the spec names the resolver and the address

dns and ip were declared, validated, handed to the runtime — and part of
no comparison, so their first deployment compared every container equal
and changed nothing, silently. The same shape as 04-ISSUES/045: a field
that is not in the spec is a field that can never reach a container that
already runs.

internal/apply/apply.go

@@ -1314,6 +1314,15 @@ func containerSpecReading(r *declaration.Container, declares, reads map[string]s
 	for _, a := range r.Args {
 		b.WriteString("arg " + a + "\n")
 	}
+	// The resolver and address are part of what was declared: a container whose dns or ip moved
+	// is a different container, or the fields could never reach one that already ran — which is
+	// exactly how their first deployment silently changed nothing.
+	for _, d := range r.Dns {
+		b.WriteString("dns " + d + "\n")
+	}
+	if r.IP != "" {
+		b.WriteString("ip " + r.IP + "\n")
+	}
 	// The cadence is part of what was declared, so a changed schedule is a changed spec — the marker
 	// moves and the install is reported "updated" and re-established. Added only when present, so no
 	// ordinary container's or run-once step's digest moves for a field it does not set.