ModuleRootResolver
interface ModuleRootResolver
Where a data module lives on an account's pod, so a grant on the module can cover the module's resources when a raw resource verb names one of them.
Only the host knows: the containers come from the type-index registrations, which can differ per pod. invalidate drops what is remembered for a WebID after a verb that may have added a container.