diff --git a/docs/BUILDER-INSTRUCTIONS.md b/docs/BUILDER-INSTRUCTIONS.md
index b994ad23..6b7c8aa2 100644
--- a/docs/BUILDER-INSTRUCTIONS.md
+++ b/docs/BUILDER-INSTRUCTIONS.md
@@ -188,6 +188,42 @@ These modules cause ~50 lines of `AE_AML_BUFFER_LIMIT` ACPI errors per boot
on the operator laptop. Removing them eliminates the spam with no functional
loss (fn-keys continue to work via the standard acpi_video module).
+### 3g. xkb keyboard plugin — show flag instead of text label
+
+**File:** `live/operator-session/panel-skel/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml`
+
+The xkb plugin (plugin-10) was showing the language code "si" as text.
+Change `display-type` from 1 (text label) to 0 (image/flag only):
+
+```diff
+-
++
+```
+
+### 3h. Clock format — 2-digit year
+
+**File:** `live/operator-session/panel-skel/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml`
+
+Truncate the 4-digit year (`2026`) to 2 digits (`26`):
+
+```diff
+-
++
+```
+
+### 3i. Icon cache note
+
+After build, all icon caches regenerate automatically via the package
+post-install scripts. On the live system, if icons appear dotted/broken
+after updating icon files, run:
+
+```sh
+for theme in Papirus Papirus-Dark Papirus-Light hicolor Adwaita; do
+ gtk-update-icon-cache -f /usr/local/share/icons/$theme
+done
+pkill xfce4-panel; DISPLAY=:0 xfce4-panel &
+```
+
---
## Verification checklist (post-build boot)
@@ -200,10 +236,12 @@ loss (fn-keys continue to work via the standard acpi_video module).
| 4 | Panel on laptop display | taskbar on eDP, not HDMI |
| 5 | Wallpaper on both monitors | clawdie-operator-bg.png on laptop + TV |
| 6 | HDMI rotation | 270° (vertical) |
-| 7 | Clawdie-start icon | isn't fuzzy/misplaced |
-| 8 | Visuals guard | absent (`/usr/local/bin/clawdie-xfce-visuals-guard.sh` → no such file) |
-| 9 | No-blank guard | runs (check `~/.clawdie-noblank-guard.log`) |
-| 10 | `xfconf-query -c xfce4-desktop -p /backdrop/screen0 -lv` | All `image-path`/`last-image` values are **scalars** (no `[...]` brackets) |
+| 7 | Clawdie-start icon | clearly rendered, not fuzzy/misplaced |
+| 8 | xkb plugin | shows flag icon, not "si" text |
+| 9 | Clock format | shows 2-digit year (e.g., `06:23 04.Jun.26`) |
+| 10 | Visuals guard | absent (`/usr/local/bin/clawdie-xfce-visuals-guard.sh` → no such file) |
+| 11 | No-blank guard | runs (check `~/.clawdie-noblank-guard.log`) |
+| 12 | `xfconf-query -c xfce4-desktop -p /backdrop/screen0 -lv` | All `image-path`/`last-image` values are **scalars** (no `[...]` brackets) |
---
@@ -215,7 +253,7 @@ Files to create:
Files to modify:
build.sh (hostname, kld_list, displays.xml loop)
- live/operator-session/panel-skel/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml (+output-name)
+ live/operator-session/panel-skel/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml (+output-name, xkb flag, 2-digit year)
live/operator-session/panel-skel/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-desktop.xml (+monitorHDMI-A-0 block)
Already on branches:
diff --git a/docs/COLIBRI-XFCE-HANDOFF-04.JUN.2026.md b/docs/COLIBRI-XFCE-HANDOFF-04.JUN.2026.md
new file mode 100644
index 00000000..fab674c1
--- /dev/null
+++ b/docs/COLIBRI-XFCE-HANDOFF-04.JUN.2026.md
@@ -0,0 +1,173 @@
+# Colibri + XFCE Handoff — 4 Jun 2026
+
+> Live USB operator session diagnostics and fixes. Covers XFCE desktop layout
+> finalization and Colibri daemon out-of-box readiness.
+
+---
+
+## XFCE Desktop — ✅ COMPLETE (merged to main)
+
+All changes baked into ISO build. Three branches merged via PR #11:
+
+| Branch | What |
+|---|---|
+| `fix/xfce-start-icon-48` | Proper 48px PNG (was duplicate 64px) |
+| `fix/remove-xfce-visuals-guard` | Removed runtime XFCE visuals guard |
+| `fix/desktop-layout-and-hostname` | Displays, hostname, ACPI, panel, clock, xkb |
+
+### What ships now
+
+- **Dual-monitor layout**: eDP (laptop) primary at (1080,840), HDMI-A-0 rotated 270° at (0,0)
+- **Panel locked to laptop**: `output-name="eDP"` in panel-1
+- **Wallpaper on both monitors**: `clawdie-operator-bg.png`, all scalar values (no array `[...]` — xfdesktop ignores arrays)
+- **Hostname**: `usb.clawdie.home.arpa` (for DNS/Tailscale schema)
+- **No ASUS ACPI spam**: `acpi_asus`/`acpi_asus_wmi` removed from kld_list
+- **xkb flag icon**: `display-type=0` (image) instead of "si" text
+- **Clock 2-digit year**: `%y` not `%Y`
+- **48px clawdie-start icon**: differentiated from 64px (hashes differ)
+
+### Live-system setup procedure (for existing USB, no rebuild)
+
+```sh
+# 1. Remove visuals guard
+rm /usr/local/bin/clawdie-xfce-visuals-guard.sh
+rm /usr/local/etc/xdg/autostart/clawdie-xfce-visuals-guard.desktop
+sed -i '' '/clawdie-xfce-visuals-guard-log/d' /usr/local/bin/hw-report
+
+# 2. Fix 48px icon
+cp live/operator-session/icons/clawdie-start-48.png \
+ /usr/local/share/icons/hicolor/48x48/apps/clawdie-start.png
+
+# 3. Regenerate icon caches
+for theme in Papirus Papirus-Dark Papirus-Light hicolor Adwaita; do
+ gtk-update-icon-cache -f /usr/local/share/icons/$theme
+done
+
+# 4. Set hostname
+hostname usb.clawdie.home.arpa
+sed -i '' 's/hostname="clawdie-live"/hostname="usb.clawdie.home.arpa"/' /etc/rc.conf
+
+# 5. Remove ASUS modules
+sed -i '' 's/ acpi_asus acpi_asus_wmi//' /etc/rc.conf
+
+# 6. Reset XFCE to skel defaults (if visuals are wrong)
+pkill xfconfd
+mv ~/.config/xfce4 ~/.config/xfce4.bak.$(date +%s)
+rm -rf ~/.cache/sessions
+mkdir -p ~/.config
+cp -Rp /etc/skel/.config/xfce4 ~/.config/
+
+# 7. Fix panel output-name + xkb + clock (if not already in skel)
+xfconf-query -c xfce4-panel -p /panels/panel-1/output-name -n -t string -s "eDP"
+xfconf-query -c xfce4-panel -p /plugins/plugin-10/display-type -t int -s 0
+xfconf-query -c xfce4-panel -p /plugins/plugin-12/digital-format -t string -s "%H:%M %d.%b.%y"
+
+# 8. Logout/login or reboot
+```
+
+---
+
+## Colibri Daemon — 🔴 NEEDS FIX (packaging bug)
+
+### Current state
+
+```
+service colibri_daemon status → "not running" (always, even when running)
+service colibri_daemon onestart → WORKS (daemon runs, socket binds, DB creates)
+```
+
+### What works
+
+- `colibri-daemon` binary starts, binds Unix socket at `/var/run/colibri/colibri.sock`
+- SQLite database created at `/var/db/colibri/colibri.sqlite`
+- CLI tool responds: `colibri status`, `create-task`, `list-tasks`, `list-sessions`
+- Configuration reads correctly from environment: hostname, cost mode, paths
+- Smoke-tested: task created, status queried, DB persisted across restarts
+
+### rc.d bugs (in `packaging/freebsd/colibri_daemon.in`)
+
+**Bug 1: procname collision**
+
+```ini
+procname="/usr/sbin/daemon"
+```
+
+Matches ANY `daemon(8)` instance on the system (tailscaled uses one too).
+`_find_processes` in rc.subr finds the wrong process, so `service status`
+always reports "not running" even when colibri-daemon is up.
+
+**Fix:** Use a unique procname:
+```ini
+procname="colibri-daemon"
+```
+
+**Bug 2: daemon(8) -P pidfile not created**
+
+The `-P` flag should write the supervisor PID, but no file appears.
+Combined with Bug 1, `service status` has no way to find the process.
+
+**Fix options:**
+- **A (recommended):** Drop daemon(8) wrapper, let rc.subr's built-in
+ supervision handle forking. Run `colibri-daemon` directly as the
+ `command`, with `command_args` containing just the daemon's own flags.
+ colibri-daemon already runs in foreground mode — it doesn't need daemon(8).
+- **B:** Fix daemon(8) integration — use `-p` (child pidfile, lowercase),
+ set `procname="colibri-daemon"`, and verify supervision works.
+
+**Bug 3: daemon(8) bypassed entirely**
+
+Process tree shows rc.d → `su -m colibri` → `colibri-daemon` with NO
+daemon(8) in between. rc.subr appears to skip the `command` directive
+when `procname` matches a generic daemon. This confirms Bug 1 cascades.
+
+### Access permission
+
+`clawdie` user cannot use `colibri` CLI out of the box:
+- `/var/run/colibri` is 0750, owned `colibri:colibri`
+- Fix (already applied live): `pw groupmod colibri -m clawdie`
+
+### Enable at boot
+
+Current: `colibri_daemon_enable="NO"` — intentional, documented as "so Colibri
+cannot block SDDM/XFCE startup".
+
+To enable out-of-box:
+```sh
+sysrc colibri_daemon_enable="YES"
+```
+
+With the rc.d bugs fixed (above), enabling at boot is safe.
+
+### Smoke test (after daemon starts)
+
+```sh
+service colibri_daemon onestart # or 'start' once enabled
+colibri status
+colibri create-task --title "iso smoke test"
+colibri list-tasks
+colibri list-sessions
+service colibri_daemon stop
+```
+
+---
+
+## Files touched on live USB
+
+| Path | Change |
+|---|---|
+| `/etc/rc.conf` | hostname, kld_list (no asus), colibri enabled |
+| `/usr/local/bin/clawdie-xfce-visuals-guard.sh` | removed |
+| `/usr/local/etc/xdg/autostart/clawdie-xfce-visuals-guard.desktop` | removed |
+| `/usr/local/bin/hw-report` | visuals guard log line removed |
+| `/usr/local/share/icons/hicolor/48x48/apps/clawdie-start.png` | replaced with proper 48px |
+| `~/etc/group` | clawdie added to colibri group |
+| `~/.config/xfce4/` | reset from skel, then displays/panel/desktop restored from backup |
+
+---
+
+## Next steps
+
+1. **Colibri rc.d fix** — needs change in colibri source repo (`packaging/freebsd/colibri_daemon.in`), not ISO repo
+2. **Tailscale join** — needs tailscale auth key, service is staged but not joined
+3. **Colibri enable at boot** — after rc.d bug is fixed, flip `colibri_daemon_enable` to `YES` in build.sh
+4. **XFCE dotted icons** — still investigating; icon caches regenerated, clawdie-start found in cache, may be SVG rendering issue with librsvg2-rust