[stateless] readonly-root support