A checked-out application instance: a supervision tree carrying its own config scope and its own copies of fnord's services.

start_link/1 installs the calling process as a Services.Globals root, applies the given config as tree-local overrides, and starts the service roster under a supervisor. Everything spawned beneath the caller resolves config and services from that root, so multiple instances in one BEAM (e.g. tests) are mutually invisible.

The caller owns the instance: when it exits, the supervisor (and all services under it) shut down with it, and Services.Globals wipes the root's config overrides and service registrations.

This is the single boot path: production (Fnord.main/1) and tests (Fnord.TestCase setup) both check out an instance. NamePool and Approvals read config at call time (their inits read nothing), so no second config-dependent boot phase exists. Not in the roster: per-conversation servers (Services.Task, started by Cmd.Ask with a conversation pid), Services.MemoryIndexer (session-lazy, started by Cmd.Ask), UI.Tee (started only under --tee), and the MCP stack (atom-named by the hermes library; see docs/dev/gotchas.md).