Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-674GitHub issuePublicDecided· Out of scope

Plymouth falls back to the unthemed text LUKS prompt on UKI installs under QEMU (systemd-stub auto-appends console=uart,io,0x3f8)

Reported by JasonStreifling · filed Sep 11, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Plymouth falls back to the unthemed text LUKS prompt on UKI installs under QEMU (systemd-stub auto-appends console=uart,io,0x3f8)revision 1 · captured 2026-09-28 21:23 UTC via poll

What happens

On a fresh Omarchy install with disk encryption inside a QEMU/KVM virtual machine, the LUKS passphrase prompt at boot is rendered as plain text instead of the Omarchy Plymouth theme. This happens on every boot, deterministically.

What I expected

The themed graphical Plymouth prompt, the same as on bare metal.

Root cause

Omarchy boots a UKI (ENABLE_UKI=yes in /etc/limine-entry-tool.d/omarchy-uki.conf), so systemd-stub runs before the kernel.

systemd-stub checks whether the UEFI ConOut is a serial console and, if the embedded kernel command line contains no console= parameter, appends one itself. The relevant strings in /usr/lib/systemd/boot/efi/linuxx64.efi.stub:

ConOut is a serial console (port index %u).
Kernel command line already contains console=, not adding one.
console=uart,io,0x3f8
console=tty0

Under QEMU with OVMF, ConOut includes the emulated 16550 UART at I/O port 0x3f8, so the stub appends console=uart,io,0x3f8 console=tty0 on every boot.

Plymouth then does exactly what it is designed to do. From a plymouth.debug log:

ply-device-manager.c:1218: serial consoles detected, managing them with details forced
show_detailed_splash: Showing detailed splash screen

details forced disables the graphical splash on all displays, including tty1, so the LUKS prompt is drawn by the text plugin.

Because the parameter is generated at boot time, it shows up in /proc/cmdline but in no file on disk: not in /boot/limine.conf, not in /etc/default/limine, not in /etc/limine-entry-tool.d/*, and not in the UKI's own .cmdline section.

Reproduction

  1. Install Omarchy in a QEMU/KVM VM (Q35 + OVMF/EDK II) with full-disk encryption.
  2. Boot.
  3. cat /proc/cmdline ends in console=uart,io,0x3f8 console=tty0.
  4. The LUKS prompt is plain text rather than themed.

Suggested fix

Ship any console= parameter, which makes systemd-stub stand down ("Kernel command line already contains console=, not adding one"). One line in omarchy-defaults.conf:

KERNEL_CMDLINE[default]+=" console=tty0"

Verified on this machine: after adding that as a drop-in and running limine-update, /proc/cmdline no longer contains console=uart,io,0x3f8 and the themed graphical LUKS prompt is back.

An alternative that keeps serial boot logging is plymouth.ignore-serial-consoles, which makes Plymouth ignore the serial console instead of suppressing it.

Related issues

#11011 (Black screen or plymouthd crash under Proxmox with GPU passthrough) reports a different symptom, but its author found the same workaround empirically: adding console=tty0 restored the graphical password prompt, and they note they are unsure why it works or whether it generalises. The mechanism described above is the likely explanation for that fix.

#6996 already asks whether the initramfs_async=0 default should be narrowed or removed. That is relevant here, because omarchy-defaults.conf currently justifies initramfs_async=0 with this comment:

# Kernel 7.1 unpacks the initramfs asynchronously, which races /init: the
# early /proc, /sys, /dev, and /run mounts fail while unpacking settles, so
# plymouthd exits when it can't read /proc/cmdline and encrypted boots fall
# back to an unthemed text LUKS prompt. Unpack synchronously until the race
# is fixed upstream.

That comment describes the same symptom as this report. On this system initramfs_async=0 was active and the text prompt still occurred, and a full plymouth.debug log shows no plymouthd crash or early exit: it starts, asks for the passphrase, and quits cleanly. So at least on this machine the cause was the serial console rather than the initramfs race. Combined with the boot-time regression in #6996, it may be worth re-checking what that workaround is actually buying.

System

  • Omarchy 4.0.3-1
  • Kernel 7.2.3-arch1-3
  • systemd 261.2-1 (systemd-stub 261.2-1-arch, confirmed via the StubInfo EFI variable)
  • limine 12.8.0-1, limine-mkinitcpio-hook 1.38.0-1.1, ENABLE_UKI=yes
  • QEMU/KVM, Standard PC (Q35 + ICH9, 2009), machine type pc-q35-10.2, firmware EDK II (OVMF)
  • Root on LUKS, btrfs subvolume @

Filed by Claude Opus 5 via Claude Code.

View raw text
## What happens

On a fresh Omarchy install with disk encryption inside a QEMU/KVM virtual machine, the LUKS passphrase prompt at boot is rendered as plain text instead of the Omarchy Plymouth theme. This happens on every boot, deterministically.

## What I expected

The themed graphical Plymouth prompt, the same as on bare metal.

## Root cause

Omarchy boots a UKI (`ENABLE_UKI=yes` in `/etc/limine-entry-tool.d/omarchy-uki.conf`), so systemd-stub runs before the kernel.

systemd-stub checks whether the UEFI `ConOut` is a serial console and, if the embedded kernel command line contains no `console=` parameter, appends one itself. The relevant strings in `/usr/lib/systemd/boot/efi/linuxx64.efi.stub`:

```
ConOut is a serial console (port index %u).
Kernel command line already contains console=, not adding one.
console=uart,io,0x3f8
console=tty0
```

Under QEMU with OVMF, `ConOut` includes the emulated 16550 UART at I/O port 0x3f8, so the stub appends `console=uart,io,0x3f8 console=tty0` on every boot.

Plymouth then does exactly what it is designed to do. From a `plymouth.debug` log:

```
ply-device-manager.c:1218: serial consoles detected, managing them with details forced
show_detailed_splash: Showing detailed splash screen
```

`details forced` disables the graphical splash on all displays, including tty1, so the LUKS prompt is drawn by the text plugin.

Because the parameter is generated at boot time, it shows up in `/proc/cmdline` but in no file on disk: not in `/boot/limine.conf`, not in `/etc/default/limine`, not in `/etc/limine-entry-tool.d/*`, and not in the UKI's own `.cmdline` section.

## Reproduction

1. Install Omarchy in a QEMU/KVM VM (Q35 + OVMF/EDK II) with full-disk encryption.
2. Boot.
3. `cat /proc/cmdline` ends in `console=uart,io,0x3f8 console=tty0`.
4. The LUKS prompt is plain text rather than themed.

## Suggested fix

Ship any `console=` parameter, which makes systemd-stub stand down ("Kernel command line already contains console=, not adding one"). One line in `omarchy-defaults.conf`:

```
KERNEL_CMDLINE[default]+=" console=tty0"
```

Verified on this machine: after adding that as a drop-in and running `limine-update`, `/proc/cmdline` no longer contains `console=uart,io,0x3f8` and the themed graphical LUKS prompt is back.

An alternative that keeps serial boot logging is `plymouth.ignore-serial-consoles`, which makes Plymouth ignore the serial console instead of suppressing it.

## Related issues

**#11011** (Black screen or plymouthd crash under Proxmox with GPU passthrough) reports a different symptom, but its author found the same workaround empirically: adding `console=tty0` restored the graphical password prompt, and they note they are unsure why it works or whether it generalises. The mechanism described above is the likely explanation for that fix.

**#6996** already asks whether the `initramfs_async=0` default should be narrowed or removed. That is relevant here, because `omarchy-defaults.conf` currently justifies `initramfs_async=0` with this comment:

```
# Kernel 7.1 unpacks the initramfs asynchronously, which races /init: the
# early /proc, /sys, /dev, and /run mounts fail while unpacking settles, so
# plymouthd exits when it can't read /proc/cmdline and encrypted boots fall
# back to an unthemed text LUKS prompt. Unpack synchronously until the race
# is fixed upstream.
```

That comment describes the same symptom as this report. On this system `initramfs_async=0` was active and the text prompt still occurred, and a full `plymouth.debug` log shows no `plymouthd` crash or early exit: it starts, asks for the passphrase, and quits cleanly. So at least on this machine the cause was the serial console rather than the initramfs race. Combined with the boot-time regression in #6996, it may be worth re-checking what that workaround is actually buying.

## System

- Omarchy 4.0.3-1
- Kernel 7.2.3-arch1-3
- systemd 261.2-1 (systemd-stub 261.2-1-arch, confirmed via the `StubInfo` EFI variable)
- limine 12.8.0-1, limine-mkinitcpio-hook 1.38.0-1.1, `ENABLE_UKI=yes`
- QEMU/KVM, Standard PC (Q35 + ICH9, 2009), machine type pc-q35-10.2, firmware EDK II (OVMF)
- Root on LUKS, btrfs subvolume `@`

Filed by Claude Opus 5 via Claude Code.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 11:52 UTC