docs(fv-ml1): docker on tank zvol, held packages, kernel metas removed; memory

servers/fv-ml1/README.md

@@ -27,7 +27,20 @@ Primary AI inference host for PFI.
   moving its data-root to tank needs a model-seat outage window (Prime's call). sudo session recordings are
   archived weekly by `services/sudo-io-archive/`.
 - **OS:** Debian 13 (trixie), kernel 6.12.x
-- **Docker:** 29.3.1, runtimes: runc (default), nvidia, io.containerd.runc.v2
+- **Docker:** 29.8.2 (since 2026-10-05), runtimes: runc (default), nvidia, io.containerd.runc.v2
+- ⚠ **`/var/lib/docker` is the zvol `tank/docker`** (sparse 1 TiB, ext4), not zroot, since 2026-10-05 0233 (Prime,
+  park 99). It is mounted by `/etc/fstab` with `nofail` after `zfs-volume-wait.service`, and
+  `docker.service.d/10-requires-docker-mount.conf` (`RequiresMountsFor=/var/lib/docker`) stops Docker from ever starting
+  on an empty root directory. It is a zvol, not a dataset, because Docker's overlay2 refuses a ZFS backing filesystem
+  (an unpinned daemon would pick the zfs graph driver and lose every image). Freed blocks reach the zvol only through
+  TRIM: `fstrim.timer` is enabled weekly (the first trim gave back 108 G). Root went from 49% to 8% used.
+  Move script: `scripts/oneoff/fv-ml1-docker-to-tank-20261005.sh`. ⚠ Lesson from run 1, which aborted on its own guard:
+  a live rsync of `/var/lib/docker` without `-x` walks INTO mounted `overlay2/*/merged` views and copies whole container
+  root filesystems.
+- ⚠ **Held packages, parked for Prime (2026-10-05):** the ZFS stack (2.3.2 → 2.3.9; root is on ZFS) and
+  `nvidia-container-toolkit` 1.19 → 1.20. **The kernel metas `linux-image-amd64`/`linux-headers-amd64` were REMOVED**:
+  6.12.111 came in with the patch run, NVIDIA 580.65.06 DKMS failed to build for it, and it was purged (still
+  booting 6.12.74). Reinstall the metas only together with an NVIDIA driver that builds on the new kernel.
 
 ## NVMe drive inventory (`tank`, raidz2-0) — read 2026-09-09 via `nvme-cli`
 
@@ -171,7 +184,7 @@ meter on the circuit. Until then, treat 1650 W as a floor.
 | `/tank/aimodels/llm/` | Legacy GGUF models (790 GB, referenced by llama-swap as `/models/`) |
 | `/tank/aimodels/mlx/` | MLX packs (Apple-silicon formats, kept for acquisition only; nothing on this host serves them). Created 2026-09-28 for Ternary-Bonsai-2-27B |
 | `/tank/aimodels/<model>.PROVENANCE.txt` | Provenance sits BESIDE each model dir, not inside it |
-| `/var/lib/docker/` | Docker data (on zroot) |
+| `/var/lib/docker/` | Docker data (zvol `tank/docker`, ext4, since 2026-10-05) |
 
 ## Running stacks