Write into a file the machine shares instead of over it, and reload a service that re-reads its configuration instead of restarting it (hq ADR 0102)

internal/apply/hold.go

@@ -46,9 +46,13 @@ func KeepIn(dir string) Keep {
 }
 
 // holdable is whether a resource is one a predecessor can already have on the machine: a file at
-// a path, or a container under a name.
+// a path, or a container under a name. A file written into is not: it replaces nothing that was
+// found, only adds the mesh's keys beside it (novox/hq ADR 0102).
 func holdable(r declaration.Resource) bool {
-	return r.Kind() == declaration.TypeFile || r.Kind() == declaration.TypeContainer
+	if f, ok := r.(*declaration.File); ok {
+		return f.Into == ""
+	}
+	return r.Kind() == declaration.TypeContainer
 }
 
 // found is whether a declared file or container is present on the machine with no record of this