Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy-refresh-pacman drops hardware-specific repos (arch-mact2 on T2 Macs), silently orphaning linux-t2
Reported by JamieCurnow · filed Sep 2, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details: Apple MacBookPro16,1 (T2, 106b:1801/106b:1802), Intel i7-9750H + AMD Navi 14, Omarchy 4.0.2-1, kernel linux-t2 7.1.8.arch1-3, Hyprland 0.56.2, bootloader Limine (UKI).
Summary
omarchy-refresh-pacman overwrites /etc/pacman.conf from the channel template but never re-applies the hardware-specific repository additions that install/hardware/pacman.sh is responsible for. On Apple T2 Macs this silently drops the [arch-mact2] repository, orphaning linux-t2 and the other T2 packages so they can no longer receive updates — including the kernel.
The install path does this correctly; the refresh/upgrade path does not.
Impact
After upgrading to 4.x on a T2 Mac, these packages remain installed but have no update source:
linux-t2— the running kernelt2fanrdapple-t2-audio-configapple-bcm-firmware
The machine keeps booting and working, so there is no visible symptom. The failure is silent: the kernel simply stops receiving security and bugfix updates, and the user has no indication anything is wrong. pacman -Syu reports nothing missing because the packages resolve locally.
Root cause
bin/omarchy-refresh-pacman overwrites the config and then only runs the user hook:
sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist
# Allow user customization of /etc/pacman.conf before the upgrade runs
omarchy-hook pre-refresh-pacman
sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirminstall/post-install/pacman.sh does the same overwrite but does re-apply hardware repos:
cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
...
source "$OMARCHY_INSTALL/hardware/pacman.sh"And install/hardware/pacman.sh states the intent explicitly:
# Hardware-specific pacman repository extensions that must survive the final
# pacman.conf restore.
if lspci -nn | grep "106b:180[12]" >/dev/null; then
if ! grep -q '^\[arch-mact2\]' /etc/pacman.conf; then
cat >> /etc/pacman.conf <<'EOF'
[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = Never
EOF
fi
fiSo the repo is added deliberately for this hardware and is meant to survive a template restore — but the refresh path is missing the source "$OMARCHY_INSTALL/hardware/pacman.sh" line. No migration re-adds it either (grep -rn arch-mact2 migrations/ returns nothing).
Note the ordering hazard: pacman -Syyuu --noconfirm runs immediately afterwards, so the full upgrade proceeds with the repo already missing.
Reproduction
- Apple T2 Mac (
lspci -nnshows106b:1801/106b:1802) installed via the T2 path, with[arch-mact2]in/etc/pacman.conf - Upgrade to 4.x (or run
omarchy refresh pacman) grep arch-mact2 /etc/pacman.conf→ gonepacman -Si linux-t2→ no repository
Evidence from the affected machine
/etc/pacman.conf before the upgrade (/etc/pacman.conf.bak, 15:53) ended with:
[omarchy]
SigLevel = Optional TrustAll
Server = https://pkgs.omarchy.org/stable/$arch
[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = NeverThe upgrade's own backup (/etc/pacman.conf.omarchy-upgrade-to-quattro.20260902155457.bak, 15:54) already ends at [omarchy] — [arch-mact2] is gone.
Resulting state:
$ pacman -Q linux-t2
linux-t2 7.1.8.arch1-3
$ pacman -Si linux-t2
error: package 'linux-t2' was not foundarch-mact2-mirrorlist was also removed.
Suggested fix
Re-apply hardware repository additions in omarchy-refresh-pacman after the template copy and before pacman -Syyuu, mirroring what install/post-install/pacman.sh already does:
sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist
source "$OMARCHY_INSTALL/hardware/pacman.sh" # <-- add
omarchy-hook pre-refresh-pacman
sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirminstall/hardware/pacman.sh is already idempotent (it guards on grep -q '^\[arch-mact2\]'), so this is safe to run unconditionally on every refresh.
A migration to repair already-upgraded machines would also help, since affected users have no symptom to prompt them to look.
Workaround
Re-append the stanza to /etc/pacman.conf manually, or add a~/.config/omarchy/hooks/pre-refresh-pacman.d/ hook that re-adds it on each refresh.
Note on scope
The removal of tiny-dfr by migration 1785944594.sh is not part of this report — that is clearly deliberate and well-reasoned ("the optional daemon holds stale device descriptors across suspend with t2bce"), and matches this machine's experience. Only the loss of the repository appears unintended.
This issue was researched and written by Claude (Claude Code) running on the affected machine, and filed by the repository account owner. All command output above was collected from that machine.
View raw text
**System details:** Apple MacBookPro16,1 (T2, `106b:1801`/`106b:1802`), Intel i7-9750H + AMD Navi 14, Omarchy 4.0.2-1, kernel `linux-t2` 7.1.8.arch1-3, Hyprland 0.56.2, bootloader Limine (UKI).
## Summary
`omarchy-refresh-pacman` overwrites `/etc/pacman.conf` from the channel template but never re-applies the hardware-specific repository additions that `install/hardware/pacman.sh` is responsible for. On Apple T2 Macs this silently drops the `[arch-mact2]` repository, orphaning `linux-t2` and the other T2 packages so they can no longer receive updates — including the kernel.
The install path does this correctly; the refresh/upgrade path does not.
## Impact
After upgrading to 4.x on a T2 Mac, these packages remain installed but have no update source:
- `linux-t2` — **the running kernel**
- `t2fanrd`
- `apple-t2-audio-config`
- `apple-bcm-firmware`
The machine keeps booting and working, so there is no visible symptom. The failure is silent: the kernel simply stops receiving security and bugfix updates, and the user has no indication anything is wrong. `pacman -Syu` reports nothing missing because the packages resolve locally.
## Root cause
`bin/omarchy-refresh-pacman` overwrites the config and then only runs the user hook:
```bash
sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist
# Allow user customization of /etc/pacman.conf before the upgrade runs
omarchy-hook pre-refresh-pacman
sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirm
```
`install/post-install/pacman.sh` does the same overwrite but *does* re-apply hardware repos:
```bash
cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
...
source "$OMARCHY_INSTALL/hardware/pacman.sh"
```
And `install/hardware/pacman.sh` states the intent explicitly:
```bash
# Hardware-specific pacman repository extensions that must survive the final
# pacman.conf restore.
if lspci -nn | grep "106b:180[12]" >/dev/null; then
if ! grep -q '^\[arch-mact2\]' /etc/pacman.conf; then
cat >> /etc/pacman.conf <<'EOF'
[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = Never
EOF
fi
fi
```
So the repo is added deliberately for this hardware and is meant to survive a template restore — but the refresh path is missing the `source "$OMARCHY_INSTALL/hardware/pacman.sh"` line. No migration re-adds it either (`grep -rn arch-mact2 migrations/` returns nothing).
Note the ordering hazard: `pacman -Syyuu --noconfirm` runs immediately afterwards, so the full upgrade proceeds with the repo already missing.
## Reproduction
1. Apple T2 Mac (`lspci -nn` shows `106b:1801` / `106b:1802`) installed via the T2 path, with `[arch-mact2]` in `/etc/pacman.conf`
2. Upgrade to 4.x (or run `omarchy refresh pacman`)
3. `grep arch-mact2 /etc/pacman.conf` → gone
4. `pacman -Si linux-t2` → no repository
## Evidence from the affected machine
`/etc/pacman.conf` before the upgrade (`/etc/pacman.conf.bak`, 15:53) ended with:
```
[omarchy]
SigLevel = Optional TrustAll
Server = https://pkgs.omarchy.org/stable/$arch
[arch-mact2]
Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
SigLevel = Never
```
The upgrade's own backup (`/etc/pacman.conf.omarchy-upgrade-to-quattro.20260902155457.bak`, 15:54) already ends at `[omarchy]` — `[arch-mact2]` is gone.
Resulting state:
```
$ pacman -Q linux-t2
linux-t2 7.1.8.arch1-3
$ pacman -Si linux-t2
error: package 'linux-t2' was not found
```
`arch-mact2-mirrorlist` was also removed.
## Suggested fix
Re-apply hardware repository additions in `omarchy-refresh-pacman` after the template copy and before `pacman -Syyuu`, mirroring what `install/post-install/pacman.sh` already does:
```bash
sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist
source "$OMARCHY_INSTALL/hardware/pacman.sh" # <-- add
omarchy-hook pre-refresh-pacman
sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirm
```
`install/hardware/pacman.sh` is already idempotent (it guards on `grep -q '^\[arch-mact2\]'`), so this is safe to run unconditionally on every refresh.
A migration to repair already-upgraded machines would also help, since affected users have no symptom to prompt them to look.
## Workaround
Re-append the stanza to `/etc/pacman.conf` manually, or add a
`~/.config/omarchy/hooks/pre-refresh-pacman.d/` hook that re-adds it on each refresh.
## Note on scope
The removal of `tiny-dfr` by migration `1785944594.sh` is **not** part of this report — that is clearly deliberate and well-reasoned ("the optional daemon holds stale device descriptors across suspend with t2bce"), and matches this machine's experience. Only the loss of the repository appears unintended.
---
*This issue was researched and written by Claude (Claude Code) running on the affected machine, and filed by the repository account owner. All command output above was collected from that machine.*
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/8781· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 10:37 UTC