Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1404GitHub issuePublicDecided· Out of scope

omarchy-hibernation-setup's HOOKS+=(resume) can never place resume before `filesystems`

Reported by manuelbecker123 · filed Aug 26, 2026 · open at source

Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

omarchy-hibernation-setup's HOOKS+=(resume) can never place resume before `filesystems`revision 1 · captured 2026-09-28 21:24 UTC via poll

What happened

omarchy-hibernation-setup places the resume hook last in HOOKS, after filesystems, fsck and btrfs-overlayfs. mkinitcpio requires resume to run after whatever provides the resume device (encrypt, lvm2, …) and before filesystems, so that the resume attempt happens before the root filesystem is mounted.

On this machine the effective array is:

 1 base          6 microcode    11 encrypt
 2 udev          7 modconf      12 filesystems
 3 plymouth      8 keymap       13 fsck
 4 keyboard      9 consolefont  14 btrfs-overlayfs
 5 autodetect   10 block        15 resume          <-- should be 12

By the time /usr/lib/initcpio/hooks/resume writes to /sys/power/resume, filesystems has already mounted root (rw is on the cmdline).

Expected

resume immediately after encrypt, before filesystems.

Root cause

Two drop-ins disagree, and sort order decides:

  • `/etc/mkinitcpio.conf.d/omarchy_hooks.conf` (shipped by omarchy-settings) reassigns the whole array:
  HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)
  • `/etc/mkinitcpio.conf.d/omarchy_resume.conf`, written by omarchy-hibernation-setup, only appends:
  echo "HOOKS+=(resume)" | sudo tee "$MKINITCPIO_CONF" >/dev/null

omarchy_hooks sorts before omarchy_resume, so the reassignment always happens first and the append can only ever land at the end. There is no ordering of these two files that produces a correct result, because one is = and the other is +=. Any install that runs omarchy hibernation setup gets this.

omarchy-hibernation-setup is already alert to a related risk — its own comment reads:

# Add resume= kernel parameters so the initramfs resume hook knows where to find the
# hibernation image. Without these, resume happens late (after GPU drivers load) and fails.

but that is about the resume=/resume_offset= cmdline params, which are set correctly here. The hook's position in HOOKS is a separate thing and is not handled.

Reproduce

omarchy hibernation setup
bash -c 'source /etc/mkinitcpio.conf
         for f in $(ls /etc/mkinitcpio.conf.d/*.conf | sort); do source "$f"; done
         printf "%s\n" "${HOOKS[@]}" | nl'

resume is last. Confirmed against the build too — limine-mkinitcpio runs [encrypt] … [filesystems] [fsck] [btrfs-overlayfs] [resume].

Relationship to #8352

#8352 reports resume failing on hybrid Intel+NVIDIA laptops and notes in passing that the hook is appended at the end, but attributes the failure to NVIDIA modules being coldplugged early, and treats resume being last as a given ("which is last, and can't run any earlier than encrypt").

This is a separate defect: the hook is misplaced relative to filesystems, not just relative to module loading, and it affects every install with hibernation enabled. This machine has NVIDIA stripped from the initramfs entirely (MODULES=(thunderbolt i915), no nvidia*, kms dropped) and still gets resume at position 15.

In fairness: I have not been able to demonstrate a resume failure attributable to the ordering in isolation on this machine, because hibernation is separately unavailable here (/sys/power/disk: [disabled] — an unrelated memfd_secret holder). The ordering itself is objectively wrong against mkinitcpio's contract; the observable consequence is what I can't isolate.

Suggested fix

Have omarchy-hibernation-setup write a drop-in that positions rather than appends — sorting after omarchy_hooks.conf and re-inserting after the device-providing hook. Working version in use here:

if [[ " ${HOOKS[*]} " == *" resume "* && " ${HOOKS[*]} " == *" encrypt "* ]]; then
  _stripped=(); for _h in "${HOOKS[@]}"; do [[ $_h == resume ]] || _stripped+=("$_h"); done
  _out=(); for _h in "${_stripped[@]}"; do
    _out+=("$_h"); [[ $_h == encrypt ]] && _out+=(resume)
  done
  HOOKS=("${_out[@]}")
fi

Alternatively omarchy_hooks.conf could include resume in its own array position and have hibernation setup toggle it, which avoids the = vs += conflict entirely.

System

  • Omarchy 4.0.1-1, kernel 7.1.9-arch1-2, Hyprland 0.56.2
  • ASUSTeK UX430UNR, i7-8550U, Intel UHD 620 + NVIDIA MX150 (hybrid; NVIDIA drives no display and is excluded from the initramfs here)
  • Limine + UKI, LUKS2 → btrfs, 15.5 GB swapfile on a chattr +C /swap subvolume
  • resume=/dev/mapper/root resume_offset=1907833 (offset verified against btrfs inspect-internal map-swapfile -r)
View raw text
## What happened

`omarchy-hibernation-setup` places the `resume` hook **last** in `HOOKS`, after `filesystems`, `fsck` and `btrfs-overlayfs`. mkinitcpio requires `resume` to run after whatever provides the resume device (`encrypt`, `lvm2`, …) and **before** `filesystems`, so that the resume attempt happens before the root filesystem is mounted.

On this machine the effective array is:

```
 1 base          6 microcode    11 encrypt
 2 udev          7 modconf      12 filesystems
 3 plymouth      8 keymap       13 fsck
 4 keyboard      9 consolefont  14 btrfs-overlayfs
 5 autodetect   10 block        15 resume          <-- should be 12
```

By the time `/usr/lib/initcpio/hooks/resume` writes to `/sys/power/resume`, `filesystems` has already mounted root (`rw` is on the cmdline).

## Expected

`resume` immediately after `encrypt`, before `filesystems`.

## Root cause

Two drop-ins disagree, and sort order decides:

- **`/etc/mkinitcpio.conf.d/omarchy_hooks.conf`** (shipped by `omarchy-settings`) **reassigns** the whole array:
  ```sh
  HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)
  ```
- **`/etc/mkinitcpio.conf.d/omarchy_resume.conf`**, written by `omarchy-hibernation-setup`, only **appends**:
  ```sh
  echo "HOOKS+=(resume)" | sudo tee "$MKINITCPIO_CONF" >/dev/null
  ```

`omarchy_hooks` sorts before `omarchy_resume`, so the reassignment always happens first and the append can only ever land at the end. There is no ordering of these two files that produces a correct result, because one is `=` and the other is `+=`. Any install that runs `omarchy hibernation setup` gets this.

`omarchy-hibernation-setup` is already alert to a *related* risk — its own comment reads:

```
# Add resume= kernel parameters so the initramfs resume hook knows where to find the
# hibernation image. Without these, resume happens late (after GPU drivers load) and fails.
```

but that is about the `resume=`/`resume_offset=` cmdline params, which are set correctly here. The hook's position in `HOOKS` is a separate thing and is not handled.

## Reproduce

```bash
omarchy hibernation setup
bash -c 'source /etc/mkinitcpio.conf
         for f in $(ls /etc/mkinitcpio.conf.d/*.conf | sort); do source "$f"; done
         printf "%s\n" "${HOOKS[@]}" | nl'
```

`resume` is last. Confirmed against the build too — `limine-mkinitcpio` runs `[encrypt] … [filesystems] [fsck] [btrfs-overlayfs] [resume]`.

## Relationship to #8352

#8352 reports resume failing on hybrid Intel+NVIDIA laptops and notes in passing that the hook is appended at the end, but attributes the failure to NVIDIA modules being coldplugged early, and treats `resume` being last as a given ("which is last, and can't run any earlier than `encrypt`").

This is a separate defect: the hook is misplaced relative to `filesystems`, not just relative to module loading, and it affects **every** install with hibernation enabled. This machine has NVIDIA stripped from the initramfs entirely (`MODULES=(thunderbolt i915)`, no `nvidia*`, `kms` dropped) and still gets `resume` at position 15.

In fairness: I have **not** been able to demonstrate a resume failure attributable to the ordering in isolation on this machine, because hibernation is separately unavailable here (`/sys/power/disk: [disabled]` — an unrelated `memfd_secret` holder). The ordering itself is objectively wrong against mkinitcpio's contract; the observable consequence is what I can't isolate.

## Suggested fix

Have `omarchy-hibernation-setup` write a drop-in that *positions* rather than appends — sorting after `omarchy_hooks.conf` and re-inserting after the device-providing hook. Working version in use here:

```sh
if [[ " ${HOOKS[*]} " == *" resume "* && " ${HOOKS[*]} " == *" encrypt "* ]]; then
  _stripped=(); for _h in "${HOOKS[@]}"; do [[ $_h == resume ]] || _stripped+=("$_h"); done
  _out=(); for _h in "${_stripped[@]}"; do
    _out+=("$_h"); [[ $_h == encrypt ]] && _out+=(resume)
  done
  HOOKS=("${_out[@]}")
fi
```

Alternatively `omarchy_hooks.conf` could include `resume` in its own array position and have hibernation setup toggle it, which avoids the `=` vs `+=` conflict entirely.

## System

- Omarchy 4.0.1-1, kernel 7.1.9-arch1-2, Hyprland 0.56.2
- ASUSTeK UX430UNR, i7-8550U, Intel UHD 620 + NVIDIA MX150 (hybrid; NVIDIA drives no display and is excluded from the initramfs here)
- Limine + UKI, LUKS2 → btrfs, 15.5 GB swapfile on a `chattr +C` `/swap` subvolume
- `resume=/dev/mapper/root resume_offset=1907833` (offset verified against `btrfs inspect-internal map-swapfile -r`)

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 09:24 UTC