f1df01b5c5
Live-validated on demo guest 9201 (felhom-flash throwaway): shared/slave mount propagation delivers host->guest drive swaps live with no restart and no pct change; bind source = permanent stable dir => inherently C1-immune (clean boot with drive absent). nsenter fallback non-viable on unprivileged LXC; ro-tmpfs placeholder is the CAP_DAC_OVERRIDE-proof fail-close. Report-only, no code change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>