keep service containers' boot-wait budgets under their start limit, and check it

nix/container-modules/swarm-container.nix

@@ -5,6 +5,17 @@
 # They restate host-side facts the container cannot read on its own: its
 # evaluation is nested inside `containers.<name>`, and reading the host side
 # back from in here recurses.
+#
+# ⚠️ The container is `Type=notify`: the host's start job lasts until this
+# guest's job queue is empty and ends in a kill at the container's
+# `timeoutStartSec`, one minute unless the host module sets more. A unit in that
+# queue, wanted by `multi-user.target` or required by a unit that is, states a
+# `TimeoutStartSec` below that limit; a fetch that needs longer fails fast,
+# restarts with a growing delay, and starts what depends on it with
+# `systemctl start --no-block` (./swarm-journal-forwarder.nix is the pattern).
+# `module-eval-swarm-services-switch` fails on a unit whose budget, stated or the
+# manager's 90 s default, reaches the limit, unless the unit is listed there with
+# a reason.
 { config, lib, ... }:
 let
   cfg = config.services.hyperhive.swarmContainer;