Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@extensions/netboot/netboot.sh`:
- Around line 38-42: The function
extension_prepare_config__netboot_force_nfs_rootfs sets ROOTFS_TYPE too late (it
runs during do_extra_configuration) so NFS-specific branches in
do_main_configuration never see it; move the ROOTFS_TYPE assignment earlier by
ensuring extension_prepare_config__netboot_force_nfs_rootfs (or its logic) runs
before do_main_configuration—either call that function in the init/startup hook
that executes prior to main configuration (e.g., extension_init or top-level
script before do_main_configuration) or export/set declare -g ROOTFS_TYPE="nfs"
at script initialization so the global variable is in effect for
do_main_configuration and the NFS setup in
lib/functions/configuration/main-config.sh executes.
- Around line 147-149: The PXE staging copies ${MOUNT}/boot/uInitrd but never
references it in the generated extlinux.cfg, so U-Boot won't load the initramfs;
modify the netboot stanza generation to set an initrd_line variable when the
file exists (mirror how fdt_line is created — e.g. check for
"${MOUNT}/boot/uInitrd", set initrd_line="INITRD ${tftp_prefix_dir}/uInitrd")
and then include ${initrd_line} in the emitted PXE stanza alongside fdt_line so
the INITRD directive is present for U-Boot.

In `@extensions/netboot/README.md`:
- Around line 137-155: The README has multiple unlabeled fenced code blocks
(e.g., the directory tree block showing "/srv/netboot/" and other blocks around
lines 159-164, 171-175, 465-489, 544-547); update each triple-backtick fence to
include an appropriate info string (for example use sh, ini, or text as
appropriate) so markdownlint stops flagging them—locate the fences by searching
for the blocks that display the directory tree and configuration snippets and
add the matching language tag to each opening ``` line.

In `@lib/functions/image/rootfs-to-image.sh`:
- Around line 82-93: The rsync into ROOTFS_EXPORT_DIR can leave stale files
behind when the export tree is reused; update the rsync invocation in
rootfs-to-image.sh (the run_host_command_logged rsync call) to include --delete
(and optionally --delete-excluded) so files removed from the source are removed
from "${ROOTFS_EXPORT_DIR}" as well; add the flag either into $rsync_ea or
directly in the rsync command invocation to ensure exported NFS root mirrors the
built image.
- Around line 69-76: The archive creation pipeline (tar … | pv … |
${archive_filter} > "${ROOTFS_ARCHIVE_PATH}") must be guarded with pipefail so
failures in tar or pv aren't masked by a later stage; wrap that pipeline in a
shell context with set -o pipefail (or enable set -o pipefail locally before
running the pipeline) so a nonzero exit from tar or pv will cause the script to
fail and propagate the error from creating ROOTFS_ARCHIVE_PATH; update the block
around display_alert/ tar / pv / ${archive_filter} to ensure pipefail is active
for that pipeline.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@extensions/netboot/netboot.sh`:
- Around line 386-405: The install logic for dhcpcd_hook and initramfs_hook
should unconditionally overwrite the target hooks and force the initramfs
rebuild instead of only installing when the file is missing; remove the [[ ! -f
"${dhcpcd_hook}" ]] and [[ ! -f "${initramfs_hook}" ]] guards so
run_host_command_logged install -D -m 0755
"${EXTENSION_DIR}/files/dhcpcd-hooks/71-netboot-rootpath" "${dhcpcd_hook}" and
run_host_command_logged install -D -m 0755
"${EXTENSION_DIR}/files/initramfs-hooks/netboot-rootpath" "${initramfs_hook}"
always execute, ensure changed is set to "yes" after each install, and keep the
chroot_sdcard update-initramfs -u call guarded by if [[ "${changed}" == "yes" ]]
so the new hooks are always included in the uInitrd.

In `@extensions/netboot/README.md`:
- Around line 611-655: The Helios64 example block is inconsistent with the
captured log; update the sample so all values match (or clearly mark the log as
an older capture). Ensure NETBOOT_SERVER, ROOTFS_EXPORT_DIR, ROOTFS_TYPE,
BUILD_MINIMAL and the BUILD BRANCH/RELEASE (e.g., edge/trixie) in the compile.sh
invocation match the values shown in the log (remove mismatched "edge-noble",
path-only "nfsroot=", and bootserver/rootserver=192.168.1.65), or add a short
note before the log stating it is from a different run with its exact settings;
keep the compile.sh invocation and the log consistent and self-contained.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@extensions/netboot/netboot.sh`:
- Around line 438-440: The script currently silently skips copying DTB from
"${MOUNT}/boot/dtb" to "${tftp_prefix_dir}/dtb/" but still emits a PXE FDTDIR
pointing at "${NETBOOT_TFTP_PREFIX}/dtb", causing broken PXE configs; modify the
logic around the DTB staging (check existence of "${MOUNT}/boot/dtb" and/or
"${tftp_prefix_dir}/dtb") to fail fast or omit the FDTDIR fallback: either (A)
if no DTB tree is staged, log an error and exit non-zero so the build fails
early, or (B) when producing the PXE config, only emit the FDTDIR
${NETBOOT_TFTP_PREFIX}/dtb line if the destination dtb directory actually exists
and contains files; update the blocks that reference MOUNT, tftp_prefix_dir,
NETBOOT_TFTP_PREFIX and the FDTDIR emission to implement one of these two
behaviors.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@extensions/netboot/README.md`:
- Around line 437-444: The README incorrectly states that rsync performs kernel
reflinks on btrfs/xfs; update the text near ROOTFS_EXPORT_DIR to remove or
reword the claim that "the kernel reflinks the rootfs tree" and instead explain
that while bind-mounting and rsync preserve ownership, rsync will copy data
unless explicit reflink tooling or filesystem-level copy-on-write (e.g., cp
--reflink or filesystem snapshot mechanisms) is used; reference
ROOTFS_EXPORT_DIR and the rsync-in-container behavior so readers understand the
export remains fast only when reflink/cow mechanisms are explicitly employed,
not automatically by rsync.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@extensions/netboot/README.md`:
- Around line 659-660: The example uses a glob "output/images/*-netboot-tftp/"
which can accidentally merge multiple build outputs into "/srv/netboot/tftp/";
update the README example to point at a specific build directory instead of the
wildcard (e.g., replace "output/images/*-netboot-tftp/" with the specific build
directory name for the target board/release) and keep the destination
"/srv/netboot/tftp/"; update the example text so readers must substitute their
exact build directory (referencing the string "output/images/*-netboot-tftp/"
and the destination "/srv/netboot/tftp/").

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@extensions/netboot/files/initramfs-scripts/init-premount/zz-netboot-watchdog`:
- Around line 14-16: The watchdog currently writes "b" to /proc/sysrq-trigger
which is a no-op if kernel sysrq is disabled; modify the script around the sleep
600 block so it first attempts to enable sysrq by writing "1" to
/proc/sys/kernel/sysrq (check the write/result), then trigger the sysrq reboot
via echo b > /proc/sysrq-trigger only if enabling succeeded, and if enabling or
triggering fails fallback to a forced reboot command (e.g., busybox reboot -f or
echo c to /proc/sysrq-trigger / invoking kexec/reboot alternative) so the
watchdog cannot silently hang.
- Line 11: Update the inaccurate comment in zz-netboot-watchdog: replace "Force
kernel panic + PSCI reset after 10 min if NFS root mount hangs." with text that
correctly describes the action performed by the script (e.g. "Trigger immediate
reboot via SysRq 'b' (not a kernel panic) + PSCI reset after 10 min if NFS root
mount hangs.") so the comment accurately reflects that echo b >
/proc/sysrq-trigger issues an immediate reboot rather than causing a kernel
panic.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@extensions/netboot/files/initramfs-scripts/nfs-bottom/zz-netboot-watchdog-cancel`:
- Around line 9-11: In zz-netboot-watchdog-cancel, don't pass raw pidfile
contents to kill; read /run/netboot-watchdog.pid, trim whitespace, validate it
matches a numeric regex and is within a safe range (e.g. >1), verify the PID
refers to a live process (kill -0 or /proc/$pid exists) and only then call kill;
if validation fails, log/ignore and remove the stale pidfile rather than sending
a signal to an unintended process.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@extensions/netboot/netboot.sh`:
- Around line 446-480: The TFTP staging subtree (${tftp_prefix_dir}) is never
cleared so stale files (old DTBs, uInitrd) can persist across incremental
builds; before copying artifacts (kernel via kernel_src, dtbs, uInitrd) remove
or clean the contents of ${tftp_prefix_dir} (but keep the directory itself) and
recreate any required subdirs (e.g. dtb and pxe_dir) so subsequent
run_host_command_logged cp -v / cp -a operations only copy current ${MOUNT}/boot
artifacts; ensure this cleaning happens just after declaring
tftp_prefix_dir/pxe_dir and before copying kernel, dtb, and initrd so
dtb_payload and INITRD checks reflect the fresh tree.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@extensions/netboot/netboot-deploy.sh`:
- Around line 44-48: The script must fail fast if the remote side is not
effectively root for NFS updates: update the logic around NETBOOT_DEPLOY_SUDO,
the archive untar routine (where tar --numeric-owner is used) and the
kernel-only sync to require either NETBOOT_DEPLOY_SUDO=yes or an effective
remote UID of 0; implement a remote check (ssh "$host" 'id -u' or similar)
before running tar/rsync/mkdir/tar that preserve numeric owners and if neither
condition is true exit with a clear error; tighten the NETBOOT_DEPLOY_SUDO
help/contract text to state it is required when the SSH account cannot act as
root for rsync/mkdir/tar on TFTP_ROOT and NETBOOT_NFS_PATH; apply the same
check/exit logic to the other similar blocks mentioned (archive untar and
/lib/modules sync locations).
- Around line 545-550: The rsync that syncs
"${scratch_dir}/usr/lib/linux-image-${kver}/" to
"${NETBOOT_DEPLOY_SSH}:${NETBOOT_DEPLOY_TFTP_ROOT}/${NETBOOT_TFTP_PREFIX}/dtb/"
copies new DTBs but does not remove DTBs removed or renamed in the package, so
add the delete option to the rsync invocation (i.e. include --delete among the
"${rsync_base[@]}" options passed to run_host_command_logged_raw) for the dtb
sync to mirror the full-image deploy behavior and ensure removed DTBs are pruned
from the target.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lib/functions/rootfs/rootfs-create.sh`:
- Around line 26-27: The tar extraction in the rootfs cache restore (the tar xp
invocation in create-cache.sh) is missing the --sparse flag so sparse-file
extents recorded during creation are lost; update the extraction command (the
tar xp --numeric-owner --xattrs
--xattrs-include="${ROOTFS_TAR_XATTR_INCLUDE:-security.*}" --acls --selinux ...
-C "${SDCARD}"/ invocation) to include --sparse so restored files preserve
sparse metadata and match the creation command used in rootfs-create.sh.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@extensions/netboot/netboot-deploy.sh`:
- Around line 435-438: The remote command passed to run_host_command_logged_raw
can exit early under set -e and leave the large q_remote_archive in /tmp if tar
fails; change the remote shell sequence invoked over ssh (the string currently
building with mkdir -p ${q_nfs_path}; ${sudo_prefix}tar -xp ... -f
${q_remote_archive} -C ${q_nfs_path}; rm -f ${q_remote_archive}) so that the
mkdir→tar step short-circuits on error (use && between mkdir and tar) but the rm
-f ${q_remote_archive} is executed unconditionally and the original tar exit
status is preserved and re-exited (capture the tar/mkdir exit code into a temp
var and then run rm -f ${q_remote_archive}; exit ${ret}) to ensure cleanup
always runs while still propagating failures back to
run_host_command_logged_raw.
- Line 437: The tar invocation that uses --selinux, --acls, and --xattrs (the
line that runs "${sudo_prefix}tar -xp --numeric-owner --xattrs
--xattrs-include='*' --acls --selinux -f ${q_remote_archive} -C ${q_nfs_path}")
assumes GNU tar and will fail on BusyBox; modify the deployment script to probe
the remote tar capabilities (e.g. run "${sudo_prefix}tar --version" or check for
"GNU" in output) and conditionally set an extended-attribute flags variable
(like EXT_TAR_FLAGS="--numeric-owner --xattrs --xattrs-include='*' --acls
--selinux" for GNU tar, fallback to "-x --numeric-owner" or "-xp" for non-GNU),
then use "${sudo_prefix}tar ${EXT_TAR_FLAGS} -f ${q_remote_archive} -C
${q_nfs_path}" in place of the hardcoded flags; alternatively, if you prefer
docs-only, add a README note stating GNU tar is required on the NFS server.

---

Duplicate comments:
In
`@extensions/netboot/files/initramfs-scripts/nfs-bottom/zz-netboot-watchdog-cancel`:
- Line 17: In zz-netboot-watchdog-cancel make the watchdog PID kill tolerant to
stale/exited PIDs by masking kill's exit status; locate the line using the
watchdog_pid variable and the kill "${watchdog_pid}" 2> /dev/null invocation and
change it so failures don't propagate (for example by appending a no-op OR to
swallow non-zero exit codes like "|| true" or using ":"), ensuring the script
won't abort under set -e when the PID is already gone.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@extensions/netboot/README.md`:
- Line 95: The README uses two spellings ("Normalize" and "normalises") for the
same concept; pick one dialect and make it consistent across the file by
updating all occurrences (e.g., the NETBOOT_CLIENT_MAC description and earlier
uses) to the chosen spelling; search for instances of "normalize", "normalise",
"normalizes", "normalises" and update them to one variant so the README is
consistent.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@lib/functions/image/rootfs-to-image.sh`:
- Around line 47-50: The array exclude_home is declared to avoid embedded quote
characters but is being forwarded through run_host_command_logged which rebuilds
commands with bash -c "$*", so you must serialize the array to preserve quoting:
replace any use of "${exclude_home[@]}" passed into
run_host_command_logged/rsync with "${exclude_home[*]@Q}" (or construct a
helper-safe quoted string variable) at both rsync call sites and the other
occurrences that forward this array through run_host_command_logged (e.g., the
blocks invoking rsync where exclude_home is appended); ensure the serialized
form is used in the command arguments passed to run_host_command_logged so rsync
receives the correct --exclude pattern.