Document Windows metadata request boundary

codex-rs/windows-sandbox-rs/src/setup_main_win.rs

@@ -79,6 +79,8 @@ use sandbox_users::resolve_sandbox_users_group_sid;
 use sandbox_users::resolve_sid;
 use sandbox_users::sid_bytes_to_psid;
 
+/// Layer: Windows enforcement request boundary. Helper-process copy of the
+/// setup payload decoded from the orchestrator.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 struct Payload {
     version: u32,

codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs

@@ -91,6 +91,9 @@ pub struct SandboxSetupRequest<'a> {
     pub proxy_enforced: bool,
 }
 
+/// Layer: Windows enforcement request boundary. These overrides are already
+/// projected by the adapter layer; setup code only packages them for the helper
+/// process.
 #[derive(Default)]
 pub struct SetupRootOverrides {
     pub read_roots: Option<Vec<PathBuf>>,
@@ -430,6 +433,8 @@ pub(crate) fn gather_write_roots(
     out
 }
 
+/// Layer: Windows enforcement request boundary. Serialized setup-helper process
+/// input; this carries prepared enforcement data, not policy decisions.
 #[derive(Serialize)]
 struct ElevationPayload {
     version: u32,