Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Fingerprint unlock rejected on first attempt after resume (Goodix, race with sleep-lock inhibitor)
Reported by ukkit · filed Sep 8, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. So far: in the audited area (lock) — decided by agents · verified; matches no known issue — decided by agents · verified. The outcome (valid, duplicate, not a bug, …) is not decided yet. See the decision.
Original report
What happened
The first fingerprint attempt after resuming from suspend (and the first
attempt right after a session starts) is reliably rejected. A second attempt
a couple of seconds later succeeds. This is consistent across multiple boots
today.
Journal evidence points to a race between fprintd and Omarchy's own
suspend/lock handling:
- At suspend time,
fprintdtries to install its own sleep-delay inhibitor
and fails because Omarchy's omarchy-system-sleep-lock inhibitor
("Lock screen before suspend") already holds that slot:
fprintd[...]: Failed to install a sleep delay inhibitor: GDBus.Error:org.freedesktop.login1.OperationInProgress: The operation inhibition has been requested for is already running- On resume, the first automatic verify from the Quickshell lock screen
(omarchy-lock-fingerprint PAM service) fires before fprintd's view of
the device has caught up, and fails:
fprintd[...]: Device reported an error during verify: Cannot run while suspended.- That failed verify leaves the sensor claimed, so the follow-up release
also fails, and the user's finger swipe is rejected:
quickshell[...]: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.I also caught one worse episode where the sensor's own firmware
overheat-protection tripped (Device disabled to prevent overheating) and
something kept retrying the verify once a second for about 14 minutes
straight with no backoff, until the machine suspended again. That looks like
a symptom of the same underlying "verify fires before the device/claim state
is actually ready" issue, not real heat.
Full excerpt (representative lines from 3 separate boots today) attached.
What was expected
Fingerprint unlock to work on the first attempt after resume, the same as
subsequent attempts later in the session.
Steps to reproduce
- Enroll a fingerprint (
fprintd-enroll) with the Quickshell lock screen
wired up (omarchy apply lock / omarchy setup security fingerprint).
2. Suspend the laptop (lid close or omarchy system lock + suspend).
3. Resume and, at the lock screen, place the enrolled finger on the sensor
immediately.
4. Observe the first scan is rejected; a second attempt a couple of seconds
later succeeds.
System details
- Omarchy version: 4.0.2-1
- Laptop: Lenovo ThinkBook 14 G9 IRL
- Fingerprint sensor: Goodix 27c6:550a (match-on-chip; requires the
proprietary TOD driver — not affected by driver choice, same behavior with
libfprint-tod + libfprint-2-tod1-goodix-v2 from AUR and official
fprintd)
- omarchy debug --no-sudo --print output attached separately
Notes
- SDDM is set to autologin for this user, so the session never actually
prompts for fingerprint at the SDDM greeter — the first fingerprint prompt
a user hits is Omarchy's own Quickshell lock screen right after session
start or after resume, which is where this reproduces.
- Journal excerpt and full debug log are attached to this issue.
View raw text
## What happened
The first fingerprint attempt after resuming from suspend (and the first
attempt right after a session starts) is reliably rejected. A second attempt
a couple of seconds later succeeds. This is consistent across multiple boots
today.
Journal evidence points to a race between `fprintd` and Omarchy's own
suspend/lock handling:
1. At suspend time, `fprintd` tries to install its own sleep-delay inhibitor
and fails because Omarchy's `omarchy-system-sleep-lock` inhibitor
("Lock screen before suspend") already holds that slot:
```
fprintd[...]: Failed to install a sleep delay inhibitor: GDBus.Error:org.freedesktop.login1.OperationInProgress: The operation inhibition has been requested for is already running
```
2. On resume, the first automatic verify from the Quickshell lock screen
(`omarchy-lock-fingerprint` PAM service) fires before fprintd's view of
the device has caught up, and fails:
```
fprintd[...]: Device reported an error during verify: Cannot run while suspended.
```
3. That failed verify leaves the sensor claimed, so the follow-up release
also fails, and the user's finger swipe is rejected:
```
quickshell[...]: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.
```
I also caught one worse episode where the sensor's own firmware
overheat-protection tripped (`Device disabled to prevent overheating`) and
something kept retrying the verify once a second for about 14 minutes
straight with no backoff, until the machine suspended again. That looks like
a symptom of the same underlying "verify fires before the device/claim state
is actually ready" issue, not real heat.
Full excerpt (representative lines from 3 separate boots today) attached.
## What was expected
Fingerprint unlock to work on the first attempt after resume, the same as
subsequent attempts later in the session.
## Steps to reproduce
1. Enroll a fingerprint (`fprintd-enroll`) with the Quickshell lock screen
wired up (`omarchy apply lock` / `omarchy setup security fingerprint`).
2. Suspend the laptop (lid close or `omarchy system lock` + suspend).
3. Resume and, at the lock screen, place the enrolled finger on the sensor
immediately.
4. Observe the first scan is rejected; a second attempt a couple of seconds
later succeeds.
## System details
- Omarchy version: 4.0.2-1
- Laptop: Lenovo ThinkBook 14 G9 IRL
- Fingerprint sensor: Goodix 27c6:550a (match-on-chip; requires the
proprietary TOD driver — not affected by driver choice, same behavior with
`libfprint-tod` + `libfprint-2-tod1-goodix-v2` from AUR and official
`fprintd`)
- `omarchy debug --no-sudo --print` output attached separately
## Notes
- SDDM is set to autologin for this user, so the session never actually
prompts for fingerprint at the SDDM greeter — the first fingerprint prompt
a user hits is Omarchy's own Quickshell lock screen right after session
start or after resume, which is where this reproduces.
- Journal excerpt and full debug log are attached to this issue.
Also reported as
This defect is tracked under R-830 (filed Sep 8, 2026). 3 other reports describe the same defect.
Earliest report of this defect: R-1610 (filed Aug 20, 2026).
- Sep 8, 2026R-830 · this report— tracked here
- ·Decided by agents · verified
Open upstream.
- ·Decided by agents · verified
Open upstream.
- ·Decided by agents · verified
Open upstream.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/9919· confirmed
- Related PRpr/11273· confirmed
- Related PRpr/12690· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Decided by agents · verified: in the audited area (lock)
- Decided by agents · verified: matches no known issue
The outcome (valid, duplicate, not a bug, …) is not decided yet.