A full host implements the network shape, and something checks that it does

The shape was added everywhere except the one list that decides whether
a host can actually apply it, so every declaration carrying a network
was refused whole — correctly, and with the reason stated:

  resource "umami.net" is a network, and the arch host does not
  implement that shape

The mesh behaved as designed throughout. A host that applied the parts
it understood would leave a machine that looks configured and is not, so
it refused the lot and said why. What was missing was anybody reading
the host's log.

The vocabulary test did not catch it because it checks what the language
has, not what a host can do — those are different lists and only one of
them was updated. There is now a test that a host claiming to do
everything implements every shape the language has. It fails with the
message above when the registration is removed.

A network needs the same runtime a container does, so it belongs to a
full host and not to the portable floor.

internal/system/shapes_test.go

@@ -0,0 +1,31 @@
+package system
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-host/internal/declaration"
+)
+
+// Every shape in the vocabulary is implemented by a host that claims to do everything.
+//
+// **Added because adding a shape and forgetting this was silent here and loud there.** The
+// `network` shape parsed, validated, applied and removed, and a full host still refused every
+// declaration containing one — correctly, because it does not do half a declaration. The count
+// test above passed throughout: it checks what the language has, not what a host can do.
+func TestAFullHostImplementsEveryShapeTheLanguageHas(t *testing.T) {
+	does := map[declaration.Type]bool{}
+	for _, s := range All() {
+		if s.Name() != "arch" {
+			continue
+		}
+		for _, shape := range s.Shapes() {
+			does[shape] = true
+		}
+	}
+	for _, shape := range declaration.Vocabulary() {
+		if !does[shape] {
+			t.Errorf("the language has %q and a full host cannot apply it, so every declaration "+
+				"carrying one is refused whole", shape)
+		}
+	}
+}

internal/system/system.go

@@ -166,6 +166,9 @@ func everyShape() []declaration.Type {
 		declaration.TypeDirectory, declaration.TypeFile, declaration.TypeService,
 		declaration.TypePackage, declaration.TypeContainer, declaration.TypeAction,
 		declaration.TypeUser, declaration.TypeArchive,
+		// A network needs the same runtime a container does, so a host that can run one can make
+		// the other. Not in portableShapes for exactly that reason.
+		declaration.TypeNetwork,
 	}
 }