fix(#946): drop hive-priv self-bind fallback (require socket activation) + clarify child-state rw is intentional

hive-c0re/src/lifecycle.rs

@@ -1103,6 +1103,15 @@ const HOST_SHARED_ROOT: &str = "/var/lib/hyperhive/shared";
 /// `binds`. All three are RW so the parent can read/write state and
 /// submit config-change requests. Creates missing host-side directories
 /// so nspawn doesn't refuse to start; missing dirs are non-fatal.
+/// Mount a child agent's `state`, `harness`, and `config` dirs into the
+/// parent, all read-write. The RW on `state` is deliberate (not just a
+/// read mount): a parent manages its children, which includes writing
+/// into a child's state for recovery (e.g. seeding notes / clearing a
+/// stuck sentinel) as well as reading it. `config` is RW because the
+/// parent authors proposed config changes for the child (the approval
+/// flow commits into the child's config repo). `harness` is RW for the
+/// same management reasons. Per-child isolation still holds: a child
+/// only ever has its *own* dirs bind-mounted, never a sibling's.
 fn bind_child_agent_dirs(child: &str, binds: &mut Vec<BindMount>) {
     let state_dir = format!("{HOST_AGENTS_ROOT}/{child}/state");
     let harness_dir = format!("{HOST_AGENTS_ROOT}/{child}/harness");
@@ -1221,7 +1230,8 @@ async fn set_nspawn_flags(
 
     // Topology-driven child mounts: every direct child of this agent gets
     // its state, harness, and config dirs bind-mounted RW so the parent
-    // can read state and manage config.
+    // can read AND write child state (recovery) and manage its config.
+    // See `bind_child_agent_dirs` for why state is RW, not read-only.
     let direct_children = crate::topology::children_of(agent_name);
     for child in &direct_children {
         bind_child_agent_dirs(child, &mut binds);