diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/Xreset
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/Xreset	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,6 @@
+#!/bin/sh
+# Xreset - runs as root at session end on display :0.
+# Return console ownership to root (TakeConsole). Absolute paths.
+/bin/chown root /dev/console
+/bin/chmod 622 /dev/console
+exit 0
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/Xresources
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/Xresources	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,86 @@
+Xcursor.theme: whiteglass
+
+xlogin*login.translations: #override \
+	Ctrl<Key>R: abort-display()\n\
+	<Key>F1: set-session-argument(failsafe) finish-field()\n\
+	<Key>Delete: delete-character()\n\
+	<Key>Left: move-backward-character()\n\
+	<Key>Right: move-forward-character()\n\
+	<Key>Home: move-to-begining()\n\
+	<Key>End: move-to-end()\n\
+	Ctrl<Key>KP_Enter: set-session-argument(failsafe) finish-field()\n\
+	<Key>KP_Enter: set-session-argument() finish-field()\n\
+	Ctrl<Key>Return: set-session-argument(failsafe) finish-field()\n\
+	<Key>Return: set-session-argument() finish-field()
+
+xlogin*greeting: Hammerhead - Zygaena
+xlogin*namePrompt: \040\040\040\040\040\040\040Login:
+xlogin*fail: Login incorrect or forbidden by policy
+
+#if WIDTH > 800
+xlogin*greetFont: -adobe-helvetica-bold-o-normal--24-240-75-75-p-138-iso8859-1
+xlogin*font: -adobe-helvetica-medium-r-normal--18-180-75-75-p-98-iso8859-1
+xlogin*promptFont: -adobe-helvetica-bold-r-normal--18-180-75-75-p-103-iso8859-1
+xlogin*failFont: -adobe-helvetica-bold-r-normal--18-180-75-75-p-103-iso8859-1
+xlogin*greetFace:	Serif-24:bold:italic
+xlogin*face: 		Helvetica-18
+xlogin*promptFace: 	Helvetica-18:bold
+xlogin*failFace: 	Helvetica-18:bold
+#else
+xlogin*greetFont: -adobe-helvetica-bold-o-normal--17-120-100-100-p-92-iso8859-1
+xlogin*font: -adobe-helvetica-medium-r-normal--12-120-75-75-p-67-iso8859-1
+xlogin*promptFont: -adobe-helvetica-bold-r-normal--12-120-75-75-p-70-iso8859-1
+xlogin*failFont: -adobe-helvetica-bold-o-normal--14-140-75-75-p-82-iso8859-1
+xlogin*greetFace:	Serif-18:bold:italic
+xlogin*face:		Helvetica-12
+xlogin*promptFace:	Helvetica-12:bold
+xlogin*failFace:	Helvetica-14:bold
+#endif
+
+#ifdef COLOR
+! Zygaena marine-dark palette
+!   bg      #0d1117  (deep marine)
+!   text    #cfe0e0  (pale teal-grey)
+!   accent  #1fb6b6  (teal - greeting/prompt/input)
+!   input   #161b22  (slightly raised field)
+!   fail    #ff5f56  (warning red)
+xlogin*borderWidth: 1
+xlogin*frameWidth: 4
+xlogin*innerFramesWidth: 1
+xlogin*shdColor:	#0a0d12
+xlogin*hiColor:		#1c2530
+xlogin*background:	#0d1117
+xlogin*foreground:	#cfe0e0
+xlogin*inpColor:	#161b22
+xlogin*greetColor:	#1fb6b6
+xlogin*promptColor:	#1fb6b6
+xlogin*failColor:	#ff5f56
+*Foreground:		#cfe0e0
+*Background:		#0d1117
+#else
+xlogin*borderWidth: 3
+xlogin*frameWidth: 0
+xlogin*innerFramesWidth: 1
+xlogin*shdColor: black
+xlogin*hiColor: black
+#endif
+#if PLANES >= 8
+xlogin*logoFileName: /usr/local/lib/X11/xdm/pixmaps/xorg.xpm
+#else
+xlogin*logoFileName: /usr/local/lib/X11/xdm/pixmaps/xorg-bw.xpm
+#endif
+xlogin*useShape: true
+xlogin*logoPadding: 10
+
+XConsole.text.geometry:	480x130
+XConsole.verbose:	true
+XConsole*iconic:	true
+XConsole*font:		fixed
+
+Chooser*geometry:		700x500+300+200
+Chooser*allowShellResize:	false
+Chooser*viewport.forceBars:	true
+Chooser*label.font:		*-new century schoolbook-bold-i-normal-*-240-*
+Chooser*label.label:		XDMCP Host Menu from CLIENTHOST
+Chooser*list.font:		-*-*-medium-r-normal-*-*-230-*-*-c-*-iso8859-1
+Chooser*Command.font:		*-new century schoolbook-bold-r-normal-*-180-*
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/Xservers
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/Xservers	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,15 @@
+#
+# Xservers file, Hammerhead workstation
+#
+# Launch our own Xorg on the local console the proven M2/M3 way:
+#   - absolute path to /usr/local/bin/Xorg (the xdm default shells out to
+#     "X", which on Hammerhead is not what we want to depend on)
+#   - -nolisten tcp: no TCP transport
+#   - -config /etc/X11/xorg.conf: our framebuffer config
+#
+# Deliberately NO -dumbSched (patch 0005 makes plain Xorg CPU-sane) and NO
+# vtN argument: console-login is held off via the zyginit `conflicts` edge so
+# the console is free; explicit VT binding is deferred to the multi-VT
+# follow-up.
+#
+:0 local /usr/local/bin/Xorg :0 -nolisten tcp -config /etc/X11/xorg.conf
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/Xsession
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/Xsession	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,7 @@
+#!/bin/sh
+# Xsession - runs AS the authenticated user after login. Prefer the user's
+# own ~/.xsession; otherwise start the Hammerhead default Openbox session.
+if [ -x "$HOME/.xsession" ]; then
+	exec "$HOME/.xsession"
+fi
+exec /usr/local/bin/openbox-session
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/Xsetup_0
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/Xsetup_0	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,6 @@
+#!/bin/sh
+# Xsetup_0 - branded backdrop drawn before the xlogin box appears.
+# Runs as root on display :0. Absolute paths only.
+/usr/local/bin/xsetroot -solid "#0d1117"
+[ -r /usr/local/share/backgrounds/hammerhead.png ] && \
+	/usr/local/bin/feh --bg-fill /usr/local/share/backgrounds/hammerhead.png &
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/Xstartup
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/Xstartup	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,5 @@
+#!/bin/sh
+# Xstartup - runs as root at session start on display :0.
+# Give console ownership to the logging-in user (GiveConsole). Absolute paths.
+/bin/chown "$USER" /dev/console
+exit 0
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/build.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/build.sh	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,32 @@
+#!/bin/sh
+# Build script for hammerhead-xdm.
+#
+# No upstream tarball - all inputs are local files shipped alongside this
+# script. This port overlays Hammerhead branding + X-server/session wiring
+# onto the stock xdm defaults (installed under $PREFIX/lib/X11/xdm by the
+# xdm port), and ships a DISABLED zyginit xdm service under /etc.
+set -e
+
+PORTDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+# --- A. Config overlay -> $PREFIX/lib/X11/xdm/ ---
+XDMDIR="$PKGDIR$PREFIX/lib/X11/xdm"
+mkdir -p "$XDMDIR"
+
+# Plain config files (mode 644).
+install -m 644 "$PORTDIR/xdm-config" "$XDMDIR/xdm-config"
+install -m 644 "$PORTDIR/Xservers"   "$XDMDIR/Xservers"
+install -m 644 "$PORTDIR/Xresources" "$XDMDIR/Xresources"
+
+# Executable X* hook scripts (mode 755).
+install -m 755 "$PORTDIR/Xsetup_0" "$XDMDIR/Xsetup_0"
+install -m 755 "$PORTDIR/Xsession" "$XDMDIR/Xsession"
+install -m 755 "$PORTDIR/Xstartup" "$XDMDIR/Xstartup"
+install -m 755 "$PORTDIR/Xreset"   "$XDMDIR/Xreset"
+
+# --- B. zyginit service (shipped DISABLED) -> /etc/zyginit/services/xdm/ ---
+# Absolute /etc, OUTSIDE $PREFIX. No enabled.d symlink is created.
+SVCDIR="$PKGDIR/etc/zyginit/services/xdm"
+mkdir -p "$SVCDIR"
+install -m 644 "$PORTDIR/service.toml" "$SVCDIR/service.toml"
+install -m 755 "$PORTDIR/start.sh"     "$SVCDIR/start.sh"
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/package.toml
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/package.toml	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,24 @@
+# hammerhead-xdm - Zygaena branding + X-server/session wiring overlaid onto
+# xdm's installed default config, plus Hammerhead's first port-provided
+# zyginit service (shipped DISABLED).
+#
+# No upstream source: all inputs are local config files shipped alongside
+# build.sh. This port depends on xdm (which installs the stock defaults we
+# overlay) and hammerhead-desktop (Openbox session + branded backdrop).
+# See build.sh and docs/roadmap/DESKTOP_XLIBRE_XDM_GREETER_PLAN.md.
+
+[package]
+name = "hammerhead-xdm"
+version = "1.0.0"
+release = 1
+description = "Zygaena marine-dark xdm greeter branding, system Xsession/Xservers wiring, and a disabled zyginit xdm service"
+url = "https://git.sharkos.one/zygaena/hammerhead"
+license = "CDDL-1.0"
+maintainer = "Chris Tusa <chris.tusa@leafscale.com>"
+arch = "x86_64"
+
+[dependencies]
+runtime = ["xdm", "hammerhead-desktop"]
+
+[build]
+parallel = false
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/service.toml
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/service.toml	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,24 @@
+# Hammerhead's first port-provided zyginit service.
+# Graphical login via xdm on the console framebuffer. Runs as ROOT (xdm
+# itself drops privileges per session), so NO `user` field. Shipped
+# DISABLED: this port creates no /etc/zyginit/enabled.d/xdm symlink.
+#
+# `conflicts = ["console-login"]` is mutual exclusion: xdm and the console
+# ttymon both want /dev/console, so only one may be enabled at a time.
+[service]
+name = "xdm"
+description = "Graphical login (xdm on the console framebuffer)"
+type = "daemon"
+[exec]
+start = "/etc/zyginit/services/xdm/start.sh"
+[dependencies]
+requires = ["utmpd", "filesystem"]
+after = ["devfs"]
+conflicts = ["console-login"]
+[contract]
+param = ["inherit", "noorphan"]
+fatal = ["hwerr"]
+[restart]
+on = "failure"
+delay = 5
+max_retries = 3
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/start.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/start.sh	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,4 @@
+#!/bin/zsh
+# zyginit start hook for the xdm graphical login service. Runs in the
+# foreground (-nodaemon) so the supervisor can track it. Absolute paths only.
+exec /usr/local/bin/xdm -nodaemon -config /usr/local/lib/X11/xdm/xdm-config
diff -r aaf6bcb7593f -r f3dcdf0b59f1 base/hammerhead-xdm/xdm-config
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/hammerhead-xdm/xdm-config	Thu Jul 23 22:30:20 2026 -0500
@@ -0,0 +1,33 @@
+!
+! Hammerhead xdm-config: overlaid onto the stock xdm default. Only the
+! display-:0 startup/reset hooks are re-pointed at our Xstartup/Xreset
+! (GiveConsole/TakeConsole console-ownership handling); the setup, session,
+! and resources hooks already reference the paths we ship. XDMCP stays OFF.
+!
+DisplayManager.authDir:	/var/lib/xdm
+DisplayManager.errorLogFile:	/var/log/xdm.log
+DisplayManager.pidFile:		/var/run/xdm.pid
+DisplayManager.keyFile:		/usr/local/lib/X11/xdm/xdm-keys
+DisplayManager.servers:		/usr/local/lib/X11/xdm/Xservers
+DisplayManager.accessFile:	/usr/local/lib/X11/xdm/Xaccess
+DisplayManager*resources:	/usr/local/lib/X11/xdm/Xresources
+DisplayManager.willing:		su nobody -s /bin/sh -c /usr/local/lib/X11/xdm/Xwilling
+! All displays should use authorization, but we cannot be sure
+! X terminals may not be configured that way, so they will require
+! individual resource settings.
+DisplayManager*authorize:	true
+!
+DisplayManager*chooser:		/usr/local/lib/X11/xdm/chooser
+DisplayManager*startup:		/usr/local/lib/X11/xdm/Xstartup
+DisplayManager*session:		/usr/local/lib/X11/xdm/Xsession
+DisplayManager*reset:		/usr/local/lib/X11/xdm/Xreset
+DisplayManager*authComplain:	true
+! The following resources set up display :0 as the console.
+DisplayManager._0.setup:	/usr/local/lib/X11/xdm/Xsetup_0
+DisplayManager._0.startup:	/usr/local/lib/X11/xdm/Xstartup
+DisplayManager._0.reset:	/usr/local/lib/X11/xdm/Xreset
+DisplayManager._0.session:	/usr/local/lib/X11/xdm/Xsession
+DisplayManager*loginmoveInterval:	10
+! SECURITY: do not listen for XDMCP or Chooser requests
+! Comment out this line if you want to manage X terminals with xdm
+DisplayManager.requestPort:	0