Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1705GitHub issuePublicDecided· Out of scope

Quattro upgrade removes iwd but leaves wifi.backend=iwd in NetworkManager conf.d, leaving Wi-Fi unavailable (incomplete fix for #6612)

Reported by skoom21 · filed Aug 17, 2026 · open at source

Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Quattro upgrade removes iwd but leaves wifi.backend=iwd in NetworkManager conf.d, leaving Wi-Fi unavailable (incomplete fix for #6612)revision 1 · captured 2026-09-28 21:29 UTC via poll

System details

Dell Latitude E5470 · Intel Core i5-6440HQ (Skylake-S) · Intel HD 530 + AMD Radeon Topaz XT · Wi-Fi: Intel Dual Band Wireless-AC 8260 (8086:24f3, iwlwifi) · Omarchy 4.0.0-1 · Kernel 7.1.8-arch1-3 · Hyprland 0.56.2 · SDDM

What's wrong?

Upgrading to Quattro removed the iwd package but left a NetworkManager drop-in that still selects iwd as the Wi-Fi backend. NetworkManager is then configured to use a backend whose daemon does not exist, so every Wi-Fi device sits at unavailable forever. There is no Wi-Fi after the upgrade and nothing in the UI explains why.

This is the same failure as #6612, which was closed as completed — but the underlying condition is still reachable on stable 4.0.0, because nothing in the shipped tree ever inspects the backend setting.

Root cause

The upgrade removed iwd:

[2026-08-18T02:55:06+0500] [PACMAN] Running 'pacman -Rns --noconfirm --ask 4 ... iwd ...'
[2026-08-18T02:55:07+0500] [ALPM] removed iwd (3.12-1)

But this file survived untouched:

$ cat /etc/NetworkManager/conf.d/wifi_backend.conf
[device]
wifi.backend=iwd

Result:

$ nmcli device status
DEVICE       TYPE      STATE          CONNECTION
wlp2s0       wifi      unavailable    --

$ systemctl status iwd
Unit iwd.service could not be found.

The driver is healthy the entire time — this is purely NetworkManager having no usable backend:

iwlwifi 0000:02:00.0: Detected Intel(R) Dual Band Wireless-AC 8260
iwlwifi 0000:02:00.0: loaded firmware version 36.c8e8e144.0 8000C-36.ucode op_mode iwlmvm
iwlwifi 0000:02:00.0: base HW address: <redacted>, OTP minor version: 0x4
ieee80211 phy0: Selected rate control algorithm 'iwl-mvm-rs'

No rfkill block, WIFI-HW enabled, WIFI enabled, firmware loaded, MAC detected, zero driver errors.

Why the existing migration does not catch it

migrations/1786567036.sh is the only migration that addresses iwd-era Wi-Fi breakage, and it bails out immediately unless wpa_supplicant.service is masked:

state=$(systemctl is-enabled wpa_supplicant.service 2>/dev/null || true)
[[ $state == masked* ]] || exit 0

On this machine wpa_supplicant.service was disabled, not masked, so the migration exited at line 8 and never ran. It recorded itself as applied regardless.

Nothing else in the tree looks at the setting at all:

$ grep -rn 'wifi\.backend\|wifi_backend\|iwd-backend' /usr/share/omarchy/
# (no matches)

install/hardware/network.sh disables iwd.service, and migrations/1782002156.sh retires networkd/iwd units — but neither inspects /etc/NetworkManager/conf.d/ for a backend selection.

Worth noting the filename differs from #6612: that report proposed removing 10-iwd-backend.conf specifically. Mine was wifi_backend.conf. Any fix keyed to one filename will keep missing installs like this one, since the name depends on which era/tool wrote the drop-in.

Steps to reproduce

  1. Install an Omarchy release that configures iwd as the NetworkManager Wi-Fi backend via a drop-in under /etc/NetworkManager/conf.d/ (filename varies).
  2. Ensure wpa_supplicant.service is disabled rather than masked.
  3. Upgrade to Quattro (4.0.0), which removes the iwd package.
  4. Reboot.
  5. nmcli device status → Wi-Fi device is unavailable; it never recovers.

Workaround

sudo mv /etc/NetworkManager/conf.d/wifi_backend.conf{,.bak}   # any drop-in setting wifi.backend=iwd
sudo systemctl restart NetworkManager

The device moves unavailable → disconnected and wpa_supplicant is D-Bus activated on demand. Note that saved profiles may additionally be pinned to the old wlan0 interface name and need connection.interface-name cleared, since the device is now wlp2s0.

Suggested fix

Detect the condition rather than a filename — scan the drop-in directory for an iwd backend selection and neutralize it when iwd is absent. Something along these lines, as a migration:

if ! command -v iwd >/dev/null && ! systemctl list-unit-files iwd.service >/dev/null 2>&1; then
  while IFS= read -r f; do
    [[ -n $f ]] || continue
    mv "$f" "$f.omarchy-iwd-retired.bak"
    restart_nm=1
  done < <(grep -rlE '^[[:space:]]*wifi\.backend[[:space:]]*=[[:space:]]*iwd' \
             /etc/NetworkManager/conf.d/ 2>/dev/null)
  [[ -n ${restart_nm:-} ]] && systemctl restart NetworkManager.service
fi

It would also help to drop the masked-only early exit in 1786567036.sh, or run the backend check ahead of it, so the two failure modes are handled independently.

View raw text
### System details

Dell Latitude E5470 · Intel Core i5-6440HQ (Skylake-S) · Intel HD 530 + AMD Radeon Topaz XT · Wi-Fi: Intel Dual Band Wireless-AC 8260 (`8086:24f3`, `iwlwifi`) · Omarchy 4.0.0-1 · Kernel 7.1.8-arch1-3 · Hyprland 0.56.2 · SDDM

### What's wrong?

Upgrading to Quattro removed the `iwd` package but left a NetworkManager drop-in that still selects `iwd` as the Wi-Fi backend. NetworkManager is then configured to use a backend whose daemon does not exist, so every Wi-Fi device sits at `unavailable` forever. There is no Wi-Fi after the upgrade and nothing in the UI explains why.

This is the same failure as #6612, which was closed as completed — but the underlying condition is still reachable on stable 4.0.0, because nothing in the shipped tree ever inspects the backend setting.

### Root cause

The upgrade removed `iwd`:

```
[2026-08-18T02:55:06+0500] [PACMAN] Running 'pacman -Rns --noconfirm --ask 4 ... iwd ...'
[2026-08-18T02:55:07+0500] [ALPM] removed iwd (3.12-1)
```

But this file survived untouched:

```
$ cat /etc/NetworkManager/conf.d/wifi_backend.conf
[device]
wifi.backend=iwd
```

Result:

```
$ nmcli device status
DEVICE       TYPE      STATE          CONNECTION
wlp2s0       wifi      unavailable    --

$ systemctl status iwd
Unit iwd.service could not be found.
```

The driver is healthy the entire time — this is purely NetworkManager having no usable backend:

```
iwlwifi 0000:02:00.0: Detected Intel(R) Dual Band Wireless-AC 8260
iwlwifi 0000:02:00.0: loaded firmware version 36.c8e8e144.0 8000C-36.ucode op_mode iwlmvm
iwlwifi 0000:02:00.0: base HW address: <redacted>, OTP minor version: 0x4
ieee80211 phy0: Selected rate control algorithm 'iwl-mvm-rs'
```

No rfkill block, `WIFI-HW enabled`, `WIFI enabled`, firmware loaded, MAC detected, zero driver errors.

### Why the existing migration does not catch it

`migrations/1786567036.sh` is the only migration that addresses iwd-era Wi-Fi breakage, and it bails out immediately unless `wpa_supplicant.service` is **masked**:

```bash
state=$(systemctl is-enabled wpa_supplicant.service 2>/dev/null || true)
[[ $state == masked* ]] || exit 0
```

On this machine `wpa_supplicant.service` was `disabled`, not `masked`, so the migration exited at line 8 and never ran. It recorded itself as applied regardless.

Nothing else in the tree looks at the setting at all:

```bash
$ grep -rn 'wifi\.backend\|wifi_backend\|iwd-backend' /usr/share/omarchy/
# (no matches)
```

`install/hardware/network.sh` disables `iwd.service`, and `migrations/1782002156.sh` retires networkd/iwd units — but neither inspects `/etc/NetworkManager/conf.d/` for a backend selection.

Worth noting the filename differs from #6612: that report proposed removing `10-iwd-backend.conf` specifically. Mine was `wifi_backend.conf`. Any fix keyed to one filename will keep missing installs like this one, since the name depends on which era/tool wrote the drop-in.

### Steps to reproduce

1. Install an Omarchy release that configures `iwd` as the NetworkManager Wi-Fi backend via a drop-in under `/etc/NetworkManager/conf.d/` (filename varies).
2. Ensure `wpa_supplicant.service` is `disabled` rather than `masked`.
3. Upgrade to Quattro (4.0.0), which removes the `iwd` package.
4. Reboot.
5. `nmcli device status` → Wi-Fi device is `unavailable`; it never recovers.

### Workaround

```bash
sudo mv /etc/NetworkManager/conf.d/wifi_backend.conf{,.bak}   # any drop-in setting wifi.backend=iwd
sudo systemctl restart NetworkManager
```

The device moves `unavailable` → `disconnected` and `wpa_supplicant` is D-Bus activated on demand. Note that saved profiles may additionally be pinned to the old `wlan0` interface name and need `connection.interface-name` cleared, since the device is now `wlp2s0`.

### Suggested fix

Detect the condition rather than a filename — scan the drop-in directory for an `iwd` backend selection and neutralize it when `iwd` is absent. Something along these lines, as a migration:

```bash
if ! command -v iwd >/dev/null && ! systemctl list-unit-files iwd.service >/dev/null 2>&1; then
  while IFS= read -r f; do
    [[ -n $f ]] || continue
    mv "$f" "$f.omarchy-iwd-retired.bak"
    restart_nm=1
  done < <(grep -rlE '^[[:space:]]*wifi\.backend[[:space:]]*=[[:space:]]*iwd' \
             /etc/NetworkManager/conf.d/ 2>/dev/null)
  [[ -n ${restart_nm:-} ]] && systemctl restart NetworkManager.service
fi
```

It would also help to drop the `masked`-only early exit in `1786567036.sh`, or run the backend check ahead of it, so the two failure modes are handled independently.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 04:37 UTC