textus 0.49.0 → 0.51.0

data/docs/architecture/README.md

@@ -1,13 +1,13 @@
 # Textus architecture
 
 > **Explanation** · for contributors · **read this first** for orientation before SPEC
-> **SSoT for** the Ruby implementation layout (layers, container, ports, read/write/fetch paths) · **reviewed** 2026-06 (v0.43)
+> **SSoT for** the Ruby implementation layout (layers, container, ports, read/write/produce paths) · **reviewed** 2026-06 (v0.45)
 
 ```mermaid
 flowchart TD
     interface["Interface — CLI verbs · MCP gate (JSON-RPC)"]
-    application["Application — Call · Container · Dispatcher · RoleScope<br/>read/ · write/ · maintenance/ use cases · envelope IO"]
-    domain["Domain — Permission · Freshness · Staleness<br/>Policy (Guard · GuardFactory · BaseGuards · Evaluation · Fetch · Matcher · Predicates)"]
+    application["Application — Call · Container · Dispatcher · RoleScope<br/>read/ · write/ · maintenance/ · produce/ use cases · envelope IO"]
+    domain["Domain — Permission · Freshness<br/>Policy (Guard · GuardFactory · BaseGuards · Evaluation · Fetch · Matcher · Predicates)"]
     infra["Infrastructure — Store · FileStore · Manifest · Schemas<br/>Ports · Hooks · Entry format strategies"]
     interface --> application
     application --> domain
@@ -38,12 +38,11 @@ MCP/Ruby, `view(:cli)` for the operator envelope); declarative `source:`/
 wrap the single dispatch site (`RoleScope#dispatch_bound`) for stateful verbs;
 and `cli_default:` declares a CLI default that diverges from the agent default.
 `CLI::Runner` generates a command per `:cli` contract, dispatching `contract.verb`
-by construction. Only verbs with genuine *behavior* — `put` (fetch
-orchestration), `get` (UnknownKey + resolver suggestions, CLI-only), `build`
-(actor-role resolution + BuildLock), the `fetch`/`fetch_all` workers, and the
-`boot`/`doctor` composite reports — stay hand-authored, plus commands with no
-dispatcher verb (`init`, `hook`, `mcp serve`, `schema diff/init`). Total
-reconciliation specs make name/dispatch/facet drift unrepresentable.
+by construction. Only verbs with genuine *behavior* — `put` (entry persistence),
+`get` (UnknownKey + resolver suggestions, CLI-only), and `doctor` (not yet
+generatable) — stay hand-authored, plus commands with no dispatcher verb (`init`,
+`hook`, `mcp serve`, `schema diff/init`). `boot` is auto-generated from its
+contract. Total reconciliation specs make name/dispatch/facet drift unrepresentable.
 
 **Application**
 
@@ -55,13 +54,13 @@ Dispatcher       (static VERBS table: verb → use-case)
 RoleScope        (Store#as(role) — forwards verb calls)
 
 read/{get,list,where,uid,schema_envelope,
-      deps,rdeps,published,stale,validate_all,boot,doctor,
+      deps,rdeps,published,validate_all,boot,doctor,
       freshness,audit,blame,rule_explain,rule_list,pulse}.rb
-write/{put,delete,mv,accept,reject,build,
-       materializer,intake_fetch,retention_sweep,
-       fetch_worker,fetch_orchestrator,fetch_all}
-maintenance/{migrate,key_mv_prefix,key_delete_prefix,
+write/{put,key_delete,key_mv,accept,reject,propose}.rb
+maintenance/{reconcile,key_mv_prefix,key_delete_prefix,
              zone_mv,rule_lint}.rb
+produce/{engine,events,render,
+         acquire/{intake,handler,projection,serializer}}.rb
 envelope/io/{reader,writer}.rb  (split: parse vs persist)
 projection.rb
 ```
@@ -70,8 +69,7 @@ projection.rb
 
 ```
 Permission         (write predicate per zone)
-Freshness::{Policy,Verdict,Evaluator}
-Staleness          (Generator/Intake checks)
+Freshness::{Verdict,Evaluator}
 Action  Outcome  Sentinel
 Policy::{Guard,GuardFactory,BaseGuards,Evaluation,Fetch,Matcher,HandlerAllowlist,
          Predicates::{ZoneWritableBy,SchemaValid,AuthorHeld,TargetIsCanon,EtagMatch,FreshWithin}}
@@ -87,7 +85,7 @@ Storage::FileStore (bytes-only port: read/write/delete/
 Manifest           (Data, Resolver, Policy, Rules)
 Schemas            (eager-load cache)
 Ports::{AuditLog,AuditSubscriber,Publisher,Clock,
-        Fetch::Lock,Fetch::Detached,BuildLock}
+        BuildLock,ProduceOnWriteSubscriber,SentinelStore}
 Hooks::{EventBus,RpcRegistry,Loader,Context,FireReport,
         Signature,Builtin,ErrorLog}
 Entry::{Markdown,Json,Yaml,Text}  (format strategies)
@@ -125,7 +123,7 @@ reached through `Dispatcher::VERBS`, not a special method on `RoleScope`.
 
 Two collaborators live outside the dispatcher because they're composed by other use cases, not invoked as verbs:
 
-- `Write::FetchOrchestrator` — composes `FetchWorker` with the freshness `Action` returned by `Domain::Freshness`.
+- `Produce::Engine` — runs `reconcile`'s produce pipeline; composes `Acquire::Intake` (external pull via handler) with `Produce::Render` (template-driven publish) per entry. `AsyncRunner` (nested in `Engine`) enqueues reactive re-produce on `entry_written` events and drains before the process exits.
 - `Envelope::IO::{Reader,Writer}` — own the parse and persist halves of the write pipeline; the audit-append-as-final-step invariant lives in `Writer`.
 
 ## Container
@@ -139,7 +137,7 @@ Container = Data.define(
 )
 ```
 
-The `Store` builds one `Container` at boot; every use case receives it via `(container:, call:)`. RPC hook callables (`:resolve_intake`, `:transform_rows`, `:validate`) receive `caps: <Container>` — field names match what the prior `WriteCaps` exposed, so handlers reading `caps.manifest`, `caps.events`, etc. continue to work.
+The `Store` builds one `Container` at boot; every use case receives it via `(container:, call:)`. RPC hook callables (`:resolve_handler`, `:transform_rows`, `:validate`) receive `caps: <Container>` — field names match what the prior `WriteCaps` exposed, so handlers reading `caps.manifest`, `caps.events`, etc. continue to work.
 
 ## Ports
 
@@ -151,9 +149,9 @@ Ports are infrastructure adapters with an interface defined by the domain. Each
 | `Ports::AuditLog` | Append-only structured log (`audit.log`). Owns seq numbering, file-locking, and rotation. |
 | `Ports::Clock` | Supplies `Time.now` — a module-function so tests can swap it without dependency injection boilerplate. |
 | `Ports::Publisher` | Copies a built artifact to a repo-relative consumer path and writes a sentinel so the next publish can confirm the target is managed. |
-| `Ports::Fetch::Lock` | Non-blocking `flock`-backed lock per key — prevents concurrent fetch workers from racing on the same entry. |
-| `Ports::Fetch::Detached` | Spawns a background thread for async fetch; the caller receives a `fetch_backgrounded` event instead of blocking. |
-| `Ports::BuildLock` | Process-exclusive `flock` guard over the materializer build pipeline. Raises `BuildInProgress` if a build is already running. |
+| `Ports::BuildLock` | Process-exclusive `flock` guard over the produce pipeline. Raises `BuildInProgress` if a build is already running. |
+| `Ports::ProduceOnWriteSubscriber` | Pub-sub listener on `entry_written`; enqueues keys into `Produce::Engine::AsyncRunner` for reactive re-produce after any write. |
+| `Ports::SentinelStore` | Reads and writes the per-target sentinel file that `Publisher` uses to detect unmanaged overwrites. |
 
 Application use cases access ports only through `Container` fields — never through the raw `Store`.
 
@@ -188,43 +186,49 @@ The four members are wired in `Manifest.build` (`lib/textus/manifest.rb`). `Mani
 
 ## Read path (`store.get(key)`)
 
-`Read::Get` is the single public read verb (ADR 0062). It is read-through by default: it returns the freshest obtainable envelope, fetching on a stale verdict per the entry's fetch rule, and degrading to a pure on-disk result when the key has no fetch rule. An optional `fetch: false` flag (CLI `--no-fetch`, MCP `{fetch:false}`) forces a pure on-disk read.
+`Read::Get` is the single public read verb. It is a **pure read** (ADR 0089): it resolves the path, reads bytes, parses the envelope, and annotates a freshness verdict — it NEVER ingests and NEVER mutates. The read-through that once refreshed a stale entry in-process (ADR 0062) is removed; quarantine freshness is system-pushed via `reconcile` (scheduled sweep) and `hook run` (event push).
 
 1. CLI verb (or MCP tool) calls `store.get(key, role:)` (or `store.as(role).get(key)`).
-2. `Store#get` looks up `Dispatcher::VERBS[:get] → Read::Get`, builds a `Call`, instantiates `Read::Get.new(container:, call:).call(key)`. The contract declares `arg :fetch, default: true`, injected by `Contract::Binder.bind` at the single verb-dispatch chokepoint (`RoleScope#dispatch_bound`) for every surface — so the public verb is always read-through unless the caller explicitly passes `fetch: false`.
-3. `Read::Get#call(key, fetch: false)` runs the pure read sub-step inline: resolves the path through `container.manifest`, reads bytes via `container.file_store`, parses the envelope, and annotates a freshness verdict (`stale`, `reason`, `fetching: false`). When the key has no fetch rule, the envelope is annotated fresh and returned immediately — no orchestrator is involved.
-4. If `fetch: true` and the verdict is stale and the entry's fetch rule demands action, `Read::Get` hands off to `Write::FetchOrchestrator` (built lazily — a pure `fetch: false` call never touches the orchestrator). The orchestrator executes the fetch policy's `Action` (`sync`, `timed_sync`, `detached`, …) and returns an `Outcome`.
-5. The outcome is mapped back to an envelope: `Fetched` → fresh envelope from the write; `Detached` → original envelope with `fetching: true`; `Failed` → original envelope with `fetch_error` set; `Skipped` → original envelope unchanged.
+2. `Store#get` looks up `Dispatcher::VERBS[:get] → Read::Get`, builds a `Call`, instantiates `Read::Get.new(container:, call:).call(key)`. The verb takes only `key` — there is no `fetch` flag on any surface.
+3. `Read::Get#call(key)` resolves the path through `container.manifest`, reads bytes via `container.file_store`, parses the envelope, and annotates a freshness verdict (`stale`, `reason`, `fetching: false`). When the key has no `upkeep` rule, the envelope is annotated fresh. A stale entry with `upkeep: { ttl:, action: refresh }` is returned **stale** — the read does not refresh it; the next `reconcile` does.
 
-The pure read is `Read::Get#call(key, fetch: false)` — it is the safe default for direct in-process callers (accept/reject/publish, materializer, uid, validate_all/validator, schema/tools, hooks/context) that must never trigger a fetch. They construct `Read::Get` directly, bypassing the dispatch injection that sets `fetch: true`. The prior separate read-through path `get_or_fetch` and the separate pure class `Read::GetEntry` were both unified into the one `Read::Get` class (ADR 0062 amendment).
+Because the read is always pure, every caller — interactive reads, dashboards, and the direct in-process callers (accept/reject/publish, materializer, uid, validate_all/validator, schema/tools, hooks/context) — gets the same orchestrator-free, side-effect-free read. The prior read-through path (`get_or_fetch`, then the `fetch:`-flagged `Read::Get`, ADR 0062) and its `Write::FetchOrchestrator` are gone (ADR 0089).
 
 ## Write path (`store.put(key, ...)`)
 
 1. CLI verb calls `store.put(key, meta:, body:, content:, if_etag:, role:)`.
 2. `Write::Put#call` validates the key, resolves the manifest entry, builds `GuardFactory.for(:put, key)` and calls `Guard#check!(eval)` (topology is predicate #0, `zone_writable_by`) — raises `WriteForbidden` if the topology gate denies, `GuardFailed` if any other predicate fails.
 3. Delegates persistence to `Envelope::IO::Writer#put`, which serializes, schema-validates, etag-checks (raises `EtagMismatch` on conflict), writes via the `FileStore` port, and appends the audit row.
-4. Publishes `:entry_put` via `container.events` with `ctx: <Hooks::Context>`, `key:`, `envelope:`.
+4. Publishes `:entry_written` via `container.events` with `ctx: <Hooks::Context>`, `key:`, `envelope:`.
 
-`Write::{Delete,Mv,Accept,Reject,Build}` follow the same shape: explicit container, the unified `Guard` for authz (built per transition via `GuardFactory`), `Envelope::IO::Writer` for persistence (where applicable), event published with the `Hooks::Context` handle.
+`Write::{KeyDelete,KeyMv,Accept,Reject,Propose}` follow the same shape: explicit container, the unified `Guard` for authz (built per transition via `GuardFactory`), `Envelope::IO::Writer` for persistence (where applicable), event published with the `Hooks::Context` handle.
 
-`Write::Mv` delegates the file-move + audit to `Envelope::IO::Writer#move`, then publishes `:entry_renamed` itself. UID injection (when the source lacks one) goes through `Envelope::IO::Writer#write` directly — no `Put` bypass.
+`Write::KeyMv` delegates the file-move + audit to `Envelope::IO::Writer#move`, then publishes `:entry_renamed` itself. UID injection (when the source lacks one) goes through `Envelope::IO::Writer#write` directly — no `Put` bypass.
 
-## Fetch path (`store.fetch(key)`)
+## Produce path (`reconcile` + reactive `entry_written`)
 
-1. CLI `Verb::Fetch` calls `store.fetch(key, role: "automation")`.
-2. `Write::FetchWorker#run(key)`:
-   - Resolves the manifest entry, looks up the intake handler via `container.rpc.callable(:resolve_intake, mentry.handler)`.
-   - Publishes `:fetch_started` with the hook context.
-   - Invokes the handler under a 30s thread-join deadline.
-   - On any error: publishes `:fetch_failed`, then re-raises.
-   - On success: builds `GuardFactory.for(:fetch, key)` and calls `Guard#check!`, then persists via `Envelope::IO::Writer#write` directly (no `Put` round-trip); publishes `:entry_fetched` unless etag is unchanged.
-3. `store.fetch_all(prefix:, zone:)` lists stale entries via `Read::Stale` and runs `FetchWorker#run` per entry; returns `{ fetched:, failed:, skipped: }`.
+The produce pipeline handles two concerns — **acquire** (pull live data via an intake handler) and **render** (template-driven artifact publish) — unified under `Produce::Engine`.
+
+`Produce::Engine.converge(container:, call:, keys:)` is the entry point for both `reconcile` (scheduled batch) and the reactive `AsyncRunner` (triggered on `entry_written` by `Ports::ProduceOnWriteSubscriber`).
+
+For each key, `Engine#produce_one`:
+
+1. **Acquire phase** — `Produce::Acquire::Intake#run(key)`:
+   - Resolves the manifest entry; looks up the intake handler via `container.rpc.callable(:resolve_handler, mentry.handler)`.
+   - Publishes `:entry_fetch_started` via `Produce::Events`.
+   - Invokes the handler under a timeout deadline.
+   - On error: publishes `:entry_fetch_failed`, re-raises.
+   - On success: normalises the handler result via its own `normalize_action_result` (keyed on the entry's format), checks guard, persists via `Envelope::IO::Writer`, publishes `:entry_fetched` unless the etag is unchanged.
+   - `Acquire::Handler` resolves and invokes the RPC callable under the timeout deadline. (The sibling **projection** sub-path — `from: project` entries — instead runs `Acquire::Projection`, which renders data files through `Acquire::Serializer::{Json,Yaml,Text}` before persisting.)
+2. **Render phase** — `entry.publish_via(context)` calls `Produce::Render#bytes_for(target:, data:, boot:)` to expand the Mustache template and copy the result to the publish target via `Ports::Publisher`. Returns `nil` if no publish is configured (skipped).
+
+`AsyncRunner` (nested in `Engine`) enqueues reactive produce when `entry_written` fires, then drains before the process exits via an `at_exit` hook. A held `BuildLock` is a soft miss — the in-flight build already produces fresh output.
 
 ## Hook payload contract
 
-Pub-sub hooks (`:entry_put`, `:entry_fetched`, …) receive `ctx:` — a `Textus::Hooks::Context` that exposes a narrow surface (`get`, `list`, `put`, `delete`, `audit`, `publish_followup`, plus `role` and `correlation_id`). The raw `Store` is not handed out.
+Pub-sub hooks (`:entry_written`, `:entry_fetched`, …) receive `ctx:` — a `Textus::Hooks::Context` that exposes a narrow surface (`get`, `list`, `put`, `delete`, `audit`, `publish_followup`, plus `role` and `correlation_id`). The raw `Store` is not handed out.
 
-RPC hooks (`:resolve_intake`, `:transform_rows`, `:validate`) receive `caps:` — a `Textus::Container`. They are gem-internal: the framework calls them, not user pub-sub.
+RPC hooks (`:resolve_handler`, `:transform_rows`, `:validate`) receive `caps:` — a `Textus::Container`. They are gem-internal: the framework calls them, not user pub-sub.
 
 ## Agent surface (boot + pulse + MCP)
 

data/docs/reference/conventions.md

@@ -49,78 +49,83 @@ Tooling around `git blame` or audit logs may filter on owner; the gem itself onl
 
 ## Derived entries
 
-A derived entry declares a `compute:` block with a `kind:` discriminator. Two kinds:
+A derived entry declares a `source:` block with a `from:` discriminator (ADR 0093/0094). A `source:` acquires **data** — it never renders; rendering is a publish concern (below). Two `from:` values for derived entries:
 
-**`compute: { kind: projection }`** — textus computes the entry on `textus build` from other store entries. Declarative; nothing shells out.
+**`source: { from: project }`** — textus computes the entry's data on `textus reconcile` from other store entries. Declarative; nothing shells out. Projection fields are flat under `source:`.
 
 ```yaml
-- key: artifacts.catalogs.people
-  path: artifacts/catalogs/people.md
+- key: artifacts.derived.people
+  path: artifacts/derived/people.md
   zone: artifacts
   schema: null
   owner: automation:catalog-people
-  compute:
-    kind: projection
+  source:
+    from: project
     select: knowledge.network.org   # prefix or list of prefixes
     pluck:  [name, relationship, org]
     sort_by: name
-  template: people.mustache         # under .textus/templates/
+    format: json                    # the stored form is data
   publish:
-    to: [docs/people.md]            # optional repo-relative byte-copy targets
+    - { to: docs/people.md, template: people.mustache }   # render the data through a template
 ```
 
-**`compute: { kind: external }`** — an external build tool (rake, just, a shell script) produces the file. textus never executes the `command:`; it only tracks `sources:` so `textus freshness` can compare source mtimes against the file's `_meta.generated.at`. The role running the build must hold `build` (default: `automation`).
+**`source: { from: command }`** — an external build tool (rake, just, a shell script) produces the file. textus never executes the `command:`; it only tracks `sources:` so `doctor`'s `generator_drift` check can compare source mtimes against the file's `_meta.generated.at`. The role running the build must hold `reconcile` (default: `automation`).
 
 ```yaml
-- key: artifacts.catalogs.skills
-  path: artifacts/catalogs/skills.md
+- key: artifacts.derived.skills
+  path: artifacts/derived/skills.md
   zone: artifacts
   owner: automation:catalog-skills
-  compute:
-    kind: external
+  source:
+    from: command
     command: "rake catalog:skills"   # informational; the automation invokes it
     sources: [knowledge.projects, knowledge.network]
 ```
 
-The build automation is responsible for writing the `generated:` frontmatter block (`by`, `at`, `from`) when it produces the file. `generated.from` SHOULD match `compute.sources` — same list, recorded twice so a diff proves what was consumed.
+The build automation is responsible for writing the `generated:` frontmatter block (`by`, `at`, `from`) when it produces the file. `generated.from` SHOULD match `source.sources` — same list, recorded twice so a diff proves what was consumed.
 
-Full contract for both shapes is in [`../../SPEC.md` §5.2.1 and §5.2.2](../../SPEC.md). Transforms (`compute.transform:`) and subtree publishing (`publish: { tree: }`) are also covered there.
+Full contract for both shapes is in [`../../SPEC.md` §5.2.1 and §5.2.2](../../SPEC.md). Data transforms (`source.transform:`) and publishing (a `publish:` list of `{ to, template? }` / `{ tree }` targets — render or copy the data) are covered in §5.2–§5.3.
 
 ## Intake and freshness
 
-External inputs land via `:resolve_intake` hooks, not shell commands. Each intake entry names a registered handler; refresh is on demand via a read-through `get`:
+External inputs land via `:resolve_handler` hooks, not shell commands. Each intake entry declares `source: { from: handler, handler: <name>, ttl: <dur> }`; re-pull is system-pushed via `reconcile` (scheduled sweep) and `hook run` (event push) — a `get` never refreshes (ADR 0089):
 
 ```sh
-textus get feeds.notion.roadmap --as=automation        # refreshes if stale
-textus freshness --zone=feeds --output=json            # which entries are expired
+textus pulse --output=json                             # `stale` lists expired entries; `next_due_at` is the soonest deadline
+textus reconcile --as=automation                       # re-pulls every intake entry past its source.ttl
 ```
 
-Lifecycle budgets live in the top-level `rules:` block, matched by glob:
+The re-pull cadence is the entry's own `source.ttl`. Age-based garbage collection is the orthogonal `retention:` rule slot in the top-level `rules:` block, matched by glob (`{ ttl, action: drop | archive }`); the two compose — re-pull hourly *and* archive at 90 days:
 
 ```yaml
+- key: artifacts.feeds.notion.events
+  kind: produced                # produce-method (intake) read from source.from: handler
+  zone: artifacts
+  source: { from: handler, handler: notion, config: { ... }, ttl: 6h }
+
 rules:
-  - match: feeds.notion.**
-    lifecycle: { ttl: 6h, on_expire: refresh }   # refresh | warn | drop | archive
+  - match: artifacts.feeds.notion.**
+    retention: { ttl: 90d, action: archive }
 ```
 
-A typical scheduled integration reads each expired feed (a read-through `get`
-refreshes it in-process):
+A typical scheduled integration runs `reconcile` on a cron to re-pull every
+expired feed:
 
 ```sh
-textus get feeds.notion.roadmap --as=automation   # in cron / CI
+textus reconcile --as=automation   # in cron / CI — re-pulls all stale feeds
 ```
 
 See [`./zones.md` §6](zones.md) for the full intake contract and [`../how-to/writing-hooks.md`](../how-to/writing-hooks.md) for writing custom handlers.
 
 ### Read vs. refresh
 
-There is one public read operation (ADR 0062):
+There is one public read operation, and it is pure (ADR 0089):
 
 | Operation | Behaviour | Use for |
 |-----------|-----------|---------|
-| `ops.get` | Read-through by default — refreshes on stale per the entry's `lifecycle` rule when `on_expire: refresh`; degrades to a pure on-disk read when the key has no lifecycle rule. Pass `fetch: false` (CLI `--no-fetch`, MCP `{fetch:false}`) for an explicit pure read | all callers, including interactive reads, dashboards, and scripts that want the freshest obtainable envelope |
+| `ops.get` | A pure on-disk read annotated with a freshness verdict — it NEVER ingests, regardless of the entry's `action`. A stale `refresh` entry reads back stale until the next `reconcile`. | every caller — interactive reads, dashboards, scripts, and internal pipelines (materializer, projection, schema tooling, accept/reject/publish, uid, validator) |
 
-Build pipelines and other internal callers that must never trigger a refresh (materializer, projection, schema tooling, accept/reject/publish, uid, validator) construct `Read::Get` directly with the method default `fetch: false` — a pure, orchestrator-free read. They bypass the verb-dispatch injection that sets `fetch: true`, so they always get pure reads without any extra argument.
+Refreshing a stale entry is `reconcile`'s job (or a `hook run` event), never a read's — so no caller can accidentally trigger network I/O by reading.
 
 ## Body content
 
@@ -146,4 +151,4 @@ The user-facing CLI surface, the wire envelope shape, and the protocol version (
 
 - **MCP servers**: a thin server that exposes `textus get` and `textus put` as tools is the recommended way to give Claude/agents access. Don't bake MCP into this gem.
 - **Vector stores**: index `body` content into a vector store if you want fuzzy retrieval. `frontmatter` stays in textus as the source of truth for deterministic facts.
-- **CI**: run `textus freshness` (or `textus list` + schema validation) in CI to catch drift between derived entries and their sources.
+- **CI**: run `textus doctor` (the `generator_drift` check) or `textus pulse` (the `stale` list) in CI to catch drift between derived entries and their sources.

data/lib/textus/boot.rb

@@ -26,14 +26,11 @@ module Textus
         "propose changes by writing #{manifest.policy.queue_zone}.* entries with --as=#{name} " \
           "and a 'proposal:' frontmatter block; the #{authority} role runs 'textus accept' to apply"
       end,
-      fetch: lambda do |name, manifest|
-        "fetch #{zone_label(manifest, :quarantine, "quarantine")} entries with " \
-          "'textus fetch KEY --as=#{name}' (uses the entry's declared action)"
-      end,
-      build: lambda do |_name, manifest|
-        derived = zone_label(manifest, :derived, "derived")
-        "'textus build' computes #{derived} entries from projections; " \
-          "#{derived} files are never hand-edited"
+      reconcile: lambda do |_name, manifest|
+        machine = zone_label(manifest, :machine, "machine")
+        "'textus reconcile' materializes derived #{machine} entries from their sources and " \
+          "refreshes stale intake #{machine} entries from their declared source; " \
+          "derived files are never hand-edited (reactive on canon writes, or a full pass on demand)"
       end,
     }.freeze
 
@@ -71,49 +68,49 @@ module Textus
       },
     }.freeze
 
-    # Curated agent-facing verb catalog. For verbs that have a Dispatcher contract,
-    # the summary is derived from `contract.summary` at load time (ADR 0039). The
-    # editorial strings below are the fallback for CLI-only verbs without contracts.
-    # CLI_VERBS itself is assigned in textus.rb after Zeitwerk eager_load so that
-    # all contract-declaring files are loaded before derivation runs.
+    # Curated agent-facing verb catalog. This declares which verbs the operator
+    # CLI surfaces and in what order — the editorial presentation. The summary of
+    # each verb is a fact, not presentation: it is derived from `contract.summary`
+    # at load time (ADR 0039). A literal "summary" survives here only for grouped
+    # CLI tokens (schema/key/rule/hook) that aggregate several sub-contracts and so
+    # have no single contract to derive from. CLI_VERBS itself is assigned in
+    # textus.rb after Zeitwerk eager_load so all contract files are present.
     CURATED_CLI_VERBS = [
       { "name" => "boot" },
       { "name" => "list" },
       { "name" => "get" },
-      { "name" => "where", "summary" => "resolve a key to its zone and path without reading" },
+      { "name" => "where" },
       { "name" => "schema", "summary" => "schema operations: 'schema show KEY', 'schema diff', 'schema init', 'schema migrate'" },
       { "name" => "put" },
       { "name" => "propose" },
-      { "name" => "accept",   "summary" => "apply a queued proposal to its target zone; requires the author capability" },
-      { "name" => "key",      "summary" => "key operations: 'key delete', 'key mv', 'key uid'" },
-      { "name" => "build",    "summary" => "materialize derived entries; publish_to and publish_tree fan out copies" },
-      { "name" => "tend" },
-      { "name" => "freshness", "summary" => "per-entry lifecycle report (status, age, ttl, on_expire action)" },
-      { "name" => "audit",    "summary" => "query .textus/audit.log with filters (key, role, since, correlation-id, ...)" },
-      { "name" => "blame",    "summary" => "audit rows for one key joined with git commit metadata" },
-      { "name" => "rule",     "summary" => "inspect effective rules: 'rule list', 'rule explain KEY'" },
-      { "name" => "doctor",   "summary" => "health-check the store (missing schemas, illegal keys, sentinel drift, etc.)" },
-      { "name" => "hook",     "summary" => "list and run registered hooks: 'hook list', 'hook run NAME'" },
+      { "name" => "accept" },
+      { "name" => "key", "summary" => "key operations: 'key delete', 'key mv', 'key uid'" },
+      { "name" => "reconcile" },
+      { "name" => "audit" },
+      { "name" => "blame" },
+      { "name" => "rule", "summary" => "inspect effective rules: 'rule list', 'rule explain KEY'" },
+      { "name" => "doctor" },
+      { "name" => "hook", "summary" => "list and run registered hooks: 'hook list', 'hook run NAME'" },
       { "name" => "pulse" },
       { "name" => "capabilities" },
     ].freeze
 
-    # Build the CLI verb catalog by deriving each summary from the corresponding
-    # Dispatcher contract when one exists, falling back to the editorial string for
-    # CLI-only verbs without a contract (e.g. accept, build, where). Called once
-    # from textus.rb after eager_load so all contract files are present.
-    def self.build_cli_verbs
-      by_contract = Dispatcher::VERBS.values
-                                     .select { |k| k.respond_to?(:contract?) && k.contract? }
-                                     .to_h { |k| [k.contract.verb.to_s, k.contract.summary] }
+    # verb token => contract.summary, for every Dispatcher verb that carries a
+    # contract. The single source for a verb's one-line summary (ADR 0039).
+    def self.contract_summaries
+      Dispatcher::VERBS.values
+                       .select { |k| k.respond_to?(:contract?) && k.contract? }
+                       .to_h { |k| [k.contract.verb.to_s, k.contract.summary] }
+    end
 
+    # Build the CLI verb catalog: each summary is derived from its contract when
+    # one exists, falling back to the curated editorial string for grouped tokens
+    # (schema/key/rule/hook). Called once from textus.rb after eager_load.
+    def self.build_cli_verbs
+      summaries = contract_summaries
       CURATED_CLI_VERBS.map do |entry|
-        derived = by_contract[entry["name"]]
-        if derived
-          entry.merge("summary" => derived)
-        else
-          entry
-        end
+        derived = summaries[entry["name"]]
+        derived ? entry.merge("summary" => derived) : entry
       end
     end
 
@@ -130,7 +127,8 @@ module Textus
         # Both verb lists derive from the MCP catalog (ADR 0056, ADR 0057): the
         # agent's real read and write surface, named as verbs the agent calls —
         # not CLI strings. read_verbs can neither advertise a verb the agent
-        # cannot call (audit/freshness/doctor are CLI-only) nor omit one it can
+        # cannot call (audit/doctor are CLI-only; freshness is a Ruby-only
+        # internal scan, ADR 0085) nor omit one it can
         # (schema_show/rules); write_verbs drops the old `put KEY --as=… --stdin` CLI
         # framing (role is connection-resolved over MCP; there is no stdin).
         # writable_zones / propose_zone below carry the agent's write authority.
@@ -144,11 +142,11 @@ module Textus
 
     # Recipes reference verbs, not a transport's CLI strings (ADR 0056): every
     # step names a verb the agent can call (each transport frames it — CLI as
-    # `textus get KEY`, MCP as the `get` tool) or is a plain build step. This
+    # `textus get KEY`, MCP as the `get` tool) or is a plain materialize step. This
     # keeps shell lines out of the surface an MCP agent reads.
     def self.recipes(manifest)
       queue = manifest.policy.queue_zone
-      feeds = zone_label(manifest, :quarantine, "the quarantine zone")
+      feeds = zone_label(manifest, :machine, "the machine zone")
       {
         "read" => {
           "purpose" => "find and read an entry",
@@ -174,11 +172,11 @@ module Textus
             "accept #{queue}.KEY — promotes the proposal into its target zone",
           ],
         },
-        "fetch" => {
-          "purpose" => "refresh stale quarantine-zone caches from their declared intake",
+        "reconcile" => {
+          "purpose" => "keep the machine-maintained lanes fresh — re-pull stale intake entries from their declared source",
           "steps" => [
             "pulse — its `stale` list names entries past their ttl",
-            "fetch_all (zone: #{feeds}) — re-pull the stale entries",
+            "reconcile (zone: #{feeds}) — re-pull the stale entries",
           ],
         },
       }
@@ -196,8 +194,20 @@ module Textus
       )
     end
 
-    def self.build(container:)
+    def self.build(container:, lean: false)
       manifest = container.manifest
+      etag = Textus::Etag.for_contract(container.root)
+
+      if lean
+        return {
+          "protocol" => PROTOCOL_ID,
+          "store_root" => container.root,
+          "zones" => zones_for(manifest),
+          "agent_quickstart" => agent_quickstart(manifest, container.audit_log),
+          "contract_etag" => etag,
+        }
+      end
+
       {
         "protocol" => PROTOCOL_ID,
         "store_root" => container.root,
@@ -208,6 +218,7 @@ module Textus
         "cli_verbs" => CLI_VERBS.map(&:dup),
         "agent_protocol" => agent_protocol(manifest),
         "agent_quickstart" => agent_quickstart(manifest, container.audit_log),
+        "contract_etag" => etag,
         "docs" => { "spec" => "SPEC.md", "example" => "examples/project/" },
       }
     end
@@ -225,7 +236,7 @@ module Textus
 
     def self.entries_for(manifest)
       manifest.data.entries.map do |e|
-        derived = manifest.policy.derived_zone?(e.zone)
+        derived = e.derived?
         {
           "key" => e.key,
           "zone" => e.zone,
@@ -234,7 +245,7 @@ module Textus
           "owner" => e.owner,
           "format" => e.format,
           "derived" => derived,
-          "intake" => e.is_a?(Textus::Manifest::Entry::Intake),
+          "intake" => e.intake?,
           "publish_to" => Array(e.publish_to),
         }
       end

data/lib/textus/call.rb

@@ -9,7 +9,7 @@ module Textus
       new(
         role: role.to_s,
         correlation_id: correlation_id || SecureRandom.uuid,
-        now: now || Textus::Ports::Clock.now,
+        now: now || Textus::Ports::Clock.new.now,
         dry_run: dry_run,
       )
     end

data/lib/textus/cli/runner.rb

@@ -130,18 +130,23 @@ module Textus
       # — behavior the generic projection cannot express (ADR 0068/0069):
       #   get   — raises UnknownKey with resolver suggestions (a CLI-only
       #           affordance; the agent surface deliberately returns nil)
-      #   put   — IntakeFetch read-through orchestration on --fetch
-      #   build — auto-resolves the build-capability actor role (not --as) and
-      #           serializes under BuildLock; the role resolution is policy, not
-      #           a projection (around: covers only the lock)
-      BEHAVIORAL_HATCHES = %i[get put build].freeze
+      #   put   — reads the entry JSON from --stdin (ADR 0089: just stores bytes,
+      #           no --fetch transform)
+      # (build removed in ADR 0087: materialization is system-pushed via reconcile)
+      BEHAVIORAL_HATCHES = %i[get put].freeze
 
       # Contract verbs whose CLI is a plain `< Verb` command, not a projection at
-      # all — composite reports assembled outside the contract:
-      #   boot, doctor — composite reports
-      # (fetch/fetch_all were removed in ADR 0079: FetchWorker is now internal,
-      # driven by get's read-through orchestrator and the tend sweep.)
-      NON_PROJECTED_CLI = %i[boot doctor].freeze
+      # all — composite reports assembled outside the contract.
+      # (boot removed: its contract carries surfaces :cli + the :lean arg, so the
+      # generic projection now generates it; the hand-authored CLI::Verb::Boot is
+      # deleted in ADR 0101.)
+      # (doctor retained: hand-authored to preserve --check=NAME flag spelling and
+      # the exit_code: res["ok"] ? 0 : 1 behavior — two things the generic
+      # projection cannot yet express; kept in ADR 0101 pending a future pass.)
+      # (fetch/fetch_all were removed in ADR 0079: Produce::Acquire::Intake is now internal,
+      # driven by the reconcile sweep and hook run — ADR 0089 removed the
+      # read-through that once also drove it.)
+      NON_PROJECTED_CLI = %i[doctor].freeze
 
       # The installer skips generation for either category.
       HAND_AUTHORED_VERBS = (BEHAVIORAL_HATCHES + NON_PROJECTED_CLI).freeze

data/lib/textus/cli/verb/get.rb

@@ -4,12 +4,10 @@ module Textus
       class Get < Runner::Base
         self.spec = Textus::Read::Get.contract
         option :as_flag, "--as=ROLE"
-        option :no_fetch, "--no-fetch"
 
         def invoke(store)
           key = positional.shift or raise UsageError.new("get requires a key")
-          kw = no_fetch.nil? ? {} : { fetch: false }
-          result = session_for(store).get(key, **kw)
+          result = session_for(store).get(key)
           raise Textus::UnknownKey.new(key, suggestions: store.manifest.resolver.suggestions_for(key)) if result.nil?
 
           emit(result.to_h_for_wire)

data/lib/textus/cli/verb/hook_run.rb

@@ -31,7 +31,7 @@ module Textus
           Role.resolve(flag: as_flag, env: ENV, root: store.root)
 
           begin
-            Textus::Write::IntakeFetch.invoke(
+            Textus::Produce::Acquire::Handler.invoke(
               caps: store.container, handler: name, config: {}, args: args, label: "hook run",
             )
           rescue Textus::Error

data/lib/textus/cli/verb/put.rb

@@ -6,7 +6,6 @@ module Textus
 
         option :as_flag, "--as=ROLE"
         option :use_stdin, "--stdin"
-        option :fetch_name, "--fetch=NAME"
 
         def invoke(store)
           key = positional.shift or raise UsageError.new("put requires a key")
@@ -14,25 +13,10 @@ module Textus
 
           role = resolved_role(store)
 
-          raw = @stdin.read
-          payload =
-            if fetch_name
-              result = Textus::Write::IntakeFetch.invoke(
-                caps: store.container, handler: fetch_name,
-                config: { "bytes" => raw }, args: {}, label: "fetch"
-              )
-              basename = key.split(".").last
-              {
-                "_meta" => {
-                  "name" => basename,
-                  "last_fetched_at" => Time.now.utc.iso8601,
-                  "fetched_with" => fetch_name,
-                }.merge(result[:_meta] || result["_meta"] || {}),
-                "body" => result[:body] || result["body"] || "",
-              }
-            else
-              JSON.parse(raw)
-            end
+          # put only stores the stdin JSON (ADR 0089): no transform-on-write.
+          # Ingest (running a handler over bytes) is system-pushed via reconcile
+          # and hook run, never a put flag.
+          payload = JSON.parse(@stdin.read)
 
           meta = payload["_meta"] || {}
           body = payload["body"] || ""

data/lib/textus/cli.rb

@@ -122,10 +122,7 @@ module Textus
           textus list [--prefix=KEY] [--zone=Z]
           textus where KEY
           textus get KEY
-          textus put KEY --stdin [--fetch=NAME] --as=ROLE
-          textus freshness [--prefix=KEY] [--zone=Z]
-          textus fetch KEY
-          textus fetch all [--prefix=KEY] [--zone=Z]
+          textus put KEY --stdin --as=ROLE
           textus audit [--key=K] [--zone=Z] [--role=R] [--verb=V] [--since=X] [--correlation-id=ID] [--limit=N]
           textus blame KEY [--limit=N]
           textus doctor