seele

One tool that measures what the machine has become, asks about the parts nothing accounts for, and acts on the answers. It is what makes "why is this disk full" and "move this machine to that one" answerable from a record instead of by inspection.

Evidence is separate from disposition

Provenance answers where a file came from. It does not answer whether you may delete it, whether it should follow you to the next machine, or whether it is a secret. A taxonomy that derives the second from the first classifies model weights as untouchable and SSH keys as unexplained bytes. So they are two layers.

Evidence — measured	Mechanism
byte-identical to the composed image, modified, or absent	btrfs diff against the generation
package-owned; modified against packaged content	`rpm -qf`, `rpm -V`
requested by the user, or pulled in as a dependency	dnf history
size, file count, shape, last written	`stat`
last read	atime, via `relatime`
which process wrote it	attribution

Disposition — decided once	Meaning
`keep`	follows you to another machine
`never-touch`	no automated action, ever, regardless of any other property
`recreatable(cost)`	can be rebuilt, priced in bytes, wall time and network
`secret`	leaves the machine only with explicit per-item consent
`unknown`	the default, and the only thing that generates a question

Two rules that shape the tool

You never write a declaration. There is no manifest to maintain. Answering the queue is what produces the declaration, which is the only version of this idea that survives contact with a real machine.

A declaration patches the repository, never a live slot. Any setting that exists only in a running system's /etc is a bug. A tool that wrote its answers into the live slot would manufacture that bug at machine speed.

Read-recency is the evidence that distinguishes live state from dead state, and nothing else substitutes for it: mtime records when something was last written, which for a cache is precisely the wrong signal.