Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-5141GitHub issuePublicFixed

Lock screen retries fingerprint every 250ms forever when pam_fprintd fails instantly (e.g. after suspend mid-verify)

Reported by mdsilvers · filed Oct 4, 2026Closed upstream on 2026-10-04 by the bot omarchybot; the closing comment says it was fixed by PR #7158. GitHub close reason: completed.

Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Lock screen retries fingerprint every 250ms forever when pam_fprintd fails instantly (e.g. after suspend mid-verify)revision 1 · captured 2026-10-04 16:02 UTC via poll

System details

AMD Ryzen 7 7735HS, Radeon 680M (Lenovo ThinkBook 14 G7 ARP), Goodix MOC fingerprint sensor (27c6:659a), Omarchy 4.0.4, fprintd 1.94.5, quickshell 0.3.1, systemd 261

What's wrong?

When the fingerprint reader gets into a state where pam_fprintd fails immediately, the lock screen retries fingerprint auth every 250 ms with no backoff or limit. Each retry spawns a new PAM subprocess, so the machine stays busy for as long as it stays locked. In my case the laptop woke in a bag (lid sensor bounce) and spent 74 minutes locked, making 14,056 fingerprint attempts (~3/s), and came out noticeably hot. Fingerprint unlock also stops working until you unlock with the password.

Trigger: suspending while a fingerprint verify is in progress, e.g. lid closed while the lock screen is waiting for a finger (or while sudo is waiting on pam_fprintd). fprintd logs:

fprintd: Device reported an error during verify: Cannot run while suspended.
pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.

After resume, every attempt fails instantly:

quickshell.service.pam.subprocess: Error while authenticating: "Authentication service cannot retrieve authentication info" (code 9)

repeated about every 300 ms until a password unlock.

Steps to reproduce (with a fingerprint enrolled):
1. Lock the screen.
2. Close the lid straight away, without touching the sensor, so the laptop suspends mid-verify.
3. Wait about 10 seconds and open the lid.
4. Fingerprint unlock doesn't work, and journalctl -f shows the Error while authenticating … (code 9) loop.

Why it loops: in shell/plugins/lock/Service.qml, both handleFingerprintFinished() (on any non-success result) and fingerprintPam.onError call fingerprintRetryTimer.restart() (interval: 250, re-armed after every failure), so an instant failure becomes a tight loop.

Suggested fix: back off on consecutive immediate failures (for example 250 ms, then 1 s, 5 s, 30 s), or stop retrying after N instant failures until the next user input. Restarting the fingerprint attempt after PrepareForSleep(false) would also help with the resume case.

Workaround that restores fingerprint unlock after resume (and so stops the loop in this case):

# /etc/systemd/system/fprintd-resume-reset.service
[Unit]
Description=Release stuck fingerprint reader after resume
After=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target

[Service]
Type=oneshot
ExecStart=/usr/bin/systemctl --no-block try-restart fprintd.service

[Install]
WantedBy=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target

With this enabled, the same steps give about 5 failed attempts, then fingerprint unlock works about 1 s after resume. The unbounded 250 ms retry is still worth fixing, since any other cause of a persistent pam_fprintd failure would produce the same busy loop.

View raw text
### System details

AMD Ryzen 7 7735HS, Radeon 680M (Lenovo ThinkBook 14 G7 ARP), Goodix MOC fingerprint sensor (27c6:659a), Omarchy 4.0.4, fprintd 1.94.5, quickshell 0.3.1, systemd 261

### What's wrong?

When the fingerprint reader gets into a state where `pam_fprintd` fails immediately, the lock screen retries fingerprint auth every 250 ms with no backoff or limit. Each retry spawns a new PAM subprocess, so the machine stays busy for as long as it stays locked. In my case the laptop woke in a bag (lid sensor bounce) and spent 74 minutes locked, making **14,056 fingerprint attempts (~3/s)**, and came out noticeably hot. Fingerprint unlock also stops working until you unlock with the password.

**Trigger:** suspending while a fingerprint verify is in progress, e.g. lid closed while the lock screen is waiting for a finger (or while `sudo` is waiting on `pam_fprintd`). fprintd logs:

```
fprintd: Device reported an error during verify: Cannot run while suspended.
pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.
```

After resume, every attempt fails instantly:

```
quickshell.service.pam.subprocess: Error while authenticating: "Authentication service cannot retrieve authentication info" (code 9)
```

repeated about every 300 ms until a password unlock.

**Steps to reproduce** (with a fingerprint enrolled):
1. Lock the screen.
2. Close the lid straight away, without touching the sensor, so the laptop suspends mid-verify.
3. Wait about 10 seconds and open the lid.
4. Fingerprint unlock doesn't work, and `journalctl -f` shows the `Error while authenticating … (code 9)` loop.

**Why it loops:** in `shell/plugins/lock/Service.qml`, both `handleFingerprintFinished()` (on any non-success result) and `fingerprintPam.onError` call `fingerprintRetryTimer.restart()` (`interval: 250`, re-armed after every failure), so an instant failure becomes a tight loop.

**Suggested fix:** back off on consecutive immediate failures (for example 250 ms, then 1 s, 5 s, 30 s), or stop retrying after N instant failures until the next user input. Restarting the fingerprint attempt after `PrepareForSleep(false)` would also help with the resume case.

**Workaround** that restores fingerprint unlock after resume (and so stops the loop in this case):

```ini
# /etc/systemd/system/fprintd-resume-reset.service
[Unit]
Description=Release stuck fingerprint reader after resume
After=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target

[Service]
Type=oneshot
ExecStart=/usr/bin/systemctl --no-block try-restart fprintd.service

[Install]
WantedBy=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target
```

With this enabled, the same steps give about 5 failed attempts, then fingerprint unlock works about 1 s after resume. The unbounded 250 ms retry is still worth fixing, since any other cause of a persistent `pam_fprintd` failure would produce the same busy loop.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

  • Fixed bypr/11273· confirmed
  • Fixed bypr/12461· confirmed
  • Fixed bypr/10653· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.