From 3a9ccdeec707ae17c0e2eb2b99783dacc6070323 Mon Sep 17 00:00:00 2001
From: Marcelo Alcantara <maralc@gmail.com>
Date: Fri, 25 Sep 2026 19:04:36 +1000
Subject: [PATCH 1/7] Cover BCM4388 in Wi-Fi resume recovery and gate it on the
 platform detector

BCM4388 (M2 Pro/Max) wedges on lid-close resume like BCM4378/BCM4387, so the
recovery now covers it. Setup and the recovery gate ask omarchy-hw-platform
directly, and setup fails when the detector does instead of reading that as
another platform. A changed retired backup now stops setup with a message
rather than a bare exit status.
---
 packages/omarchy-mac/README.md                |  6 +-
 .../omarchy-mac/bin/omarchy-mac-setup-system  |  9 ++-
 .../omarchy-mac/bin/omarchy-wifi-resume-fix   |  2 +-
 packages/omarchy-mac/lib/wifi-supported       |  4 +-
 packages/omarchy-mac/test/setup-test.sh       | 72 +++++++++++++++++--
 packages/omarchy-mac/test/systemd-test.sh     | 14 +++-
 packages/omarchy-mac/test/wifi-test.sh        | 34 ++++-----
 7 files changed, 110 insertions(+), 31 deletions(-)

diff --git a/packages/omarchy-mac/README.md b/packages/omarchy-mac/README.md
index a88f1899384..5c86da1f536 100644
--- a/packages/omarchy-mac/README.md
+++ b/packages/omarchy-mac/README.md
@@ -6,13 +6,13 @@ Apple Silicon defaults and support services for Omarchy. Version: `0.1.0` (candi
 
 This directory is self-contained. Copy it anywhere, run `./test/all`, then `./install /absolute/staging/root`. Staging requires Bash, coreutils and findutils; tests also use Python and systemd. Nothing is enabled or started by staging. The Arch recipe lives in `omarchy-mac/omarchy-pkgs-aarch64`, on `feature/omarchy-mac-package`, and pins a full collaboration-repository commit.
 
-Runtime dependencies: `omarchy` (shared Apple hardware detector), Bash, coreutils, diffutils (cmp), grep, sed, gawk, systemd, pciutils, kmod, NetworkManager, iwd, Python, PipeWire, pipewire-pulse, libpulse (pactl), and WirePlumber. The existing desktop audio leaf still installs the protected Asahi speaker stack. See `ORIGINS.md` for extraction attribution.
+Runtime dependencies: `omarchy` (the `omarchy-hw-platform` detector and its Apple predicate), Bash, coreutils, diffutils (cmp), grep, sed, gawk, systemd, pciutils, kmod, NetworkManager, iwd, Python, PipeWire, pipewire-pulse, libpulse (pactl), and WirePlumber. The existing desktop audio leaf still installs the protected Asahi speaker stack. See `ORIGINS.md` for extraction attribution.
 
 ## Setup contract
 
 Install the matching runtime, settings and add-on candidates in one pacman transaction. Their transferred commands and user unit must have only one owner. On Apple Silicon, include `install/omarchy-apple.packages` alongside the desktop base package list before calling `omarchy-apply-system`. The desktop checks the package is already present before its network hardware setup; offline setup never downloads it.
 
-Run `omarchy-mac-setup-system` as root on the target hardware (inside its target chroot for offline provisioning). An optional absolute root argument supports staging against the same target hardware without a bus. It retires only exact generated Wi-Fi, module and service files, retaining a `.omarchy-mac-retired` backup. It enables resume recovery only for BCM4378/BCM4387 on Apple Silicon; BCM4388 and Intel/T2 are excluded. No NetworkManager restart or driver reload occurs during setup. The backend applies when NetworkManager next starts; notch changes apply when appledrm next loads.
+Run `omarchy-mac-setup-system` as root on the target hardware (inside its target chroot for offline provisioning). An optional absolute root argument supports staging against the same target hardware without a bus. It exits without changes unless `omarchy-hw-platform` reports `apple-silicon`, and fails if the detector does. It retires only exact generated Wi-Fi, module and service files, retaining a `.omarchy-mac-retired` backup; the `/etc/NetworkManager/conf.d/wifi_backend.conf` that earlier Apple installs wrote is one of them, and any edited copy stays in place and keeps precedence. It enables resume recovery only for BCM4378, BCM4387 and BCM4388 on Apple Silicon; Intel/T2 Macs are excluded. No NetworkManager restart or driver reload occurs during setup. The backend applies when NetworkManager next starts; notch changes apply when appledrm next loads.
 
 Run `omarchy-mac-setup-user` as each target user with their HOME/XDG directories. It enables the vendor unit without a session bus. With a live bus it reloads the user manager, reports the effective unit and starts the mapper. Provisioning, first-run and the transition migration run setup; subsequent session starts only start the enabled unit, without reloading the user manager or repeating setup. The first desktop session does not depend on a bus existing during installation. Custom fragments, masks, activation links and headset policies are preserved; setup markers preserve explicit disables after initial setup. User gain state remains in `omarchy/asahi-mic-gain.json` under XDG_STATE_HOME. The desktop saves that state before restarting audio.
 
@@ -22,4 +22,4 @@ Vendor defaults use NetworkManager's `/usr/lib/NetworkManager/conf.d`, systemd's
 
 The mocked behavioral tests cover Wi-Fi health, disabled radio, journal cursor/backstop recovery, unload/load failures and chipset gates; microphone gain/mute, device choices, missing endpoints, rollback and daemon loss; setup covers fresh/upgrade/repeated/interrupted operations, two users, first-session activation, masks and overrides. The desktop retains migration and audio restart integration coverage.
 
-Before release promotion, record physical M1/M2 suspend/resume and microphone tests, effective configuration, package transaction, source/recipe revisions, and reboot evidence. Aurora needs separate evidence. A successful source test run or candidate build is not physical hardware qualification. Do not publish this candidate to the rolling feed automatically.
+Before release promotion, record physical M1/M2 suspend/resume (including lid close on a BCM4388 Mac) and microphone tests, effective configuration, package transaction, source/recipe revisions, and reboot evidence. Aurora needs separate evidence. A successful source test run or candidate build is not physical hardware qualification. Do not publish this candidate to the rolling feed automatically.
diff --git a/packages/omarchy-mac/bin/omarchy-mac-setup-system b/packages/omarchy-mac/bin/omarchy-mac-setup-system
index a3989814505..41074d56acb 100755
--- a/packages/omarchy-mac/bin/omarchy-mac-setup-system
+++ b/packages/omarchy-mac/bin/omarchy-mac-setup-system
@@ -6,7 +6,9 @@ set -euo pipefail
 root=${1:-/}
 root=${root%/}
 [[ -z $root || $root == /* ]] || exit 2
-omarchy-hw-apple-silicon || exit 0
+# A detector failure stops setup rather than reading as another platform.
+platform=$(omarchy-hw-platform)
+[[ $platform == "apple-silicon" ]] || exit 0
 share="$root/usr/share/omarchy-mac"
 
 # Retire only byte-identical generated files, never links (including masks).
@@ -14,7 +16,10 @@ retire() {
   local file=$1 original=$2
   if [[ -f $file && ! -L $file ]] && cmp -s "$file" "$original"; then
     if [[ -e $file.omarchy-mac-retired || -L $file.omarchy-mac-retired ]]; then
-      cmp -s "$file" "$file.omarchy-mac-retired" || return 1
+      if ! cmp -s "$file" "$file.omarchy-mac-retired"; then
+        echo "Error: $file.omarchy-mac-retired differs from $file; move it aside and rerun." >&2
+        return 1
+      fi
       rm -- "$file"
     else
       mv -- "$file" "$file.omarchy-mac-retired"
diff --git a/packages/omarchy-mac/bin/omarchy-wifi-resume-fix b/packages/omarchy-mac/bin/omarchy-wifi-resume-fix
index e965359a2be..868dc24b45f 100755
--- a/packages/omarchy-mac/bin/omarchy-wifi-resume-fix
+++ b/packages/omarchy-mac/bin/omarchy-wifi-resume-fix
@@ -5,7 +5,7 @@
 # omarchy:hidden=true
 # omarchy:requires-sudo=true
 
-# The Broadcom firmware on Apple Silicon Macs (BCM4378/BCM4387) can wedge
+# The Broadcom firmware on Apple Silicon Macs (BCM4378/BCM4387/BCM4388) can wedge
 # across s2idle: scans fail with -52 and every association is rejected with
 # status_code=16, which NetworkManager surfaces as a wrong password. Toggling
 # the radio does not reset the chip firmware - only a driver reload does.
diff --git a/packages/omarchy-mac/lib/wifi-supported b/packages/omarchy-mac/lib/wifi-supported
index 5bb6a2bcac9..ac21e233cd1 100755
--- a/packages/omarchy-mac/lib/wifi-supported
+++ b/packages/omarchy-mac/lib/wifi-supported
@@ -1,4 +1,4 @@
 #!/bin/bash
-# BCM4388 (4434) is intentionally excluded; T2 Macs share the other PCI IDs.
+# BCM4378, BCM4387 and BCM4388. T2 Macs share some of these IDs, so the platform decides first.
 set -o pipefail
-omarchy-hw-apple-silicon && lspci -nn | grep -E '14e4:(4425|4433)' >/dev/null
+[[ $(omarchy-hw-platform) == "apple-silicon" ]] && lspci -nn | grep -E '14e4:(4425|4433|4434)' >/dev/null
diff --git a/packages/omarchy-mac/test/setup-test.sh b/packages/omarchy-mac/test/setup-test.sh
index 0c3727a0adb..69af5e378a8 100644
--- a/packages/omarchy-mac/test/setup-test.sh
+++ b/packages/omarchy-mac/test/setup-test.sh
@@ -4,9 +4,14 @@ source "$(dirname "$0")/base-test.sh"
 work=$(mktemp -d)
 trap 'rm -rf "$work"' EXIT
 mkdir -p "$work/bin"
+cat >"$work/bin/omarchy-hw-platform" <<'STUB'
+#!/bin/bash
+[[ -z ${PLATFORM_ERROR:-} ]] || { echo "Error: $PLATFORM_ERROR" >&2; exit 1; }
+echo "${PLATFORM:-apple-silicon}"
+STUB
 cat >"$work/bin/omarchy-hw-apple-silicon" <<'STUB'
 #!/bin/bash
-[[ ${APPLE:-1} == 1 ]]
+[[ $(omarchy-hw-platform) == "apple-silicon" ]]
 STUB
 cat >"$work/bin/lspci" <<'STUB'
 #!/bin/bash
@@ -44,15 +49,42 @@ ln -s /dev/null "$unit"
 "$setup" "$stage"
 [[ $(readlink "$unit") == /dev/null && ! -s $CALLS ]] || fail 'mask survives setup'
 rm "$unit"
-for spec in '0 4433' '1 4434' '1 0000'; do
-  read -r apple wifi <<<"$spec"
-  APPLE=$apple WIFI_ID=$wifi "$setup" "$stage"
+for spec in 'generic 4433' 'qualcomm 4434' 'apple-silicon 0000'; do
+  read -r platform wifi <<<"$spec"
+  PLATFORM=$platform WIFI_ID=$wifi "$setup" "$stage"
   [[ ! -s $CALLS ]] || fail 'non-Apple and excluded hardware are untouched'
 done
 rm "$stage/var/lib/omarchy-mac/wifi-configured"
 if SYSTEMCTL_STATUS=42 "$setup" "$stage"; then fail 'enable failure must be retryable'; fi
 "$setup" "$stage"
 pass 'fresh, upgrade, repeated, interrupted, overrides, masks and hardware gates'
+# Each fresh root: recovery is enabled for BCM4378, BCM4387 and BCM4388 on Apple Silicon only.
+for spec in 'apple-silicon 4425 1' 'apple-silicon 4433 1' 'apple-silicon 4434 1' 'apple-silicon 4488 0' \
+  'generic 4433 0' 'generic-aarch64 4434 0' 'qualcomm 4434 0'; do
+  read -r platform wifi enabled <<<"$spec"
+  fresh="$work/fresh-$platform-$wifi"
+  "$ROOT/install" "$fresh"
+  : >"$CALLS"
+  PLATFORM=$platform WIFI_ID=$wifi "$fresh/usr/bin/omarchy-mac-setup-system" "$fresh"
+  if (( enabled )); then
+    grep -q 'enable omarchy-wifi-resume-fix.service' "$CALLS" || fail "recovery enabled on $platform $wifi"
+    [[ -f $fresh/var/lib/omarchy-mac/wifi-configured ]] || fail "recovery setup recorded on $platform $wifi"
+  else
+    [[ ! -s $CALLS && ! -e $fresh/var/lib/omarchy-mac ]] || fail "recovery left off on $platform $wifi"
+  fi
+done
+# A detector that cannot decide stops setup before it changes anything.
+fresh="$work/fresh-contradiction"
+"$ROOT/install" "$fresh"
+mkdir -p "$fresh/etc/NetworkManager/conf.d"
+cp "$ROOT/legacy/wifi_backend.conf" "$fresh/etc/NetworkManager/conf.d/"
+: >"$CALLS"
+if PLATFORM_ERROR='contradictory platform identity' "$fresh/usr/bin/omarchy-mac-setup-system" "$fresh" 2>"$work/err"; then
+  fail 'a detector failure fails setup'
+fi
+grep -q 'contradictory platform identity' "$work/err" || fail 'setup reports the detector failure'
+[[ -f $fresh/etc/NetworkManager/conf.d/wifi_backend.conf && ! -s $CALLS ]] || fail 'a detector failure changes nothing'
+pass 'BCM4378, BCM4387 and BCM4388 on Apple Silicon only, and a detector failure stops setup'
 for relative in etc/modprobe.d/asahi-notch.conf etc/NetworkManager/conf.d/wifi_backend.conf; do
   file="$stage/$relative"
   mkdir -p "${file%/*}"
@@ -63,6 +95,38 @@ for relative in etc/modprobe.d/asahi-notch.conf etc/NetworkManager/conf.d/wifi_b
   "$setup" "$stage"
   [[ $(cat "$file") == 'administrator override' ]] || fail 'modified config survives'
 done
+# Earlier Apple installs wrote the backend file with a heredoc or printf; both give these bytes.
+backend="$stage/etc/NetworkManager/conf.d/wifi_backend.conf"
+rm -f "$backend" "$backend.omarchy-mac-retired"
+printf '%s\n' '[device]' 'wifi.backend=iwd' >"$backend"
+"$setup" "$stage"
+[[ ! -e $backend ]] && cmp -s "$backend.omarchy-mac-retired" "$ROOT/legacy/wifi_backend.conf" ||
+  fail 'the generated backend file retires with a backup'
+cmp -s "$stage/usr/lib/NetworkManager/conf.d/20-omarchy-mac-wifi.conf" "$ROOT/legacy/wifi_backend.conf" ||
+  fail 'the vendor default keeps the retired setting'
+# Any edit, even one that keeps iwd, is the administrator's file now.
+for variant in '[device]\nwifi.backend=wpa_supplicant\n' '[device]\nwifi.backend=iwd\nwifi.scan-rand-mac-address=no\n' \
+  '# keep iwd\n[device]\nwifi.backend=iwd\n' '[device]\nwifi.backend=iwd'; do
+  rm -f "$backend"
+  printf '%b' "$variant" >"$backend"
+  cp "$backend" "$work/expected"
+  "$setup" "$stage"
+  cmp -s "$backend" "$work/expected" || fail 'an edited backend file survives setup' "$variant"
+done
+rm "$backend"
+ln -s "$stage/usr/share/omarchy-mac/legacy/wifi_backend.conf" "$backend"
+"$setup" "$stage"
+[[ -L $backend ]] || fail 'a linked backend file survives setup'
+rm "$backend"
+# A backup the administrator changed is never overwritten; setup stops and says why.
+printf 'administrator backup\n' >"$backend.omarchy-mac-retired"
+cp "$ROOT/legacy/wifi_backend.conf" "$backend"
+if "$setup" "$stage" 2>"$work/err"; then fail 'a changed backup blocks retirement'; fi
+grep -q 'wifi_backend.conf.omarchy-mac-retired' "$work/err" || fail 'a blocked retirement names the backup'
+[[ $(cat "$backend.omarchy-mac-retired") == 'administrator backup' ]] && cmp -s "$backend" "$ROOT/legacy/wifi_backend.conf" ||
+  fail 'a blocked retirement keeps both files'
+rm "$backend" "$backend.omarchy-mac-retired"
+pass 'the legacy backend file retires only unmodified and never loses an administrator edit'
 user_setup="$stage/usr/bin/omarchy-mac-setup-user"
 export XDG_RUNTIME_DIR="$work/no-session"
 unset XDG_CONFIG_HOME XDG_STATE_HOME
diff --git a/packages/omarchy-mac/test/systemd-test.sh b/packages/omarchy-mac/test/systemd-test.sh
index c02a4943b04..6ac4edd9156 100644
--- a/packages/omarchy-mac/test/systemd-test.sh
+++ b/packages/omarchy-mac/test/systemd-test.sh
@@ -7,8 +7,8 @@ trap 'rm -rf "$work"' EXIT
 mkdir -p "$work/root/etc/systemd/system" "$work/bin"
 cp "$ROOT"/legacy/omarchy-wifi-resume-fix.service "$work/root/etc/systemd/system/"
 systemctl --root="$work/root" enable omarchy-wifi-resume-fix.service
-printf '#!/bin/bash\nexit 0\n' >"$work/bin/omarchy-hw-apple-silicon"
-printf '#!/bin/bash\necho "14e4:4433"\n' >"$work/bin/lspci"
+printf '#!/bin/bash\necho apple-silicon\n' >"$work/bin/omarchy-hw-platform"
+printf '#!/bin/bash\necho "14e4:${WIFI_ID:-4433}"\n' >"$work/bin/lspci"
 chmod +x "$work/bin/"*
 PATH="$work/bin:$PATH" "$work/root/usr/bin/omarchy-mac-setup-system" "$work/root"
 for target in suspend hibernate hybrid-sleep suspend-then-hibernate; do
@@ -16,3 +16,13 @@ for target in suspend hibernate hybrid-sleep suspend-then-hibernate; do
   [[ $(readlink "$link") == /usr/lib/systemd/system/omarchy-wifi-resume-fix.service ]] || fail 'legacy enablement points to vendor unit'
 done
 pass 'real systemctl upgrade repairs generated enablement links' 
+
+# A fresh BCM4388 Mac gets the vendor unit enabled for every sleep target.
+"$ROOT"/install "$work/fresh"
+WIFI_ID=4434 PATH="$work/bin:$PATH" "$work/fresh/usr/bin/omarchy-mac-setup-system" "$work/fresh"
+for target in suspend hibernate hybrid-sleep suspend-then-hibernate; do
+  link="$work/fresh/etc/systemd/system/$target.target.wants/omarchy-wifi-resume-fix.service"
+  [[ $(readlink "$link") == /usr/lib/systemd/system/omarchy-wifi-resume-fix.service ]] || fail 'BCM4388 enables the vendor unit'
+done
+[[ ! -e $work/fresh/etc/systemd/system/omarchy-wifi-resume-fix.service ]] || fail 'fresh setup writes no /etc unit'
+pass 'real systemctl enables recovery on a fresh BCM4388 Mac'
diff --git a/packages/omarchy-mac/test/wifi-test.sh b/packages/omarchy-mac/test/wifi-test.sh
index b8bbb303fbc..15185f04fae 100755
--- a/packages/omarchy-mac/test/wifi-test.sh
+++ b/packages/omarchy-mac/test/wifi-test.sh
@@ -30,19 +30,11 @@ done
 SH
 
 # The recovery is for Apple Silicon, so every case has to say which
-# architecture it runs on rather than inherit the machine running the suite.
-cat >"$stub_bin/omarchy-hw-apple-silicon" <<'SH'
+# platform it runs on rather than inherit the machine running the suite.
+cat >"$stub_bin/omarchy-hw-platform" <<'SH'
 #!/bin/bash
-[[ ${ARCH:-x86_64} == aarch64 ]]
-SH
-cat >"$stub_bin/uname" <<'SH'
-#!/bin/bash
-
-if [[ ${1:-} == "-m" ]]; then
-  echo "${ARCH:-x86_64}"
-else
-  exec /usr/bin/uname "$@"
-fi
+[[ ${PLATFORM:-generic} != error ]] || { echo "Error: contradictory platform identity" >&2; exit 1; }
+echo "${PLATFORM:-generic}"
 SH
 
 cat >"$stub_bin/systemctl" <<'SH'
@@ -164,7 +156,7 @@ chmod +x "$stub_bin"/*
 sed "s|/usr/lib/omarchy-mac/wifi-supported|$ROOT/lib/wifi-supported|" "$fix" >"$test_tmp/fix"
 chmod +x "$test_tmp/fix"
 fix="$test_tmp/fix"
-export ARCH=aarch64 WIFI_ID=4433
+export PLATFORM=apple-silicon WIFI_ID=4433
 
 # The recovery command itself: wedge detection and the decision to reload.
 run_fix() {
@@ -271,9 +263,17 @@ pass "a reload that never reconnects fails loudly"
 
 out=$(LOAD_FAILS=1 run_fix) && fail "failed driver reload must fail" "$out"
 grep -q 'failed to reload' <<<"$out" || fail "failed reload is diagnosed" "$out"
-for spec in 'aarch64 4434' 'x86_64 4433' 'aarch64 0000'; do
-  read -r ARCH WIFI_ID <<<"$spec"
-  run_fix >/dev/null
-  [[ ! -s $calls ]] || fail "unsupported hardware must not reload"
+for spec in 'generic 4433' 'generic-aarch64 4434' 'qualcomm 4425' 'error 4434' 'apple-silicon 4488' 'apple-silicon 0000'; do
+  read -r PLATFORM WIFI_ID <<<"$spec"
+  REJECT_LINES=2 run_fix >/dev/null 2>&1
+  [[ ! -s $calls ]] || fail "unsupported hardware must not reload" "$spec"
 done
 pass "failed reload and excluded chipsets are safe"
+
+# BCM4378, BCM4387 and BCM4388 all wedge across s2idle, so each one recovers.
+for WIFI_ID in 4425 4433 4434; do
+  PLATFORM=apple-silicon
+  out=$(REJECT_LINES=2 run_fix) || fail "a wedged $WIFI_ID recovers" "$out"
+  grep -Fxq $'modprobe\tbrcmfmac' "$calls" || fail "a wedged $WIFI_ID reloads the driver" "$(cat "$calls")"
+done
+pass "BCM4378, BCM4387 and BCM4388 recover on Apple Silicon"

From 02adbb6d0e9ca2a87f7561c35b93d63178f28e90 Mon Sep 17 00:00:00 2001
From: Marcelo Alcantara <maralc@gmail.com>
Date: Fri, 25 Sep 2026 19:06:13 +1000
Subject: [PATCH 2/7] Enable Wi-Fi resume recovery on existing BCM4388 Macs

Setup skipped BCM4388 until now and marks nothing when it does, so existing
M2 Pro/Max installs need setup to run again. The migration runs system setup
only on Apple Silicon Macs with that chip, and stays pending while the
installed add-on still predates it.
---
 migrations/1790327076.sh                      |  12 ++
 .../apple-wifi-bcm4388-migration-test.sh      | 112 ++++++++++++++++++
 2 files changed, 124 insertions(+)
 create mode 100644 migrations/1790327076.sh
 create mode 100755 test/shell.d/apple-wifi-bcm4388-migration-test.sh

diff --git a/migrations/1790327076.sh b/migrations/1790327076.sh
new file mode 100644
index 00000000000..8b315cff78e
--- /dev/null
+++ b/migrations/1790327076.sh
@@ -0,0 +1,12 @@
+echo "Enable Wi-Fi resume recovery on Apple Silicon Macs with BCM4388"
+
+omarchy-hw-apple-silicon || exit 0
+# grep without -q reads all of lspci's output; see migrations/1789140994.sh.
+lspci -nn | grep -E '14e4:4434' >/dev/null || exit 0
+
+omarchy-setup-mac --system
+# Setup skips the chip when the installed add-on predates it; stay pending until it doesn't.
+if ! /usr/lib/omarchy-mac/wifi-supported; then
+  echo "Error: the installed omarchy-mac does not cover BCM4388 yet; update again to finish." >&2
+  exit 1
+fi
diff --git a/test/shell.d/apple-wifi-bcm4388-migration-test.sh b/test/shell.d/apple-wifi-bcm4388-migration-test.sh
new file mode 100755
index 00000000000..44bf42ba32e
--- /dev/null
+++ b/test/shell.d/apple-wifi-bcm4388-migration-test.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+test_tmp=$(mktemp -d)
+trap 'rm -rf "$test_tmp"' EXIT
+
+stub_bin="$test_tmp/bin"
+calls="$test_tmp/calls.log"
+installed="$test_tmp/installed"
+mkdir -p "$stub_bin" "$test_tmp/omarchy/migrations"
+
+cat >"$stub_bin/omarchy-hw-apple-silicon" <<'SH'
+#!/bin/bash
+[[ ${APPLE:-1} == 1 ]]
+SH
+
+cat >"$stub_bin/lspci" <<'SH'
+#!/bin/bash
+echo "01:00.0 Network controller [0280]: Broadcom Inc. Wireless [14e4:${WIFI_ID:-4434}]"
+for _ in {1..4096}; do
+  echo '02:00.0 Host bridge [0600]: Filler Device [ffff:0000]'
+done
+SH
+
+cat >"$stub_bin/sudo" <<'SH'
+#!/bin/bash
+echo "sudo $*" >>"$CALLS"
+"$@"
+SH
+
+cat >"$stub_bin/pacman" <<'SH'
+#!/bin/bash
+echo "pacman $*" >>"$CALLS"
+if [[ $1 == "-Q" ]]; then
+  [[ -e $INSTALLED ]]
+else
+  touch "$INSTALLED"
+fi
+SH
+
+cat >"$stub_bin/omarchy-mac-setup-system" <<'SH'
+#!/bin/bash
+echo "omarchy-mac-setup-system" >>"$CALLS"
+exit "${SETUP_STATUS:-0}"
+SH
+
+cat >"$stub_bin/omarchy-mac-setup-user" <<'SH'
+#!/bin/bash
+echo "omarchy-mac-setup-user" >>"$CALLS"
+SH
+
+# The installed add-on's chipset gate: an add-on older than this change answers no.
+cat >"$stub_bin/wifi-supported" <<'SH'
+#!/bin/bash
+[[ ${ADDON_COVERS_4434:-1} == 1 ]]
+SH
+
+chmod +x "$stub_bin"/*
+ln -s "$ROOT/bin/omarchy-setup-mac" "$stub_bin/omarchy-setup-mac"
+
+source_migration="$ROOT/migrations/1790327076.sh"
+[[ $(stat -c %a "$source_migration") == 644 ]] || fail "the migration is sourced, not executed" "$(stat -c %a "$source_migration")"
+[[ $(head -n 1 "$source_migration") == echo* ]] || fail "the migration starts with an echo"
+migration="$test_tmp/omarchy/migrations/1790327076.sh"
+sed "s|/usr/lib/omarchy-mac/wifi-supported|$stub_bin/wifi-supported|" "$source_migration" >"$migration"
+grep -Fq "$stub_bin/wifi-supported" "$migration" || fail "the test reaches the add-on's chipset gate"
+
+export CALLS="$calls" INSTALLED="$installed" PATH="$stub_bin:$PATH"
+
+run_migration() {
+  : >"$calls"
+  bash -euo pipefail "$migration"
+}
+
+touch "$installed"
+APPLE=0 run_migration >/dev/null
+WIFI_ID=4433 run_migration >/dev/null
+WIFI_ID=4425 run_migration >/dev/null
+[[ ! -s $calls ]] || fail "other Macs and other hardware never reach sudo" "$(cat "$calls")"
+pass "only Apple Silicon Macs with BCM4388 run setup"
+
+run_migration >/dev/null
+grep -Fxq 'sudo omarchy-mac-setup-system' "$calls" || fail "a BCM4388 Mac runs system setup" "$(cat "$calls")"
+! grep -Fq 'omarchy-mac-setup-user' "$calls" || fail "the migration leaves user setup alone" "$(cat "$calls")"
+! grep -Fq 'pacman -S' "$calls" || fail "an installed add-on is not reinstalled" "$(cat "$calls")"
+pass "a BCM4388 Mac with the add-on runs system setup only"
+
+rm "$installed"
+run_migration >/dev/null
+grep -Fq 'pacman -S --needed --noconfirm omarchy-mac' "$calls" || fail "a missing add-on comes from the sync repository" "$(cat "$calls")"
+grep -Fxq 'sudo omarchy-mac-setup-system' "$calls" || fail "setup follows the install" "$(cat "$calls")"
+pass "a BCM4388 Mac without the add-on installs it before setup"
+
+status=0
+SETUP_STATUS=43 run_migration >/dev/null 2>&1 || status=$?
+(( status == 43 )) || fail "a setup failure fails the migration" "$status"
+pass "a setup failure fails the migration"
+
+# Through the runner: an add-on that predates BCM4388 keeps the migration pending until it is updated.
+export OMARCHY_PATH="$test_tmp/omarchy" OMARCHY_MIGRATION_STATE="$test_tmp/state"
+marker="$OMARCHY_MIGRATION_STATE/1790327076.sh"
+status=0
+ADDON_COVERS_4434=0 "$ROOT/bin/omarchy-migrate" >"$test_tmp/out" 2>&1 || status=$?
+(( status != 0 )) && [[ ! -e $marker ]] || fail "an old add-on leaves the migration pending" "$(cat "$test_tmp/out")"
+grep -q 'does not cover BCM4388' "$test_tmp/out" || fail "the pending migration says why" "$(cat "$test_tmp/out")"
+[[ $("$ROOT/bin/omarchy-migrate" --pending) == 1790327076.sh ]] || fail "the runner lists the migration as pending"
+"$ROOT/bin/omarchy-migrate" >"$test_tmp/out" 2>&1 || fail "the updated add-on completes the migration" "$(cat "$test_tmp/out")"
+[[ -e $marker ]] || fail "the completed migration is marked"
+pass "an add-on that predates BCM4388 keeps the migration pending until it is updated"

From dc219c4b002de3cb8e89cde2a0b2c2efd8c5b1c0 Mon Sep 17 00:00:00 2001
From: Marcelo Alcantara <maralc@gmail.com>
Date: Fri, 25 Sep 2026 19:13:43 +1000
Subject: [PATCH 3/7] Keep the BCM4388 migration pending when detection fails

A detector or lspci failure read as other hardware, so the runner marked the
migration done without enabling recovery. Each platform and chip case is now
checked on its own.
---
 migrations/1790327076.sh                      |  8 +++--
 packages/omarchy-mac/test/wifi-test.sh        |  2 +-
 .../apple-wifi-bcm4388-migration-test.sh      | 34 ++++++++++++++-----
 3 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/migrations/1790327076.sh b/migrations/1790327076.sh
index 8b315cff78e..d38ce2ac92d 100644
--- a/migrations/1790327076.sh
+++ b/migrations/1790327076.sh
@@ -1,8 +1,10 @@
 echo "Enable Wi-Fi resume recovery on Apple Silicon Macs with BCM4388"
 
-omarchy-hw-apple-silicon || exit 0
-# grep without -q reads all of lspci's output; see migrations/1789140994.sh.
-lspci -nn | grep -E '14e4:4434' >/dev/null || exit 0
+# A failed detector or lspci keeps the migration pending instead of skipping it.
+platform=$(omarchy-hw-platform)
+[[ $platform == "apple-silicon" ]] || exit 0
+devices=$(lspci -nn)
+grep -E '14e4:4434' <<<"$devices" >/dev/null || exit 0
 
 omarchy-setup-mac --system
 # Setup skips the chip when the installed add-on predates it; stay pending until it doesn't.
diff --git a/packages/omarchy-mac/test/wifi-test.sh b/packages/omarchy-mac/test/wifi-test.sh
index 15185f04fae..d6d81634c81 100755
--- a/packages/omarchy-mac/test/wifi-test.sh
+++ b/packages/omarchy-mac/test/wifi-test.sh
@@ -33,7 +33,7 @@ SH
 # platform it runs on rather than inherit the machine running the suite.
 cat >"$stub_bin/omarchy-hw-platform" <<'SH'
 #!/bin/bash
-[[ ${PLATFORM:-generic} != error ]] || { echo "Error: contradictory platform identity" >&2; exit 1; }
+[[ ${PLATFORM:-generic} != "error" ]] || { echo "Error: contradictory platform identity" >&2; exit 1; }
 echo "${PLATFORM:-generic}"
 SH
 
diff --git a/test/shell.d/apple-wifi-bcm4388-migration-test.sh b/test/shell.d/apple-wifi-bcm4388-migration-test.sh
index 44bf42ba32e..ef6f004510d 100755
--- a/test/shell.d/apple-wifi-bcm4388-migration-test.sh
+++ b/test/shell.d/apple-wifi-bcm4388-migration-test.sh
@@ -12,13 +12,20 @@ calls="$test_tmp/calls.log"
 installed="$test_tmp/installed"
 mkdir -p "$stub_bin" "$test_tmp/omarchy/migrations"
 
+cat >"$stub_bin/omarchy-hw-platform" <<'SH'
+#!/bin/bash
+[[ ${PLATFORM:-apple-silicon} != "error" ]] || { echo "Error: contradictory platform identity" >&2; exit 1; }
+echo "${PLATFORM:-apple-silicon}"
+SH
+
 cat >"$stub_bin/omarchy-hw-apple-silicon" <<'SH'
 #!/bin/bash
-[[ ${APPLE:-1} == 1 ]]
+[[ $(omarchy-hw-platform) == "apple-silicon" ]]
 SH
 
 cat >"$stub_bin/lspci" <<'SH'
 #!/bin/bash
+(( ${LSPCI_STATUS:-0} == 0 )) || exit "$LSPCI_STATUS"
 echo "01:00.0 Network controller [0280]: Broadcom Inc. Wireless [14e4:${WIFI_ID:-4434}]"
 for _ in {1..4096}; do
   echo '02:00.0 Host bridge [0600]: Filler Device [ffff:0000]'
@@ -55,15 +62,15 @@ SH
 # The installed add-on's chipset gate: an add-on older than this change answers no.
 cat >"$stub_bin/wifi-supported" <<'SH'
 #!/bin/bash
-[[ ${ADDON_COVERS_4434:-1} == 1 ]]
+[[ ${ADDON_COVERS_4434:-1} == "1" ]]
 SH
 
 chmod +x "$stub_bin"/*
 ln -s "$ROOT/bin/omarchy-setup-mac" "$stub_bin/omarchy-setup-mac"
 
 source_migration="$ROOT/migrations/1790327076.sh"
-[[ $(stat -c %a "$source_migration") == 644 ]] || fail "the migration is sourced, not executed" "$(stat -c %a "$source_migration")"
-[[ $(head -n 1 "$source_migration") == echo* ]] || fail "the migration starts with an echo"
+[[ $(stat -c %a "$source_migration") == "644" ]] || fail "the migration is sourced, not executed" "$(stat -c %a "$source_migration")"
+[[ $(head -n 1 "$source_migration") == "echo "* ]] || fail "the migration starts with an echo"
 migration="$test_tmp/omarchy/migrations/1790327076.sh"
 sed "s|/usr/lib/omarchy-mac/wifi-supported|$stub_bin/wifi-supported|" "$source_migration" >"$migration"
 grep -Fq "$stub_bin/wifi-supported" "$migration" || fail "the test reaches the add-on's chipset gate"
@@ -76,12 +83,21 @@ run_migration() {
 }
 
 touch "$installed"
-APPLE=0 run_migration >/dev/null
-WIFI_ID=4433 run_migration >/dev/null
-WIFI_ID=4425 run_migration >/dev/null
-[[ ! -s $calls ]] || fail "other Macs and other hardware never reach sudo" "$(cat "$calls")"
+for spec in 'generic 4434' 'generic-aarch64 4434' 'qualcomm 4434' 'apple-silicon 4433' 'apple-silicon 4425' 'apple-silicon 0000'; do
+  read -r platform wifi <<<"$spec"
+  PLATFORM=$platform WIFI_ID=$wifi run_migration >/dev/null
+  [[ ! -s $calls ]] || fail "other platforms and chips never reach sudo" "$spec: $(cat "$calls")"
+done
 pass "only Apple Silicon Macs with BCM4388 run setup"
 
+for spec in 'PLATFORM=error' 'LSPCI_STATUS=5'; do
+  status=0
+  env "$spec" bash -euo pipefail "$migration" >/dev/null 2>&1 || status=$?
+  (( status != 0 )) || fail "a detection failure keeps the migration pending" "$spec"
+done
+[[ ! -s $calls ]] || fail "a detection failure changes nothing" "$(cat "$calls")"
+pass "a detector or lspci failure keeps the migration pending"
+
 run_migration >/dev/null
 grep -Fxq 'sudo omarchy-mac-setup-system' "$calls" || fail "a BCM4388 Mac runs system setup" "$(cat "$calls")"
 ! grep -Fq 'omarchy-mac-setup-user' "$calls" || fail "the migration leaves user setup alone" "$(cat "$calls")"
@@ -106,7 +122,7 @@ status=0
 ADDON_COVERS_4434=0 "$ROOT/bin/omarchy-migrate" >"$test_tmp/out" 2>&1 || status=$?
 (( status != 0 )) && [[ ! -e $marker ]] || fail "an old add-on leaves the migration pending" "$(cat "$test_tmp/out")"
 grep -q 'does not cover BCM4388' "$test_tmp/out" || fail "the pending migration says why" "$(cat "$test_tmp/out")"
-[[ $("$ROOT/bin/omarchy-migrate" --pending) == 1790327076.sh ]] || fail "the runner lists the migration as pending"
+[[ $("$ROOT/bin/omarchy-migrate" --pending) == "1790327076.sh" ]] || fail "the runner lists the migration as pending"
 "$ROOT/bin/omarchy-migrate" >"$test_tmp/out" 2>&1 || fail "the updated add-on completes the migration" "$(cat "$test_tmp/out")"
 [[ -e $marker ]] || fail "the completed migration is marked"
 pass "an add-on that predates BCM4388 keeps the migration pending until it is updated"

From ae8a33f53b7dc26b928a3b091d57947becc9015a Mon Sep 17 00:00:00 2001
From: Marcelo Alcantara <maralc@gmail.com>
Date: Fri, 25 Sep 2026 19:18:51 +1000
Subject: [PATCH 4/7] Quote the vendor unit path in the fresh BCM4388
 enablement check

---
 packages/omarchy-mac/test/systemd-test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/omarchy-mac/test/systemd-test.sh b/packages/omarchy-mac/test/systemd-test.sh
index 6ac4edd9156..1d861f4e254 100644
--- a/packages/omarchy-mac/test/systemd-test.sh
+++ b/packages/omarchy-mac/test/systemd-test.sh
@@ -22,7 +22,7 @@ pass 'real systemctl upgrade repairs generated enablement links'
 WIFI_ID=4434 PATH="$work/bin:$PATH" "$work/fresh/usr/bin/omarchy-mac-setup-system" "$work/fresh"
 for target in suspend hibernate hybrid-sleep suspend-then-hibernate; do
   link="$work/fresh/etc/systemd/system/$target.target.wants/omarchy-wifi-resume-fix.service"
-  [[ $(readlink "$link") == /usr/lib/systemd/system/omarchy-wifi-resume-fix.service ]] || fail 'BCM4388 enables the vendor unit'
+  [[ $(readlink "$link") == "/usr/lib/systemd/system/omarchy-wifi-resume-fix.service" ]] || fail 'BCM4388 enables the vendor unit'
 done
 [[ ! -e $work/fresh/etc/systemd/system/omarchy-wifi-resume-fix.service ]] || fail 'fresh setup writes no /etc unit'
 pass 'real systemctl enables recovery on a fresh BCM4388 Mac'

From e5fcf4c7eab09c73e65147a7fa779d2bb1212ffd Mon Sep 17 00:00:00 2001
From: Marcelo Alcantara <maralc@gmail.com>
Date: Fri, 25 Sep 2026 19:20:23 +1000
Subject: [PATCH 5/7] Add a before-and-after hardware check for Wi-Fi resume

Run on the Mac around a lid-close suspend: it checks the iwd backend, the
retired legacy file and recovery enablement, then that recovery ran for the
resume and Wi-Fi came back.
---
 test/manual/wifi-resume-check.sh | 86 ++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)
 create mode 100755 test/manual/wifi-resume-check.sh

diff --git a/test/manual/wifi-resume-check.sh b/test/manual/wifi-resume-check.sh
new file mode 100755
index 00000000000..6a5337bc491
--- /dev/null
+++ b/test/manual/wifi-resume-check.sh
@@ -0,0 +1,86 @@
+#!/bin/bash
+
+# Hardware check for Wi-Fi resume on an Apple Silicon Mac. Not part of
+# ./test/shell: it needs the real chip, a known network and a suspend. Run it as
+# the desktop user from a local session, since suspend drops SSH.
+#
+#   bash test/manual/wifi-resume-check.sh before
+#   close the lid for at least five minutes (or run systemctl suspend), then wake
+#   bash test/manual/wifi-resume-check.sh after
+#
+# before checks the backend and recovery setup and records a journal cursor;
+# after checks that recovery ran for this resume and that Wi-Fi came back.
+# Every check is fatal: a run that reaches the end has passed.
+
+set -euo pipefail
+
+unit=omarchy-wifi-resume-fix.service
+cursor_file=/var/tmp/omarchy-wifi-resume-check.cursor
+legacy=/etc/NetworkManager/conf.d/wifi_backend.conf
+# systemd-sleep's "returned from sleep" entry, whatever its wording.
+sleep_stop=MESSAGE_ID=8811e6df2a8e40f58a94cea26f8ebf14
+
+check() {
+  local description=$1
+  shift
+  if "$@"; then
+    printf 'ok - %s\n' "$description"
+  else
+    printf 'not ok - %s\n' "$description" >&2
+    exit 1
+  fi
+}
+
+apple_silicon() { [[ $(omarchy-hw-platform) == "apple-silicon" ]]; }
+iwd_backend() { NetworkManager --print-config | grep -Fx 'wifi.backend=iwd' >/dev/null; }
+legacy_not_generated() { [[ ! -f $legacy ]] || ! cmp -s "$legacy" /usr/share/omarchy-mac/legacy/wifi_backend.conf; }
+wifi_connected() { nmcli -t -f TYPE,STATE device status | grep -Fx 'wifi:connected' >/dev/null; }
+resumed() { journalctl -q --after-cursor "$cursor" "$sleep_stop" | grep . >/dev/null; }
+reachable() { [[ $(nmcli networking connectivity check) == "full" ]]; }
+recovery_ran() { grep -E 'no reload needed|reconnected .* after reload' <<<"$runs" >/dev/null; }
+recovery_succeeded() { [[ $(systemctl show -P Result "$unit") == "success" ]]; }
+
+wait_for_wifi() {
+  local i
+  for ((i = 0; i < 90; i++)); do
+    wifi_connected && return 0
+    sleep 1
+  done
+  return 1
+}
+
+case ${1:-} in
+  before)
+    check "the platform is Apple Silicon" apple_silicon
+    lspci -nn | grep -E '14e4:(4425|4433|4434)' || true
+    check "the add-on covers this Wi-Fi chip" /usr/lib/omarchy-mac/wifi-supported
+    check "NetworkManager uses iwd" iwd_backend
+    check "setup retired the generated $legacy" legacy_not_generated
+    if [[ -e $legacy || -L $legacy ]]; then
+      echo "note - $legacy stays as an administrator file:"
+      cat "$legacy"
+    fi
+    check "resume recovery is enabled" systemctl is-enabled --quiet "$unit"
+    check "Wi-Fi is connected" wifi_connected
+    journalctl -q -n 0 --show-cursor | sed -n 's/^-- cursor: //p' >"$cursor_file"
+    check "the journal cursor is recorded" test -s "$cursor_file"
+    echo "Now close the lid for at least five minutes, wake the Mac and run: bash $0 after"
+    ;;
+  after)
+    check "a cursor from the before step exists" test -s "$cursor_file"
+    cursor=$(<"$cursor_file")
+    check "the Mac suspended and resumed since the before step" resumed
+    check "Wi-Fi reconnects within 90 seconds" wait_for_wifi
+    check "the network is reachable" reachable
+    check "names resolve" getent hosts archlinux.org
+    runs=$(journalctl -q --after-cursor "$cursor" -u "$unit" -o cat)
+    printf '%s\n' "$runs"
+    check "resume recovery ran after this resume" recovery_ran
+    check "resume recovery finished without failing" recovery_succeeded
+    rm -f "$cursor_file"
+    ;;
+  *)
+    echo "Usage: bash $0 before|after" >&2
+    exit 2
+    ;;
+esac

From 9fbe4320e2ee4ecf7d6204384f982d48f14f7b13 Mon Sep 17 00:00:00 2001
From: Marcelo Alcantara <maralc@gmail.com>
Date: Fri, 25 Sep 2026 19:27:53 +1000
Subject: [PATCH 6/7] Tie the Wi-Fi resume check to the Broadcom interface and
 the latest resume

A failed suspend, an unfinished recovery run, another connected adapter or an
administrator symlink could decide the result. The check now waits for the
recovery run after the latest real resume, routes through the brcmfmac
interface and establishes the same connectivity baseline before suspend.
---
 test/manual/wifi-resume-check.sh | 91 +++++++++++++++++++++++---------
 1 file changed, 66 insertions(+), 25 deletions(-)

diff --git a/test/manual/wifi-resume-check.sh b/test/manual/wifi-resume-check.sh
index 6a5337bc491..cda3350750a 100755
--- a/test/manual/wifi-resume-check.sh
+++ b/test/manual/wifi-resume-check.sh
@@ -1,15 +1,17 @@
 #!/bin/bash
 
 # Hardware check for Wi-Fi resume on an Apple Silicon Mac. Not part of
-# ./test/shell: it needs the real chip, a known network and a suspend. Run it as
-# the desktop user from a local session, since suspend drops SSH.
+# ./test/shell: it needs the real chip, a known network with Internet access and
+# a suspend. Unplug Ethernet and run it as the desktop user from a local
+# session, since suspend drops SSH.
 #
 #   bash test/manual/wifi-resume-check.sh before
 #   close the lid for at least five minutes (or run systemctl suspend), then wake
 #   bash test/manual/wifi-resume-check.sh after
 #
-# before checks the backend and recovery setup and records a journal cursor;
-# after checks that recovery ran for this resume and that Wi-Fi came back.
+# before checks the backend, recovery setup and a working Wi-Fi baseline and
+# records a journal cursor; after checks that recovery finished for the latest
+# resume and that the same Wi-Fi interface carries traffic again.
 # Every check is fatal: a run that reaches the end has passed.
 
 set -euo pipefail
@@ -17,7 +19,8 @@ set -euo pipefail
 unit=omarchy-wifi-resume-fix.service
 cursor_file=/var/tmp/omarchy-wifi-resume-check.cursor
 legacy=/etc/NetworkManager/conf.d/wifi_backend.conf
-# systemd-sleep's "returned from sleep" entry, whatever its wording.
+# systemd-sleep logs this ID for a resume and for a failed suspend; only the
+# first says "returned from sleep".
 sleep_stop=MESSAGE_ID=8811e6df2a8e40f58a94cea26f8ebf14
 
 check() {
@@ -31,25 +34,63 @@ check() {
   fi
 }
 
+brcmfmac_iface() {
+  local dev
+  for dev in /sys/class/net/*; do
+    if [[ $(basename "$(readlink -f "$dev/device/driver")") == "brcmfmac" ]]; then
+      echo "${dev##*/}"
+      return 0
+    fi
+  done
+  return 1
+}
+
+has_brcmfmac() { brcmfmac_iface >/dev/null; }
 apple_silicon() { [[ $(omarchy-hw-platform) == "apple-silicon" ]]; }
 iwd_backend() { NetworkManager --print-config | grep -Fx 'wifi.backend=iwd' >/dev/null; }
-legacy_not_generated() { [[ ! -f $legacy ]] || ! cmp -s "$legacy" /usr/share/omarchy-mac/legacy/wifi_backend.conf; }
-wifi_connected() { nmcli -t -f TYPE,STATE device status | grep -Fx 'wifi:connected' >/dev/null; }
-resumed() { journalctl -q --after-cursor "$cursor" "$sleep_stop" | grep . >/dev/null; }
+# Setup retires only a regular file identical to the one earlier installs wrote.
+legacy_not_generated() { [[ ! -f $legacy || -L $legacy ]] || ! cmp -s "$legacy" /usr/share/omarchy-mac/legacy/wifi_backend.conf; }
+wifi_connected() { nmcli -t -f DEVICE,STATE device status | grep -Fx "$iface:connected" >/dev/null; }
+routed_over_wifi() { ip route get 1.1.1.1 | grep -F " dev $iface " >/dev/null; }
 reachable() { [[ $(nmcli networking connectivity check) == "full" ]]; }
-recovery_ran() { grep -E 'no reload needed|reconnected .* after reload' <<<"$runs" >/dev/null; }
-recovery_succeeded() { [[ $(systemctl show -P Result "$unit") == "success" ]]; }
 
-wait_for_wifi() {
+wait_for() {
   local i
-  for ((i = 0; i < 90; i++)); do
-    wifi_connected && return 0
+  for ((i = 0; i < 120; i++)); do
+    "$@" && return 0
     sleep 1
   done
   return 1
 }
 
-case ${1:-} in
+latest_resume_cursor() {
+  journalctl -q --after-cursor "$cursor" "$sleep_stop" --grep 'returned from sleep' -o export |
+    sed -n 's/^__CURSOR=//p' | tail -n 1
+}
+
+recovery_outcome() {
+  journalctl -q --after-cursor "$resume" -u "$unit" -o cat |
+    grep -E 'no reload needed|reconnected .* after reload|still not connected|failed to (unload|reload)|radio is disabled' |
+    tail -n 1
+}
+
+recovery_finished() {
+  [[ -n $(recovery_outcome) && $(systemctl show -P ActiveState "$unit") != "activating" ]]
+}
+
+recovery_succeeded() {
+  recovery_outcome | grep -E 'no reload needed|reconnected .* after reload' >/dev/null &&
+    [[ $(systemctl show -P Result "$unit") == "success" ]]
+}
+
+if [[ ${1:-} != "before" && ${1:-} != "after" ]]; then
+  echo "Usage: bash $0 before|after" >&2
+  exit 2
+fi
+check "the Broadcom Wi-Fi interface is present" has_brcmfmac
+iface=$(brcmfmac_iface)
+
+case $1 in
   before)
     check "the platform is Apple Silicon" apple_silicon
     lspci -nn | grep -E '14e4:(4425|4433|4434)' || true
@@ -61,7 +102,10 @@ case ${1:-} in
       cat "$legacy"
     fi
     check "resume recovery is enabled" systemctl is-enabled --quiet "$unit"
-    check "Wi-Fi is connected" wifi_connected
+    check "$iface is connected" wifi_connected
+    check "traffic leaves through $iface" routed_over_wifi
+    check "the network is reachable" reachable
+    check "names resolve" getent hosts archlinux.org
     journalctl -q -n 0 --show-cursor | sed -n 's/^-- cursor: //p' >"$cursor_file"
     check "the journal cursor is recorded" test -s "$cursor_file"
     echo "Now close the lid for at least five minutes, wake the Mac and run: bash $0 after"
@@ -69,18 +113,15 @@ case ${1:-} in
   after)
     check "a cursor from the before step exists" test -s "$cursor_file"
     cursor=$(<"$cursor_file")
-    check "the Mac suspended and resumed since the before step" resumed
-    check "Wi-Fi reconnects within 90 seconds" wait_for_wifi
+    resume=$(latest_resume_cursor)
+    check "the Mac resumed from sleep since the before step" test -n "$resume"
+    check "resume recovery finished for the latest resume" wait_for recovery_finished
+    journalctl -q --after-cursor "$resume" -u "$unit" -o cat
+    check "resume recovery succeeded" recovery_succeeded
+    check "$iface is connected" wait_for wifi_connected
+    check "traffic leaves through $iface" routed_over_wifi
     check "the network is reachable" reachable
     check "names resolve" getent hosts archlinux.org
-    runs=$(journalctl -q --after-cursor "$cursor" -u "$unit" -o cat)
-    printf '%s\n' "$runs"
-    check "resume recovery ran after this resume" recovery_ran
-    check "resume recovery finished without failing" recovery_succeeded
     rm -f "$cursor_file"
     ;;
-  *)
-    echo "Usage: bash $0 before|after" >&2
-    exit 2
-    ;;
 esac

From e0c5cc4144e99397951add38ace42cccbf87afb3 Mon Sep 17 00:00:00 2001
From: Marcelo Alcantara <maralc@gmail.com>
Date: Fri, 25 Sep 2026 19:43:40 +1000
Subject: [PATCH 7/7] Let the Wi-Fi resume check wait out the driver reload and
 dual-stack reconnect

Look up the Broadcom interface only after recovery finishes, retry routing,
connectivity and DNS after the reconnect, and report a missing resume instead
of stopping silently when journalctl finds no match.
---
 test/manual/wifi-resume-check.sh | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/test/manual/wifi-resume-check.sh b/test/manual/wifi-resume-check.sh
index cda3350750a..bd369b5566d 100755
--- a/test/manual/wifi-resume-check.sh
+++ b/test/manual/wifi-resume-check.sh
@@ -87,11 +87,10 @@ if [[ ${1:-} != "before" && ${1:-} != "after" ]]; then
   echo "Usage: bash $0 before|after" >&2
   exit 2
 fi
-check "the Broadcom Wi-Fi interface is present" has_brcmfmac
-iface=$(brcmfmac_iface)
-
 case $1 in
   before)
+    check "the Broadcom Wi-Fi interface is present" has_brcmfmac
+    iface=$(brcmfmac_iface)
     check "the platform is Apple Silicon" apple_silicon
     lspci -nn | grep -E '14e4:(4425|4433|4434)' || true
     check "the add-on covers this Wi-Fi chip" /usr/lib/omarchy-mac/wifi-supported
@@ -113,15 +112,20 @@ case $1 in
   after)
     check "a cursor from the before step exists" test -s "$cursor_file"
     cursor=$(<"$cursor_file")
-    resume=$(latest_resume_cursor)
+    # journalctl --grep exits 1 when nothing matches; the next check reports it.
+    resume=$(latest_resume_cursor) || true
     check "the Mac resumed from sleep since the before step" test -n "$resume"
     check "resume recovery finished for the latest resume" wait_for recovery_finished
     journalctl -q --after-cursor "$resume" -u "$unit" -o cat
     check "resume recovery succeeded" recovery_succeeded
+    # A driver reload recreates the interface, so look it up only now.
+    check "the Broadcom Wi-Fi interface is present" wait_for has_brcmfmac
+    iface=$(brcmfmac_iface)
     check "$iface is connected" wait_for wifi_connected
-    check "traffic leaves through $iface" routed_over_wifi
-    check "the network is reachable" reachable
-    check "names resolve" getent hosts archlinux.org
+    # NetworkManager reports connected once either address family is up.
+    check "traffic leaves through $iface" wait_for routed_over_wifi
+    check "the network is reachable" wait_for reachable
+    check "names resolve" wait_for getent hosts archlinux.org
     rm -f "$cursor_file"
     ;;
 esac