Keep the original of any file the host writes over without a record of it, on every node, and name where (hq ADR 0100)

internal/apply/hold_test.go

@@ -472,8 +472,40 @@ func TestAConvergedNodeStillReplacesWhatItFinds(t *testing.T) {
 	if len(state.Held) != 0 || outcomeOf(report, "hello-web.page").Action == "held" {
 		t.Errorf("a converged node held something: %+v", state.Held)
 	}
-	if _, err := os.Stat(filepath.Join(dir, "kept")); !errors.Is(err, os.ErrNotExist) {
-		t.Error("a converged node kept originals")
+	// What it writes over that it has no record of, it keeps first — on any node.
+	o := outcomeOf(report, "hello-web.page")
+	kept := o.Detail[strings.Index(o.Detail, "kept at ")+len("kept at "):]
+	if got, err := os.ReadFile(kept); err != nil || string(got) != "the predecessor's page\n" {
+		t.Errorf("the file written over was not kept, or not named: %q (%s) %v", got, o.Detail, err)
+	}
+}
+
+func TestAFileWrittenOverIsKeptOnceAndOnlyWhenTheHostHasNoRecordOfIt(t *testing.T) {
+	dir := t.TempDir()
+	conf := filepath.Join(dir, "nftables.conf")
+	_ = os.WriteFile(conf, []byte("# the distribution's own\n"), 0o644)
+	decl := func(content string) *declaration.Declaration {
+		return parse(t, `{"declaration":1,"resources":[{"id":"nftables.config","type":"file","path":"`+conf+
+			`","content":"`+content+`"}]}`)
+	}
+	m := &machine{containers: map[string]*fakeContainer{}}
+	report, state := applyAdopted(t, decl("table inet mesh {}\\n"), store.State{}, m, dir)
+	o := outcomeOf(report, "nftables.config")
+	if !strings.Contains(o.Detail, "had no record of, was kept at ") {
+		t.Fatalf("writing over an unrecorded file did not keep it: %+v", o)
+	}
+	kept := o.Detail[strings.Index(o.Detail, "kept at ")+len("kept at "):]
+	if got, _ := os.ReadFile(kept); string(got) != "# the distribution's own\n" {
+		t.Errorf("the kept original is %q", got)
+	}
+
+	// Now the mesh's: a later change keeps nothing more, and the first original stays.
+	report, _ = applyAdopted(t, decl("table inet mesh { }\\n"), state, m, dir)
+	if o := outcomeOf(report, "nftables.config"); o.Action != "updated" || strings.Contains(o.Detail, "kept at") {
+		t.Errorf("a file the mesh wrote was kept again: %+v", o)
+	}
+	if got, _ := os.ReadFile(kept); string(got) != "# the distribution's own\n" {
+		t.Errorf("the first original was overwritten: %q", got)
 	}
 }