Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-2197GitHub issuePublicLinked

FocalTech fingerprint reader (2808:a97a): not detected, and lock screen unlock fails after suspend

Reported by jddmgt · filed Oct 2, 2026 · open at source · 2 revisions

Partly in the audited area (lock) — decided by agents · verified. Not validated yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaPartly in the audited arealock· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. So far: partly in the audited area (lock) — decided by agents · verified; matches no known issue — decided by agents · verified. The outcome (valid, duplicate, not a bug, …) is not decided yet. See the decision.

Original report

Revision12 (current)
FocalTech fingerprint reader (2808:a97a): not detected, and lock screen unlock fails after suspendrevision 2 · captured 2026-10-03 06:14 UTC via poll

System details

ASUS ExpertBook B9406CAA, Intel Core Ultra X7 358H, FocalTech fingerprint reader (2808:a97a), Omarchy 4.0.4-1, libfprint-git 1.94.100.r10, fprintd 1.94.5

What's wrong?

The FocalTech fingerprint reader on this laptop has two separate problems.

1. Reader is not detected by omarchy-hw-fingerprint

Symptom
omarchy-setup-security-fingerprint exits with No fingerprint sensor detected., and the post-update fingerprint setup notification never appears.

Finding

Bus 003 Device 004: ID 2808:a97a Focal FocalTech FT9349 ESS

libfprint-git and fprintd drive the reader fine. fprintd-list reports it as "Focaltech MOC Sensors (press)", and enrolling and verifying both work. No kernel driver is bound to its interface. The detection misses it for two reasons:
- Vendor 2808 (FocalTech) is not in fingerprint_vendors.
- The product string FocalTech FT9349 ESS contains neither "fingerprint" nor "biometric".

Suggested fix
Add 2808 to fingerprint_vendors in omarchy-hw-fingerprint. The existing has_kernel_driver check still keeps FocalTech touchscreens and touchpads (which bind usbhid) from matching.

Workaround
Put a stub omarchy-hw-fingerprint that exits 0 first on PATH, then run omarchy-setup-security-fingerprint.

2. Lock screen fingerprint unlock fails after resume from suspend

Symptom
After waking from suspend (s2idle), the lock screen doesn't accept the fingerprint. Only the password works.

Finding
The lock screen starts pam_fprintd verification before suspend, and the suspend interrupts it:

fprintd: Device reported an error during verify: Cannot run while suspended.
quickshell: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.

After resume, fprintd is still stuck on that claim. The 250ms fingerprintRetryTimer in plugins/lock/Service.qml keeps re-arming PAM, and every attempt fails right away:

quickshell.service.pam.subprocess: Error while authenticating: "Authentication service cannot retrieve authentication info" (code 9)

In one case this went on for about 15 seconds (~55 attempts) until I unlocked with my password.

Suggested fix
Either of these should work:
- Ship a systemd sleep hook that restarts fprintd around suspend (shown below), or
- Have the lock screen abort the fingerprint PamContext before suspend (e.g. on logind PrepareForSleep) and re-arm it after resume.

Workaround (tested, works)
/usr/lib/systemd/system-sleep/fprintd-resume:

#!/bin/sh
case "$1" in
  pre)  systemctl stop fprintd.service ;;
  post) systemctl restart fprintd.service ;;
esac

With this hook in place, the first PAM attempt after resume still fails with code 9 while fprintd restarts. The next retry succeeds, and fingerprint unlock works about 1 second after resume.

View raw text
### System details

ASUS ExpertBook B9406CAA, Intel Core Ultra X7 358H, FocalTech fingerprint reader (`2808:a97a`), Omarchy 4.0.4-1, libfprint-git 1.94.100.r10, fprintd 1.94.5

### What's wrong?

The FocalTech fingerprint reader on this laptop has two separate problems.

## 1. Reader is not detected by `omarchy-hw-fingerprint`

**Symptom**
`omarchy-setup-security-fingerprint` exits with `No fingerprint sensor detected.`, and the post-update fingerprint setup notification never appears.

**Finding**
```
Bus 003 Device 004: ID 2808:a97a Focal FocalTech FT9349 ESS
```
libfprint-git and fprintd drive the reader fine. `fprintd-list` reports it as "Focaltech MOC Sensors (press)", and enrolling and verifying both work. No kernel driver is bound to its interface. The detection misses it for two reasons:
- Vendor `2808` (FocalTech) is not in `fingerprint_vendors`.
- The product string `FocalTech FT9349 ESS` contains neither "fingerprint" nor "biometric".

**Suggested fix**
Add `2808` to `fingerprint_vendors` in `omarchy-hw-fingerprint`. The existing `has_kernel_driver` check still keeps FocalTech touchscreens and touchpads (which bind usbhid) from matching.

**Workaround**
Put a stub `omarchy-hw-fingerprint` that exits 0 first on `PATH`, then run `omarchy-setup-security-fingerprint`.

## 2. Lock screen fingerprint unlock fails after resume from suspend

**Symptom**
After waking from suspend (s2idle), the lock screen doesn't accept the fingerprint. Only the password works.

**Finding**
The lock screen starts `pam_fprintd` verification before suspend, and the suspend interrupts it:
```
fprintd: Device reported an error during verify: Cannot run while suspended.
quickshell: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.
```
After resume, fprintd is still stuck on that claim. The 250ms `fingerprintRetryTimer` in `plugins/lock/Service.qml` keeps re-arming PAM, and every attempt fails right away:
```
quickshell.service.pam.subprocess: Error while authenticating: "Authentication service cannot retrieve authentication info" (code 9)
```
In one case this went on for about 15 seconds (~55 attempts) until I unlocked with my password.

**Suggested fix**
Either of these should work:
- Ship a systemd sleep hook that restarts fprintd around suspend (shown below), or
- Have the lock screen abort the fingerprint `PamContext` before suspend (e.g. on logind `PrepareForSleep`) and re-arm it after resume.

**Workaround (tested, works)**
`/usr/lib/systemd/system-sleep/fprintd-resume`:
```sh
#!/bin/sh
case "$1" in
  pre)  systemctl stop fprintd.service ;;
  post) systemctl restart fprintd.service ;;
esac
```
With this hook in place, the first PAM attempt after resume still fails with code 9 while fprintd restarts. The next retry succeeds, and fingerprint unlock works about 1 second after resume.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Decided by agents · verified: partly in the audited area (lock)
  • Decided by agents · verified: matches no known issue

The outcome (valid, duplicate, not a bug, …) is not decided yet.