A container does not take restart-on, and nine of them did

This is what stopped the forge. The host refused the whole declaration:

  resource "postgres.server": a container does not use "restart-on",
  and it is set. Refused rather than ignored

`restart-on` belongs to a service. I put it on containers this morning
so one would pick up a rotated credential — nine times across seven
modules — and nothing between the manifest and the machine said a word.
The control plane composed it happily; the parser accepted it; the
manifest tests passed. The only thing that knew was the host, five steps
downstream, and hearing from it cost a seventeen-minute run.

The host was right twice over. It refused, and it refused *everything*,
because applying the parts it understood would leave a machine that
looks configured and is not. One misplaced key therefore stops a module
dead, which is the correct severity and an argument for catching it
where it is written.

So the shapes and their keys are now written down here and checked. They
are duplicated from another repository deliberately — this is its wire
format, like the shape of a grant file — and a contract with two copies
and no check is a contract until somebody edits one.

What this does not fix is why I reached for it: a container cannot
follow a file. Filed separately.

examples/modules/object-store.json

@@ -1,15 +1,23 @@
 {
   "module": "object-store",
   "version": "1",
-
-  "provides": [{"name": "s3-bucket", "scope": "mesh"}],
-  "capabilities": ["container-runtime"],
-
+  "provides": [
+    {
+      "name": "s3-bucket",
+      "scope": "mesh"
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
   "listens": [
-    {"port": 9000, "protocol": "tcp", "from": "mesh",
-     "why": "the S3 endpoint, for modules on any machine that were granted a bucket"}
+    {
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the S3 endpoint, for modules on any machine that were granted a bucket"
+    }
   ],
-
   "serves": {
     "s3-bucket": {
       "port": 9000,
@@ -17,35 +25,63 @@
       "region": "us-east-1"
     }
   },
-
-  "receives": {"s3-bucket": "/var/lib/objectstore/grants"},
-  "grants": {"s3-bucket": "/var/lib/objectstore/grants"},
-
-  "own-secrets": {"root": "/var/lib/objectstore/root.secret"},
-
+  "receives": {
+    "s3-bucket": "/var/lib/objectstore/grants"
+  },
+  "grants": {
+    "s3-bucket": "/var/lib/objectstore/grants"
+  },
+  "own-secrets": {
+    "root": "/var/lib/objectstore/root.secret"
+  },
   "resources": [
-    {"id": "state", "type": "directory", "path": "/var/lib/objectstore", "mode": "0700"},
-    {"id": "grants", "type": "directory", "path": "/var/lib/objectstore/grants", "mode": "0700"},
-
-    {"id": "store", "type": "container", "name": "mesh-store",
-     "image": "minio/minio@sha256:aefec8a86702aff0b0dcfdd9284bd7ab7c5631cbf9be63275799e6edcb30dfa2",
-     "args": ["server", "/data"],
-     "env": {"MINIO_ROOT_USER": "meshroot"},
-     "ports": ["9000:9000"],
-     "volumes": ["mesh-store-data:/data", "/var/lib/objectstore/root.secret:/run/secrets/root:ro"]},
-
-    {"id": "provisioner", "type": "container", "name": "mesh-provision-objectstore",
-     "image": "mesh-provision-objectstore@sha256:0000000000000000000000000000000000000000000000000000000000000000",
-     "env": {
-       "GRANTS": "/var/lib/objectstore/grants",
-       "MESH_OBJECTSTORE_URL": "http://127.0.0.1:9000",
-       "MESH_OBJECTSTORE_ROOT_USER": "meshroot",
-       "MESH_OBJECTSTORE_ROOT_PASSWORD_FILE": "/run/secrets/root"
-     },
-     "volumes": [
-       "/var/lib/objectstore/grants:/var/lib/objectstore/grants:ro",
-       "/var/lib/objectstore/root.secret:/run/secrets/root:ro"
-     ],
-     "restart-on": ["grants"]}
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/objectstore",
+      "mode": "0700"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "path": "/var/lib/objectstore/grants",
+      "mode": "0700"
+    },
+    {
+      "id": "store",
+      "type": "container",
+      "name": "mesh-store",
+      "image": "minio/minio@sha256:aefec8a86702aff0b0dcfdd9284bd7ab7c5631cbf9be63275799e6edcb30dfa2",
+      "args": [
+        "server",
+        "/data"
+      ],
+      "env": {
+        "MINIO_ROOT_USER": "meshroot"
+      },
+      "ports": [
+        "9000:9000"
+      ],
+      "volumes": [
+        "mesh-store-data:/data",
+        "/var/lib/objectstore/root.secret:/run/secrets/root:ro"
+      ]
+    },
+    {
+      "id": "provisioner",
+      "type": "container",
+      "name": "mesh-provision-objectstore",
+      "image": "mesh-provision-objectstore@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "env": {
+        "GRANTS": "/var/lib/objectstore/grants",
+        "MESH_OBJECTSTORE_URL": "http://127.0.0.1:9000",
+        "MESH_OBJECTSTORE_ROOT_USER": "meshroot",
+        "MESH_OBJECTSTORE_ROOT_PASSWORD_FILE": "/run/secrets/root"
+      },
+      "volumes": [
+        "/var/lib/objectstore/grants:/var/lib/objectstore/grants:ro",
+        "/var/lib/objectstore/root.secret:/run/secrets/root:ro"
+      ]
+    }
   ]
 }