring, and a disabled zyginit xdm service"
 url = "https://git.sharkos.one/zygaena/hammerhead"
 license = "CDDL-1.0"
@@ -18,9 +18,10 @@
 arch = "x86_64"
 
 [dependencies]
-# xsetroot: Xsetup_0 execs /usr/local/bin/xsetroot to paint a solid
-# backdrop before the xlogin box appears (Task 4 finding, fixed release 2).
-runtime = ["xdm", "hammerhead-desktop", "xsetroot"]
+# xsetroot: Xsetup_0 paints a solid backdrop; xrdb: xdm loads the branded
+# Xresources onto the greeter; xauth: start.sh sets the MIT-MAGIC-COOKIE for
+# the decoupled (foreign) server (release 3).
+runtime = ["xdm", "hammerhead-desktop", "xsetroot", "xrdb", "xauth"]
 
 [build]
 parallel = false
diff -r 99debf19e3ce -r 4bec91d91306 base/hammerhead-xdm/start.sh
--- a/base/hammerhead-xdm/start.sh	Fri Jul 24 09:16:18 2026 -0500
+++ b/base/hammerhead-xdm/start.sh	Fri Jul 24 09:20:54 2026 -0500
@@ -1,4 +1,37 @@
 #!/bin/zsh
-# zyginit start hook for the xdm graphical login service. Runs in the
-# foreground (-nodaemon) so the supervisor can track it. Absolute paths only.
+# zyginit start hook for the Hammerhead xdm graphical login.
+#
+# DECOUPLED server model: xdm-managed X-server startup hangs on illumos VT
+# acquisition ("using VT number 2" never completes) — while a separately
+# started server works fine. So we start our own Xorg here (the proven M2/M3
+# launch), then run xdm against it as a FOREIGN display (xdm draws only the
+# greeter + runs the session; it does not start/stop the server). See
+# docs/roadmap/DESKTOP_XLIBRE_XDM_GREETER_PLAN.md.
+#
+# MIT-MAGIC-COOKIE-1 access control so the display is authorized (no
+# "unsecure session" warning). Absolute paths only (zyginit convention).
+set -u
+
+XAUTHDIR=/var/lib/xdm/authdir/authfiles
+XAUTH="$XAUTHDIR/A:0"
+
+/bin/mkdir -p "$XAUTHDIR"
+/bin/rm -f "$XAUTH" /tmp/.X0-lock /tmp/.X11-unix/X0 2>/dev/null
+
+# Fresh cookie, shared between the server (-auth) and every X client via
+# XAUTHORITY (xdm greeter, Xsetup, and the user session all inherit it).
+COOKIE=$(/usr/bin/openssl rand -hex 16)
+/usr/local/bin/xauth -f "$XAUTH" add :0 . "$COOKIE"
+export XAUTHORITY="$XAUTH"
+
+# Start Xorg with auth, in the background (the launch that works on our console).
+/usr/local/bin/Xorg :0 -nolisten tcp -auth "$XAUTH" -config /etc/X11/xorg.conf &
+
+# Wait for the server socket (illumos has no seq/timeout(1)).
+i=0
+while [ ! -S /tmp/.X11-unix/X0 ] && [ "$i" -lt 60 ]; do /bin/sleep 0.25; i=$((i + 1)); done
+/bin/sleep 1
+
+# Run xdm on the foreign, authorized server. exec so zyginit supervises xdm;
+# Xorg is in the same process contract and is torn down with the service.
 exec /usr/local/bin/xdm -nodaemon -config /usr/local/lib/X11/xdm/xdm-config