diff --git a/config/redbear-full.toml b/config/redbear-full.toml
index 79705cc26d..f0778b5add 100644
--- a/config/redbear-full.toml
+++ b/config/redbear-full.toml
@@ -290,8 +290,11 @@ libxfixes = {}
 libxi = {}
 libxrender = {}
 libxft = {}
-libice = {}
-libsm = {}
+# libice/libsm deliberately NOT included: they are X11 session-management
+# libraries used only by ksmserver, which is inside if(WITH_X11) and is not
+# built. They also need xorg util-macros, which is in no recipe here -- so
+# including them would mean porting a build dependency for code we do not
+# compile.
 
 libvorbis = {}
 libogg = {}
diff --git a/src/cook/fetch.rs b/src/cook/fetch.rs
index bb4e7eea2c..91c0b89677 100644
--- a/src/cook/fetch.rs
+++ b/src/cook/fetch.rs
@@ -551,7 +551,7 @@ pub fn fetch_offline(recipe: &CookRecipe, logger: &PtyOut) -> Result<FetchResult
             }
         }
         Some(SourceRecipe::Tar {
-            tar: _,
+            tar,
             blake3,
             patches,
             script,
@@ -560,6 +560,32 @@ pub fn fetch_offline(recipe: &CookRecipe, logger: &PtyOut) -> Result<FetchResult
             let cached = source_dir.is_dir();
             if !cached {
                 let source_tar = recipe_dir.join("source.tar");
+                // Existence BEFORE hashing. get_blake3() used to run first, so a
+                // missing tarball surfaced as
+                //   repo: failed to fetch: Opening file for blake3 failed at
+                //   "recipes/x11/libice/source.tar": No such file (os error 2)
+                // which names neither the recipe nor what to do about it. This
+                // bit twice -- libogg/libvorbis, then four newly promoted X11
+                // recipes -- and both times it was worked around by hand rather
+                // than diagnosed, because the message pointed at hashing rather
+                // than at a missing download.
+                if !source_tar.exists() {
+                    bail_other_err!(
+                        "{}: source.tar is missing and this build is OFFLINE.\n    \
+                         Expected: {}\n    \
+                         Upstream: {}\n    \
+                         Fetch it with:\n      \
+                         curl -sSL -o {} '{}'\n    \
+                         then verify against the blake3 in the recipe. A recipe \
+                         newly added to a config has no tarball until it is \
+                         fetched once.",
+                        recipe_dir.display(),
+                        source_tar.display(),
+                        tar,
+                        source_tar.display(),
+                        tar
+                    );
+                }
                 let source_tar_blake3 = get_blake3(&source_tar)?;
                 if source_tar.exists() {
                     if let Some(blake3) = blake3 {