Document managed root directory policy and kernel mount compatibility

docs/system-recovery.md

@@ -12,6 +12,16 @@ subvolumes beneath `@root` are refused. Boot and fstab must select the filesyste
 UUID plus `subvol=@root`, never a numeric root subvolume ID. `@home` and VM disks
 stored there survive restoration; files stored elsewhere in `@root` roll back.
 
+The image keeps `/srv`, `/var/lib/machines` and `/var/lib/portables` as ordinary
+directories so that systemd does not create nested subvolumes on first boot.
+Assembly copies the installed vendor `home.conf`, `systemd-nspawn.conf` and
+`portables.conf` into `/etc/tmpfiles.d`, changing only those three creation rules.
+Other vendor rules and the separate `/home` policy are preserved. Image rebuilds
+regenerate these overrides and reject unexpected vendor rules. After a Portage
+systemd update, review the overrides against the new `/usr/lib/tmpfiles.d` files;
+existing `/etc` overrides continue to take precedence. Recovery still refuses
+unknown nested subvolumes rather than silently omitting their contents.
+
 This includes `/var/lib/hydra-update`: a full root restoration also restores the
 checkpoint's runtime update receipts and replay floor. The signed updater's
 monotonic sequence guarantee applies to runtime apply/recovery/rollback, not to
@@ -37,7 +47,8 @@ hydra-system restore --root-uuid ROOT_UUID --checkpoint CHECKPOINT_ID \
   --execute --confirm-root-uuid ROOT_UUID
 ```
 
-Plans and list mount targets read-only; Btrfs inspection disables log replay.
+Plans and list mount targets read-only; Btrfs inspection disables log replay with
+`rescue=nologreplay`, as supported by the packaged kernel.
 Execution requires matching confirmation and verifies UUID/PARTUUID uniqueness,
 ordinary partitions, inactive swap, no holders, and a single-device Btrfs layout.
 A private mount namespace and a root-owned lock isolate the command's mounts.