It appears that, at least in Puppet 3.8, if you do

    class top {
        class { sub: ... ; }
    }

then having a dependency on Class[top] doesn't propagate into being
a dependency on Class[sub], even though it does for other kinds of
resources.  Adding a contain call, turning it into

    class top {
        class { sub: ... ; }
        contain sub
    }

helps, though.  Add such contain calls to xen::dom0 for the OS-
specific helper classes.