homehub: rsync-based home-drive sync via Synology hub

DESIGN.md is the rationale; README.md the operations half.
Four data classes: files (mtime-arbitrated two-way), git repos (manifest +
clone, never byte-synced), the browser link bar (union merge), and everything
else denied by default.

rules/sets.d/base.list

@@ -0,0 +1,42 @@
+# set: base — the minimum every machine (laptop included) syncs both ways.
+# Plain home-relative paths; trailing slash = directory subtree.
+# Remember: denylist wins, so anything under /.config/ can never appear here (§8).
+
+# identity + credentials (accepted in decision D1: the hub then holds every key
+# you own, which is why the hub copy is forced 700/600 and the NAS must stay LAN-only)
+/.ssh/
+/.gitconfig
+/.gitignore_global
+/.hgrc
+
+# shell / terminal
+/.bashrc
+/.bash_profile
+/.bash_logout
+/.profile
+/.inputrc
+/.screenrc
+/.tmux.conf
+/.p10k.zsh
+/.vimrc
+/.alsoftrc
+/.gtk-bookmarks
+
+# personal scripts
+/bin/
+
+# pi agent STATE only — never install/ bin/ npm/ (§8: state vs config vs cache)
+/.pi/agent/sessions/
+/.pi/agent/settings.json
+/.pi/agent/models.json
+/.pi/agent/models-store.json
+/.pi/agent/AGENTS.md
+/.pi/agent/extensions/
+/.pi/agent/prompts/
+/.pi/agent/skills/
+
+# homehub's shared state root: the ONE directory whose contents are shared
+# verbatim, and the anchor that survives the NixOS migration unchanged (§8).
+# It is deliberately NOT ~/.local/state/homehub — that is homehub's own private
+# scratch (filters, markers, error logs), and syncing it makes machines fight.
+/.local/state/shared/

rules/sets.d/docs.list

@@ -0,0 +1,2 @@
+# set: docs — real documents. On the laptop too (decision D4).
+/Documents/

rules/sets.d/media.list

@@ -0,0 +1,2 @@
+# set: media — desktops only for now; 323 M and grows sideways.
+/Pictures/

rules/sets.d/misc.list

@@ -0,0 +1,7 @@
+# set: misc — small hand-written trees that are not git repos.
+# Anything here that later becomes a repo must be REMOVED from this set and picked
+# up by `homehub git inventory` instead (§6).
+/journal/
+/projects/
+/mu_code/
+/public_html/