internal/apply/hold.go

@@ -235,6 +235,15 @@ func holdOnAdopted(ctx context.Context, sys system.System, r declaration.Resourc
 		}
 	}
 
+	// A file written into replaces nothing that was found, so it is never held (novox/hq ADR
+	// 0102) — and a hold from when it was declared whole must not keep the mesh's keys out.
+	if f, ok := r.(*declaration.File); ok && f.Into != "" {
+		if already {
+			known.Release(r.Identity())
+		}
+		return false, false, out, nil
+	}
+
 	module, untaken := d.Adoption.UntakenModuleOf(r.Identity())
 	if !untaken {
 		return false, false, out, nil

internal/apply/into_test.go

@@ -281,3 +281,24 @@ func TestAListTheMeshCreatedGoesWhenEmptied(t *testing.T) {
 		t.Errorf("the key the mesh created was not removed: %v", o)
 	}
 }
+
+func TestAHoldFromAWholeFileDoesNotKeepOutAnIntoWrite(t *testing.T) {
+	// Declared whole before, the runtime's file was held; declared into now, it is written into.
+	path := filepath.Join(t.TempDir(), "daemon.json")
+	_ = os.WriteFile(path, []byte(machinesOwn), 0o644)
+	known := store.State{Held: []store.Held{{ID: "networking.registry-trust", Module: "networking",
+		Kind: "file", Target: path}}}
+	d := adopted(t, `{"taken":[],"untaken":{"networking":["networking.registry-trust"]}}`,
+		fmt.Sprintf(`{"id":"networking.registry-trust","type":"file","path":%q,"into":"json","content":%q}`,
+			path, `{"insecure-registries":["10.42.0.1:5000"]}`))
+	report, state := applyAdopted(t, d, known, &machine{}, t.TempDir())
+	if got := outcomeOf(report, "networking.registry-trust").Action; got != "updated" {
+		t.Errorf("the file was %q, not written into", got)
+	}
+	if len(state.Held) != 0 {
+		t.Errorf("the old hold outlived the into declaration: %+v", state.Held)
+	}
+	if fmt.Sprint(readObject(t, path)["insecure-registries"]) != "[192.0.2.7:5000 10.42.0.1:5000]" {
+		t.Errorf("the mesh's member was not written in: %v", readObject(t, path))
+	}
+}