Give the controller the contract it can fill (hq ADR 0325, issue 567)

The controller cannot know the operator's account's uid, names an access by its
declared id (which holds a slash), and should not parse words. A tool runner's
account may now come by name alone and is read here (refused when absent or root's,
its uid said in the access's listing); the take act matches the declared id exactly;
an access wait says its reason (keep or disk) and, for a filesystem that refuses
ACLs, whether the take act can enable them.

internal/apply/keeper_linux.go

@@ -242,6 +242,9 @@ func TakeFolder(ctx context.Context, d *declaration.Declaration, id, path, warra
 	if d == nil {
 		return nil, "", errors.New("this engine has applied no declaration, and takes no folder it was not told of")
 	}
+	if err := ResolveRunners(ctx, d)[id]; err != nil {
+		return nil, "", err
+	}
 	var access *declaration.Access
 	for _, r := range d.Resources {
 		if a, ok := r.(*declaration.Access); ok && a.ID == id {
@@ -444,3 +447,27 @@ func JudgeKept(path string, users []store.KeptUser, limits WalkLimits) (WalkCoun
 	})
 	return w.counts, err
 }
+
+// aclProbe is what a keep wait says of its folder's filesystem and ACLs: ACLNeedsEnabling when it refuses them
+// now and is a ZFS dataset the take act lets carry them, ACLUnsupported when no act can, "" when it allows
+// them or the folder cannot be read (the wait says nothing then). Reads only.
+func aclProbe(path, mount string) string {
+	_, fd, st, err := openKept(path, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, nil)
+	if err != nil {
+		return ""
+	}
+	defer unix.Close(fd)
+	if _, err := getACL(fd, aclAccessXattr, uint32(st.Mode)&0o7777); !errors.Is(err, ErrNoACL) {
+		return ""
+	}
+	return aclWord(mountSourceOf(mount))
+}
+
+// aclWord is what a keep wait says of a filesystem that refuses ACLs now, by its mount's source and type: only a
+// ZFS dataset is one the take act lets carry them.
+func aclWord(source, fstype string) string {
+	if fstype == "zfs" && source != "" {
+		return ACLNeedsEnabling
+	}
+	return ACLUnsupported
+}