Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-830GitHub issuePublicReceived

Fingerprint unlock rejected on first attempt after resume (Goodix, race with sleep-lock inhibitor)

Reported by ukkit · filed Sep 8, 2026 · open at source

In the audited area (lock) — decided by agents · verified. Not validated yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaIn the audited arealock· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. So far: in the audited area (lock) — decided by agents · verified; matches no known issue — decided by agents · verified. The outcome (valid, duplicate, not a bug, …) is not decided yet. See the decision.

Original report

Fingerprint unlock rejected on first attempt after resume (Goodix, race with sleep-lock inhibitor)revision 1 · captured 2026-09-28 21:23 UTC via poll

What happened

The first fingerprint attempt after resuming from suspend (and the first
attempt right after a session starts) is reliably rejected. A second attempt
a couple of seconds later succeeds. This is consistent across multiple boots
today.

Journal evidence points to a race between fprintd and Omarchy's own
suspend/lock handling:

  1. At suspend time, fprintd tries to install its own sleep-delay inhibitor

and fails because Omarchy's omarchy-system-sleep-lock inhibitor
("Lock screen before suspend") already holds that slot:

   fprintd[...]: Failed to install a sleep delay inhibitor: GDBus.Error:org.freedesktop.login1.OperationInProgress: The operation inhibition has been requested for is already running
  1. On resume, the first automatic verify from the Quickshell lock screen

(omarchy-lock-fingerprint PAM service) fires before fprintd's view of
the device has caught up, and fails:

   fprintd[...]: Device reported an error during verify: Cannot run while suspended.
  1. That failed verify leaves the sensor claimed, so the follow-up release

also fails, and the user's finger swipe is rejected:

   quickshell[...]: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.

I also caught one worse episode where the sensor's own firmware
overheat-protection tripped (Device disabled to prevent overheating) and
something kept retrying the verify once a second for about 14 minutes
straight with no backoff, until the machine suspended again. That looks like
a symptom of the same underlying "verify fires before the device/claim state
is actually ready" issue, not real heat.

Full excerpt (representative lines from 3 separate boots today) attached.

What was expected

Fingerprint unlock to work on the first attempt after resume, the same as
subsequent attempts later in the session.

Steps to reproduce

  1. Enroll a fingerprint (fprintd-enroll) with the Quickshell lock screen

wired up (omarchy apply lock / omarchy setup security fingerprint).
2. Suspend the laptop (lid close or omarchy system lock + suspend).
3. Resume and, at the lock screen, place the enrolled finger on the sensor
immediately.
4. Observe the first scan is rejected; a second attempt a couple of seconds
later succeeds.

System details

  • Omarchy version: 4.0.2-1
  • Laptop: Lenovo ThinkBook 14 G9 IRL
  • Fingerprint sensor: Goodix 27c6:550a (match-on-chip; requires the

proprietary TOD driver — not affected by driver choice, same behavior with
libfprint-tod + libfprint-2-tod1-goodix-v2 from AUR and official
fprintd)
- omarchy debug --no-sudo --print output attached separately

Notes

  • SDDM is set to autologin for this user, so the session never actually

prompts for fingerprint at the SDDM greeter — the first fingerprint prompt
a user hits is Omarchy's own Quickshell lock screen right after session
start or after resume, which is where this reproduces.
- Journal excerpt and full debug log are attached to this issue.

View raw text
## What happened

The first fingerprint attempt after resuming from suspend (and the first
attempt right after a session starts) is reliably rejected. A second attempt
a couple of seconds later succeeds. This is consistent across multiple boots
today.

Journal evidence points to a race between `fprintd` and Omarchy's own
suspend/lock handling:

1. At suspend time, `fprintd` tries to install its own sleep-delay inhibitor
   and fails because Omarchy's `omarchy-system-sleep-lock` inhibitor
   ("Lock screen before suspend") already holds that slot:
   ```
   fprintd[...]: Failed to install a sleep delay inhibitor: GDBus.Error:org.freedesktop.login1.OperationInProgress: The operation inhibition has been requested for is already running
   ```
2. On resume, the first automatic verify from the Quickshell lock screen
   (`omarchy-lock-fingerprint` PAM service) fires before fprintd's view of
   the device has caught up, and fails:
   ```
   fprintd[...]: Device reported an error during verify: Cannot run while suspended.
   ```
3. That failed verify leaves the sensor claimed, so the follow-up release
   also fails, and the user's finger swipe is rejected:
   ```
   quickshell[...]: pam_fprintd(omarchy-lock-fingerprint:auth): ReleaseDevice failed: Release failed with error: The device is still busy with another operation, please try again later.
   ```

I also caught one worse episode where the sensor's own firmware
overheat-protection tripped (`Device disabled to prevent overheating`) and
something kept retrying the verify once a second for about 14 minutes
straight with no backoff, until the machine suspended again. That looks like
a symptom of the same underlying "verify fires before the device/claim state
is actually ready" issue, not real heat.

Full excerpt (representative lines from 3 separate boots today) attached.

## What was expected

Fingerprint unlock to work on the first attempt after resume, the same as
subsequent attempts later in the session.

## Steps to reproduce

1. Enroll a fingerprint (`fprintd-enroll`) with the Quickshell lock screen
   wired up (`omarchy apply lock` / `omarchy setup security fingerprint`).
2. Suspend the laptop (lid close or `omarchy system lock` + suspend).
3. Resume and, at the lock screen, place the enrolled finger on the sensor
   immediately.
4. Observe the first scan is rejected; a second attempt a couple of seconds
   later succeeds.

## System details

- Omarchy version: 4.0.2-1
- Laptop: Lenovo ThinkBook 14 G9 IRL
- Fingerprint sensor: Goodix 27c6:550a (match-on-chip; requires the
  proprietary TOD driver — not affected by driver choice, same behavior with
  `libfprint-tod` + `libfprint-2-tod1-goodix-v2` from AUR and official
  `fprintd`)
- `omarchy debug --no-sudo --print` output attached separately

## Notes

- SDDM is set to autologin for this user, so the session never actually
  prompts for fingerprint at the SDDM greeter — the first fingerprint prompt
  a user hits is Omarchy's own Quickshell lock screen right after session
  start or after resume, which is where this reproduces.
- Journal excerpt and full debug log are attached to this issue.

Also reported as

This defect is tracked under R-830 (filed Sep 8, 2026). 3 other reports describe the same defect.

Earliest report of this defect: R-1610 (filed Aug 20, 2026).

  1. Sep 8, 2026R-830 · this report— tracked here
  2. ·Decided by agents · verified

    Open upstream.

  3. ·Decided by agents · verified

    Open upstream.

  4. ·Decided by agents · verified

    Open upstream.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

  • Related PRpr/9919· confirmed
  • Related PRpr/11273· confirmed
  • Related PRpr/12690· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Decided by agents · verified: in the audited area (lock)
  • Decided by agents · verified: matches no known issue

The outcome (valid, duplicate, not a bug, …) is not decided yet.