A fellow engineer came to me with an interesting puzzle.
He discovered that third party module (docker, in this case) which contains a class he wants to customize with parameters is not referenced explicitly anywhere in our manifest. Yet the class is indeed being included in the machine's catalog.
He had been referencing resources within the class (a Service resource) as part of his relationships and ordering.
Does a reference to a Service in a foreign class implicitly include that class in the catalog?
No, if you're just creating a dependency or notification relationship; if the resource is not in a class that's been included somehow, then you'll get an error instead of an automatic inclusion of the class.
More likely it's being included in a way you aren't expecting. To test, remove the references to the class from the included module (and in finding them, make sure they're all just dependencies), and verify that the class is no longer included in the node's catalog.
My money's on him using a defined type belonging to the docker module, which in turn is including the other classes that it needs.