diff --git a/local/docs/DBUS-INTEGRATION-PLAN.md b/local/docs/DBUS-INTEGRATION-PLAN.md
index 4496d3586d..23a83986a1 100644
--- a/local/docs/DBUS-INTEGRATION-PLAN.md
+++ b/local/docs/DBUS-INTEGRATION-PLAN.md
@@ -1,7 +1,7 @@
 # Red Bear OS D-Bus Integration Plan
-**Implementation status (2026-07-26):** All DBUS plan code artifacts are build-verified. Phase 3 DRM-compositor gates (PauseDevice/ResumeDevice emission, PrepareForSleep emission, dynamic device enumeration) are now structurally complete. **Phase 4 re-enablement progress:** 20/24 KF6 frameworks have USE_DBUS=ON. **redbear-polkit v0.2** now implements real authorization (subject UID extraction, `*` / `@group` / `!uid` / `!@group` policy syntax, default-deny for unknown actions). **redbear-udisks v0.2** now has working `Mount` / `Unmount` methods (fork+exec the appropriate filesystem daemon, `SIGTERM` to unmount, `MountPoints` / `IdType` properties). **redbear-notifications v0.2** now emits the `ActionInvoked` signal via the new `InvokeAction` method. **redbear-upower v0.2** exposes additional UPower Device properties (`TimeToFull`, `TimeToEmpty`, `Energy`, `EnergyRate`, `BatteryLevel`, `PowerSupply`, `Serial`); 7 unit tests cover the level enum. **redbear-statusnotifierwatcher v0.2** has 12 unit tests covering the full D-Bus surface: `RegisterStatusNotifierItem` / `RegisterStatusNotifierHost` (signal-emitting) and `UnregisterStatusNotifierItem` / `UnregisterStatusNotifierHost` (previously stubbed), plus the `StatusNotifierHostRegistered` signal that the spec requires; 12 unit tests. **redbear-sessiond** is now host-buildable after fixing a `RefCell` → `Arc<Mutex>` Send/Sync issue and replacing the host-incompatible `libredox::call::kill` with the portable `libc::kill`; 32 unit tests pass. The remaining items are runtime validation gates requiring QEMU, plus the Phase 4 broader surface (kf6-kwallet + kwalletd, kf6-kauth + PolkitQt6-1, kf6-kded6 + kglobalaccel binaries).
+**Implementation status (2026-07-26):** All DBUS plan code artifacts are build-verified. Phase 3 DRM-compositor gates (PauseDevice/ResumeDevice emission, PrepareForSleep emission, dynamic device enumeration) are now structurally complete. **Phase 4 re-enablement progress:** 20/24 KF6 frameworks have USE_DBUS=ON. **redbear-polkit v0.2** now implements real authorization (subject UID extraction, `*` / `@group` / `!uid` / `!@group` policy syntax, default-deny for unknown actions). **redbear-udisks v0.2** now has working `Mount` / `Unmount` methods (fork+exec the appropriate filesystem daemon, `SIGTERM` to unmount, `MountPoints` / `IdType` properties). **redbear-notifications v0.2** now emits the `ActionInvoked` signal via the new `InvokeAction` method. **redbear-upower v0.2** exposes additional UPower Device properties (`TimeToFull`, `TimeToEmpty`, `Energy`, `EnergyRate`, `BatteryLevel`, `PowerSupply`, `Serial`); 7 unit tests cover the level enum. **redbear-statusnotifierwatcher v0.2** has 12 unit tests covering the full D-Bus surface: `RegisterStatusNotifierItem` / `RegisterStatusNotifierHost` (signal-emitting) and `UnregisterStatusNotifierItem` / `UnregisterStatusNotifierHost` (previously stubbed), plus the `StatusNotifierHostRegistered` signal that the spec requires; 12 unit tests. **redbear-sessiond** is now host-buildable after fixing a `RefCell` → `Arc<Mutex>` Send/Sync issue and replacing the host-incompatible `libredox::call::kill` with the portable `libc::kill`; 32 unit tests pass. **kf6-kwallet** build now enables the kwalletd6 daemon binary (added KF6Crash / KF6DBusAddons / KF6GuiAddons / KF6Notifications / KF6WidgetsAddons to the dependency list, removed `BUILD_KWALLETD=OFF`, added a kwalletd6-wrapper.sh that disables the Wayland QPA on Redox). The remaining items are runtime validation gates requiring QEMU, plus the Phase 4 broader surface (kf6-kauth + PolkitQt6-1, kf6-kded6 + kglobalaccel binaries).
 
-**Version:** 3.6 — 2026-07-26
+**Version:** 3.7 — 2026-07-26
 **Status:** Active plan aligned with desktop path v5.9 (2026-07-21)
 **Scope:** Full D-Bus infrastructure for KDE Plasma 6 on Wayland, tightly integrated with Redox scheme IPC
 **Parent plan:** `local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md` (v5.9, 2026-07-21)
diff --git a/local/recipes/kde/kf6-kwallet/recipe.toml b/local/recipes/kde/kf6-kwallet/recipe.toml
index f11b1c6738..89cdcc1704 100644
--- a/local/recipes/kde/kf6-kwallet/recipe.toml
+++ b/local/recipes/kde/kf6-kwallet/recipe.toml
@@ -2,7 +2,10 @@
 name = "kf6-kwallet"
 version = "6.28"
 
-#TODO: KWallet — build the real KF6 client library; KF6WindowSystem + KF6I18n enabled. kwalletd, kwallet-query, X11, and translations stay disabled until the broader runtime service surface is proven.
+# redbear-kwallet — KF6 client library + kwalletd6 daemon. KF6WindowSystem
+# + KF6I18n + KF6DBusAddons + KF6Notifications + KF6WidgetsAddons + KF6Crash
+# + KF6GuiAddons enabled. kwallet-query + X11 + translations stay disabled
+# until the broader runtime service surface is proven.
 [source]
 tar = "https://download.kde.org/stable/frameworks/6.28/kwallet-6.28.0.tar.xz"
 blake3 = "8475d4e8205a40c29b2ba5a3780ee1f516af5ca51ef77e6a473010eaf6d4c413"
@@ -14,6 +17,11 @@ dependencies = [
     "kf6-extra-cmake-modules",
     "kf6-kcoreaddons",
     "kf6-kconfig",
+    "kf6-kcrash",
+    "kf6-kdbusaddons",
+    "kf6-kguiaddons",
+    "kf6-knotifications",
+    "kf6-kwidgetsaddons",
     "kf6-kwindowsystem",
     "kf6-ki18n",
 ]
@@ -31,6 +39,22 @@ done
 #DISABLED: sed -i 's/^ki18n_install(po)/#ki18n_install(po) # translations deferred until lupdate/lrelease is built for target/' \
     "${COOKBOOK_SOURCE}/CMakeLists.txt" 2>/dev/null || true
 
+# The kwalletd6 binary uses Qt6 Wayland. Wrap it so it falls back to the
+# offscreen QPA on Redox, mirroring the kded6-wrapper.sh approach.
+mkdir -p "${COOKBOOK_SOURCE}/runtime/kwalletd"
+cat > "${COOKBOOK_SOURCE}/runtime/kwalletd/kwalletd6-wrapper.sh" << 'WRAPPER'
+#!/bin/sh
+# kwalletd6 wrapper — prevents Qt6 Wayland QPA crash on Redox by
+# disabling the wayland plugin (Qt6 still tries wayland even with
+# QT_QPA_PLATFORM=offscreen unless the plugin is renamed).
+if [ -f /usr/plugins/platforms/libqwayland.so ]; then
+    mv /usr/plugins/platforms/libqwayland.so /usr/plugins/platforms/libqwayland.so.disabled
+fi
+export QT_QPA_PLATFORM=offscreen
+exec /usr/bin/kwalletd6.real "$@"
+WRAPPER
+chmod +x "${COOKBOOK_SOURCE}/runtime/kwalletd/kwalletd6-wrapper.sh"
+
 rm -f CMakeCache.txt
 rm -rf CMakeFiles
 
@@ -43,12 +67,19 @@ cmake "${COOKBOOK_SOURCE}" \
     -DCMAKE_PREFIX_PATH="${COOKBOOK_SYSROOT}:${COOKBOOK_STAGE}/usr/lib/cmake" \
     -DBUILD_TESTING=OFF \
     -DBUILD_QCH=OFF \
-    -DBUILD_KWALLETD=OFF \
     -DBUILD_KWALLET_QUERY=OFF \
     -DWITH_X11=OFF \
     -Wno-dev
 cmake --build . -j${COOKBOOK_MAKE_JOBS}
-cmake --install . --prefix "${COOKBOOK_STAGE}/usr"
+DESTDIR="${COOKBOOK_STAGE}" cmake --install . --prefix /usr
+
+# Wrap the kwalletd6 binary so it works on Redox (Qt6 Wayland page-faults
+# on null+8 in wl_proxy_add_listener at startup). Same approach as kded6.
+if [ -f "${COOKBOOK_STAGE}/usr/bin/kwalletd6" ]; then
+    mv "${COOKBOOK_STAGE}/usr/bin/kwalletd6" "${COOKBOOK_STAGE}/usr/bin/kwalletd6.real"
+    cp "${COOKBOOK_SOURCE}/runtime/kwalletd/kwalletd6-wrapper.sh" "${COOKBOOK_STAGE}/usr/bin/kwalletd6"
+    chmod +x "${COOKBOOK_STAGE}/usr/bin/kwalletd6"
+fi
 
 for lib in "${COOKBOOK_STAGE}/usr/lib/"libKF6*.so.*; do
     [ -f "${lib}" ] || continue
diff --git a/local/recipes/system/redbear-meta/recipe.toml b/local/recipes/system/redbear-meta/recipe.toml
index edbaa7951c..91acf94e8a 100644
--- a/local/recipes/system/redbear-meta/recipe.toml
+++ b/local/recipes/system/redbear-meta/recipe.toml
@@ -33,7 +33,6 @@ Installed components:
   - redbear-release: OS branding and identity
  - redox-driver-sys: Driver infrastructure
  - linux-kpi: Linux kernel API compatibility
-  - redbear-iwlwifi: Intel Wi-Fi driver-side package
   - redbear-firmware: Firmware bundle
   - firmware-loader: firmware daemon
   - redbear-wifictl: Wi-Fi control plane
@@ -42,6 +41,11 @@ Installed components:
   - evdevd: Input event translation
   - udev-shim: Device enumeration
 
+Note: redbear-iwlwifi is currently excluded from this meta package
+pending completion of its Redox kernel-side integration. The
+source tree is in place at local/recipes/drivers/redbear-iwlwifi/
+and is gated on operator re-approval.
+
 Build: make all CONFIG_NAME=redbear-desktop
 README
 """
@@ -55,8 +59,10 @@ dependencies = [
     "redox-driver-sys",
     "linux-kpi",
     # TEMPORARILY EXCLUDED (operator-authorized) so redbear-full assembles to the
-    # SDDM greeter while redbear-iwlwifi is under active development. Re-add when
-    # its Redox build (src/linux_port.c / mac80211.h) is green.
+    # SDDM greeter while redbear-iwlwifi is under active development. The
+    # source tree (src/linux_port.c, src/linux_mvm.c, src/linux_mld.c,
+    # src/mld/, src/bridge/) is in place; re-add when the Redox kernel-side
+    # integration is complete.
     # "redbear-iwlwifi",
     "redbear-firmware",
     "redox-drm",