Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
FocalTech fingerprint reader (2808:a97a): not detected, and lock screen unlock fails after suspend
Reported by jddmgt · filed Oct 2, 2026 · open at source · 2 revisions
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. So far: partly in the audited area (lock) — decided by agents · verified; matches no known issue — decided by agents · verified. The outcome (valid, duplicate, not a bug, …) is not decided yet. See the decision.
Original report
System details
ASUS ExpertBook B9406CAA, Intel Core Ultra X7 358H, FocalTech fingerprint reader (2808:a97a), Omarchy 4.0.4-1, libfprint-git 1.94.100.r10, fprintd 1.94.5
What's wrong?
The FocalTech fingerprint reader on this laptop has two separate problems.
1. Reader is not detected by omarchy-hw-fingerprint
Symptomomarchy-setup-security-fingerprint exits with No fingerprint sensor detected., and the post-update fingerprint setup notification never appears.
Finding
Bus 003 Device 004: ID 2808:a97a Focal FocalTech FT9349 ESSlibfprint-git and fprintd drive the reader fine. fprintd-list reports it as "Focaltech MOC Sensors (press)", and enrolling and verifying both work. No kernel driver is bound to its interface. The detection misses it for two reasons:
- Vendor 2808 (FocalTech) is not in fingerprint_vendors.
- The product string FocalTech FT9349 ESS contains neither "fingerprint" nor "biometric".
Suggested fix
Add 2808 to fingerprint_vendors in omarchy-hw-fingerprint. The existing has_kernel_driver check still keeps FocalTech touchscreens and touchpads (which bind usbhid) from matching.
Workaround
Put a stub omarchy-hw-fingerprint that exits 0 first on PATH, then run omarchy-setup-security-fingerprint.
2. Lock screen fingerprint unlock fails after resume from suspend
Symptom
After waking from suspend (s2idle), the lock screen doesn't accept the fingerprint. Only the password works.
Finding
The lock screen starts pam_fprintd verification before suspend, and the suspend interrupts it:
fprintd: Device reported an error during verify: Cannot run while suspended.
quickshell: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.After resume, fprintd is still stuck on that claim. The 250ms fingerprintRetryTimer in plugins/lock/Service.qml keeps re-arming PAM, and every attempt fails right away:
quickshell.service.pam.subprocess: Error while authenticating: "Authentication service cannot retrieve authentication info" (code 9)In one case this went on for about 15 seconds (~55 attempts) until I unlocked with my password.
Suggested fix
Either of these should work:
- Ship a systemd sleep hook that restarts fprintd around suspend (shown below), or
- Have the lock screen abort the fingerprint PamContext before suspend (e.g. on logind PrepareForSleep) and re-arm it after resume.
Workaround (tested, works)/usr/lib/systemd/system-sleep/fprintd-resume:
#!/bin/sh
case "$1" in
pre) systemctl stop fprintd.service ;;
post) systemctl restart fprintd.service ;;
esacWith this hook in place, the first PAM attempt after resume still fails with code 9 while fprintd restarts. The next retry succeeds, and fingerprint unlock works about 1 second after resume.
View raw text
### System details ASUS ExpertBook B9406CAA, Intel Core Ultra X7 358H, FocalTech fingerprint reader (`2808:a97a`), Omarchy 4.0.4-1, libfprint-git 1.94.100.r10, fprintd 1.94.5 ### What's wrong? The FocalTech fingerprint reader on this laptop has two separate problems. ## 1. Reader is not detected by `omarchy-hw-fingerprint` **Symptom** `omarchy-setup-security-fingerprint` exits with `No fingerprint sensor detected.`, and the post-update fingerprint setup notification never appears. **Finding** ``` Bus 003 Device 004: ID 2808:a97a Focal FocalTech FT9349 ESS ``` libfprint-git and fprintd drive the reader fine. `fprintd-list` reports it as "Focaltech MOC Sensors (press)", and enrolling and verifying both work. No kernel driver is bound to its interface. The detection misses it for two reasons: - Vendor `2808` (FocalTech) is not in `fingerprint_vendors`. - The product string `FocalTech FT9349 ESS` contains neither "fingerprint" nor "biometric". **Suggested fix** Add `2808` to `fingerprint_vendors` in `omarchy-hw-fingerprint`. The existing `has_kernel_driver` check still keeps FocalTech touchscreens and touchpads (which bind usbhid) from matching. **Workaround** Put a stub `omarchy-hw-fingerprint` that exits 0 first on `PATH`, then run `omarchy-setup-security-fingerprint`. ## 2. Lock screen fingerprint unlock fails after resume from suspend **Symptom** After waking from suspend (s2idle), the lock screen doesn't accept the fingerprint. Only the password works. **Finding** The lock screen starts `pam_fprintd` verification before suspend, and the suspend interrupts it: ``` fprintd: Device reported an error during verify: Cannot run while suspended. quickshell: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later. ``` After resume, fprintd is still stuck on that claim. The 250ms `fingerprintRetryTimer` in `plugins/lock/Service.qml` keeps re-arming PAM, and every attempt fails right away: ``` quickshell.service.pam.subprocess: Error while authenticating: "Authentication service cannot retrieve authentication info" (code 9) ``` In one case this went on for about 15 seconds (~55 attempts) until I unlocked with my password. **Suggested fix** Either of these should work: - Ship a systemd sleep hook that restarts fprintd around suspend (shown below), or - Have the lock screen abort the fingerprint `PamContext` before suspend (e.g. on logind `PrepareForSleep`) and re-arm it after resume. **Workaround (tested, works)** `/usr/lib/systemd/system-sleep/fprintd-resume`: ```sh #!/bin/sh case "$1" in pre) systemctl stop fprintd.service ;; post) systemctl restart fprintd.service ;; esac ``` With this hook in place, the first PAM attempt after resume still fails with code 9 while fprintd restarts. The next retry succeeds, and fingerprint unlock works about 1 second after resume.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related toR-830Fingerprint unlock rejected on first attempt after resume (Goodix, race with sleep-lock inhibitor)· decided by agents · verified
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Decided by agents · verified: partly in the audited area (lock)
- Decided by agents · verified: matches no known issue
The outcome (valid, duplicate, not a bug, …) is not decided yet.