Sync custom kernel to CachyOS 7.2.10-1 and fix overlay and ESP refresh

- Kernel snapshot, patch and guard now match the running 7.2.10-fiw-nyx-v1.2.
- Overlay install replaces the tree instead of merging, so removed ebuilds
  cannot linger next to a newer Manifest; the old tree is restored on failure.
- Limine refresh removes ESP kernel folders the managed menu no longer lists.
- ESP discovery checks fstab FAT mounts, triggers x-systemd.automount and
  ignores the autofs placeholder.

docs/boot.md

@@ -13,8 +13,9 @@ sudo ./install --selection local/selection.json --deploy-bootloader
 sudo ./install --selection local/selection.json --deploy-bootloader --esp /boot/efi
 ```
 
-Discovery checks mounted `/efi`, `/boot/efi` and `/boot` candidates for the GPT
+Discovery checks `/efi`, `/boot/efi`, `/boot` and FAT mount points from
-ESP type and FAT filesystem. The plan shows the selected partition, root
+`/etc/fstab` for the GPT ESP type and FAT filesystem. An `x-systemd.automount`
+ESP is mounted by accessing it first. The plan shows the selected partition, root
 filesystem, kernel arguments, installed kernel/initramfs candidates and
 proposed loader config or commands. UUIDs are derived on the target and kept
 in its local state; they are not shipped in the repo.
@@ -41,7 +42,8 @@ followed by generic kernels, including an installed binary fallback.
 A marked block contains the generated Gentoo entries. Entries outside that
 block are preserved. Locally edited managed entries receive a `.new` proposal
 instead of being overwritten. ESP free space is checked before copying kernel
-artifacts. The protocol and paths follow the upstream
+artifacts. Once the managed menu is current, kernel folders it no longer lists
+are removed from the ESP; folders with other files are left alone. The protocol and paths follow the upstream
 [Limine configuration reference](https://github.com/limine-bootloader/limine/blob/v12.x/CONFIG.md).
 
 ## GRUB

docs/setup.md

@@ -73,7 +73,7 @@ Custom kernel installs with NVIDIA also check its modules against the selected
 custom kernel and binary fallback. Missing or outdated modules are compiled
 for each, and failures appear in the package report.
 
-The custom kernel uses the CachyOS 7.2.9-2 patch and is named `7.2.9-fiw-nyx-v1.2`. Newer
+The custom kernel uses the CachyOS 7.2.10-1 patch and is named `7.2.10-fiw-nyx-v1.2`. Newer
 7.2.x point releases reuse that patch and config; the next series stays masked
 until the snapshot is updated. Fiw's Ryzen preset also installs
 `/etc/sysctl.d/70-fiw-dots-performance.conf` (CachyOS-style memory/network

lib/boot.py

@@ -28,13 +28,31 @@ def mount_info(path, exact=False):
                             text=True, capture_output=True)
     if result.returncode:
         raise RuntimeError('Not a mounted filesystem: ' + str(path))
-    data = json.loads(result.stdout)['filesystems'][0]
+    # An x-systemd.automount point lists its autofs placeholder first.
-    return data
+    mounted = [fs for fs in json.loads(result.stdout)['filesystems'] if fs['fstype'] != 'autofs']
+    if not mounted:
+        raise RuntimeError('Not a mounted filesystem: ' + str(path))
+    return mounted[-1]
+
+
+def fstab_vfat():
+    result = subprocess.run(['findmnt', '--fstab', '--json', '--types', 'vfat', '--output', 'TARGET'],
+                            text=True, capture_output=True)
+    if result.returncode or not result.stdout.strip():
+        return []
+    return [Path(fs['target']) for fs in json.loads(result.stdout)['filesystems']]
 
 
 def discover_esp(path=None):
     candidates = [Path(path)] if path else [Path('/efi'), Path('/boot/efi'), Path('/boot')]
+    if not path:
+        candidates += [target for target in fstab_vfat() if target not in candidates]
     for candidate in candidates:
+        # Accessing an automount point mounts it; findmnt alone does not.
+        try:
+            os.listdir(candidate)
+        except OSError:
+            pass
         try:
             info = mount_info(candidate, exact=True)
         except RuntimeError:
@@ -336,12 +354,29 @@ def refresh(saved, backups, exclude=None, ask=None):
         write(proposal, output, backups)
         saved['pending_config'] = str(proposal)
         print('Preserved edited Limine entries; review ' + str(proposal))
-    elif output != old:
+    else:
-        write(config, output, backups)
+        if output != old:
-        saved['block_hash'] = block_hash(block)
+            write(config, output, backups)
+            saved['block_hash'] = block_hash(block)
+        # Only once the menu no longer lists them: drop removed kernels' copies.
+        prune_kernels(folder / 'kernels', {image['version'] for image in images})
     return saved
 
 
+def prune_kernels(directory, keep):
+    """Remove ESP kernel folders that refresh created and the menu no longer uses."""
+    if not directory.is_dir():
+        return
+    for path in directory.iterdir():
+        if path.name in keep or path.is_symlink() or not path.is_dir():
+            continue
+        names = {child.name for child in path.iterdir()}
+        # Leave anything that is not purely this tool's vmlinuz/initramfs copy.
+        if names <= {'vmlinuz', 'initramfs.img', '.vmlinuz.tmp', '.initramfs.img.tmp'}:
+            shutil.rmtree(path)
+            print('Removed unused ESP kernel copy: ' + path.name)
+
+
 def confirm(prompt, choices, default):
     if not sys.stdin.isatty():
         raise RuntimeError('Interactive confirmation required: ' + prompt)

lib/rice.py

@@ -483,6 +483,30 @@ def nvidia_modules():
     return result
 
 
+def replace_tree(source, target):
+    """Replace target with a copy of source; merging would keep removed ebuilds
+    next to a Manifest that no longer lists their distfiles."""
+    target.parent.mkdir(parents=True, exist_ok=True)
+    scratch = target.with_name('.' + target.name + '-new-' + str(os.getpid()))
+    retired = target.with_name('.' + target.name + '-old-' + str(os.getpid()))
+    try:
+        shutil.copytree(source, scratch, symlinks=True)
+        if target.exists() or target.is_symlink():
+            target.rename(retired)
+        try:
+            scratch.rename(target)
+        except OSError:
+            if retired.exists() and not target.exists():
+                retired.rename(target)
+            raise
+    finally:
+        for leftover in (scratch, retired):
+            if leftover.is_symlink():
+                leftover.unlink()
+            elif leftover.exists():
+                shutil.rmtree(leftover)
+
+
 def install_packages(selection):
     if os.geteuid() != 0:
         raise RuntimeError('Package installation requires root. Run sudo ./install --install-packages --selection <file>.')
@@ -578,7 +602,7 @@ def install_packages(selection):
         overlay = Path('/var/db/repos/fiw-dots')
         if overlay.exists():
             shutil.copytree(overlay, backup_root / 'overlay', symlinks=True)
-        shutil.copytree(REPO / 'overlay', overlay, dirs_exist_ok=True, symlinks=True)
+        replace_tree(REPO / 'overlay', overlay)
         make_conf = Path('/etc/portage/make.conf')
         include = 'source /etc/portage/fiw-dots.conf'
         if include not in make_conf.read_text():

optional/kernel/config.d/99-name.config

@@ -1,7 +1,7 @@
-# uname -r → <linux version>-fiw-nyx-v<own version>, e.g. 7.2.9-fiw-nyx-v1.2.
+# uname -r → <linux version>-fiw-nyx-v<own version>, e.g. 7.2.10-fiw-nyx-v1.2.
 # Only the kernel version plus Fiw's name: no CachyOS release number or other extras.
 # Bump v<N> by hand when you change your own tweaks.
 # History: v1 = "-1-fiwzen-v1" (first build), v1.1 = renamed to fiw-nyx,
 # v1.2 = 2026-10-08 rebuild (7.2.9, CachyOS 7.2.9-2 patch), "-<cachyos release>" dropped
-# from the name from the next kernel build on.
+# from the name from the next kernel build on (first: 7.2.10, CachyOS 7.2.10-1 patch).
 CONFIG_LOCALVERSION="-fiw-nyx-v1.2"

optional/kernel/guard

@@ -8,7 +8,7 @@ export KBUILD_BUILD_HOST=gentoo
 # has a release for a new gentoo-kernel). A newer point release in the same
 # series (7.2.x) reuses the existing patch and config.d unchanged; if the patch
 # no longer applies, the build stops and the installed kernels stay as they are.
-FIW_CACHY_PV=7.2.9
+FIW_CACHY_PV=7.2.10
 pre_src_prepare() {
 	[[ ${PV} == "${FIW_CACHY_PV}" ]] && return
 	if [[ ${PV%.*} != "${FIW_CACHY_PV%.*}" ]]; then

optional/kernel/snapshot.json

@@ -1,9 +1,9 @@
 {
-  "atom": "=sys-kernel/gentoo-kernel-7.2.9",
+  "atom": "=sys-kernel/gentoo-kernel-7.2.10",
-  "patch_kernel": "7.2.9",
+  "patch_kernel": "7.2.10",
-  "cachyos_tag": "cachyos-7.2.9-2",
+  "cachyos_tag": "cachyos-7.2.10-1",
   "tested_kernel_versions": [
-    "7.2.9"
+    "7.2.10"
   ],
-  "patch_sha256": "49e635ff0b35ebfbff5ddfab117dcd49bafc2b04f8794fccd6c7ff201f27ebf9"
+  "patch_sha256": "ed5f06622f9045ac3938e7c89270622f647252dd6e9e6c699b7ff8368a829b1a"
 }