## What happened

The Quattro upgrade (3.8.x → 4.0) switches the network stack from iwd to NetworkManager, but nothing converts the saved Wi-Fi profiles. After the upgrade reboot, every saved network — SSIDs and passphrases — is gone: `nmcli connection show` is simply empty, with no error or warning anywhere.

The data isn't destroyed. It's still sitting in `/var/lib/iwd/`, but that directory is mode 700 root-only, so a normal user has no visible hint it survived. And since the upgrade also removes the `iwd` and `impala` packages, the tooling that could read the old store is gone too.

During the Quattro upgrade, the NetworkManager swap itself is already handled carefully (the disable/enable happens in one step, the running connection deliberately survives until reboot, per the comments in `omarchy-upgrade-to-quattro`). The credential store just wasn't part of the scope.

This is worth fixing because after upgrading to Quattro and rebooting, your wifi will be gone, and moreover, if you have a large library of saved networks and passwords (for offices, coworking spaces, friends' and family's homes, cafes, etc.), losing them all is more than inconvenient.

Reproduced first-hand: upgraded 2026-08-13 from 3.8.x to 4.0.0rc4, now on 4.0.1-1. 26 saved networks vanished and had to be recovered by hand (workaround below).

## What I expected

Either the saved networks come across (open/WPA-PSK at least), or a heads-up before the reboot prompt so you can note down passphrases while the machine still has a working connection.

## Steps to reproduce

1. On Omarchy 3.8.x, have Wi-Fi networks saved via iwd (files in `/var/lib/iwd/`).
2. Run the Quattro upgrade and reboot when prompted.
3. `nmcli connection show` — empty. No saved networks, no warning, no error.

## Confirmed still unfixed in 4.0.1-1

- `grep -rn "PreSharedKey\|Passphrase\|/var/lib/iwd" /usr/share/omarchy/{bin,migrations,install}` returns nothing — no import logic exists anywhere.
- The only two migrations touching iwd (`1782002156.sh`, `1786567036.sh`) handle service/backend cleanup, not credentials.
- In `omarchy-upgrade-to-quattro`, the iwd handling is purely teardown: `iwd` and `impala` are in the package-removal list, and `cleanup_retired_services()` disables `iwd.service` while enabling NetworkManager.

## Prior art

- Discussion #6577 (Suggestions, 2026-08-06) describes exactly this, but buried as item 1 of 3 unrelated observations — 0 comments, never entered the bug pipeline. Its author only avoided the loss because they'd copied `/var/lib/iwd` beforehand as a precaution.
- PR #6321 ("Import iwd WiFi networks into NetworkManager on upgrade", 2026-07-20) implemented the fix: idempotent, best-effort, open/WPA-PSK and hidden networks, enterprise left for manual re-add. It was closed unmerged by its own author on 2026-07-24, shortly after their related #6334 merged — it reads as an abandoned self-close, not a rejection; no maintainer ever reviewed it.
- The adjacent Quattro wifi-transition bugs that made Wi-Fi *visibly* broken all got reported and fixed (#6612, #6783, #6575; #7323 still open). This one slipped through because it fails silently.

## Workaround (recovered all 26 networks)

iwd stores one file per network in `/var/lib/iwd`, named `<SSID>.psk` or `<SSID>.open`; an SSID that isn't filename-safe is hex-encoded with a leading `=`. The passphrase is the `Passphrase=` line (or `PreSharedKey=` when only the derived key is stored). The files are root-only, so copy them somewhere readable first (`sudo cp -r /var/lib/iwd ~/iwd-backup && sudo chown -R $USER ~/iwd-backup`), then:

```bash
#!/bin/bash
# Import iwd network profiles into NetworkManager. Prints names only, never keys.
set -uo pipefail
dir=/path/to/copied/iwd
shopt -s nullglob

existing=$(nmcli -t -f NAME connection show)
have() { grep -Fxq "$1" <<<"$existing"; }

decode_ssid() {
  local base=$1
  if [[ $base == =* ]]; then
    python3 -c 'import sys; sys.stdout.buffer.write(bytes.fromhex(sys.argv[1]))' "${base#=}"
  else
    printf '%s' "$base"
  fi
}

for f in "$dir"/*.psk "$dir"/*.open; do
  base=$(basename "$f"); ext=${base##*.}
  ssid=$(decode_ssid "${base%.*}")
  if have "$ssid"; then echo "skip (already present): $ssid"; continue; fi

  if [[ $ext == open ]]; then
    nmcli connection add type wifi con-name "$ssid" ssid "$ssid" autoconnect yes >/dev/null \
      && echo "imported (open): $ssid" || echo "FAILED: $ssid"
    continue
  fi

  pass=$(sed -n 's/^Passphrase=//p' "$f" | head -1)
  psk=$(sed -n 's/^PreSharedKey=//p' "$f" | head -1)
  key=${pass:-$psk}
  [[ -z $key ]] && { echo "skip (no recoverable key): $ssid"; continue; }

  nmcli connection add type wifi con-name "$ssid" ssid "$ssid" \
    wifi-sec.key-mgmt wpa-psk wifi-sec.psk "$key" autoconnect yes >/dev/null \
    && echo "imported: $ssid" || echo "FAILED: $ssid"
done
```

Caveats: handles open and WPA-PSK; 802.1x/enterprise profiles need manual re-adding. Delete the readable copy afterwards (`rm -rf ~/iwd-backup`) — it's a plaintext dump of every passphrase sitting in `$HOME`. The original `/var/lib/iwd` can stay as a fallback until you're confident everything reconnects.

## Suggested fix

Whatever the maintainers prefer — a few options in ascending cost:

1. A post-upgrade note telling users their credentials still live in `/var/lib/iwd` (near zero cost — the store is already left intact).
2. A warning before the reboot prompt so people can write passphrases down while they still have a working machine.
3. Revive the #6321 approach and convert the profiles during the migration.

## System details

```
Omarchy: 4.0.1-1 (upgraded from 3.8.x to Quattro 4.0.0rc4 on 2026-08-13)
Kernel: 7.1.9-arch1-2 x86_64
Machine: LENOVO ThinkPad T14 Gen 2a (20XLS08R00)
CPU: AMD Ryzen 7 PRO 5850U with Radeon Graphics
GPU: AMD Cezanne [Radeon Vega Series / Radeon Mobile Series], amdgpu
Desktop: Hyprland 0.56.2, SDDM
NetworkManager 1.58.1-1, wpa_supplicant 2:2.12-1
iwd, impala: removed by the upgrade
```