Put the bus's two mounted programs under a directory the module declares, as the controller's module check requires (review round 1, C1)

modules/nats/README.md

@@ -59,7 +59,7 @@ live one**, which a person swaps in.
 
        image=$(docker inspect -f '{{.Config.Image}}' mesh-broker-nats)
        docker run --rm -v <restored>:/in:ro -v <new-store>:/out \
-         -v /var/lib/nats-module/snapshot:/opt/mesh:ro \
+         -v <the module's state directory>/snapshot:/opt/mesh:ro \
          --entrypoint /opt/mesh/mesh-nats-snapshot "$image" restore --into /out --from /in/bus.tar
 
    It starts a server of its own on the container's loopback with the bus's one account (`MESH`),
@@ -129,5 +129,5 @@ Each directory or archive this module declares says how it treats a file it did
 - `/var/lib/nats-module/conf`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
 - `${dir:snapshots}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
 - `${dir:mesh-state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
-- `/var/lib/nats-module/snapshot`: the unpacked snapshot program; everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
-- `/var/lib/nats-module/entrypoint`: the unpacked entrypoint; everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:state}/snapshot`: the unpacked snapshot program; everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `${dir:state}/entrypoint`: the unpacked entrypoint; everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

modules/nats/cmd/nats-tools/manifest_test.go

@@ -81,6 +81,11 @@ func TestTheBussManifestMountsItsProgramsIntoTheUpstreamImage(t *testing.T) {
 			t.Errorf("%s is %v: an archive resource unpacking %s", p.resource, r, p.artifact)
 			continue
 		}
+		// Under a directory the module declares (ADR 0030: nothing is mounted from a path no resource covers).
+		if dir, _, _ := strings.Cut(strings.TrimPrefix(r["path"].(string), "${dir:"), "}"); !strings.HasPrefix(r["path"].(string), "${dir:") ||
+			byID[dir] == nil || byID[dir]["type"] != "directory" {
+			t.Errorf("%s is at %v: not under a directory the module declares", p.resource, r["path"])
+		}
 		mounted := false
 		for _, v := range volumes {
 			if v == r["path"].(string)+p.mount {

modules/nats/module.json

@@ -105,17 +105,24 @@
       "template": "files/nats.conf",
       "mode": "0644"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
     {
       "id": "program-snapshot",
       "type": "archive",
-      "path": "/var/lib/nats-module/snapshot",
+      "path": "${dir:state}/snapshot",
       "artifact": "snapshot",
       "unknown": "program"
     },
     {
       "id": "program-entrypoint",
       "type": "archive",
-      "path": "/var/lib/nats-module/entrypoint",
+      "path": "${dir:state}/entrypoint",
       "artifact": "entrypoint",
       "unknown": "program"
     },
@@ -131,8 +138,8 @@
         "/var/lib/mesh-broker-nats:/data",
         "/var/lib/nats-module/conf:/etc/nats:ro",
         "${access:tls}:/tls:ro",
-        "/var/lib/nats-module/snapshot:/opt/mesh:ro",
-        "/var/lib/nats-module/entrypoint:/opt/mesh-entrypoint:ro"
+        "${dir:state}/snapshot:/opt/mesh:ro",
+        "${dir:state}/entrypoint:/opt/mesh-entrypoint:ro"
       ],
       "args": [
         "sh",