Guard: bail out for reboot when -Syu replaced the running kernel's modules

arch-setup.sh

@@ -94,6 +94,18 @@ fi
 step "1/8 · System updates & essential packages"
 
 pacman -Syu --noconfirm
+
+# If -Syu upgraded the kernel, the running kernel's modules are gone and
+# Docker can't load overlay/netfilter — reboot and re-run (script is
+# safe to re-run; completed steps skip themselves)
+if [ ! -d "/usr/lib/modules/$(uname -r)" ]; then
+    warn "Kernel was upgraded — running kernel $(uname -r) has no modules on disk."
+    warn "Reboot, then re-run this script:"
+    warn "  reboot"
+    warn "  bash arch-setup.sh"
+    exit 1
+fi
+
 # Minimal host package set — omaterm installs everything else it needs
 # (git, tmux, agents, tailscale all live inside its container)
 pacman -S --noconfirm --needed \