Say who owns a placed file at runtime, and which files the provisioner fills

The provisioner (ADR 0349 §5) needs each file it places to say whether it is
owned, a seed or managed, and the node-engine needs to know which paths it
fills. The words map onto today's forms (drift written back, create-once,
into), so no write changes; the reader accepts the fields and states
OwnershipContract before any controller sends them. Issue 667.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/mesh-host/main.go

@@ -1647,7 +1647,7 @@ func declaredResolvConf(d *declaration.Declaration) (string, string, bool) {
 	}
 	for _, r := range d.Resources {
 		f, ok := r.(*declaration.File)
-		if !ok || f.Path != network.ResolvConf || f.CreateOnce || f.Into != "" {
+		if !ok || f.Path != network.ResolvConf || f.Seeded() || f.Into != "" {
 			continue
 		}
 		module, ok := liveness.ModuleOf(f.ID)
@@ -1769,8 +1769,9 @@ func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, sa
 func healthAsReported(st liveness.Statement, ns *network.Statement) *link.Health {
 	// LibraryContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase B), judges a
 	// user's declared `root` (novox/hq ADR 0266), and reads a declaration's identities, groups and libraries
-	// (novox/hq ADR 0328), which is what tells the controller it may be sent any of those fields.
-	h := &link.Health{Contract: link.BusyContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
+	// (novox/hq ADR 0328), a container's busy (ADR 0335) and a file's owner-at-runtime and the filled files (ADR
+	// 0349 §5), which is what tells the controller it may be sent any of those fields.
+	h := &link.Health{Contract: link.OwnershipContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
 	for _, r := range st.Resources {
 		h.Resources = append(h.Resources, link.ResourceHealth{Module: r.Module, Resource: r.ID, Kind: r.Kind,
 			Target: r.Target, State: r.State, Reason: r.Reason, Since: r.Since.UTC(), Streak: r.Streak,

cmd/mesh-host/units_test.go

@@ -87,10 +87,10 @@ func TestTheStatementSaysAnAccountJudgedForRoot(t *testing.T) {
 			Groups: []string{"openrazer"}}, State: accounts.Healthy, Since: at},
 	}}
 	h := withAccounts(healthAsReported(liveness.Statement{At: at}, nil), as)
-	// At RootContract or later: an engine that also reads a container's busy says BusyContract (novox/hq ADR
-	// 0335), one above ADR 0334's OwnGroupContract.
-	if h.Contract < link.RootContract || link.RootContract != 3 || h.Contract != link.BusyContract ||
-		link.BusyContract != link.OwnGroupContract+1 {
+	// At RootContract or later: an engine that also reads a file's owner-at-runtime and the filled files says
+	// OwnershipContract (novox/hq ADR 0349 §5), one above ADR 0335's BusyContract.
+	if h.Contract < link.RootContract || link.RootContract != 3 || h.Contract != link.OwnershipContract ||
+		link.OwnershipContract != link.BusyContract+1 || link.BusyContract != link.OwnGroupContract+1 {
 		t.Fatalf("contract %d", h.Contract)
 	}
 	got := map[string]string{}