Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/i3/README.md

@@ -16,14 +16,14 @@ The window manager as a module (novox/hq ADR 0208, research 026, to-be 42 phase
 
 | path | class (ADR 0182) | what |
 |---|---|---|
-| `~/.config/i3/` | owned directory | its contents other than `config` are found and kept |
-| `~/.config/i3/config.d/` | owned directory | other modules' drop-ins, and yours |
+| `~/.config/i3/` | owned directory (`move-out`) | what the module declares, and `scripts/` (named in `knows`: the screenshot binding in the main file runs `scripts/screenshot.sh`, kept until its owner exists); any other file is moved out by the node-engine to `~/.local/state/mesh-moved/i3/` with a list, never deleted (ADR 0422 §4) |
+| `~/.config/i3/config.d/` | owned directory (`move-out`) | what the module declares, and `10-asus.conf` and `20-g14.conf` (named in `knows`, kept until the laptop's hardware module exists); any other file is moved out by the node-engine to `~/.local/state/mesh-moved/i3/` with a list, never deleted (ADR 0422 §4) |
 | `~/.config/i3/config` | owned (the found file kept once) | the main configuration, from [`files/config`](files/config) |
 | `/etc/lemurs/wms/i3` | owned | the login manager's session entry: `exec systemd-cat -t x-session /bin/sh "$HOME/.xinitrc"`, the session's output in the journal (`journalctl -t x-session`) because the login manager's pipe has no reader |
 
-**Drop-ins.** Another module adds to i3 with its own `~/.config/i3/config.d/<NN>-<module>.conf`. The
-`include` is the last line of the main file, so every variable set there (`$mod`, `$ws1`…`$ws10`) is
-in scope. Files are read in name order. A file of yours there is yours.
+**Drop-ins.** `~/.config/i3/config.d/` holds what this module declares and the files named in `knows`; a
+file of yours put there is moved out (ADR 0422). The `include` is the last line of the main file, so every
+variable set there (`$mod`, `$ws1`…`$ws10`) is in scope. Files are read in name order.
 
 ## The reload watcher
 
@@ -103,10 +103,13 @@ key.
 volume, the sessions launcher and the screenshot binding. Each leaves when the module that owns it is
 written. The peripherals' tray applet left it for the `polychromatic` module.
 
-## What it leaves found
+## What it keeps, and what it moves out
 
-`~/.config/i3/scripts/`, `~/.config/i3/unlock-keyring.sh`, every file in `config.d/`, the
-`/usr/share/xsessions` entries (the package's, no longer offered by `lemurs`), and i3's restart
+Kept, because they work for the operator today: `~/.config/i3/scripts/` (the screenshot binding runs
+`scripts/screenshot.sh`), and `config.d/10-asus.conf` and `20-g14.conf`, each until its owner exists. Both are
+named in `knows`. Anything else in `~/.config/i3/` (such as `unlock-keyring.sh`) or in `config.d/` is moved
+out by the node-engine to `~/.local/state/mesh-moved/i3/` with a list, never deleted (ADR 0422 §4). Left
+alone, outside the folders: the `/usr/share/xsessions` entries (the package's, no longer offered by `lemurs`), and i3's restart
 state and logs.
 
 ## The one-off migration (ADR 0182)
@@ -120,11 +123,11 @@ state and logs.
    module decides.
 3. **Delete `/etc/lemurs/wms/i3wm`** (see `lemurs`).
 4. **`config.d/` fragments:**
-   - `10-asus.conf` and `20-g14.conf` (the laptop) belong to that machine model's hardware module.
-     Keep them until it exists. The desktop no longer carries them.
-   - `50-slack.conf` (both) is yours, or a future `slack` module's. Keep it.
-   - `99-tmp-wine-focus.conf` (the desktop), a test of a predecessor change by its own comment:
-     **delete** it, or keep it as yours.
+   - `10-asus.conf` and `20-g14.conf` (the laptop) belong to that machine model's hardware module. They
+     are named in `knows`, so they stay until it exists. The desktop no longer carries them.
+   - `50-slack.conf` is not an i3 file: the Slack rule is dunst's (`dunstrc.d`, see `dunst`).
+   - `99-tmp-wine-focus.conf` (the desktop), a test of a predecessor change by its own comment, is moved
+     out at the first look with a list; nothing is lost.
 5. **The main file's predecessor copy** is kept once by the host and written over. Nothing to do.
 
 ## What changes when it is assigned
@@ -156,6 +159,13 @@ about to end, or accept it: a reload keeps every window and workspace.
 
 `node-display-session` receives `config` contributions, and this module places them with
 `${contribution:node-display-session:config}` near the end of its configuration, each module's
-under a line naming it. `~/.config/i3/config.d/` is now the operator's alone: the include at the very
+under a line naming it. `~/.config/i3/config.d/` holds only what is declared and named in `knows`: the include at the very
 end reads it after the mesh's lines. The catalogue-wide test composes every module's contribution as
 the controller does and checks the result with `i3 -C`.
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `~/.config/i3`: holds only what this module declares and `scripts/` (the main file's screenshot binding runs `scripts/screenshot.sh`; kept until its owner exists); anything else is moved out by the node-engine to `~/.local/state/mesh-moved/i3/` with a list, never deleted (ADR 0422 §4).
+- `~/.config/i3/config.d`: holds only what this module declares and `10-asus.conf`, `20-g14.conf` (the laptop's, kept until its hardware module exists); anything else is moved out by the node-engine to `~/.local/state/mesh-moved/i3/` with a list, never deleted (ADR 0422 §4).

modules/i3/module.json

@@ -72,14 +72,18 @@
       "type": "directory",
       "path": "${machine:account-home}/.config/i3",
       "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["scripts/"]
     },
     {
       "id": "drop-ins",
       "type": "directory",
       "path": "${machine:account-home}/.config/i3/config.d",
       "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["10-asus.conf", "20-g14.conf"]
     },
     {
       "id": "config",