# Lock screen: PAM info messages from the fingerprint stack are not surfaced

## Summary

`Service.qml` wires `onPamMessage` for the password PAM stack but not for the
fingerprint PAM stack. As a result every PAM info/error message `pam_fprintd`
sends is discarded. The lock screen has no fingerprint text element at all, so
the user sees nothing: not the standing "Place your right index finger on the
fingerprint reader" instruction, and not the module's guidance when something
goes wrong — most importantly "Remove your finger, and try touching the sensor
again".

The practical effect: when a press produces no usable image, the lock screen
gives no feedback whatsoever — no message, no state change, nothing. There is no
visible difference between "the sensor saw nothing", "the sensor saw an
unusable image" and "the session timed out". The user has no reason to change
what they are doing, and typically presses harder or holds longer, which
reproduces the same failure.

## Environment

    Omarchy 4.0.0.alpha
    file: /usr/share/omarchy/shell/plugins/lock/Service.qml
    fprintd 1.94.5, libfprint-tod 1.95.2+tod1
    device: Broadcom ControlVault3+ (0a5c:5865), press-type sensor

## Steps to reproduce

1. Enroll a fingerprint; confirm it verifies normally (`fprintd-verify` matches
   in ~1s).
2. Lock the screen and press with a smudge or partial contact, so the driver
   returns `verify-remove-and-retry`.
3. Watch the lock screen text while this happens.

## Observed

The journal shows the module sending the hint:

    09:12:45.807  fprintd: Line: 450 status 89 :
    09:12:45.808  quickshell.service.pam.subprocess:
                  Relaying pam message: "Remove your finger, and try touching the sensor again"
                  echo: 1 error: 1 responseRequired: 0
    09:12:46.396  quickshell.service.pam.subprocess:
                  Relaying pam message: "Verification timed out"

The message is relayed to the frontend successfully. The lock screen displays
nothing at all — it does not change state or show any text. The only
fingerprint-related element in the UI is a static icon:

    LockView.qml:204-210
      id: fingerprintIcon
      objectName: "fingerprintIndicator"
      visible: root.fingerprintConfigured
      text: "󰈷"

That icon is a static nerd-font glyph marking the sensor's presence. It has no
message binding and never changes in response to PAM traffic. The only text
element in the view is the password prompt:

    LockView.qml:189
      text: root.authenticatingPassword ? "Checking…"
          : (root.failureMessage.length > 0 ? root.failureMessage
                                            : root.placeholderText)

and `failureMessage` is only ever set by `handlePasswordFailure()`, so it cannot
carry a fingerprint message.

## Expected

The fingerprint stack's PAM info/error messages should reach the lock screen UI,
at minimum as a transient hint line, the same way the password stack's messages
are handled.

## Root cause

`/usr/share/omarchy/shell/plugins/lock/Service.qml`, the password stack at
line 319:

    PamContext {
      id: passwordPam
      config: "omarchy-lock-password"
      user: root.userName

      onResponseRequiredChanged: root.respondToPasswordPrompt()
      onPamMessage: root.respondToPasswordPrompt()     // <-- present here
      ...

and the fingerprint stack at line 341:

    PamContext {
      id: fingerprintPam
      config: "omarchy-lock-fingerprint"
      user: root.userName

      onCompleted: function(result) {
        root.handleFingerprintFinished(result)
      }

      onError: function(error) {
        root.fingerprintAuthenticating = false
        if (root.lockRequested && root.fingerprintConfigured) fingerprintRetryTimer.restart()
      }
    }

There is no `onPamMessage` (and no `onResponseRequiredChanged`) on
`fingerprintPam`. `fingerprintPam` is never read back into any UI property —
the only references to it elsewhere are `fingerprintPam.abort()` (lines 125, 385)
and the `.start()` call in `startFingerprint()`. So even if `onPamMessage` were
added, there is currently no property for the text to land in; `failureMessage`
is set only by `handlePasswordFailure()` (line 205).

## Impact

- The lock screen is entirely silent about the fingerprint stack. A failed press
  and an idle 10-30 second timeout look identical from the outside.
- The one actionable instruction (`Remove your finger, and try touching the
  sensor again`) never reaches the person who needs it.
- Reinforces the impression that the reader is unreliable, when in fact it is
  behaving per spec and the module is emitting correct guidance.
- The user's only diagnostic signal is "did it unlock or not", which makes a
  correctable press error indistinguishable from a hardware fault.

## Suggested fix

Add message handling to the fingerprint stack and surface it, e.g.:

    PamContext {
      id: fingerprintPam
      config: "omarchy-lock-fingerprint"
      user: root.userName

      onPamMessage: root.handleFingerprintMessage(text, type)
      ...

and a `fingerprintMessage` property consumed by `LockView.qml`. Note there is no
existing fingerprint text element to hang this on — the only fingerprint UI is
the static `fingerprintIndicator` icon, so this needs a new text element (or a
reuse of the password field's text line, which would be confusing since that
field is for the password). It also needs care to avoid the hint being cleared
by the next `VerifyStatus` signal, which fires on every scan result.

## Relationship to existing issues

This is distinct from, and complements, the two open fingerprint lock-screen reports:

- **#13906** (250 ms retry loop when the reader is unavailable) and **#13944**
  (thermal guard disabling the reader after ~3 min locked) both concern the *retry
  loop* and reader availability. This report is about something orthogonal: even
  while the reader is healthy and a session is active, the lock screen has no
  fingerprint text element at all, so the guidance `pam_fprintd` emits is discarded.
- **Not a duplicate of #13944.** Verified on this machine that the thermal guard
  never fires (`journalctl | grep -ci overheat` → 0 matches) and the reader does not
  re-enumerate pathologically (4 enumerations over 3 days, normal resume behavior).
  The symptom here appears with a healthy reader and a healthy session.
- **Different code path.** #13906 / #13944 point at `fingerprintRetryTimer` and
  `handleFingerprintFinished`; this points at the absent `onPamMessage` on the
  fingerprint `PamContext` (~line 341) and the absent fingerprint text element in
  `LockView.qml`.

## Notes

- Duplicate check: searched `basecamp/omarchy` issues for "fingerprint" in
  titles; no existing issue covering PAM message surfacing.
- Related but distinct upstream problem: fprintd has no case for
  `verify-remove-and-retry`, so it returns `PAM_AUTH_ERR` instead of retrying.
  Surfacing the message does not fix that, but it does make the failure
  understandable to the user rather than looking like a dead sensor. I'm filing
  that separately with fprintd.
- This is the lock-screen half of the symptom "fingerprint only works about half
  the time"; the other half is the fprintd-side session abort.
- Willing to test a patch and provide journal output before/after.