Reject ambiguous ESP filesystem UUIDs before root formatting

hydra/install_storage.py

@@ -118,6 +118,14 @@ def partition_plan(request, probe, topo):
         fail('ESP must be an existing FAT GPT EFI System Partition')
     if not UUID.fullmatch(esp_node.get('uuid') or ''):
         fail('ESP filesystem UUID missing')
+    # fstab resolves the ESP by filesystem UUID. Copies on any surviving
+    # device are ambiguous even when their GPT partition identities differ.
+    # Root's old filesystem is replaced before fstab is written.
+    copies = [path for path, node in topo.nodes.items()
+              if path not in {root, esp}
+              and (node.get('uuid') or '').lower() == esp_node['uuid'].lower()]
+    if copies:
+        fail('ESP filesystem UUID is ambiguous on surviving devices: ' + ', '.join(sorted(copies)))
     # Equal GPT IDs anywhere would make later PARTUUID recovery ambiguous.
     ids = [n.get('partuuid', '').lower() for n in topo.nodes.values() if n.get('partuuid')]
     if len(ids) != len(set(ids)):