Re: CP == Hypervisor
It's been many years, but IIRC, the only *safe* way to shut down a second or third level, etc. VM system was to log in as OPERATOR and type SHUTDOWN there.
And you're right, anything not recognised by CMS got passed to CP by default. Once upon a time, I worked for a well-known software company where it seemed to be a point of honour for any software we wrote could detect that it was running in a VM and issue commands to the base operating system via DIAG X'08'. This was a bit of a faff, 'cause you had to grab a chunk of page-aligned storage, get the real address (via LRA) then stick the command in there and fire it off.
Having had a few incidents where the dreaded "Warm Checkpoint area saved" message appeared, we made a point of
a) Never using SHUTDOWN as a command to stop a product running.
b) Intercepted SHUTDOWN as a precaution.
These days you can customise the command classes quite well so it's hard to get killed inadvertently, but having class ABCDEFG in yer VM directory entry is usually a warning that there is a gun pointed at your foot.
That said, once managed to knock over a VM system at IBM Portsmouth three times in one afternoon from a class G machine writing an APPC thing, and some years earlier, at a major chemist's wholesaler twatting about with DIAG X'7C' (apparently they were a bit behind with applying service).
Haven't worked with it for over 20 years, but VM remains my first love as an operating system.