Merge pull request 'Design 29: a folder a module owns says how it treats files it did not write (issue 1024)' (#409) from feat/owned-paths into main

03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md

@@ -5,7 +5,7 @@ code:
   - mesh-controller internal/inventory
   - mesh-controller internal/catalogue
   - mesh-controller cmd/mesh-controller
-updated: 2026-10-16
+updated: 2026-10-17
 decisions:
   - "ADR 0181"
   - "ADR 0182"
@@ -16,6 +16,11 @@ decisions:
   - "ADR 0117"
   - "ADR 0399"
   - "ADR 0400"
+  - "ADR 0412"
+  - "ADR 0415"
+  - "ADR 0416"
+  - "ADR 0417"
+  - "ADR 0422"
 ---
 
 # 29 — A node has operator accounts, and the mesh owns what lives under a home
@@ -58,6 +63,15 @@ These are a **family**, not one module: an `ssh-client` module, a shell module,
 module, each a *universal-tier* consumer of the account fact — assigned wherever a person logs in,
 which is every node, unlike the graphical stack that a capability gates.
 
+**A folder a module owns says how it treats a file it did not write** (ADR 0416, ADR 0422). Declaring a
+directory under a home owns it (ADR 0182 §1), and the owner alone writes there and reacts to every file
+that enters it, never losing what the file held. The manifest says how, on the directory itself:
+`unknown` is `move-out` (the node-engine moves every path the manifest does not declare and `knows` does
+not name into `~/.local/state/mesh-moved/<module>/`, with a list), `module` (the module's own process
+reacts, as ssh-client does in `~/.ssh`) or `program` (everything in it is the program's, as in a
+service's data directory). `move-out` is only for a folder under a home, the home of the account the
+assignment runs for (ADR 0412 §5). A folder many modules write in is not declared at all.
+
 ## 3. The whole of `~/.ssh` is the mesh's — with one boundary drawn inside it
 
 The predecessor owned a single file (`~/.ssh/config`) and left the rest alone; it drifted, because
@@ -84,6 +98,9 @@ ADR 0117 draws for the uplink and the sshd
 module draws for the firewall: **the mesh must never be able to arrange the one failure that severs
 its own way back in.** The carve-out is not a convenience; it is that rule, in `~/.ssh`.
 
+Since ADR 0415 and ADR 0417 the found class no longer holds in `~/.ssh`: ssh-client moves out what it
+does not know into a kept folder, and never moves a key or `authorized_keys`, which keeps this boundary.
+
 ## 4. Keys are the mesh's to generate — through a CA, and existing keys are adopted, not replaced
 
 Key *generation* is the mesh's, not each node's improvising its own. The clean form is an **SSH