A resource's owner is read to the last dot, because a module's name may contain one

novox.be is a module on this mesh. Reading a resource's owner to the first dot made its resources
belong to something called "novox", and a step's gate would then skip whatever else happened to start
that way — silently. A resource's own id never contains a dot, which is what makes the last one the
boundary; the mesh's derived step was changed to add a hyphen rather than a dot for the same reason
(mesh-controller #128).

internal/apply/apply.go

@@ -2281,16 +2281,22 @@ func meshMadeUnits(known store.State) map[string]bool {
 
 // moduleOf is the module a declared resource belongs to.
 //
-// The mesh composes a module's resource ids as `<module>.<id>`, so the part before the first dot is
-// the module. False for what the mesh declares in its own right — a guard, an opening, the adoption's
-// own resources — which belongs to no module, and whose gate is therefore the machine's.
+// The mesh composes a module's resource ids as `<module>.<its own id>`, and **a module's name may
+// contain a dot** — `novox.be` is one on this mesh — while a resource's own id never does. So the
+// owner is everything before the *last* dot; reading to the first one would make `novox.be.server`
+// belong to a module called "novox", and a gate would then skip whatever else happened to start that
+// way.
+//
+// False for what the mesh declares in its own right: the foundation's resources carry no dot at all,
+// and the adoption's are named for the mesh rather than for a module. Both belong to no module, and
+// their gate is therefore the machine's.
 func moduleOf(identity string) (string, bool) {
 	if strings.HasPrefix(identity, declaration.AdoptionPrefix) {
 		return "", false
 	}
-	module, _, ok := strings.Cut(identity, ".")
-	if !ok || module == "" {
+	at := strings.LastIndex(identity, ".")
+	if at <= 0 {
 		return "", false
 	}
-	return module, true
+	return identity[:at], true
 }