[DevomB]

The fifth part of the cleanup-held redo (after #241-#244). These are comments only, in kryptikd's broker.rs, serve.rs, update.rs, zone.rs, main.rs, broker/tests.rs, update/tests.rs, Cargo.toml, probes/boundary-checks.sh and probes/fixtures.sh, and compartments/tests/cli.sh.

How it was done. The same procedure as #242. Cleanup-held's change was merged onto main, and only regions where every changed line is a comment or blank were kept; code, messages and conflicts went back to main. Each kept cut was then read by hand. Stripping comments (Rust //, ///, /* */, char and string literals respected; sh #) from main's version and this one gives the same code in all eleven files; bash -n passes on the shell ones. zone/tests.rs had no comment region left.

Kept where the cut corrects or adds to main:

• The broker's request table gains transfer <zone> <name> (+1 fd) and clipboard-move ... -> error: ... a zone 0 act, both checked against parse_request and its reply.
• cli.sh's header names its exit codes (1, and 2 for a missing kryptik or kryptikd).
• The volume doc says destroy needs root too.

Changed from the cut, to keep a reason it dropped:

• broker.rs:
  • The peer's uid is asserted by the kernel, so the zone cannot choose it.
  • A zone reaches only its own clipboard, and a move crosses once.
  • None for the home device refuses every transfer.
  • The destination is looked up again after the question because it may have restarted.
  • The identity switch is restored on every path.
• update.rs:
  • A base is never resolved under what the net zone reports.
  • Nothing is staged past the signed size.
  • The channel file is the image's own, as sysinit prunes a copy under /etc.
• serve.rs: the socket directory is 0750 so the group alone reaches it, and open_nofollow's want_socket keeps its meaning.
• main.rs:
  • The launcher is signalled only while its pid and start time match, as pids are reused.
  • Nothing unbuilt is a silent no-op.
  • The clipboard payload lives in one zone's entry at a time.
  • core-sched's four values.
• zone.rs: the nobody mapping and check --target's refusal; the TOML reader's refusal of arrays and nested tables; why a zone name is restricted (cgroup paths, interface names).
• The suites: where boundary-checks runs and what it skips; that other zones are refused before a payload is read; cli.sh's three guarantees; why the zone's hostname is read in the zone; how a Wi-Fi passphrase reaches kryptikd; the symptom without the 0700 traverse; and the consent test's lock.

Dropped from the cut: comments that only repeat the error message beside them (io_max's volume, storage.size, a persistent zone's volume); the conflicting hunks; two stray blank lines.

Proof: CI's Compartment layer (cargo test of kryptikd, which compiles every file here) and the fixture and shell checks. Nothing kryptikd does changes.