Function explain_scope 

pub fn explain_scope(
    policy: &CapabilityPolicy,
    declared: ContainmentClass,
    exports: Option<&Exports>,
    state_stores: Vec<StateStoreReport>,
    configured_artifacts: Vec<String>,
    preopens: Vec<PreopenReport>,
    io_max: IoMaxReport,
    workdir: &Path,
) -> Result<ScopeReport, HomeUnusable>

Builds a ScopeReport for policy against this host, with declared as the already- combined floor. Takes one crate::sandbox::HostProbe, so the tier, the shortfall and the grant it reports all describe one host at one moment.

state_stores, configured_artifacts and preopens are resolved by the caller (from the manifest’s artifact entries, via crate::state_store::state_store_reports, crate::artifact_config::configured_artifact_names and crate::network_policy::preopen_reports) rather than derived here, because all three are per-artifact and policy is capsule-wide. No resolution creates anything, so this stays a read-only diagnostic.

workdir is the workdir root the launch would use — --workdir, or <manifest dir>/workdir without one — which names the records group and decides whether the runtime or records directory lies inside it. Nothing is created to answer that; a HOME that cannot hold either is refused, as the launch would be.