diff --git a/AGENTS.md b/AGENTS.md
index bdd5aa8e4f..9b11b5e271 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -87,8 +87,8 @@ redox-master/
 | Fix kernel | `recipes/core/kernel/source/` | Kernel is a recipe, not top-level |
 | Fix a driver | `recipes/core/base/source/drivers/` | All drivers are userspace daemons |
 | Fix relibc (POSIX) | `recipes/core/relibc/source/` | C library written in Rust |
-| Wayland integration | `recipes/wip/wayland/` + `local/docs/WAYLAND-IMPLEMENTATION-PLAN.md` | 21 WIP recipes + local validation/ownership plan |
-| KDE Plasma path | `recipes/wip/kde/` + `local/docs/legacy-obsolete-2026-07-25/05-KDE-PLASMA-ON-REDOX.md` (historical) | 9 WIP KDE app recipes |
+| Wayland integration | `recipes/wip/wayland/` + `local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md` | 21 WIP recipes; Wayland compositor detail consolidated into 3D-desktop plan (formerly `WAYLAND-IMPLEMENTATION-PLAN.md`, deleted 2026-07-27) |
+| KDE Plasma path | `recipes/wip/kde/` + `local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md` (canonical) | 9 WIP KDE app recipes; historical `05-KDE-PLASMA-ON-REDOX.md` was deleted 2026-07-27 (see `local/docs/SUPERSEDED-DOC-LOG.md`) |
 | **Desktop path plan** | `local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md` | **Canonical plan: console → HW-accelerated KDE** |
 | Linux driver compat | `docs/04-LINUX-DRIVER-COMPAT.md` | linux-kpi + redox-driver-sys architecture (**GPU and Wi-Fi only — not USB**) |
 | Build system internals | `src/bin/repo.rs`, `src/lib.rs`, `mk/repo.mk` | Cookbook tool in Rust |
@@ -272,7 +272,7 @@ make all
     → For each recipe: fetch source → apply patches → check cache (BLAKE3 dep hashes) → build or restore from repo/ → stage into sysroot
     → dep_hashes.toml written per recipe (BLAKE3 of each build dep's PKGAR)
     → Package groups resolved by installer Config::from_file()
-  → mk/disk.mk (create filesystem.img, harddrive.img, redbear-live.iso or harddrive.img)
+  → mk/disk.mk (create filesystem.img, harddrive.img, or `<config>`.iso)
     → redoxfs-mkfs → redox_installer → bootloader embedding
 ```
 
diff --git a/README.md b/README.md
index 8b8c1a8dea..c04fe71017 100644
--- a/README.md
+++ b/README.md
@@ -135,7 +135,7 @@ successfully on branch `0.3.1`. Graphics packages are frozen at latest upstream
 | Mesa — llvmpipe + virgl | ✅ Builds; EGL platform real, virgl auto-probe wired (DRM_IOCTL_VERSION major=0 + name + PCI info) |
 | Mesa redox gallium winsys | ✅ Source landed; BO byte count now correct; per-surface crtc_id tracking via redox_drm_surface_set_crtc; meson wires it on iris/radeonsi; compile unverified in current canonical build |
 | 3D userland (iris / radeonsi / Vulkan) | 🟡 Recipe enabled; configure failed on libclc — now fixed (libclc in deps); needs canonical `build-redbear.sh redbear-full` to validate | Comprehensive plan in `local/docs/3D-DRIVER-PLAN.md` |
-| Qt6 Wayland null+8 | ✅ Comprehensive null guards in qtwaylandscanner (init_listener wrap) and libwayland (all wl_proxy_* entry points) | Detailed in `local/docs/QT6-WAYLAND-NULL8-DIAGNOSIS.md` |
+| Qt6 Wayland null+8 | 🟡 Compile-time null guards in qtwaylandscanner (init_listener wrap) and libwayland (all wl_proxy_* entry points); **runtime re-verification pending** — static diagnosis only, no QEMU run with instrumented rebuild yet | Detailed in `local/docs/QT6-WAYLAND-NULL8-DIAGNOSIS.md` |
 | SDDM display manager + Greeter/Login | ✅ Built; service + PAM + kde-wayland.desktop + greeter user all in `redbear-full.toml`; runtime proof needs canonical build |
 | Qt 6.11.1 (Core, Gui, DBus, Wayland) | 🟡 Builds; Wayland `null+8` statically diagnosed; needs isolated runtime fix |
 | KF6 Frameworks — 40/40 | 🟡 All frameworks build; KWin cooks successfully |
@@ -201,7 +201,7 @@ Red Bear OS operates under strict discipline. Full policies: [`local/AGENTS.md`]
 
 ## Documentation
 
-- [Desktop Path Plan](local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md) — Canonical plan v6.0 (2026-07-26): kernel → DRM → Mesa → Wayland → KDE
+- [Desktop Path Plan](local/docs/CONSOLE-TO-KDE-DESKTOP-PLAN.md) — Canonical plan v6.0 (2026-07-27): kernel → DRM → Mesa → Wayland → KDE
 - [Implementation Plan](docs/07-RED-BEAR-OS-IMPLEMENTATION-PLAN.md) — Roadmap and execution model
 - [cub Package Manager](local/docs/CUB-PACKAGE-MANAGER.md) — AUR → recipe pipeline, CLI reference, architecture
 - [tlc File Manager](local/recipes/tui/tlc/README.md) — Pure-Rust Midnight Commander replacement
diff --git a/local/recipes/system/redbear-acmd/source/src/main.rs b/local/recipes/system/redbear-acmd/source/src/main.rs
index ce157b9133..94b8a17ffb 100644
--- a/local/recipes/system/redbear-acmd/source/src/main.rs
+++ b/local/recipes/system/redbear-acmd/source/src/main.rs
@@ -218,7 +218,13 @@ fn main() {
             dev.bulk_out,
             std::sync::Arc::clone(&serial_state),
         );
-        let _ = libredox::call::setrens(0, 0);
+        if let Err(e) = libredox::call::setrens(0, 0) {
+            log::error!(
+                "CDC ACM: setrens(0, 0) failed: {e} — refusing to serve USB-serial \
+                 requests with elevated namespace privileges"
+            );
+            return;
+        }
         log::info!("CDC ACM: scheme /scheme/{} ready", scheme_name);
         loop {
             let request = match socket.next_request(SignalBehavior::Restart) {