[maralcbr]

Ticket 69, found in the ticket 28 VM run.

Summary

• omarchy-drive-password ran blkid as the user, which reads only root's cache in /run/blkid. That cache stays empty until root runs blkid, so on a fresh boot the command found no LUKS drive. It now lists LUKS devices with lsblk (udev's probe, the same source root detection already uses), each device once. Root detection still fails closed. The LUKS-first ordering (Change the root LUKS key before syncing login and root passwords #532) and the token-only key checks (Security: keep enrolled LUKS2 tokens from passing LUKS key checks #549) are unchanged.
• The Mac encrypt initrd unit had StandardOutput=journal+kmsg. systemd rejects that value and falls back to the journal only. It now uses kmsg (journal plus kernel log) with SyslogLevel=notice, because by default journald only passes notice and above to kmsg. It still never writes straight to the console.

Testing

• test/shell.d/drive-password-test.sh: the fake blkid now behaves like an empty cache (no output, exit 2), and discovery goes through a fake lsblk. A new case offers every LUKS drive once and changes the system disk. The old script fails this case; the full file passes, including the real-cryptsetup LUKS1/LUKS2 runs.
• mac-encrypt-test.sh: asserts kmsg + SyslogLevel=notice and runs systemd-analyze verify on the unit, failing on any output, because verify exits 0 on parse warnings. It skips where verify can't run (emulated containers). The old unit fails; the new one passes. The boot package suite passes. All of this ran as a non-root user in the CI image (archlinux:base-devel, systemd 261) on native x86.
• On the M1 Pro, blkid -c /dev/null as the user (no cache) finds nothing, while the new lsblk query lists the root LUKS partition. A transient unit with StandardOutput=kmsg reached dmesg at notice; at info it reached only the journal.
• Second review: it found that journald's kmsg level cap would still drop info-level lines, and that the verify probe was looser than the check it gates. Both are fixed, and the re-check came back clean.