Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1951GitHub issuePublicDecided· Out of scope

hibernation-setup misses UKI rebuild after snapper rollback (limine-snapper-sync)

Reported by SomeCodecat · filed May 9, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

hibernation-setup misses UKI rebuild after snapper rollback (limine-snapper-sync)revision 1 · captured 2026-09-28 21:29 UTC via poll

System details

Intel i5-1135G7, Surface Laptop 4, linux-surface 6.19.8, Omarchy 3.7.1 master

What's wrong?

After a snapper rollback (via omarchy snapshot restore / limine-snapper-sync), the on-ESP UKI can end up older than the mkinitcpio drop-in that enables the resume hook. Re-running omarchy hibernation setup --force doesn't fix it: it sees HOOKS+=(resume) already in /etc/mkinitcpio.conf.d/omarchy_resume.conf, prints "Hibernation is already set up", and exits without invoking limine-mkinitcpio. The running initramfs has no resume hook, so systemctl hibernate writes the swap image but the next boot ignores it and starts fresh.

What I observed:

  • /etc/mkinitcpio.conf.d/omarchy_resume.conf had HOOKS+=(resume)
  • /etc/limine-entry-tool.d/resume.conf and /etc/default/limine had a valid resume=/dev/mapper/root resume_offset=...
  • /boot/EFI/Linux/omarchy_linux*.efi were several weeks older — lsinitcpio /boot/EFI/Linux/omarchy_linux-surface.efi | grep '^hooks/resume$' returned nothing
  • omarchy hibernation setup --force reported "already set up"
  • sudo systemctl hibernate powered the machine off cleanly, but on resume it booted clean (session lost)
  • sudo limine-mkinitcpio (run manually) rebuilt the UKI with hooks/resume, after which hibernate actually resumed

The mkinitcpio drop-in was added during a previous run of the setup script, but the matching UKI was swapped out by the snapper rollback (the ESP isn't a btrfs subvolume, but limine-snapper-sync keeps per-snapshot UKI history under /boot/$MACHINE_ID/limine_history/ and may select an older one when promoting a snapshot).

Suggested fix

In the early-exit branch of omarchy-hibernation-setup, verify the active UKI actually contains the resume hook before declaring success:

for k in /boot/EFI/Linux/omarchy_*.efi; do
  lsinitcpio "$k" 2>/dev/null | grep -q '^hooks/resume$' || NEEDS_REBUILD=1
done
[[ -n "$NEEDS_REBUILD" ]] && limine-mkinitcpio

Or simpler: when --force is passed, drop the early exit and always rebuild. That makes --force actually mean something.

omarchy debug
Date: Sat May  9 04:52:31 PM CEST 2026
Hostname: alcantara
Omarchy Branch: master

=========================================
SYSTEM INFORMATION
=========================================
System:
  Kernel 6.19.8-arch1-2-surface arch x86_64 bits 64 compiler gcc v 15.2.1 clocksource tsc
    avail acpi_pm parameters rtc_cmos.use_acpi_alarm=1 resume=/dev/mapper/root resume_offset=3047385
    quiet splash loglevel=0 systemd.show_status=false rd.udev.log_level=0
    vt.global_cursor_default=0 cryptdevice=PARTUUID=8a748ea6-5541-4d9d-97bf-e85fe2b82123:root
    root=/dev/mapper/root zswap.enabled=0 rootflags=subvol=@ rw rootfstype=btrfs
  Desktop Hyprland v 0.54.3 with waybar tools hypridle avail hyprlock vt 1 dm SDDM
    Distro Arch Linux
Machine:
  Type Laptop System Microsoft product Surface Laptop 4
    v 124I:00061T:000M:0100000D:0B:05F:1C:01P:16Y:0U:02S:0 serial <superuser required> Chassis type 9
    serial <superuser required>
  Mobo Microsoft model Surface Laptop 4 serial <superuser required>
    part-nu Surface_Laptop_4_1950:1951 uuid <superuser required> Firmware UEFI vendor Microsoft
    v 30.101.143 date 10/16/2024
Battery:
  ID-1 BAT1 charge 17.7 Wh (45.1%) condition 39.3/45.8 Wh (85.8%) power 6.2 W volts 7.51 min 7.58
    model SMP M1087273 type Li-ion serial <filter> charging status discharging cycles 300
CPU:
  Info model 11th Gen Intel Core i5-1135G7 bits 64 type MT MCP arch Tiger Lake gen core 11 level v4
    note check built 2020 process Intel 10nm family 6 model-id 0x8C (140) stepping 1 microcode 0xBE
  Topology cpus 1x dies 1 clusters 4 cores 4 threads 8 tpc 2 smt enabled cache L1 320 KiB
    desc d-4x48 KiB; i-4x32 KiB L2 5 MiB desc 4x1.2 MiB L3 8 MiB desc 1x8 MiB
  Speed (MHz) avg 1200 min/max 400/4200 scaling driver intel_pstate governor powersave cores
    121 1200 122 1200 123 1200 124 1200 125 1200 126 1200 127 1200 128 1200 bogomips 38707
  Flags-basic avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
  Vulnerabilities
  Type gather_data_sampling mitigation Microcode
  Type ghostwrite status Not affected
  Type indirect_target_selection mitigation Aligned branch/return thunks
  Type itlb_multihit status Not affected
  Type l1tf status Not affected
  Type mds status Not affected
  Type meltdown status Not affected
  Type mmio_stale_data status Not affected
  Type old_microcode status Not affected
  Type reg_file_data_sampling status Not affected
  Type retbleed status Not affected
  Type spec_rstack_overflow status Not affected
  Type spec_store_bypass mitigation Speculative Store Bypass disabled via prctl
  Type spectre_v1 mitigation usercopy/swapgs barriers and __user pointer sanitization
  Type spectre_v2 mitigation Enhanced / Automatic IBRS; IBPB: conditional; PBRSB-eIBRS: SW
    sequence; BHI: SW loop, KVM: SW loop
  Type srbds status Not affected
  Type tsa status Not affected
  Type tsx_async_abort status Not affected
  Type vmscape status Not affected
Graphics:
  Device-1 Intel TigerLake-LP GT2 [Iris Xe Graphics] vendor Microsoft driver i915 v kernel
    alternate xe arch Xe process Intel 10nm built 2020-21 ports active eDP-1 empty DP-1,DP-2,HDMI-A-1
    bus-ID 00:02.0 chip-ID 8086:9a49 class-ID 0300
  Device-2 Surface Camera Front driver uvcvideo type USB rev 2.0 speed 480 Mb/s lanes 1 mode 2.0
    bus-ID 3-6:3 chip-ID 045e:0990 class-ID 0e02 serial <filter>
  Display wayland server X.org v 1.21.1.22 with Xwayland v 24.1.11 compositor Hyprland v 0.54.3
    driver X loaded modesetting alternate fbdev,intel,vesa dri iris gpu i915 display-ID 1
  Monitor-1 eDP-1 model Sharp LQ135P1JX51 serial <filter> built 2019 res 2256x1504 dpi 201
    gamma 1.2 size 285x190mm (11.22x7.48") diag 343mm (13.5") ratio 3:2 modes 2256x1504
  API EGL Message EGL data requires eglinfo. Check --recommends.
  Info Tools x11 xprop
Audio:
  Device-1 Intel 500 Series Family On-Package High Definition Audio driver snd_hda_intel v kernel
    alternate snd_soc_avs,snd_sof_pci_intel_tgl bus-ID 00:1f.3 chip-ID 8086:a0c8 class-ID 0403
  API ALSA v k6.19.8-arch1-2-surface status kernel-api tools alsactl,alsamixer,amixer
  Server-1 sndiod v N/A status off tools aucat,midicat,sndioctl
  Server-2 PipeWire v 1.6.4 status active with 121 pipewire-pulse status active 122 wireplumber
    status active 123 pipewire-alsa type plugin 124 pw-jack type plugin tools pactl,pw-cat,pw-cli,wpctl
Network:
  Device-1 Intel Wi-Fi 6 AX201 driver iwlwifi v kernel bus-ID 00:14.3 chip-ID 8086:a0f0
    class-ID 0280
  IF wlan0 state up mac <filter>
  Info services iwd, systemd-networkd, systemd-timesyncd
Bluetooth:
  Device-1 N/A driver btusb v 0.8 type USB rev 2.0 speed  Mb/s lanes 1 mode 1.1 bus-ID 3-10:4
    chip-ID 8087:0026 class-ID e001
  Report rfkill ID hci0 rfk-id 6 state up address see --recommends
Drives:
  Local Storage total 476.94 GiB used 34.24 GiB (7.2%)
  SMART Message Required tool smartctl not installed. Check --recommends
  ID-1 /dev/nvme0n1 maj-min 259:0 vendor Samsung model MZ9LQ5HALU-00000 size 476.94 GiB
    block-size physical 5 B logical 5 B speed 31.6 Gb/s lanes 4 tech SSD serial <filter>
    fw-rev FXV72M0Q temp 10.8 C scheme GPT
Partition:
  ID-1 / raw-size 474.92 GiB size 474.92 GiB (100.00%) used 33.99 GiB (7.2%) fs btrfs dev /dev/dm-0
    maj-min 253:0 mapped root
  ID-2 /boot raw-size 2 GiB size 2 GiB (99.80%) used 256.3 MiB (12.5%) fs vfat dev /dev/nvme0n1p1
    maj-min 259:1
  ID-3 /home raw-size 474.92 GiB size 474.92 GiB (100.00%) used 33.99 GiB (7.2%) fs btrfs
    dev /dev/dm-0 maj-min 253:0 mapped root
  ID-4 /var/log raw-size 474.92 GiB size 474.92 GiB (100.00%) used 33.99 GiB (7.2%) fs btrfs
    dev /dev/dm-0 maj-min 253:0 mapped root
Swap:
  Kernel swappiness 60 (default) cache-pressure 100 (default) zswap no
  ID-1 swap-1 type file size 7.59 GiB used 0 KiB (0.0%) priority 0 file /swap/swapfile
  ID-2 swap-2 type zram size 3.8 GiB used 364.8 MiB (9.4%) priority 100 comp zstd
    avail lzo-rle,lzo,lz4,lz4hc,deflate,842 dev /dev/zram0
Sensors:
  System Temperatures cpu 29.0 C mobo N/A
  Fan Speeds (rpm) N/A
Repos:
  Packages pm pacman pkgs 1054 libs 270 tools yay
  Active pacman repo servers in /etc/pacman.conf
    121 https: //pkg.surfacelinux.com/arch/
    122 https: //pkgs.omarchy.org/stable/$arch
  Active pacman repo servers in /etc/pacman.d/mirrorlist
    121 https: //stable-mirror.omarchy.org/$repo/os/$arch
Info:
  Memory total 8 GiB note est. available 7.6 GiB used 5. GiB (67.3%)
  Processes 302 Power uptime 2h 14m states freeze,mem,disk suspend s2idle wakeups 1
    hibernate platform avail shutdown, reboot, suspend, test_resume image 2.94 GiB
    services power-profiles-daemon, thermald, upowerd Init systemd v 260 default graphical
    tool systemctl
  Compilers clang 22.1.3 gcc 16.1.1 alt 15 Client shell wrapper v 5.3.9-release inxi 3.3.40

=========================================
DMESG
=========================================
(skipped - --no-sudo flag used)
View raw text
### System details

Intel i5-1135G7, Surface Laptop 4, linux-surface 6.19.8, Omarchy 3.7.1 master

### What's wrong?

After a snapper rollback (via `omarchy snapshot restore` / limine-snapper-sync), the on-ESP UKI can end up older than the mkinitcpio drop-in that enables the resume hook. Re-running `omarchy hibernation setup --force` doesn't fix it: it sees `HOOKS+=(resume)` already in `/etc/mkinitcpio.conf.d/omarchy_resume.conf`, prints "Hibernation is already set up", and exits without invoking `limine-mkinitcpio`. The running initramfs has no resume hook, so `systemctl hibernate` writes the swap image but the next boot ignores it and starts fresh.

What I observed:

- `/etc/mkinitcpio.conf.d/omarchy_resume.conf` had `HOOKS+=(resume)`
- `/etc/limine-entry-tool.d/resume.conf` and `/etc/default/limine` had a valid `resume=/dev/mapper/root resume_offset=...`
- `/boot/EFI/Linux/omarchy_linux*.efi` were several weeks older — `lsinitcpio /boot/EFI/Linux/omarchy_linux-surface.efi | grep '^hooks/resume$'` returned nothing
- `omarchy hibernation setup --force` reported "already set up"
- `sudo systemctl hibernate` powered the machine off cleanly, but on resume it booted clean (session lost)
- `sudo limine-mkinitcpio` (run manually) rebuilt the UKI with `hooks/resume`, after which hibernate actually resumed

The mkinitcpio drop-in was added during a previous run of the setup script, but the matching UKI was swapped out by the snapper rollback (the ESP isn't a btrfs subvolume, but limine-snapper-sync keeps per-snapshot UKI history under `/boot/$MACHINE_ID/limine_history/` and may select an older one when promoting a snapshot).

### Suggested fix

In the early-exit branch of `omarchy-hibernation-setup`, verify the active UKI actually contains the resume hook before declaring success:

```bash
for k in /boot/EFI/Linux/omarchy_*.efi; do
  lsinitcpio "$k" 2>/dev/null | grep -q '^hooks/resume$' || NEEDS_REBUILD=1
done
[[ -n "$NEEDS_REBUILD" ]] && limine-mkinitcpio
```

Or simpler: when `--force` is passed, drop the early exit and always rebuild. That makes `--force` actually mean something.

<details><summary><code>omarchy debug</code></summary>

```
Date: Sat May  9 04:52:31 PM CEST 2026
Hostname: alcantara
Omarchy Branch: master

=========================================
SYSTEM INFORMATION
=========================================
System:
  Kernel 6.19.8-arch1-2-surface arch x86_64 bits 64 compiler gcc v 15.2.1 clocksource tsc
    avail acpi_pm parameters rtc_cmos.use_acpi_alarm=1 resume=/dev/mapper/root resume_offset=3047385
    quiet splash loglevel=0 systemd.show_status=false rd.udev.log_level=0
    vt.global_cursor_default=0 cryptdevice=PARTUUID=8a748ea6-5541-4d9d-97bf-e85fe2b82123:root
    root=/dev/mapper/root zswap.enabled=0 rootflags=subvol=@ rw rootfstype=btrfs
  Desktop Hyprland v 0.54.3 with waybar tools hypridle avail hyprlock vt 1 dm SDDM
    Distro Arch Linux
Machine:
  Type Laptop System Microsoft product Surface Laptop 4
    v 124I:00061T:000M:0100000D:0B:05F:1C:01P:16Y:0U:02S:0 serial <superuser required> Chassis type 9
    serial <superuser required>
  Mobo Microsoft model Surface Laptop 4 serial <superuser required>
    part-nu Surface_Laptop_4_1950:1951 uuid <superuser required> Firmware UEFI vendor Microsoft
    v 30.101.143 date 10/16/2024
Battery:
  ID-1 BAT1 charge 17.7 Wh (45.1%) condition 39.3/45.8 Wh (85.8%) power 6.2 W volts 7.51 min 7.58
    model SMP M1087273 type Li-ion serial <filter> charging status discharging cycles 300
CPU:
  Info model 11th Gen Intel Core i5-1135G7 bits 64 type MT MCP arch Tiger Lake gen core 11 level v4
    note check built 2020 process Intel 10nm family 6 model-id 0x8C (140) stepping 1 microcode 0xBE
  Topology cpus 1x dies 1 clusters 4 cores 4 threads 8 tpc 2 smt enabled cache L1 320 KiB
    desc d-4x48 KiB; i-4x32 KiB L2 5 MiB desc 4x1.2 MiB L3 8 MiB desc 1x8 MiB
  Speed (MHz) avg 1200 min/max 400/4200 scaling driver intel_pstate governor powersave cores
    121 1200 122 1200 123 1200 124 1200 125 1200 126 1200 127 1200 128 1200 bogomips 38707
  Flags-basic avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
  Vulnerabilities
  Type gather_data_sampling mitigation Microcode
  Type ghostwrite status Not affected
  Type indirect_target_selection mitigation Aligned branch/return thunks
  Type itlb_multihit status Not affected
  Type l1tf status Not affected
  Type mds status Not affected
  Type meltdown status Not affected
  Type mmio_stale_data status Not affected
  Type old_microcode status Not affected
  Type reg_file_data_sampling status Not affected
  Type retbleed status Not affected
  Type spec_rstack_overflow status Not affected
  Type spec_store_bypass mitigation Speculative Store Bypass disabled via prctl
  Type spectre_v1 mitigation usercopy/swapgs barriers and __user pointer sanitization
  Type spectre_v2 mitigation Enhanced / Automatic IBRS; IBPB: conditional; PBRSB-eIBRS: SW
    sequence; BHI: SW loop, KVM: SW loop
  Type srbds status Not affected
  Type tsa status Not affected
  Type tsx_async_abort status Not affected
  Type vmscape status Not affected
Graphics:
  Device-1 Intel TigerLake-LP GT2 [Iris Xe Graphics] vendor Microsoft driver i915 v kernel
    alternate xe arch Xe process Intel 10nm built 2020-21 ports active eDP-1 empty DP-1,DP-2,HDMI-A-1
    bus-ID 00:02.0 chip-ID 8086:9a49 class-ID 0300
  Device-2 Surface Camera Front driver uvcvideo type USB rev 2.0 speed 480 Mb/s lanes 1 mode 2.0
    bus-ID 3-6:3 chip-ID 045e:0990 class-ID 0e02 serial <filter>
  Display wayland server X.org v 1.21.1.22 with Xwayland v 24.1.11 compositor Hyprland v 0.54.3
    driver X loaded modesetting alternate fbdev,intel,vesa dri iris gpu i915 display-ID 1
  Monitor-1 eDP-1 model Sharp LQ135P1JX51 serial <filter> built 2019 res 2256x1504 dpi 201
    gamma 1.2 size 285x190mm (11.22x7.48") diag 343mm (13.5") ratio 3:2 modes 2256x1504
  API EGL Message EGL data requires eglinfo. Check --recommends.
  Info Tools x11 xprop
Audio:
  Device-1 Intel 500 Series Family On-Package High Definition Audio driver snd_hda_intel v kernel
    alternate snd_soc_avs,snd_sof_pci_intel_tgl bus-ID 00:1f.3 chip-ID 8086:a0c8 class-ID 0403
  API ALSA v k6.19.8-arch1-2-surface status kernel-api tools alsactl,alsamixer,amixer
  Server-1 sndiod v N/A status off tools aucat,midicat,sndioctl
  Server-2 PipeWire v 1.6.4 status active with 121 pipewire-pulse status active 122 wireplumber
    status active 123 pipewire-alsa type plugin 124 pw-jack type plugin tools pactl,pw-cat,pw-cli,wpctl
Network:
  Device-1 Intel Wi-Fi 6 AX201 driver iwlwifi v kernel bus-ID 00:14.3 chip-ID 8086:a0f0
    class-ID 0280
  IF wlan0 state up mac <filter>
  Info services iwd, systemd-networkd, systemd-timesyncd
Bluetooth:
  Device-1 N/A driver btusb v 0.8 type USB rev 2.0 speed  Mb/s lanes 1 mode 1.1 bus-ID 3-10:4
    chip-ID 8087:0026 class-ID e001
  Report rfkill ID hci0 rfk-id 6 state up address see --recommends
Drives:
  Local Storage total 476.94 GiB used 34.24 GiB (7.2%)
  SMART Message Required tool smartctl not installed. Check --recommends
  ID-1 /dev/nvme0n1 maj-min 259:0 vendor Samsung model MZ9LQ5HALU-00000 size 476.94 GiB
    block-size physical 5 B logical 5 B speed 31.6 Gb/s lanes 4 tech SSD serial <filter>
    fw-rev FXV72M0Q temp 10.8 C scheme GPT
Partition:
  ID-1 / raw-size 474.92 GiB size 474.92 GiB (100.00%) used 33.99 GiB (7.2%) fs btrfs dev /dev/dm-0
    maj-min 253:0 mapped root
  ID-2 /boot raw-size 2 GiB size 2 GiB (99.80%) used 256.3 MiB (12.5%) fs vfat dev /dev/nvme0n1p1
    maj-min 259:1
  ID-3 /home raw-size 474.92 GiB size 474.92 GiB (100.00%) used 33.99 GiB (7.2%) fs btrfs
    dev /dev/dm-0 maj-min 253:0 mapped root
  ID-4 /var/log raw-size 474.92 GiB size 474.92 GiB (100.00%) used 33.99 GiB (7.2%) fs btrfs
    dev /dev/dm-0 maj-min 253:0 mapped root
Swap:
  Kernel swappiness 60 (default) cache-pressure 100 (default) zswap no
  ID-1 swap-1 type file size 7.59 GiB used 0 KiB (0.0%) priority 0 file /swap/swapfile
  ID-2 swap-2 type zram size 3.8 GiB used 364.8 MiB (9.4%) priority 100 comp zstd
    avail lzo-rle,lzo,lz4,lz4hc,deflate,842 dev /dev/zram0
Sensors:
  System Temperatures cpu 29.0 C mobo N/A
  Fan Speeds (rpm) N/A
Repos:
  Packages pm pacman pkgs 1054 libs 270 tools yay
  Active pacman repo servers in /etc/pacman.conf
    121 https: //pkg.surfacelinux.com/arch/
    122 https: //pkgs.omarchy.org/stable/$arch
  Active pacman repo servers in /etc/pacman.d/mirrorlist
    121 https: //stable-mirror.omarchy.org/$repo/os/$arch
Info:
  Memory total 8 GiB note est. available 7.6 GiB used 5. GiB (67.3%)
  Processes 302 Power uptime 2h 14m states freeze,mem,disk suspend s2idle wakeups 1
    hibernate platform avail shutdown, reboot, suspend, test_resume image 2.94 GiB
    services power-profiles-daemon, thermald, upowerd Init systemd v 260 default graphical
    tool systemctl
  Compilers clang 22.1.3 gcc 16.1.1 alt 15 Client shell wrapper v 5.3.9-release inxi 3.3.40

=========================================
DMESG
=========================================
(skipped - --no-sudo flag used)
```
</details>

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 02:54 UTC