round 11: libclc.pc verify + redbear-passwd [source] + sessiond can_* probe + dnsd no hardcoded upstreams + stale redbear-kde-session refs

Round 11 audit cleanup. Six fixes across six files:

1. local/recipes/system/redbear-passwd/recipe.toml — CRITICAL: was
   missing the [source] block entirely. The recipe had only [package]
   and [build] with template=cargo, which the cookbook cannot fetch.
   Added [source] path = "source" so the cookbook locates the local
   Rust crate. Also added a one-line description.

2. local/recipes/dev/libclc/recipe.toml — MEDIUM: the build script
   installs via cmake but never verifies that libclc.pc (Mesa's
   pkg-config dependency) and the .bc bitcode files actually landed.
   Without these, Mesa's 3D driver cook fails opaquely with
   'Dependency libclc not found (tried pkg-config)'. Added three
   post-install test -f checks that fail the build with a precise
   error pointing at the missing path.

3. local/recipes/system/redbear-sessiond/source/src/manager.rs — HIGH:
   the D-Bus login1 can_power_off / can_reboot / can_suspend methods
   were returning 'yes' unconditionally — the archetype lie-grade-ok
   pattern (probe says success, then the real action fails because
   /scheme/sys/kstop is missing). Replaced with a kstop_writable()
   probe that fs::metadata()s the path. Used metadata() rather than
   an actual write because writing 'shutdown'/'reset'/'s3' to
   /scheme/sys/kstop would trigger the action. The actual power_off/
   reboot/suspend methods still report granular errors when the
   write is refused.

4. local/recipes/system/redbear-dnsd/source/src/transport.rs — MEDIUM:
   UpstreamConfig::default() hardcoded 8.8.8.8 + 1.1.1.1 as fallback
   upstream DNS. Hardcoding third-party DNS bypasses netcfg integration
   and leaks user queries without consent on first boot. Replaced with
   an empty Vec — main() reads the upstream list from netcfg before
   any query is dispatched; upstream queries SERVFAIL until netcfg
   populates the list (honest default).

5. local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md — MEDIUM: 16
   references to the non-existent binary 'redbear-kde-session' (now
   'redbear-session-launch'). Global s/redbear-kde-session/redbear-
   session-launch/g. Also updated two 'redbear-kde' profile-name
   references to reflect the 2026-07-24 retirement and the current
   'redbear-full' ownership of the desktop path.

6. local/docs/DBUS-INTEGRATION-PLAN.md — LOW: 7 references to
   'redbear-kde-session' renamed to 'redbear-session-launch' (same
   binary rename).

6 files changed, +68/-28.

Note: Mesa 04-sys-ioccom-stub-header.patch migration to relibc proper
(sys/ioccom.h with Linux-style IOC encoding) is deferred — the
patch is a genuine gap-filler (relibc's sys/ioctl.h has the basic
macros but sys/ioccom.h is the BSD include path DRM UAPI expects).
That work belongs in the relibc fork with a prefix rebuild and
should be coordinated with the operator's prefix-staleness policy.

local/docs/DBUS-INTEGRATION-PLAN.md

@@ -109,7 +109,7 @@ specific schemes it needs. This keeps the architecture honest and avoids a leaky
 | **QtDBus** | `local/recipes/qt/qtbase/` | ✅ Enabled | `FEATURE_dbus=ON` for target build, Qt6DBus module present |
 | **kf6-kdbusaddons** | `local/recipes/kde/kf6-kdbusaddons/` | ✅ Builds | KF6 D-Bus convenience wrappers, provides qdbus tool integration |
 | **D-Bus system bus** | `config/redbear-full.toml` | ✅ Wired | `12_dbus.service` launches `dbus-daemon --system`, `messagebus` user (uid=100), `/var/lib/dbus` + `/run/dbus` directories |
-| **D-Bus session bus** | `local/recipes/system/redbear-greeter/source/redbear-kde-session` | ✅ Scripted | `redbear-kde-session` launches `dbus-launch --sh-syntax` before KWin |
+| **D-Bus session bus** | `local/recipes/system/redbear-greeter/source/redbear-session-launch` | ✅ Scripted | `redbear-session-launch` launches `dbus-launch --sh-syntax` before KWin |
 | **seatd** | `config/redbear-full.toml` | ✅ Wired | `13_seatd.service`, `LIBSEAT_BACKEND=seatd`, `SEATD_SOCK=/run/seatd.sock` |
 | **kf6-kservice** | `local/recipes/kde/kf6-kservice/` | ✅ Builds | Depends on kf6-kdbusaddons |
 | **kf6-kglobalaccel** | `local/recipes/kde/kf6-kglobalaccel/` | ✅ Builds | Depends on kf6-kdbusaddons |
@@ -160,7 +160,7 @@ specific schemes it needs. This keeps the architecture honest and avoids a leaky
 ```
 KWin needs:
   dbus-daemon --system          ✅ exists, wired
-  dbus-daemon --session         ✅ exists, wired in redbear-kde-session
+  dbus-daemon --session         ✅ exists, wired in redbear-session-launch
   org.freedesktop.login1        ✅ scaffold exists — session/device brokering implemented minimally
   org.kde.KWin (self-register)  ✅ KWin does this itself (dbusinterface.cpp)
 ```
@@ -224,7 +224,7 @@ Complete Plasma needs (after re-enabling disabled components):
 │   plasmashell, kwin_wayland, kded6, kglobalaccel, plasma applets        │
 ├──────────────────────────────────────────────────────────────────────────┤
 │                     Session Bus (per-user)                               │
-│   Started by: redbear-kde-session via dbus-launch or dbus-run-session   │
+│   Started by: redbear-session-launch via dbus-launch or dbus-run-session   │
 │   Policy: /etc/dbus-1/session.conf                                      │
 │   Services: /usr/share/dbus-1/session-services/                         │
 │   ┌──────────────────────────────────────────────────────────────────┐  │
@@ -277,7 +277,7 @@ Boot:
      (registers org.freedesktop.login1 on system bus)
   3. Redox init starts 13_seatd.service → seatd
 
-Session launch (redbear-kde-session):
+Session launch (redbear-session-launch):
   4. dbus-daemon --system already running
   5. eval $(dbus-launch --sh-syntax)  →  session bus started
   6. export DBUS_SESSION_BUS_ADDRESS, XDG_SESSION_ID, XDG_SEAT, XDG_RUNTIME_DIR
@@ -292,7 +292,7 @@ Session launch (redbear-kde-session):
 | System bus core (login1) | **Redox init** | Must be running before any desktop session |
 | System bus compat (UPower, NM) | **Redox init** or **D-Bus activation** | Can be started lazily, but init is simpler |
 | Session bus KDE services (kglobalaccel, kded6) | **D-Bus activation** (classic `.service` files) | KDE expects this, standard pattern |
-| Session bus KDE shell (KWin, plasmashell) | **Explicit launch** in `redbear-kde-session` | Must start in specific order with env vars |
+| Session bus KDE shell (KWin, plasmashell) | **Explicit launch** in `redbear-session-launch` | Must start in specific order with env vars |
 | Session bus compat (notifications, tray) | **D-Bus activation** | Standard freedesktop pattern |
 
 ---
@@ -1321,7 +1321,7 @@ ListNames` returns a non-empty list, or that `org.freedesktop.login1` registers
 The validation commands in section 12.1 above are aspirational, not yet executed.
 
 **Session bus:** Build-wired via a shell script. The file
-`local/recipes/system/redbear-greeter/source/redbear-kde-session` (line 127) conditionally
+`local/recipes/system/redbear-greeter/source/redbear-session-launch` (line 127) conditionally
 runs `eval "$(dbus-launch --sh-syntax)"` and exports `DBUS_SESSION_BUS_ADDRESS`. This is
 scripted, not init-managed, and has never been runtime-validated. No test confirms that the
 session bus starts, that `DBUS_SESSION_BUS_ADDRESS` is set in the KDE process environment,
@@ -1361,7 +1361,7 @@ for D-Bus runtime validation — the session-bus and activation gaps (F6) remain
 |------------------------|-------------|-----------------|----------|
 | dbus-daemon 1.16.2 builds | Yes | No (QEMU pending) | `recipe.toml` + meson template |
 | System bus wired in config | Yes | No | `config/redbear-full.toml` 12_dbus.service |
-| Session bus scripted | Yes (shell script) | No | `redbear-kde-session` line 127 |
+| Session bus scripted | Yes (shell script) | No | `redbear-session-launch` line 127 |
 | redbear-sessiond registers login1 | Yes (source builds, host tests pass) | No | 32 unit tests host-only; QEMU pending |
 | D-Bus activation files staged | Yes | No | `redbear-dbus-services/files/` |
 | StatusNotifierWatcher in image | No (not in config) | No | F5 above |

local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md

@@ -18,7 +18,7 @@ What exists today:
 - `dbus-daemon` on the system bus
 - `redbear-sessiond` exposing a minimal `org.freedesktop.login1` subset for KWin
 - `seatd` as the seat/libseat backend
-- a direct session launcher (`redbear-kde-session`) that now starts `redbear-compositor --drm`
+- a direct session launcher (`redbear-session-launch`) that now starts `redbear-compositor --drm`
 - fallback text `getty` surfaces on VT2 and `/scheme/debug/no-preserve`
 
 What does **not** exist today:
@@ -50,7 +50,7 @@ not a multi-session desktop-manager framework.
 
 - One graphical login surface for the Red Bear KDE-on-Wayland desktop path
 - A Red Bear-native greeter daemon, greeter UI, authentication daemon, and session launcher
-- Integration with existing `dbus-daemon`, `redbear-sessiond`, `seatd`, `inputd`, and `redbear-kde-session`
+- Integration with existing `dbus-daemon`, `redbear-sessiond`, `seatd`, `inputd`, and `redbear-session-launch`
 - Explicit VT ownership and handoff on the desktop VT
 - A narrow local-user authentication model backed by `/etc/passwd`, `/etc/shadow`, and `/etc/group`
 - Branding integration using Red Bear assets from `local/Assets/`
@@ -75,9 +75,9 @@ recovery model.
 
 This plan assumes the Red Bear desktop direction converges on **one KDE-on-Wayland path**.
 
-Current implementation answer: the first tracked owner is `redbear-full`. Older names such
-as `redbear-kde` may still appear in historical or staging material, but they are not the
-supported compile-target surface for this plan.
+Current implementation answer: the first tracked owner is `redbear-full`. The historical
+`redbear-kde` profile name was retired alongside the operator's 2026-07-24 cutover and is not
+the supported compile-target surface for this plan.
 
 ---
 
@@ -115,7 +115,7 @@ Rules:
 | display VT activation | `29_activate_console.service` in desktop configs | ✅ usable (bounded) | `inputd -A 3` activates desktop VT |
 | fallback text login | `30_console.service` | ✅ boots | `getty 2` on VT2 |
 | debug console | `31_debug_console.service` | ✅ boots | `getty /scheme/debug/no-preserve -J` |
-| direct KDE session launcher | `/usr/bin/redbear-kde-session` | ✅ builds, experimental | Starts session bus if needed, then `exec redbear-compositor --drm` |
+| direct KDE session launcher | `/usr/bin/redbear-session-launch` | ✅ builds, experimental | Starts session bus if needed, then `exec redbear-compositor --drm` |
 | authentication daemon | `local/recipes/system/redbear-authd/` | ✅ builds, experimental | Local-user auth boundary with `/etc/passwd` / `/etc/shadow` / `/etc/group` parsing plus SHA-crypt and Argon2 verification |
 | session launcher boundary | `local/recipes/system/redbear-session-launch/` | ✅ builds, experimental | User-session bootstrap with bounded environment/runtime-dir setup |
 | greeter daemon scaffold | `local/recipes/system/redbear-greeter/` | ✅ builds, experimental | Root-owned greeter orchestrator, socket protocol, bounded restart policy |
@@ -230,7 +230,7 @@ Reuse existing pieces rather than replacing them:
 - `redbear-sessiond`
 - `seatd`
 - `inputd`
-- `redbear-kde-session`
+- `redbear-session-launch`
 
 The greeter layer sits **above** them.
 
@@ -287,7 +287,7 @@ At runtime, the greeter must use **installed asset paths**, not source-tree path
 ```text
 ┌────────────────────────────────────────────────────────────────────┐
 │ KDE Wayland user session                                          │
-│ redbear-kde-session → kwin_wayland → later Plasma services        │
+│ redbear-session-launch → kwin_wayland → later Plasma services        │
 ├────────────────────────────────────────────────────────────────────┤
 │ redbear-session-launch                                            │
 │ drop privileges, set env, start session bus, exec session         │
@@ -327,7 +327,7 @@ boot
 > on serio/0 (keyboard) and serio/1 (mouse)` startup log lines. The
 > greeter service can now rely on those lines being present to confirm
 > the input stack is alive before `inputd -A 3` runs.
-  → dbus-run-session -- redbear-kde-session
+  → dbus-run-session -- redbear-session-launch
   → kwin_wayland
 ```
 
@@ -421,10 +421,10 @@ user session exits or crashes
 - drop to target uid/gid and supplementary groups,
 - construct a minimal KDE/Wayland environment,
 - launch the user session bus,
-- exec `redbear-kde-session`.
+- exec `redbear-session-launch`.
 
 `redbear-session-launch` is intentionally thin. It must not duplicate KDE session policy already owned
-by `redbear-kde-session`.
+by `redbear-session-launch`.
 
 ### 8.5 `redbear-sessiond`
 
@@ -532,7 +532,7 @@ elsewhere, but the greeter/auth path must interact only with installed runtime a
 Preferred launch form:
 
 ```text
-dbus-run-session -- redbear-kde-session
+dbus-run-session -- redbear-session-launch
 ```
 
 If `dbus-run-session` proves unreliable on Red Bear, use the current `dbus-launch` pattern as a bounded
@@ -598,7 +598,7 @@ greeter path.
 |---|---|---|
 | G1.1 | Create recipe skeletons | `redbear-greeter`, `redbear-authd`, `redbear-session-launch`, and shared `redbear-login-protocol` build and stage |
 | G1.2 | Add config fragment | A tracked config fragment wires `20_greeter.service` and supporting files |
-| G1.3 | Replace direct display launch in the chosen profile | Desktop profile starts `redbear-greeterd` instead of directly starting `redbear-kde-session` |
+| G1.3 | Replace direct display launch in the chosen profile | Desktop profile starts `redbear-greeterd` instead of directly starting `redbear-session-launch` |
 | G1.4 | Keep text/debug recovery path | VT2 `getty` and debug `getty` still boot |
 
 **Exit criteria:**
@@ -661,7 +661,7 @@ greeter path.
 
 **Exit criteria:**
 
-- successful login reaches `redbear-kde-session`,
+- successful login reaches `redbear-session-launch`,
 - session uses intended env/runtime dir,
 - session exit returns to greeter,
 - fallback VT2 login still works.
@@ -723,7 +723,7 @@ The first bounded integration proofs should answer these questions in order:
 
 1. does the image boot to a graphical greeter surface on VT3?
 2. does invalid login return to the greeter surface?
-3. does valid login reach `redbear-kde-session`?
+3. does valid login reach `redbear-session-launch`?
 4. does session exit return to the greeter?
 5. do VT2 and debug login remain available as recovery paths?
 6. does greeter failure still leave a recoverable console path instead of looping forever?
@@ -756,7 +756,7 @@ This plan is only substantially complete when **all** of the following are true:
 
 **Current status against this bar:** the bounded QEMU greeter proof now satisfies the greeter/login
 implementation bar in this plan. The remaining blocker to stronger desktop-session claims reproduces
-under direct `dbus-run-session -- redbear-kde-session` as well, so it no longer points to a missing
+under direct `dbus-run-session -- redbear-session-launch` as well, so it no longer points to a missing
 greeter/auth/session-boundary implementation inside this plan.
 
 ---
@@ -867,7 +867,7 @@ The greeter **recipe**, not the config fragment, should own staged runtime artif
 ## 15. Open Questions
 
 1. Which tracked profile should own the canonical desktop greeter path first:
-   `redbear-kde`, `redbear-full`, or a unified future target?
+   `redbear-full`, `redbear-mini` (post-cutover desktop handover), or a unified future target?
 2. Which password-hash scheme should Red Bear standardize on for v1 local users?
 3. Should reboot/shutdown requests go through `redbear-authd` or a separate narrow power helper?
 4. Is `dbus-run-session` reliable enough on Red Bear, or should the current `dbus-launch` path remain the first shipped session-bus strategy?

local/recipes/dev/libclc/recipe.toml

@@ -133,6 +133,21 @@ fi
 # libexecdir is <prefix>/share/clc (per the libclc.pc.in template).
 # The cmake install above places them at $COOKBOOK_STAGE/usr/share/clc
 # which is the right path; no further action needed.
+
+if [ ! -f "${COOKBOOK_STAGE}/usr/lib/pkgconfig/libclc.pc" ]; then
+    echo "libclc: ERROR — install did not produce libclc.pc" >&2
+    echo "libclc: expected at ${COOKBOOK_STAGE}/usr/lib/pkgconfig/libclc.pc" >&2
+    echo "libclc: check that upstream libclc CMakeLists.txt installs pkgconfig files" >&2
+    exit 1
+fi
+if [ ! -d "${COOKBOOK_STAGE}/usr/share/clc" ]; then
+    echo "libclc: ERROR — install did not produce .bc files under usr/share/clc" >&2
+    exit 1
+fi
+if ! ls "${COOKBOOK_STAGE}/usr/share/clc"/*.bc >/dev/null 2>&1; then
+    echo "libclc: ERROR — usr/share/clc contains no .bc bitcode files" >&2
+    exit 1
+fi
 '''
 
 [[optional-packages]]

local/recipes/system/redbear-dnsd/source/src/transport.rs

@@ -355,8 +355,11 @@ pub(crate) struct UpstreamConfig {
 
 impl Default for UpstreamConfig {
     fn default() -> Self {
+        // Empty by default — main() reads the upstream list from netcfg
+        // before any query is dispatched. Hardcoding third-party DNS here
+        // would leak user queries without consent on first boot.
         Self {
-            servers: vec![Ipv4Addr::new(8, 8, 8, 8), Ipv4Addr::new(1, 1, 1, 1)],
+            servers: Vec::new(),
             timeout: QUERY_TIMEOUT,
             retries: 2,
         }

local/recipes/system/redbear-passwd/recipe.toml

@@ -1,6 +1,10 @@
 [package]
 name = "redbear-passwd"
 version = "0.3.1"
+description = "Password management utility — change passwords, manage shadow file"
+
+[source]
+path = "source"
 
 [build]
 template = "cargo"

local/recipes/system/redbear-sessiond/source/src/manager.rs

@@ -178,6 +178,12 @@ impl LoginManager {
 
 }
 
+fn kstop_writable() -> bool {
+    // metadata() rather than an actual write — writing "shutdown"/"reset"
+    // to /scheme/sys/kstop would trigger the action.
+    fs::metadata("/scheme/sys/kstop").is_ok()
+}
+
 #[interface(name = "org.freedesktop.login1.Manager")]
 impl LoginManager {
     fn get_session(&self, id: &str) -> fdo::Result<OwnedObjectPath> {
@@ -259,15 +265,27 @@ impl LoginManager {
     }
 
     fn can_power_off(&self) -> fdo::Result<String> {
-        Ok(String::from("yes"))
+        if kstop_writable() {
+            Ok(String::from("yes"))
+        } else {
+            Ok(String::from("na"))
+        }
     }
 
     fn can_reboot(&self) -> fdo::Result<String> {
-        Ok(String::from("yes"))
+        if kstop_writable() {
+            Ok(String::from("yes"))
+        } else {
+            Ok(String::from("na"))
+        }
     }
 
     fn can_suspend(&self) -> fdo::Result<String> {
-        Ok(String::from("yes"))
+        if kstop_writable() {
+            Ok(String::from("yes"))
+        } else {
+            Ok(String::from("na"))
+        }
     }
 
     fn can_hibernate(&self) -> fdo::Result<String> {