Count only a record of making something at a path as the mesh's, not an access record (hq ADR 0103)

internal/apply/hold.go

@@ -189,10 +189,13 @@ func present(path string) bool {
 	return err == nil
 }
 
-// recordedPath is whether this host has a record of making something at a path.
+// recordedPath is whether this host has a record of MAKING something at a path — a directory it
+// created, a file it wrote, an archive it unpacked. An access record is not one of those: it says
+// the mesh set permissions on a path it does not own, which is exactly what it does to a path
+// somebody else's software made, so a path it only has access for is still found (novox/hq ADR 0103).
 func recordedPath(known store.State, path string) bool {
 	for _, kind := range []declaration.Type{declaration.TypeDirectory, declaration.TypeFile,
-		declaration.TypeArchive, declaration.TypeAccess} {
+		declaration.TypeArchive} {
 		if known.Recorded(string(kind), path) {
 			return true
 		}