Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy-hibernation-setup's HOOKS+=(resume) can never place resume before `filesystems`
Reported by manuelbecker123 · filed Aug 26, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
omarchy-hibernation-setup places the resume hook last in HOOKS, after filesystems, fsck and btrfs-overlayfs. mkinitcpio requires resume to run after whatever provides the resume device (encrypt, lvm2, …) and before filesystems, so that the resume attempt happens before the root filesystem is mounted.
On this machine the effective array is:
1 base 6 microcode 11 encrypt
2 udev 7 modconf 12 filesystems
3 plymouth 8 keymap 13 fsck
4 keyboard 9 consolefont 14 btrfs-overlayfs
5 autodetect 10 block 15 resume <-- should be 12By the time /usr/lib/initcpio/hooks/resume writes to /sys/power/resume, filesystems has already mounted root (rw is on the cmdline).
Expected
resume immediately after encrypt, before filesystems.
Root cause
Two drop-ins disagree, and sort order decides:
- `/etc/mkinitcpio.conf.d/omarchy_hooks.conf` (shipped by
omarchy-settings) reassigns the whole array:
HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)- `/etc/mkinitcpio.conf.d/omarchy_resume.conf`, written by
omarchy-hibernation-setup, only appends:
echo "HOOKS+=(resume)" | sudo tee "$MKINITCPIO_CONF" >/dev/nullomarchy_hooks sorts before omarchy_resume, so the reassignment always happens first and the append can only ever land at the end. There is no ordering of these two files that produces a correct result, because one is = and the other is +=. Any install that runs omarchy hibernation setup gets this.
omarchy-hibernation-setup is already alert to a related risk — its own comment reads:
# Add resume= kernel parameters so the initramfs resume hook knows where to find the
# hibernation image. Without these, resume happens late (after GPU drivers load) and fails.but that is about the resume=/resume_offset= cmdline params, which are set correctly here. The hook's position in HOOKS is a separate thing and is not handled.
Reproduce
omarchy hibernation setup
bash -c 'source /etc/mkinitcpio.conf
for f in $(ls /etc/mkinitcpio.conf.d/*.conf | sort); do source "$f"; done
printf "%s\n" "${HOOKS[@]}" | nl'resume is last. Confirmed against the build too — limine-mkinitcpio runs [encrypt] … [filesystems] [fsck] [btrfs-overlayfs] [resume].
Relationship to #8352
#8352 reports resume failing on hybrid Intel+NVIDIA laptops and notes in passing that the hook is appended at the end, but attributes the failure to NVIDIA modules being coldplugged early, and treats resume being last as a given ("which is last, and can't run any earlier than encrypt").
This is a separate defect: the hook is misplaced relative to filesystems, not just relative to module loading, and it affects every install with hibernation enabled. This machine has NVIDIA stripped from the initramfs entirely (MODULES=(thunderbolt i915), no nvidia*, kms dropped) and still gets resume at position 15.
In fairness: I have not been able to demonstrate a resume failure attributable to the ordering in isolation on this machine, because hibernation is separately unavailable here (/sys/power/disk: [disabled] — an unrelated memfd_secret holder). The ordering itself is objectively wrong against mkinitcpio's contract; the observable consequence is what I can't isolate.
Suggested fix
Have omarchy-hibernation-setup write a drop-in that positions rather than appends — sorting after omarchy_hooks.conf and re-inserting after the device-providing hook. Working version in use here:
if [[ " ${HOOKS[*]} " == *" resume "* && " ${HOOKS[*]} " == *" encrypt "* ]]; then
_stripped=(); for _h in "${HOOKS[@]}"; do [[ $_h == resume ]] || _stripped+=("$_h"); done
_out=(); for _h in "${_stripped[@]}"; do
_out+=("$_h"); [[ $_h == encrypt ]] && _out+=(resume)
done
HOOKS=("${_out[@]}")
fiAlternatively omarchy_hooks.conf could include resume in its own array position and have hibernation setup toggle it, which avoids the = vs += conflict entirely.
System
- Omarchy 4.0.1-1, kernel 7.1.9-arch1-2, Hyprland 0.56.2
- ASUSTeK UX430UNR, i7-8550U, Intel UHD 620 + NVIDIA MX150 (hybrid; NVIDIA drives no display and is excluded from the initramfs here)
- Limine + UKI, LUKS2 → btrfs, 15.5 GB swapfile on a
chattr +C/swapsubvolume resume=/dev/mapper/root resume_offset=1907833(offset verified againstbtrfs inspect-internal map-swapfile -r)
View raw text
## What happened
`omarchy-hibernation-setup` places the `resume` hook **last** in `HOOKS`, after `filesystems`, `fsck` and `btrfs-overlayfs`. mkinitcpio requires `resume` to run after whatever provides the resume device (`encrypt`, `lvm2`, …) and **before** `filesystems`, so that the resume attempt happens before the root filesystem is mounted.
On this machine the effective array is:
```
1 base 6 microcode 11 encrypt
2 udev 7 modconf 12 filesystems
3 plymouth 8 keymap 13 fsck
4 keyboard 9 consolefont 14 btrfs-overlayfs
5 autodetect 10 block 15 resume <-- should be 12
```
By the time `/usr/lib/initcpio/hooks/resume` writes to `/sys/power/resume`, `filesystems` has already mounted root (`rw` is on the cmdline).
## Expected
`resume` immediately after `encrypt`, before `filesystems`.
## Root cause
Two drop-ins disagree, and sort order decides:
- **`/etc/mkinitcpio.conf.d/omarchy_hooks.conf`** (shipped by `omarchy-settings`) **reassigns** the whole array:
```sh
HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)
```
- **`/etc/mkinitcpio.conf.d/omarchy_resume.conf`**, written by `omarchy-hibernation-setup`, only **appends**:
```sh
echo "HOOKS+=(resume)" | sudo tee "$MKINITCPIO_CONF" >/dev/null
```
`omarchy_hooks` sorts before `omarchy_resume`, so the reassignment always happens first and the append can only ever land at the end. There is no ordering of these two files that produces a correct result, because one is `=` and the other is `+=`. Any install that runs `omarchy hibernation setup` gets this.
`omarchy-hibernation-setup` is already alert to a *related* risk — its own comment reads:
```
# Add resume= kernel parameters so the initramfs resume hook knows where to find the
# hibernation image. Without these, resume happens late (after GPU drivers load) and fails.
```
but that is about the `resume=`/`resume_offset=` cmdline params, which are set correctly here. The hook's position in `HOOKS` is a separate thing and is not handled.
## Reproduce
```bash
omarchy hibernation setup
bash -c 'source /etc/mkinitcpio.conf
for f in $(ls /etc/mkinitcpio.conf.d/*.conf | sort); do source "$f"; done
printf "%s\n" "${HOOKS[@]}" | nl'
```
`resume` is last. Confirmed against the build too — `limine-mkinitcpio` runs `[encrypt] … [filesystems] [fsck] [btrfs-overlayfs] [resume]`.
## Relationship to #8352
#8352 reports resume failing on hybrid Intel+NVIDIA laptops and notes in passing that the hook is appended at the end, but attributes the failure to NVIDIA modules being coldplugged early, and treats `resume` being last as a given ("which is last, and can't run any earlier than `encrypt`").
This is a separate defect: the hook is misplaced relative to `filesystems`, not just relative to module loading, and it affects **every** install with hibernation enabled. This machine has NVIDIA stripped from the initramfs entirely (`MODULES=(thunderbolt i915)`, no `nvidia*`, `kms` dropped) and still gets `resume` at position 15.
In fairness: I have **not** been able to demonstrate a resume failure attributable to the ordering in isolation on this machine, because hibernation is separately unavailable here (`/sys/power/disk: [disabled]` — an unrelated `memfd_secret` holder). The ordering itself is objectively wrong against mkinitcpio's contract; the observable consequence is what I can't isolate.
## Suggested fix
Have `omarchy-hibernation-setup` write a drop-in that *positions* rather than appends — sorting after `omarchy_hooks.conf` and re-inserting after the device-providing hook. Working version in use here:
```sh
if [[ " ${HOOKS[*]} " == *" resume "* && " ${HOOKS[*]} " == *" encrypt "* ]]; then
_stripped=(); for _h in "${HOOKS[@]}"; do [[ $_h == resume ]] || _stripped+=("$_h"); done
_out=(); for _h in "${_stripped[@]}"; do
_out+=("$_h"); [[ $_h == encrypt ]] && _out+=(resume)
done
HOOKS=("${_out[@]}")
fi
```
Alternatively `omarchy_hooks.conf` could include `resume` in its own array position and have hibernation setup toggle it, which avoids the `=` vs `+=` conflict entirely.
## System
- Omarchy 4.0.1-1, kernel 7.1.9-arch1-2, Hyprland 0.56.2
- ASUSTeK UX430UNR, i7-8550U, Intel UHD 620 + NVIDIA MX150 (hybrid; NVIDIA drives no display and is excluded from the initramfs here)
- Limine + UKI, LUKS2 → btrfs, 15.5 GB swapfile on a `chattr +C` `/swap` subvolume
- `resume=/dev/mapper/root resume_offset=1907833` (offset verified against `btrfs inspect-internal map-swapfile -r`)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 09:24 UTC