Skip to content
Oznog

1.16 · hardware failures and rmas · after redaction

A laptop loses power exactly every five days, and the reason is out of Linux's reach

date
20260906 to ongoing, open as of 20260920
what happened
sandbox1, a T2-equipped MacBook running NixOS as a lab host, went dark three times with no warning: no link lights, no kernel panic, no shutdown sequence in its own journal, and the physical power button needed each time. Read as a table across all three incidents, every failure landed at almost exactly five days of uptime.
what it cost
Three unplanned outages of a lab host, and several rounds of diagnosis chasing explanations the data eventually ruled out.
what changed
The leading suspect is the T2 co-processor's own watchdog, which can cut power to the machine with nothing visible from the host operating system. Kernel output is now streamed off the box over the network in advance of the next event, and reading the T2's own panic log was deliberately deferred until the fault recurs.
the check now
Read boot history as a table across multiple incidents before accepting 'spontaneous' as an explanation, and treat a laptop's co-processor as a possible power-cut source that operating-system tools structurally cannot see.

A host with a healthy battery, healthy thermals and stable mains power should not be able to lose power on its own. This one has, three times since 20260906, and it is still doing it as of 20260920.

There is nothing to read afterwards. No kernel panic, no shutdown sequence, no last log line that means anything, no network link lights on the way down. The machine is simply off and needs the physical power button. Each outage on its own looks like an unrelated glitch.

What turned three glitches into a pattern was reading the boot history as a table rather than as separate events. Listed side by side, every failure had landed at almost exactly five days of uptime, regular enough to predict the next one to the day. That pattern had been sitting in already-collected data the whole time and nobody had put the rows next to each other.

From there it is elimination. Thermal readings, battery health, mains power, lid-suspend configuration, resource exhaustion and one suspicious kernel module were each checked against real measured data, and each came back clean. What is left is the explanation that leaves no evidence by construction. This model’s T2 security co-processor runs its own watchdog. It can cut power to the whole machine without the operating system ever being told.

Two decisions came out of it while the fault is still open. Kernel output is now streamed to another host over the network, so the next event arrives somewhere it can be read. And the real diagnostic, reading the T2’s own panic log, which needs a macOS boot, was deliberately left until the fault recurs, rather than spent on a guess.

Source: node0 lessons v0.1, lesson 1.16. Sanitized: checklist v0.1, 20260921; recurrence dates; voice pass 20260921. Part of oznog.com/node0.