the spec names the resolver and the address

dns and ip were declared, validated, handed to the runtime — and part of
no comparison, so their first deployment compared every container equal
and changed nothing, silently. The same shape as 04-ISSUES/045: a field
that is not in the spec is a field that can never reach a container that
already runs.

internal/apply/vocabulary_test.go

@@ -435,3 +435,19 @@ func TestAContainerIsGivenItsResolverAndItsAddress(t *testing.T) {
 		}
 	}
 }
+
+// The resolver and address are part of the spec — a container whose dns or ip moved is a
+// different container, or the fields can never reach one that already runs. That is not
+// hypothetical: their first deployment compared equal and changed nothing.
+func TestAChangedResolverOrAddressIsAChangedContainer(t *testing.T) {
+	base := &declaration.Container{ID: "c", Name: "x", Image: "a@sha256:00"}
+	withDns := &declaration.Container{ID: "c", Name: "x", Image: "a@sha256:00", Dns: []string{"192.168.203.254"}}
+	withIP := &declaration.Container{ID: "c", Name: "x", Image: "a@sha256:00", IP: "192.168.203.254"}
+	plain := containerSpecReading(base, nil, nil)
+	if containerSpecReading(withDns, nil, nil) == plain {
+		t.Error("adding a resolver did not change the spec, so it can never reach a running container")
+	}
+	if containerSpecReading(withIP, nil, nil) == plain {
+		t.Error("adding an address did not change the spec, so it can never reach a running container")
+	}
+}