Function explain_scope_probe 

pub fn explain_scope_probe(
    policy: &CapabilityPolicy,
    workdir: &Path,
) -> ScopeProbe

What mur run --explain-scope reports for policy’s cgroup scope and io.max, on the terms a launch reports them: probe_scope for a contained session, and for an unconfined one the no-scope reports when it declares no cgroup_* field, else the probe with io.max written only when cgroup_io_bytes_per_sec is declared.