textus 0.47.1 → 0.50.0

data/lib/textus/manifest/entry/base.rb

@@ -42,6 +42,7 @@ module Textus
         # without `respond_to?` guards.
         def template       = nil
         def inject_boot    = false # rubocop:disable Naming/PredicateMethod
+        def provenance     = true  # rubocop:disable Naming/PredicateMethod
         def events         = {}
         def publish_tree   = nil
         def ignore         = []

data/lib/textus/manifest/entry/derived.rb

@@ -5,13 +5,14 @@ module Textus
         Projection = ::Data.define(:select, :pluck, :sort_by, :transform)
         External   = ::Data.define(:sources, :command)
 
-        attr_reader :source, :template, :inject_boot, :events
+        attr_reader :source, :template, :inject_boot, :provenance, :events
 
-        def initialize(source:, template: nil, inject_boot: false, events: {}, **rest)
+        def initialize(source:, template: nil, inject_boot: false, provenance: true, events: {}, **rest)
           super(**rest)
           @source = source
           @template = template
           @inject_boot = inject_boot
+          @provenance = provenance
           @events = events || {}
         end
 
@@ -53,6 +54,7 @@ module Textus
             source: source,
             template: raw["template"],
             inject_boot: raw["inject_boot"] == true,
+            provenance: raw.fetch("provenance", true) != false,
             events: raw["events"] || {},
             **common,
           )

data/lib/textus/manifest/rules.rb

@@ -1,8 +1,8 @@
 module Textus
   class Manifest
     class Rules
-      RuleSet = ::Data.define(:fetch, :handler_allowlist, :guard, :retention)
-      EMPTY_SET = RuleSet.new(fetch: nil, handler_allowlist: nil, guard: nil, retention: nil)
+      RuleSet = ::Data.define(:handler_allowlist, :guard, :lifecycle)
+      EMPTY_SET = RuleSet.new(handler_allowlist: nil, guard: nil, lifecycle: nil)
 
       def self.parse(raw)
         new(Array(raw).map { |b| Block.new(b) })
@@ -15,17 +15,16 @@ module Textus
       attr_reader :blocks
 
       def for(key)
-        slots = { fetch: [], handler_allowlist: [], guard: [], retention: [] }
+        slots = { handler_allowlist: [], guard: [], lifecycle: [] }
         @blocks.each do |b|
           next unless Textus::Domain::Policy::Matcher.matches?(b.match, key)
 
           slots.each_key { |slot| slots[slot] << b if b.public_send(slot) }
         end
         RuleSet.new(
-          fetch: pick(slots[:fetch], :fetch, key),
           handler_allowlist: pick(slots[:handler_allowlist], :handler_allowlist, key),
           guard: pick(slots[:guard], :guard, key),
-          retention: pick(slots[:retention], :retention, key),
+          lifecycle: pick(slots[:lifecycle], :lifecycle, key),
         )
       end
 
@@ -44,29 +43,17 @@ module Textus
       end
 
       class Block
-        attr_reader :match, :fetch, :handler_allowlist, :guard, :retention
+        attr_reader :match, :handler_allowlist, :guard, :lifecycle
 
         def initialize(raw)
           @match = raw["match"] or raise Textus::UsageError.new("rule block missing match:")
-          @fetch = parse_fetch(raw["fetch"])
           @handler_allowlist = parse_handler_allowlist(raw["intake_handler_allowlist"])
           @guard = parse_guard(raw["guard"])
-          @retention = parse_retention(raw["retention"])
+          @lifecycle = parse_lifecycle(raw["lifecycle"])
         end
 
         private
 
-        def parse_fetch(h)
-          return nil if h.nil?
-
-          Textus::Domain::Policy::Fetch.new(
-            ttl: h["ttl"],
-            on_stale: h["on_stale"] || "warn",
-            sync_budget_ms: h["sync_budget_ms"],
-            fetch_timeout_seconds: h["fetch_timeout_seconds"],
-          )
-        end
-
         def parse_handler_allowlist(arr)
           return nil if arr.nil?
 
@@ -83,12 +70,13 @@ module Textus
           h
         end
 
-        def parse_retention(h)
+        def parse_lifecycle(h)
           return nil if h.nil?
 
-          Textus::Domain::Policy::Retention.new(
-            expire_after: h["expire_after"],
-            archive_after: h["archive_after"],
+          Textus::Domain::Policy::Lifecycle.new(
+            ttl: h["ttl"],
+            on_expire: h["on_expire"],
+            budget_ms: h["budget_ms"],
           )
         end
       end

data/lib/textus/manifest/schema.rb

@@ -25,17 +25,15 @@ module Textus
       ENTRY_KEYS = %w[
         key path zone kind schema owner nested format
         compute template publish
-        intake events inject_boot ignore tracked
+        intake events inject_boot provenance ignore tracked
       ].freeze
       # ADR 0052: the typed publish block — `publish: { to: [...] }` (file
       # fan-out) xor `publish: { tree: "dir" }` (subtree mirror).
       PUBLISH_KEYS = %w[to tree].freeze
       COMPUTE_KEYS = %w[kind select pluck sort_by limit transform command sources].freeze
       INTAKE_KEYS  = %w[handler config].freeze
-      RULE_KEYS    = %w[match fetch intake_handler_allowlist guard retention].freeze
-      FETCH_KEYS = %w[ttl on_stale sync_budget_ms fetch_timeout_seconds].freeze
-      FETCH_TIMEOUT_SECONDS_CEILING = 3600
-      RETENTION_KEYS = %w[expire_after archive_after].freeze
+      RULE_KEYS    = %w[match intake_handler_allowlist guard lifecycle].freeze
+      LIFECYCLE_KEYS = %w[ttl on_expire budget_ms].freeze
       AUDIT_KEYS = %w[max_size keep].freeze
 
       # Syntactic shape of an `owner:` subject token (the `patrick` in
@@ -136,11 +134,7 @@ module Textus
         Array(rules).each_with_index do |r, i|
           path = "$.rules[#{i}]"
           walk(r, RULE_KEYS, path)
-          if r["fetch"].is_a?(Hash)
-            walk(r["fetch"], FETCH_KEYS, "#{path}.fetch")
-            validate_fetch_timeout!(r["fetch"]["fetch_timeout_seconds"], "#{path}.fetch.fetch_timeout_seconds")
-          end
-          walk(r["retention"], RETENTION_KEYS, "#{path}.retention") if r["retention"].is_a?(Hash)
+          walk(r["lifecycle"], LIFECYCLE_KEYS, "#{path}.lifecycle") if r["lifecycle"].is_a?(Hash)
         end
       end
 
@@ -217,15 +211,6 @@ module Textus
         OWNER_SUBJECT_PATTERN.match?(subject)
       end
 
-      def self.validate_fetch_timeout!(value, path)
-        return if value.nil?
-        return if value.is_a?(Integer) && value.positive? && value <= FETCH_TIMEOUT_SECONDS_CEILING
-
-        raise BadManifest.new(
-          "fetch_timeout_seconds at '#{path}' must be a positive integer ≤ #{FETCH_TIMEOUT_SECONDS_CEILING} (got #{value.inspect})",
-        )
-      end
-
       def self.walk(hash, allowed, path)
         return unless hash.is_a?(Hash)
 

data/lib/textus/mcp/server.rb

@@ -89,12 +89,19 @@ module Textus
           return
         end
 
-        @session.check_etag!(contract_etag)
-
         name = params["name"]
         args = params["arguments"] || {}
+
+        # ADR 0083: the contract-drift guard gates mutating verbs — every MCP
+        # verb that is NOT a pure read (Write:: + the destructive Maintenance::
+        # verbs tend/zone_mv/key_*_prefix). Reads and boot bypass it (a stale
+        # read returns on-disk truth; boot re-orients). Keying on read_verbs
+        # (not write_verbs) keeps the destructive Maintenance:: verbs gated.
+        @session.check_etag!(contract_etag) unless Catalog.read_verbs.include?(name)
+
         result = Catalog.call(name, session: @session, store: @store, args: args)
         @session = @session.advance_cursor(@store.audit_log.latest_seq) if name == "pulse"
+        @session = @session.with(contract_etag: contract_etag) if name == "boot"
 
         emit_result(rid, {
                       "content" => [{ "type" => "text", "text" => JSON.dump(result) }],

data/lib/textus/ports/audit_log.rb

@@ -23,7 +23,7 @@ module Textus
           parsed = parse_row(line.chomp)
           next unless parsed
           next unless parsed["key"] == key
-          next unless %w[put delete].include?(parsed["verb"])
+          next unless %w[put delete key_delete].include?(parsed["verb"])
 
           last_role = parsed["role"]
         end

data/lib/textus/ports/audit_subscriber.rb

@@ -10,7 +10,7 @@ module Textus
     # rescue and the failure is a bus-internal concern, not a domain
     # event subscribers should be able to filter by key glob).
     #
-    # Lifecycle audit rows for verb: "put" / "delete" / "rename" are written
+    # Lifecycle audit rows for verb: "put" / "key_delete" / "key_mv" are written
     # by Envelope::IO::Writer directly (it owns the
     # audit-append-as-final-step invariant); this subscriber covers the
     # hook-failure case the writer never sees.

data/lib/textus/ports/fetch/detached.rb

@@ -31,7 +31,11 @@ module Textus
               # exists). Config-time detection is doctor's job (ADR 0044 Q2).
               role = acting_role(store)
               exit(0) unless role
-              store.as(role).fetch(key)
+              # FetchWorker is the internal executor since the public `fetch`
+              # verb was collapsed (ADR 0079); drive it directly.
+              Textus::Write::FetchWorker.new(
+                container: store.container, call: Textus::Call.build(role: role),
+              ).run(key)
             rescue StandardError
               # Already logged via :fetch_failed; exit cleanly.
             ensure

data/lib/textus/read/boot.rb

@@ -10,14 +10,16 @@ module Textus
       verb     :boot
       summary  "Return the orientation contract: zones, entries, schemas, write_flows, agent_quickstart."
       surfaces :cli, :mcp
+      arg :lean, :boolean,
+          description: "return only orientation essentials (zones, agent_quickstart, contract_etag) for cheap session-start injection"
 
       def initialize(container:, call:)
         @container = container
         @call      = call
       end
 
-      def call
-        Textus::Boot.build(container: @container)
+      def call(lean: false)
+        Textus::Boot.build(container: @container, lean: lean)
       end
     end
   end

data/lib/textus/read/freshness.rb

@@ -2,28 +2,30 @@ require "time"
 
 module Textus
   module Read
-    # Per-entry freshness report. Walks every entry declared in the manifest,
-    # consults `rules_for(key)` for a fetch rule, and reports the
-    # current status. Status is one of :fresh, :stale, :never_fetched, or
-    # :no_policy.
+    # Per-entry lifecycle scan (ADR 0079, 0085). Walks every entry declared in
+    # the manifest, consults `rules.for(key)` for a `lifecycle:` policy, and
+    # reports the unified verdict. Status is one of :fresh, :expired, or
+    # :no_policy; the row also carries the policy's :action (on_expire).
+    #
+    # ADR 0085 removed the public `freshness` verb: there is no `:cli`/`:mcp`
+    # surface. This is now a Ruby-only internal scan (empty `surfaces`, the
+    # honest home reserved by ADR 0073) consumed by `pulse` (which derives
+    # `stale` + `next_due_at` from it) and the hook `Context`. Humans drill
+    # into per-entry lifecycle detail via `get` (last_fetched_at) + `rule_explain`
+    # (the ttl / on_expire policy) instead of a dedicated verb.
     class Freshness
       extend Textus::Contract::DSL
 
       verb     :freshness
-      summary  "Report the fetch-freshness status of every entry with a fetch policy."
-      surfaces :cli
-      cli      "freshness"
+      summary  "Internal per-entry lifecycle scan (status, age, ttl, on_expire); backs pulse + hook context. No public surface (ADR 0085)."
       arg :prefix, String, required: false, description: "filter to keys with this prefix"
       arg :zone,   String, required: false, description: "filter to entries in this zone"
-      view(:cli) { |rows| { "verb" => "freshness", "rows" => rows } }
 
-      def initialize(container:, call:, evaluator: Textus::Domain::Freshness::Evaluator)
+      def initialize(container:, call:)
         @container  = container
         @call       = call
         @manifest   = container.manifest
         @file_store = container.file_store
-        @evaluator  = evaluator
-        @cache      = {}
       end
 
       # Returns the soonest `next_due_at` across all entries with a fetch
@@ -52,29 +54,38 @@ module Textus
       private
 
       def row_for(mentry)
-        set = @manifest.rules.for(mentry.key)
-        fetch = set.fetch
+        policy = lifecycle_for(mentry.key)
         envelope = safe_get(mentry.key)
         last = envelope&.meta&.dig("last_fetched_at")
 
-        return base_row(mentry, last).merge(status: :no_policy) if fetch.nil?
-
-        fp = fetch.to_freshness_policy
-        cache_key = [mentry.key, last]
-        verdict = (@cache[cache_key] ||= @evaluator.call(fp, envelope, now: @call.now))
-        status = if verdict.fresh? then :fresh
-                 elsif last.nil?   then :never_fetched
-                 else                   :stale
-                 end
+        return base_row(mentry, last).merge(status: :no_policy) if policy.nil?
 
+        expired, reason = Textus::Domain::Lifecycle.verdict(
+          policy: policy,
+          last_fetched_at: last,
+          mtime: mtime_for(mentry.key),
+          now: @call.now,
+        )
         base_row(mentry, last).merge(
-          ttl_seconds: fp.ttl_seconds,
-          on_stale: fp.on_stale,
-          status: status,
-          next_due_at: next_due(last, fp.ttl_seconds),
+          ttl_seconds: policy.ttl_seconds,
+          action: policy.on_expire,
+          status: expired ? :expired : :fresh,
+          reason: reason,
+          next_due_at: next_due(last, policy.ttl_seconds),
         )
       end
 
+      def lifecycle_for(key)
+        @manifest.rules.for(key).lifecycle
+      end
+
+      def mtime_for(key)
+        path = @manifest.resolver.resolve(key).path
+        @file_store.exists?(path) ? Textus::Ports::Storage::FileStat.new.mtime(path) : nil
+      rescue Textus::Error
+        nil
+      end
+
       def base_row(mentry, last)
         {
           key: mentry.key,

data/lib/textus/read/get.rb

@@ -2,42 +2,39 @@ module Textus
   module Read
     # The one read path. `fetch:` controls behavior:
     #   fetch: false (default) — pure read: the on-disk envelope annotated with
-    #     a freshness verdict. NEVER builds the orchestrator (no threads/forks/
-    #     locks/events). This is the safe default for direct (in-process)
-    #     callers — accept/reject/publish, materializer, uid, validate_all/
-    #     validator, schema tooling, and the hook context — that must read
-    #     persisted truth without triggering a fetch.
-    #   fetch: true — read-through: after a stale verdict, hands off to the
-    #     fetch orchestrator per the entry's fetch rule (degrades to the pure
-    #     result when the key has no rule).
+    #     a lifecycle freshness verdict. NEVER builds the orchestrator and NEVER
+    #     mutates. Safe for direct callers (accept/reject/publish, materializer,
+    #     uid, validators, hooks).
+    #   fetch: true — read-through: after a stale verdict on a `refresh` policy,
+    #     hands off to the fetch orchestrator. A read NEVER performs a
+    #     destructive action (drop/archive) — those belong to the `tend` sweep
+    #     (ADR 0079).
     #
-    # The public `get` verb is read-through because the contract declares
-    # `arg :fetch, default: true`, injected on every verb surface (RoleScope +
-    # MCP map_args, ADR 0062 amendment). Direct construction bypasses that
-    # injection and so gets the safe `fetch: false` method default.
+    # Lifecycle policy comes from the unified `lifecycle:` rule slot (ADR 0079).
     class Get
       extend Textus::Contract::DSL
 
       verb     :get
-      summary  "Read one entry. Read-through by default — fetches on stale per " \
-               "the entry's fetch rule, degrading to a pure read when the key " \
-               "has no rule. Pass fetch:false for a guaranteed pure on-disk " \
-               "read. Returns the envelope (uid, etag, _meta, body, freshness)."
+      summary  "Read one entry. Read-through by default — refreshes on stale per " \
+               "the entry's lifecycle rule (on_expire: refresh), degrading to a " \
+               "pure read when the key has no rule. Pass fetch:false for a " \
+               "guaranteed pure on-disk read. Returns the envelope (uid, etag, " \
+               "_meta, body, freshness)."
       surfaces :cli, :mcp
       arg :key, String, required: true, positional: true,
                         description: "dotted entry key to read, e.g. 'knowledge.project'"
       arg :fetch, :boolean, default: true,
-                            description: "read-through (fetch on stale per the " \
-                                         "entry's fetch rule) when true, the default; " \
+                            description: "read-through (refresh on stale per the " \
+                                         "entry's lifecycle rule) when true, the default; " \
                                          "false returns the on-disk envelope without ever fetching"
       view { |v, _i| v.to_h_for_wire }
 
-      def initialize(container:, call:, evaluator: Textus::Domain::Freshness::Evaluator, orchestrator: nil)
+      def initialize(container:, call:, orchestrator: nil, file_stat: Textus::Ports::Storage::FileStat.new)
         @container  = container
         @call       = call
         @manifest   = container.manifest
         @file_store = container.file_store
-        @evaluator  = evaluator
+        @file_stat  = file_stat
         @orchestrator = orchestrator # nil → built lazily on first fetch only
       end
 
@@ -46,12 +43,11 @@ module Textus
         return envelope if envelope.nil?
         return envelope unless fetch && envelope.freshness&.stale
 
-        fetch_policy = fetch_policy_for(key)
-        return envelope if fetch_policy.nil?
+        policy = lifecycle_for(key)
+        return envelope unless policy&.on_expire == :refresh # only refresh acts on a read
 
-        policy  = fetch_policy.to_freshness_policy
         verdict = Textus::Domain::Freshness::Verdict.stale(envelope.freshness.reason)
-        outcome = orchestrator.execute(policy.decide(verdict), key: key)
+        outcome = orchestrator.execute(refresh_policy(policy).decide(verdict), key: key)
         resolve(outcome, envelope)
       end
 
@@ -64,23 +60,42 @@ module Textus
 
       private
 
-      # Pure read + freshness verdict; no orchestrator dependency.
+      # Pure read + unified lifecycle verdict; no orchestrator dependency.
       def annotated_envelope(key)
         envelope = read_raw_envelope(key)
         return nil if envelope.nil?
 
-        fetch_policy = fetch_policy_for(key)
-        return annotate_fresh(envelope) if fetch_policy.nil?
+        policy = lifecycle_for(key)
+        return annotate_fresh(envelope) if policy.nil?
 
-        policy  = fetch_policy.to_freshness_policy
-        verdict = @evaluator.call(policy, envelope, now: @call.now)
+        expired, reason = Textus::Domain::Lifecycle.verdict(
+          policy: policy,
+          last_fetched_at: envelope.meta&.dig("last_fetched_at"),
+          mtime: mtime_for(key),
+          now: @call.now,
+        )
         envelope.with(freshness: Textus::Domain::Freshness.build(
-          stale: verdict.stale?, reason: verdict.reason, fetching: false,
+          stale: expired, reason: reason, fetching: false,
         ))
       end
 
-      def fetch_policy_for(key)
-        @manifest.rules.for(key).fetch
+      def lifecycle_for(key)
+        @manifest.rules.for(key).lifecycle
+      end
+
+      def refresh_policy(policy)
+        Textus::Domain::Freshness::Policy.new(
+          ttl_seconds: policy.ttl_seconds,
+          on_stale: policy.budget_ms ? :timed_sync : :sync,
+          sync_budget_ms: policy.budget_ms,
+        )
+      end
+
+      def mtime_for(key)
+        path = @manifest.resolver.resolve(key).path
+        @file_stat.exists?(path) ? @file_stat.mtime(path) : nil
+      rescue Textus::Error
+        nil
       end
 
       def resolve(outcome, envelope)

data/lib/textus/read/pulse.rb

@@ -30,7 +30,7 @@ module Textus
         {
           "cursor" => @audit_log.latest_seq,
           "changed" => audit_changes_since(since),
-          "stale" => freshness_rows.select { |r| r[:status] == :stale }.map { |r| r[:key] },
+          "stale" => freshness_rows.select { |r| r[:status] == :expired }.map { |r| r[:key] },
           "pending_review" => review_keys,
           "doctor" => doctor_summary,
           "contract_etag" => contract_etag,

data/lib/textus/read/rule_explain.rb

@@ -1,7 +1,7 @@
 module Textus
   module Read
     # Effective rules for a key, at two depths (ADR 0059). Lean by default —
-    # `{ fetch, guard }`, the agent-cheap read that was the `rules` verb. With
+    # `{ lifecycle, guard }`, the agent-cheap read that was the `rules` verb. With
     # `detail: true` it returns the verbose explanation — every matching policy
     # block plus the per-transition guard predicate names — that was
     # `policy_explain`. One verb, one name across CLI/MCP/method; the audience
@@ -10,7 +10,7 @@ module Textus
       extend Textus::Contract::DSL
 
       verb     :rule_explain
-      summary  "Effective rules for a key. Lean {fetch, guard} by default; detail: true adds matched blocks + guard predicates."
+      summary  "Effective rules for a key. Lean {lifecycle, guard} by default; detail: true adds matched blocks + guard predicates."
       surfaces :cli, :mcp
       cli      "rule explain"
       arg :key,    String, required: true, positional: true,
@@ -34,11 +34,10 @@ module Textus
       def effective(key)
         set = @manifest.rules.for(key)
         {
-          "fetch" => set.fetch && {
-            "ttl_seconds" => set.fetch.ttl_seconds,
-            "on_stale" => set.fetch.on_stale,
-            "sync_budget_ms" => set.fetch.sync_budget_ms,
-            "fetch_timeout_seconds" => set.fetch.fetch_timeout_seconds,
+          "lifecycle" => set.lifecycle && {
+            "ttl_seconds" => set.lifecycle.ttl_seconds,
+            "on_expire" => set.lifecycle.on_expire,
+            "budget_ms" => set.lifecycle.budget_ms,
           },
           "guard" => set.guard,
         }.compact
@@ -57,22 +56,17 @@ module Textus
           matched_blocks: matching.map do |b|
             {
               match: b.match,
-              fetch: !b.fetch.nil?,
+              lifecycle: !b.lifecycle.nil?,
               handler_allowlist: !b.handler_allowlist.nil?,
               guard: !b.guard.nil?,
-              retention: !b.retention.nil?,
             }
           end,
           effective: {
-            fetch: winners.fetch && {
-              ttl_seconds: winners.fetch.ttl_seconds,
-              on_stale: winners.fetch.on_stale,
+            lifecycle: winners.lifecycle && {
+              ttl_seconds: winners.lifecycle.ttl_seconds,
+              on_expire: winners.lifecycle.on_expire,
             },
             handler_allowlist: winners.handler_allowlist&.handlers,
-            retention: winners.retention && {
-              expire_after: winners.retention.expire_after,
-              archive_after: winners.retention.archive_after,
-            },
           },
           guards: Textus::Domain::Policy::BaseGuards::BASE.keys.to_h do |transition|
             [transition, factory.for(transition, key).predicates.map(&:name)]

data/lib/textus/read/rule_list.rb

@@ -20,17 +20,15 @@ module Textus
       def call
         @manifest.rules.blocks.map do |b|
           row = { "match" => b.match }
-          if b.fetch
-            row["fetch"] = {
-              "ttl_seconds" => b.fetch.ttl_seconds,
-              "on_stale" => b.fetch.on_stale,
-              "sync_budget_ms" => b.fetch.sync_budget_ms,
-              "fetch_timeout_seconds" => b.fetch.fetch_timeout_seconds,
+          if b.lifecycle
+            row["lifecycle"] = {
+              "ttl_seconds" => b.lifecycle.ttl_seconds,
+              "on_expire" => b.lifecycle.on_expire,
+              "budget_ms" => b.lifecycle.budget_ms,
             }
           end
           row["handler_allowlist"] = b.handler_allowlist.handlers if b.handler_allowlist
           row["guard"] = b.guard if b.guard
-          row["retention"] = { "expire_after" => b.retention.expire_after, "archive_after" => b.retention.archive_after } if b.retention
           row
         end
       end

data/lib/textus/version.rb

@@ -1,4 +1,4 @@
 module Textus
-  VERSION = "0.47.1"
+  VERSION = "0.50.0"
   PROTOCOL = "textus/3"
 end

data/lib/textus/write/accept.rb

@@ -52,7 +52,7 @@ module Textus
 
       def hook_context = @hook_context ||= Textus::Hooks::Context.for(container: @container, call: @call)
       def put_op       = @put_op ||= Textus::Write::Put.new(container: @container, call: @call)
-      def delete_op    = @delete_op ||= Textus::Write::Delete.new(container: @container, call: @call)
+      def delete_op    = @delete_op ||= Textus::Write::KeyDelete.new(container: @container, call: @call)
     end
   end
 end

data/lib/textus/write/fetch_worker.rb

@@ -2,16 +2,10 @@ require "timeout"
 
 module Textus
   module Write
+    # Internal fetch executor for one quarantine/intake entry. No longer a
+    # public verb (ADR 0079 collapsed the `fetch` surface): used by `get`'s
+    # orchestrator (read-through refresh) and by the `tend` sweep.
     class FetchWorker
-      extend Textus::Contract::DSL
-
-      verb     :fetch
-      summary  "Run a fetch action for one quarantine entry."
-      surfaces :cli, :mcp
-      arg :key, String, required: true, positional: true,
-                        description: "quarantine-zone entry key to refresh using its declared intake action"
-      view { |outcome| { "outcome" => outcome.class.name.split("::").last.downcase } }
-
       FETCH_TIMEOUT_SECONDS = IntakeFetch::FETCH_TIMEOUT_SECONDS
 
       def initialize(container:, call:)
@@ -69,9 +63,11 @@ module Textus
         @fetch_events ||= FetchEvents.from(container: @container, call: @call)
       end
 
-      def fetch_timeout_for(key)
-        rule = @manifest.rules.for(key)
-        rule&.fetch&.fetch_timeout_seconds || FETCH_TIMEOUT_SECONDS
+      # ADR 0079: a per-rule fetch_timeout_seconds override was an accepted loss
+      # in the fetch:/retention: → lifecycle: collapse; the constant ceiling
+      # applies to every intake.
+      def fetch_timeout_for(_key)
+        FETCH_TIMEOUT_SECONDS
       end
 
       def fetch_with_events(key, mentry, remaining)

data/lib/textus/write/{delete.rb → key_delete.rb}

@@ -1,9 +1,9 @@
 module Textus
   module Write
-    class Delete
+    class KeyDelete
       extend Textus::Contract::DSL
 
-      verb     :delete
+      verb     :key_delete
       summary  "Delete one entry by key. Single-key, lower blast radius than " \
                "key_delete_prefix; guarded by an optional optimistic-concurrency etag. Returns {ok, key, deleted}."
       surfaces :cli, :mcp
@@ -25,7 +25,7 @@ module Textus
         Textus::Manifest::Data.validate_key!(key)
         mentry = @manifest.resolver.resolve(key).entry
 
-        guard_for(:delete, key, if_etag: if_etag).check!(eval_for(:delete, target_key: key))
+        guard_for(:key_delete, key, if_etag: if_etag).check!(eval_for(:key_delete, target_key: key))
 
         writer.delete(key, mentry: mentry, if_etag: if_etag)