occ's config:app:set put the secret on the docker exec command line, so it sat in the docker CLI's argv, the container's php argv and docker's exec record. Apply jwt_secret through config:import on occ's stdin instead; the other three onlyoffice keys still go through config:app:set.
nextcloud
The nextcloud module of the mesh catalogue: runs the container image nextcloud.
Files it does not know
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
${dir:mesh-state}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:state}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:html}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).