Land feature 57's node-engine work on its release branch

The node-engine renders the feature's templates, collections and moved
providers' files, on the SDK the feature's modules build on (feature 57,
config and provisioning).

internal/apply/filled.go

@@ -160,7 +160,7 @@ func WriteFilled(
 // filledAs is the declared file with the filled content in place of the declaration's.
 func filledAs(declared *declaration.File, content []byte) *declaration.File {
 	f := *declared
-	f.Content, f.Sealed, f.Bytes, f.Secrets = string(content), "", "", nil
+	f.Content, f.Sealed, f.VaultSealed, f.Bytes, f.Secrets = string(content), "", nil, "", nil
 	if f.Mode == "" && (declared.Secret() || len(declared.Secrets) > 0) {
 		// Written as the declaration would have written it: a file carrying a credential is not world-readable.
 		f.Mode = "0600"
@@ -204,3 +204,27 @@ func recordKeeping(known *store.State, r declaration.Resource, o Outcome, was st
 	}
 	recordApplied(known, store.OriginDeclared, r, o, kept, keptMode, keptOwner)
 }
+
+// leftToTheClient is a filled file as an apply leaves it (novox/hq ADR 0349 §5, design 57 P7): untouched, and said
+// so. A file the mesh wrote at the same path under another id, going in this apply, is handed to it as an apply hands
+// a whole file (novox/hq ADR 0223): its record — what the mesh wrote there, and the original it kept — is the filled
+// file's now, so the verb judges what is there against it, and the file is neither removed nor written.
+func leftToTheClient(f *declaration.File, known *store.State, handedFiles map[string]store.Applied, report *Report,
+	log func(string)) Outcome {
+	if from, handed := handedFiles[f.ID]; handed {
+		if _, recorded := known.Find(f.ID); !recorded {
+			rec := from
+			rec.ID = f.ID
+			known.Record(rec)
+		}
+		delete(handedFiles, f.ID)
+		known.Forget(from.ID)
+		detail := "no longer declared; " + f.ID + " declares the file now, filled by the provisioner's client, so " +
+			"it was handed to it, not removed"
+		report.Outcomes = append(report.Outcomes, Outcome{ID: from.ID, Type: from.Type, Target: from.Target,
+			Action: "forgotten", Detail: detail})
+		log(fmt.Sprintf("  forgotten %s (%s): %s", from.ID, from.Target, detail))
+	}
+	return Outcome{ID: f.ID, Type: string(declaration.TypeFile), Target: f.Path, Action: "unchanged",
+		Detail: "filled by the provisioner's client, which alone has it written"}
+}