guest: delete the process modules and cgroups

The old layered init, the managed agent's sandbox mode and the one-shot
container helpers are gone, and with them the last users of the guest
process modules: guest::exec ran a layered root's executions, which
guest::spawn started, guest::entry entered into their namespaces, view
and identity, guest::cgroup placed and guest::process collected, and
guest::root's bootstrap moved the init's processes into the cgroups
that held them. nvx-init runs its workloads as plain processes through
sys::spawn, without per-execution containment.

Delete guest::{exec, spawn, process, cgroup, entry}, with their
submodules and tests, and guest::root::{bootstrap, Bootstrap,
BootstrapStep, Resources}, with root::Error::Bootstrap. Delete the OS
support that only they used:

- sys::entry's per-execution entry: EntryChild, its clone3 start in new
  mount, PID and UTS namespaces, its view of /proc, /sys and /dev, with
  the procfs entries that it masked or made read-only, its move into
  the root, its umask, its working directory's resolution beneath the
  root, and the CloneArgs and OpenHow structures. sys::entry keeps a
  layered root's runtime file systems and the workload identity, which
  nvx-init and Root use.
- The spawn child's per-execution stages, with their ChildSpec setters:
  the root, the working directory's credentials check, inherited
  descriptors, the cgroup placement, the session, the barrier and the
  entry. The child keeps the path of nvx-init's workloads. LaunchStage,
  whose numbers the child's launch report carries and which
  guest::spawn held, moves into sys::spawn as a crate-private enum of
  the stages that the child still takes, each with its number.
- The waits and signals that only guest::exec used: process_group_of,
  WaitTarget and wait_named, and the sys re-exports of
  signal_process_group and signal_through_pidfd, which sys::process
  keeps for kill_process_group and kill_through_pidfd.
- The cgroup writes: root::kernel's Kernel::write, which only the
  bootstrap called.
- fd's shut_down_sending, take_pipe_end, open_at and
  create_socket_pair, which only guest::exec's pipes and sockets used.
  fd's per-execution memfd and seals already left with #1310.

Root::switch keeps its move of the root and its change of root, and
the rooted open keeps its EAGAIN retry. What the warning-denied builds
then find unused goes too: root::bind_runtime_file, whose retained
variant bind_runtime_file_retained takes its rustdoc, and
guest::mappings' bind_with re-export. guest::account's items, which
only guest::entry re-exported, become crate-private.

Tests:

- The deleted modules' 125 tests retire: 44 of guest::exec, among them
  a_stalled_sink_stalls_only_its_own_execution_and_loses_nothing, 22
  of guest::entry, 22 of guest::spawn, 17 of guest::cgroup, 9 of
  guest::process and 2 of guest::root::bootstrap; guest::root's 6
  bootstrap tests; and sys::spawn's
  a_child_enters_its_root_or_reports_why_not,
  the_check_s_credentials_keep_the_parent_s_supplementary_groups and
  an_entry_leads_a_session_and_keeps_its_barrier_from_the_program,
  whose stages go. So do the deleted modules' 8 doc tests, and the
  test hooks of their code and of the deleted child stages.
- sys::spawn's invalid_specs_are_refused_before_forking,
  stream_sources_below_the_standard_streams_are_raised_and_kept_from_the_program
  and the_launch_descriptors_are_close_on_exec lose their cases of the
  credentials check, inherited descriptors and cgroup placement.
- sys::entry's the_kernel_structures_have_their_uapi_sizes loses
  CloneArgs and OpenHow, and its Simulation helper goes.
- Tests that used a deleted helper use the kept one:
  a_thread_that_may_hold_the_permission_spawns_no_command spawns
  through sys::spawn;
  a_write_takes_back_its_own_sigpipe_beside_one_pending_for_the_process
  and
  a_stolen_or_auto_reaped_status_is_reported_once_and_never_reclassified_by_an_ending
  wait with sys::wait;
  privileged_capture_sweep_kills_setsid_escapees_and_spares_both_helpers
  reads process groups with getpgid; and the managed agent's runtime
  tests signal through sys::tests' signal_through_pidfd.
  a_real_time_signal_goes_through_a_pidfd_and_to_a_process_group drops
  its check of process_group_of.
- The helpers that only deleted tests used go: root::kernel's fake
  writes and process moves, root's bootstrap fixtures,
  sys::process's untraced and traced children, sys::fd's
  set_descriptor_limit and sys::spawn's CAP_SYS_CHROOT.

Docs: the rustdoc of guest, guest::root, sys and the kept OS modules,
the crate's guest summary, the nvx README, whose module table and
sections drop the five modules, and the guest-agent guidelines no
longer describe the deleted modules or the root's bootstrap. The case
matrix retires the deleted doc tests and names the kept ones by the
lines to which they move. The test-layout allowlist and the Linux
public API snapshot drop the deleted modules.

Part of #1123 (SL6.11b).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ppenna

doc/acceptance-case-matrix.md

@@ -34,7 +34,7 @@ its own in turn.
 | [The adapter's other tests](#the-adapters-other-tests) | 169 | 0 | 9 | 160 |
 | [MicroVM scenarios](#microvm-scenarios) | 54 | 50 | 3 | 1 |
 | [CI](#ci) | 69 | 42 | 3 | 24 |
-| [Docs](#docs) | 36 | 25 | 3 | 8 |
+| [Docs](#docs) | 36 | 18 | 2 | 16 |
 
 ## The adapter's scenarios
 
@@ -480,22 +480,22 @@ this matrix. The README's own code is no doctest.
 | `nvx-rs/src/gpt/mod.rs - gpt (line 43)` | kept |  |
 | `nvx-rs/src/guest/activation.rs - guest::activation (line 158)` | kept | SL6.11c rewrote it on `guest::snapshot::capture`, when its capture preparation and admission fence left (#1087) |
 | `nvx-rs/src/guest/activation/state.rs - guest::activation::state::Activation (line 56)` | kept |  |
-| `nvx-rs/src/guest/cgroup.rs - guest::cgroup (line 36)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
-| `nvx-rs/src/guest/entry.rs - guest::entry (line 90)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
-| `nvx-rs/src/guest/exec.rs - guest::exec (line 79)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
-| `nvx-rs/src/guest/exec.rs - guest::exec::Execution::adopt (line 619)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
+| `nvx-rs/src/guest/cgroup.rs - guest::cgroup (line 36)` | retired | `guest::cgroup` leaves (SL6.11b) |
+| `nvx-rs/src/guest/entry.rs - guest::entry (line 90)` | retired | `guest::entry` leaves (SL6.11b) |
+| `nvx-rs/src/guest/exec.rs - guest::exec (line 79)` | retired | `guest::exec` leaves (SL6.11b) |
+| `nvx-rs/src/guest/exec.rs - guest::exec::Execution::adopt (line 619)` | retired | `guest::exec` leaves (SL6.11b) |
 | `nvx-rs/src/guest/gpt.rs - guest::gpt (line 18)` | kept | The guest's space becomes private (#1127), whose PR moves it to the space's unit tests |
 | `nvx-rs/src/guest/mappings/mapper.rs - guest::mappings::mapper (line 107)` | kept | The guest's space becomes private (#1127), whose PR moves it to the space's unit tests |
 | `nvx-rs/src/guest/mappings/table.rs - guest::mappings::table::MappingTable (line 47)` | kept |  |
-| `nvx-rs/src/guest/mod.rs - guest (line 39)` | kept | The guest-agent guidelines quote it |
+| `nvx-rs/src/guest/mod.rs - guest (line 34)` | kept | The guest-agent guidelines quote it |
 | `nvx-rs/src/guest/nvxs.rs - guest::nvxs (line 22)` | kept |  |
-| `nvx-rs/src/guest/process.rs - guest::process (line 12)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
-| `nvx-rs/src/guest/process.rs - guest::process (line 39)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
+| `nvx-rs/src/guest/process.rs - guest::process (line 12)` | retired | `guest::process` leaves (SL6.11b) |
+| `nvx-rs/src/guest/process.rs - guest::process (line 39)` | retired | `guest::process` leaves (SL6.11b) |
 | `nvx-rs/src/guest/reseed.rs - guest::reseed (line 17)` | kept |  |
-| `nvx-rs/src/guest/root.rs - guest::root (line 130)` | kept | The guest's space becomes private (#1127), whose PR moves it to the space's unit tests |
+| `nvx-rs/src/guest/root.rs - guest::root (line 126)` | kept | SL6.11b removed its bootstrap, which left with the cgroups. The guest's space becomes private (#1127), whose PR moves it to the space's unit tests |
 | `nvx-rs/src/guest/snapshot.rs - guest::snapshot (line 25)` | kept | The guest-agent guidelines quote it |
-| `nvx-rs/src/guest/spawn.rs - guest::spawn (line 41)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
-| `nvx-rs/src/guest/spawn.rs - guest::spawn::LaunchStage::from_code (line 201)` | rewritten | `nvx-rs/src/guest/spawn/tests.rs::launch_stages_keep_their_numbers`. The exec engine's launch failure and outcome, which the example read, leave with the engine (SL6.11a) |
+| `nvx-rs/src/guest/spawn.rs - guest::spawn (line 41)` | retired | `guest::spawn` leaves (SL6.11b) |
+| `nvx-rs/src/guest/spawn.rs - guest::spawn::LaunchStage::from_code (line 201)` | retired | `LaunchStage::from_code` and its test, `launch_stages_keep_their_numbers`, leave with `guest::spawn` (SL6.11b). The stages of nvx-init's executions keep their numbers in the crate's own fork boundary, whose launch report `nvx-rs/src/guest/init/tests/exec.rs::native_workload_cwd_accepts_procfs_links_but_closes_inherited_descriptors` reads from a real launch |
 | `nvx-rs/src/guest/terminal.rs - guest::terminal (line 10)` | kept |  |
 | `nvx-rs/src/guest/time/mod.rs - guest::time (line 9)` | kept | SL6.11c removed its capture and restore finish, which became crate-private: `guest::snapshot::capture` runs them |
 | `nvx-rs/src/host/sandbox/prepared.rs - host::sandbox::prepared::PreparedLaunch (line 92)` | retired | `PreparedLaunch` leaves with the checked-file handoff (SL6.3, #1122) |
@@ -505,9 +505,9 @@ this matrix. The README's own code is no doctest.
 | `nvx-rs/src/host/template/plan.rs - host::template::plan::TemplatePlan (line 137)` | retired | `TemplatePlan` leaves with the template store (SL6.2a, #1121) |
 | `nvx-rs/src/host/template/store.rs - host::template::store::Store (line 473)` | retired | The template store leaves (SL6.2a, #1121) |
 | `nvx-rs/src/host/transport.rs - host::transport (line 22)` | kept |  |
-| `nvx-rs/src/lib.rs - (line 58)` | rewritten | Its `Instance` and sandbox store leave (SL6.1, #1121): `nvx-rs/src/lib.rs - (line 57)` compiles a cold boot and a stop through `host::vm` |
+| `nvx-rs/src/lib.rs - (line 58)` | rewritten | Its `Instance` and sandbox store leave (SL6.1, #1121): `nvx-rs/src/lib.rs - (line 53)` compiles a cold boot and a stop through `host::vm` |
 | `nvx-rs/src/protocol/nvxs/mod.rs - protocol::nvxs (line 68)` | kept |  |
 | `nvx-rs/src/host/snapshot/capture.rs - host::snapshot::capture::finish_capture (line 48)` | kept |  |
 | `nvx-rs/src/host/store/mod.rs - host::store (line 104)` | retired | The sandbox store leaves (SL6.1, #1121) |
-| `nvx-rs/README.md`, its Example: an instance through `LaunchSpec` and the sandbox store | rewritten | Nothing compiles it. `nvx-rs/examples/host-workflows.rs` compiles the documented host workflows, and the library's guide (SL6.10a) replaces the example. SL6.1 (#1121) made it the cold boot that `nvx-rs/src/lib.rs - (line 57)` compiles |
+| `nvx-rs/README.md`, its Example: an instance through `LaunchSpec` and the sandbox store | rewritten | Nothing compiles it. `nvx-rs/examples/host-workflows.rs` compiles the documented host workflows, and the library's guide (SL6.10a) replaces the example. SL6.1 (#1121) made it the cold boot that `nvx-rs/src/lib.rs - (line 53)` compiles |
 | `nvx-rs/examples/external-launch.rs` | kept | Compiled with the crate's targets, and run by hand on a host. Since SL6.3 (#1122), which deletes `host::supervisor`, a minimal launcher of its own on `std::process` starts its VMM |

doc/guest-agent-guidelines.md

@@ -53,13 +53,8 @@ forks a child, which waits for a grandchild that forces an RCU grace period,
 and collects only the child, so a grandchild that outlives the RCU stall
 timeout passes to PID 1, or to the nearest subreaper. No call starts the
 announcer, which is a program, `/sbin/nvx-ingress`: an init runs it itself,
-or has `nvx-ingress start` run it from a socket that it binds for it. Until
-the nvx-rs slimming
-([microsoft/nvx#1076](https://github.com/microsoft/nvx/issues/1076)) removes
-them, the crate also keeps the older process
-modules, `guest::{exec, spawn, entry, cgroup, process}`, which NVX's older
-guest agents use. nvx-init uses none of these modules, and its time daemon
-runs for the VM's life.
+or has `nvx-ingress start` run it from a socket that it binds for it.
+nvx-init's time daemon runs for the VM's life.
 
 ## Build the space
 

nvx-rs/README.md

@@ -52,13 +52,11 @@ nvx-rs/
 │   ├── testing/     feature `testing`: the fake OpenVMM
 │   ├── guest/       feature `guest`: the programs that run in Linux guests, the guest's NVXS
 │   │                connection, the libraries through which a guest init or agent opens the
-│   │                terminal on which it serves its session, starts a program, drives its
-│   │                execution, collects its children's statuses, settles its executions'
-│   │                cgroups, mounts host mappings beneath the descriptors of the roots that it
-│   │                names, assembles and tears down a layered root, reads a GPT disk's partition
-│   │                table through its block device, and prepares a template's guest for a
-│   │                capture before its root's assembly, and the typed calls through which it
-│   │                runs the time ABI's steps and the reseed
+│   │                terminal on which it serves its session, mounts host mappings beneath the
+│   │                descriptors of the roots that it names, assembles and tears down a layered
+│   │                root, reads a GPT disk's partition table through its block device, and
+│   │                prepares a template's guest for a capture before its root's assembly, and
+│   │                the typed calls through which it runs the time ABI's steps and the reseed
 │   └── bin/         nvx-rs, nvx-fake-openvmm, and the guest binaries
 ├── tests/           fake-OpenVMM, CLI, NVXS session, process and spawn, checked-handoff,
 │                    host-module layering, and guest-binary tests, the CLI's scenario tests and
@@ -130,16 +128,11 @@ changes only when the module's purpose does.
 | [`nvx::guest::mappings`](#nvxguestmappings) | `Mapping` and `MappingTable`: host mappings, and the account of a host's mapping table, for any guest init or agent |
 | [`nvx::guest::nvxs`](#nvxguestnvxs) | `GuestConnection`: the guest's role of the NVXS session over a byte stream, such as the control console |
 | [`nvx::guest::terminal`](#nvxguestterminal) | `Terminal`: the terminal on which a guest agent serves its session, such as the VM's control console |
-| [`nvx::guest::spawn`](#nvxguestspawn) | `Command`: starts a program in a new process, for any guest init or agent |
-| [`nvx::guest::entry`](#nvxguestentry) | `Entry`: the namespaces, view, root, and identity in which a program runs, for any guest init or agent |
-| [`nvx::guest::process`](#nvxguestprocess) | `Child`: the status of one child that the caller names, and of no other |
-| [`nvx::guest::cgroup`](#nvxguestcgroup) | Cgroup v2 handles through which a guest init or agent places, accounts, kills, and settles its executions |
-| [`nvx::guest::exec`](#nvxguestexec) | `Execution`: drives one program as an execution, for any guest init or agent |
 | [`nvx::guest::time`](#nvxguesttime) | x86_64: the boot steps of NVX time ABI v1 as typed calls in the caller's process, for any guest init or agent |
 | [`nvx::guest::snapshot`](#nvxguestsnapshot) | x86_64: bounded Fresh capture with inline restore repair and staged failure dispositions, without execution control |
 | [`nvx::guest::activation`](#nvxguestactivation) | x86_64: fence-free activation of each clone that its capture repaired |
 | [`nvx::guest::reseed`](#nvxguestreseed) | A restore's fresh entropy, and the reseed of the kernel's random number generator with it |
-| [`nvx::guest::root`](#nvxguestroot) | The operations of a layered root: its bootstrap, assembly, shares, export, mappings, and teardown |
+| [`nvx::guest::root`](#nvxguestroot) | The operations of a layered root: its assembly, shares, export, mappings, and teardown |
 | [`nvx::guest::view`](#nvxguestview) | The VM-wide hostname, machine ID, and single-server resolver, whose binds the layered root owns |
 | [`nvx::guest::gpt`](#nvxguestgpt) | `read_disk`: the partition table of a GPT disk, read and checked through its block device |
 
@@ -1199,101 +1192,6 @@ session's bytes as they are, and drains it, so that it sends what the agent
 wrote before the agent ends the VM. NVX's managed agent and other guest agents
 serve their sessions on it.
 
-### `nvx::guest::spawn`
-
-`Command`: starts a program in a new process for any guest init or agent, with
-its arguments, environment, a `PATH` in which it looks for a program named
-without a `/`, root and working directories, standard streams, inherited
-descriptors, cgroup, process group or new session, a `Barrier` at which the
-program waits until the caller releases it, a reset that gives every signal its
-default disposition and blocks none, and an `entry::Prepared` execution to
-enter, without NVX's control protocol, managed agent, or workload identity.
-
-Its `LaunchReport` tells whether the program started, or which `LaunchStage`
-failed and why. Each stage keeps its number, `LaunchStage::code`, which
-`LaunchStage::from_code` turns back into the stage, and a new stage takes a
-number of its own.
-
-### `nvx::guest::entry`
-
-`Entry`: the execution that a program enters, for any guest init or agent, from
-typed inputs: a root, which is a mount, moved over `/` in new mount, PID, and
-UTS namespaces, where the program is PID 1 and leads a new session; a hostname;
-a fresh procfs, a read-only sysfs, and a `/dev` of its own with only the
-allowlisted `DeviceNode`s, a devpts, and a `/dev/shm`, every other mount
-`nodev`; the `MachineId`, the image's own or one generated by
-`MachineId::generate`, the time status, and the resolver file that
-`Entry::resolver` names, if any, which `Entry::bind_runtime` binds read-only
-into the root once, through `mappings::bind`'s walk and attach, for every later
-execution, and returns as `RuntimeBinds`, which `RuntimeBinds::remove` unmounts
-in reverse order before the root's teardown, and of which a failed bind removes
-those made before it, with an `Error::Rollback` that names any that stays; and
-the `Identity`: user and group IDs, supplementary groups, and `Capabilities`
-from an allowlist, which only user ID 0 may hold, without `CAP_NET_BIND_SERVICE`
-and `CAP_NET_RAW` while the execution's listeners are `Publication::Published`,
-taken with `no_new_privs`.
-
-Its program starts with every signal's default disposition and none blocked. For
-user ID 0, the risky procfs and sysfs entries are read-only or masked.
-
-`Entry::prepare` checks it, reads the existing `Account` of the IDs from the
-root's account databases unless `AccountMode::Numeric` takes them as they are,
-and `spawn::Command::enter` runs it, with each step a `LaunchStage`. It reads no
-kernel command line or boot token and creates no account.
-
-### `nvx::guest::process`
-
-`Child`: the status of one child that the caller names, by its pidfd or its
-process ID. It waits for that child alone, so another child's status stays for
-the caller; a caller that collects every status itself, such as a PID 1 that
-adopts orphans, hands each one to its `Child` with `observe`. Statuses are
-`std::process::ExitStatus`, real-time signals included.
-
-### `nvx::guest::cgroup`
-
-`Layout`: the agent's cgroup and the workload cgroup, which the caller names,
-and which may not hold the agent's.
-
-`ExecutionCgroup`: the cgroup of one execution, the workload cgroup itself or a
-child of it, which it prepares with the caller's resource values, places
-processes in, checks for occupancy through `pids.current`, kills with
-`cgroup.kill`, and settles, over the execution's cgroup or the whole workload
-subtree, as the caller's `Scope` chooses. It holds its cgroups' directories
-open, and the process's removals and preparations of cgroups take turns, so that
-it never reaches another cgroup that takes one of their paths. Settling calls
-the caller's status collector between its checks, and collects no status itself.
-
-### `nvx::guest::exec`
-
-`Execution`: drives one program that the caller spawned with the program's ends
-of its `Pipes`, or that the caller started itself and adopts with its own ends
-of the program's pipes and a `Child` that names it, without blocking, from the
-caller's own loop or reactor, and reports each step as an `Event`: the launch
-report, which an adopted program has at once, the output of each stream, kill
-failures, and the `Outcome`.
-
-It reads a stream only as far as the caller's `grant` allows, so a stalled sink
-stalls its own execution alone, writes the program's standard input without
-`SIGPIPE`, and ends the program on a cancellation, a timeout, or a
-disconnection, with `SIGKILL` through the program's pidfd to the program and, if
-the caller asks, its process group, while no collector has taken its status,
-and, through the opened directory of a cgroup that the caller names, to that
-cgroup.
-
-`signal` sends the program a signal that the caller chooses, such as `SIGTERM`
-for a graceful stop, as container runtimes stop their workloads, to the same
-processes but the cgroup's, each of them once unless the program leaves its
-group meanwhile, while no collector has taken its status. It ends neither the
-program nor the execution: it records no cause, so a program that exits after it
-ends with its own status, and the caller ends one that outlives the caller's own
-deadline with `terminate` or `cancel`. It refuses `SIGKILL`, which only the
-execution's causes send.
-
-It closes the program's input once the program has ended. It waits for its
-program alone, by a pidfd, or takes the status from the caller's collector with
-`observe`; with `Options::caller_reaps`, that collector is the program's only
-one.
-
 ### `nvx::guest::time`
 
 x86_64: `TimeAbi`, the boot steps of NVX time ABI v1 as typed calls in the
@@ -1316,7 +1214,7 @@ snapshot capture below prepares strictly.
 A call takes the permission for OpenVMM's ports on the calling thread for each
 port transaction alone, and fails with `TimeError::PortRelease` if the thread
 may still hold some of it, which a process that it started would inherit, and
-from which `nvx::guest::spawn` starts none. No call waits for a child that it
+from which NVX's guest programs start none. No call waits for a child that it
 did not start.
 
 `nvx-time` runs its steps through them.
@@ -1478,11 +1376,6 @@ The operations of a layered root, for a guest init or agent, whether or not it
 is PID 1. The module is hidden: NVX's internal reference code of the guest's
 space, unstable, and crate-private once nothing outside NVX uses it.
 
-`bootstrap`: the agent's and the workload's sibling cgroups of a `Layout`, with
-every process of their parent moved into the agent's, the agent's `memory.low`,
-and the workload cgroup prepared through `ExecutionCgroup::prepare`, with its
-`memory.max` and `pids.max`, and user namespaces kept unavailable.
-
 `assemble`: the `Assembly`'s block devices, found by their MMIO windows, checked
 against their roles' access modes and their expected sizes, and flushed, and the
 `Root` that it mounts, at a runtime directory, a canonical path that no symbolic
@@ -2679,17 +2572,12 @@ The `guest` feature adds the programs that run in NVX's Linux guests: the
 `nvx::guest` module and one binary per program. The Alpine, Ubuntu, and Azure
 Linux images ship all ten at their established `/sbin/nvx-*` paths. The
 module's libraries are not programs: `terminal` opens the terminal on which an
-agent serves its session, `spawn` starts a program in a new process, `entry`
-has the program enter an execution's namespaces, view, root, and identity,
-`process` collects the status of a child that the caller names, `cgroup`
-places, kills, and settles the processes of an execution, `exec` drives one
-program as an execution, and `mappings` describes host mappings and keeps the
+agent serves its session, and `mappings` describes host mappings and keeps the
 account of a host's mapping table. NVX's own guest space is internal reference
 code, hidden, unstable, and crate-private once nothing outside NVX uses it:
 the mapper of `mappings` mounts host mappings beneath the descriptors of the
-roots that its caller names, and `root` bootstraps the guest for a layered root
-through `cgroup`, assembles the root, mounts live shares and mappings in it
-through the mapper, and tears it down.
+roots that its caller names, and `root` assembles a layered root, mounts live
+shares and mappings in it through the mapper, and tears it down.
 `nvx-managed-agent` opens its control terminal and runs direct workloads through
 nvx-init's plain-process core: each child resets its priority, drops its
 credentials and capabilities, and enters its working directory before exec.