Judge a filled write with the roots the last apply read, asking no runtime per file (issue 1138)

internal/apply/filled.go

@@ -29,6 +29,11 @@ import (
 //
 // The caller holds the apply's lock: a write and an apply never write one file at once. log is said the path, the
 // action and the digest, never the content.
+//
+// **It does not refresh the runtimes' data roots.** A filled write is one file, not an apply; the placement guard
+// judges it with the roots the last apply read (runtimeDataRoots), falling back to the runtimes' configuration
+// files when no apply has read them yet — the runtimes themselves are asked once, at an apply's start, not once
+// per file (novox/hq issue 1138).
 func WriteFilled(
 	ctx context.Context,
 	sys system.System,
@@ -68,7 +73,6 @@ func WriteFilled(
 
 	in := inputs{declares: map[string]string{}, known: &known, windows: windows, away: newStoreAway(windows, log),
 		groups: groupsWanted(d.Resources), handed: Handed{}}
-	refreshRuntimeRoots(ctx)
 	in.refused = refusedPlaces(d.Resources)
 	in.agentHomes = rootNeverHomes(d)
 	in.dirsBefore = map[string]bool{}