I'll add documentation if you want, because I don't really see how more clear this code can be :)

It just forces resources appliable to both hosts or devices on every kind of node, then skips host-only resources when running on a device, and the reverse, then allow everything else.

I've tried writing this in a shorter form, but fail to have something as clear.