## Summary

Omarchy already diagnosed this exact failure and fixed it — for browsers only. Every other Electron app is still exposed, including Signal, which Omarchy itself installs.

`migrations/1784508556.sh` says it plainly:

> Chromium-based browsers auto-detect their os_crypt backend; on Hyprland the xdg-desktop-portal Secret backend has no provider and fails, so they can fall back to the 'basic' (v10) store. A swap from the gnome-libsecret (v11) key to the basic key makes existing cookies and saved passwords undecryptable, so the browser silently drops them and the user is logged out of everything.

That migration pins `--password-store=gnome-libsecret`, but only into:

```
~/.config/{chromium,brave,chrome,microsoft-edge-stable}-flags.conf
```

Electron apps are not Chromium browsers, but they use the same `os_crypt`/`safeStorage` machinery and the same flag. `signal-desktop` even reads the same style of file — from `/usr/bin/signal-desktop`:

```bash
SIGNAL_USER_FLAGS_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/signal-desktop-flags.conf"
```

Nothing in Omarchy writes it, so the fallback the migration exists to prevent still happens — with the same consequence, one app over.

## What happened

Signal profile carried onto an Omarchy machine during a migration. On launch:

```
Detected change in safeStorage backend, can't decrypt DB key
  (previous: gnome_libsecret, current: basic_text)
ERROR CORE sqlcipher_page_cipher: hmac check failed for pgno=1
ERROR CORE sqlite3Codec: error decrypting page 1 data: 1
```

The app opens to an unusable state. `XDG_CURRENT_DESKTOP=Hyprland`, `gnome-keyring-daemon` running and serving `org.freedesktop.secrets`, and the package is intact (`pacman -Qkk signal-desktop` → 175 files, 0 altered), so this is not packaging corruption or a missing secret service — purely the backend fallback.

## Steps to reproduce

1. On a machine with a working keyring, use `signal-desktop` so its DB key is stored under `gnome_libsecret`.
2. Copy `~/.config/Signal` to an Omarchy/Hyprland machine.
3. Launch Signal.

Expected: it decrypts and opens. Actual: `basic_text` is selected, the DB key cannot be decrypted, and the profile is unrecoverable without the original keyring secret.

## Fix

```bash
echo '--password-store=gnome-libsecret' >> ~/.config/signal-desktop-flags.conf
```

Confirmed: with the flag the `safeStorage` warning disappears immediately, and after re-linking, a quit-and-relaunch cycle shows zero decrypt errors and zero backend complaints — i.e. the pin is what makes it survive restarts.

Suggested change: extend `1784508556.sh`'s loop (and whatever ships defaults) to the Electron apps Omarchy installs or launches — `omarchy-install-service-signal` at minimum, and worth auditing `1password` and `spotify` alongside it. The browser list is an allowlist where the underlying problem is not browser-specific.

Worth noting the browser fix is the gentler case: a browser silently drops cookies and logs you out. For Signal the profile is simply unrecoverable — the local message history is gone and the device must be re-linked.

## Related

- #9235 (`default-keyring.sh` writes an unparseable stub keyring) and #5105 (keyring left invalid after update) — both about the keyring itself; this one is about apps not being pinned to it.
- #1015 (closed) — VS Code / missing OS keyring, likely the same root cause in another Electron app.

## System

- Omarchy 4.0.2-1
- Hyprland 0.56.2, `XDG_CURRENT_DESKTOP=Hyprland`
- signal-desktop 8.24.1-1
- gnome-keyring 1:50.0-1, libsecret 0.21.7-1
- Kernel 7.1.9-arch1-2, AMD Ryzen AI 9 HX 370 / Radeon 890M