QEMU System and User targets

[Kenneth Adam Miller]

If I am right, the softmmu/system build target for each architecture subsumes the source of the user target. It's what I see in the build of i386. But then, I think the user targets have some dedicated user layer which allow a foreign architecture user binary to be relayed through in order to map to the host. What I was wondering is, if the user layer of qemu is used by the user target, and by user layer I mean the using contents of linux-user, then how does the system target receive the user programs instead of the qemu user emulation layer even within a guest that is an entire OS?