textus 0.49.0 → 0.51.0

data/lib/textus/dispatcher.rb

@@ -11,8 +11,6 @@ module Textus
       key_mv: Textus::Write::KeyMv,
       accept: Textus::Write::Accept,
       reject: Textus::Write::Reject,
-      build: Textus::Write::Build,
-
       # Read
       get: Textus::Read::Get,
       list: Textus::Read::List,
@@ -37,7 +35,7 @@ module Textus
       zone_mv: Textus::Maintenance::ZoneMv,
       key_mv_prefix: Textus::Maintenance::KeyMvPrefix,
       key_delete_prefix: Textus::Maintenance::KeyDeletePrefix,
-      tend: Textus::Maintenance::Tend,
+      reconcile: Textus::Maintenance::Reconcile,
       rule_lint: Textus::Maintenance::RuleLint,
     }.freeze
 

data/lib/textus/doctor/check/generator_drift.rb

@@ -8,17 +8,18 @@ module Textus
       # verb reported.
       class GeneratorDrift < Check
         def call
-          gen = Textus::Domain::Staleness::GeneratorCheck.new(
+          gen = Textus::Domain::Freshness::Evaluator.new(
             manifest: manifest,
             file_stat: Textus::Ports::Storage::FileStat.new,
+            clock: Textus::Ports::Clock.new,
           )
-          manifest.data.entries.flat_map { |m| gen.rows_for(m) }.map do |row|
+          manifest.data.entries.flat_map { |m| gen.drift_rows(m) }.map do |row|
             {
               "code" => "generator_drift",
               "level" => "warning",
               "subject" => row["key"],
               "message" => row["reason"],
-              "fix" => "rebuild the entry: `textus build`",
+              "fix" => "rematerialize the entry: `textus reconcile`",
             }
           end
         end

data/lib/textus/doctor/check/handler_allowlist.rb

@@ -8,7 +8,7 @@ module Textus
         def call
           out = []
           manifest.data.entries.each do |mentry|
-            next unless mentry.is_a?(Textus::Manifest::Entry::Intake)
+            next unless mentry.intake?
 
             handler = mentry.handler
 

data/lib/textus/doctor/check/intake_registration.rb

@@ -6,15 +6,15 @@ module Textus
 
         def call
           declared = collect_declared_handlers
-          registered = rpc.names(:resolve_intake).to_set
+          registered = rpc.names(:resolve_handler).to_set
 
           out = (declared - registered).map do |name|
             {
               "code" => "intake.handler_missing",
               "level" => "error",
               "subject" => name.to_s,
-              "message" => "manifest references intake handler '#{name}' but no resolve_intake hook for '#{name}' is registered",
-              "fix" => "create .textus/hooks/#{name}.rb with `Textus.hook { |reg| reg.on(:resolve_intake, :#{name}) { ... } }`",
+              "message" => "manifest references intake handler '#{name}' but no resolve_handler hook for '#{name}' is registered",
+              "fix" => "create .textus/hooks/#{name}.rb with `Textus.hook { |reg| reg.on(:resolve_handler, :#{name}) { ... } }`",
             }
           end
 
@@ -23,7 +23,7 @@ module Textus
               "code" => "intake.handler_orphan",
               "level" => "warning",
               "subject" => name.to_s,
-              "message" => "resolve_intake hook '#{name}' is registered but no manifest entry references it",
+              "message" => "resolve_handler hook '#{name}' is registered but no manifest entry references it",
               "fix" => "remove the unused handler, or add an entry with `intake.handler: #{name}`",
             }
           end
@@ -36,7 +36,7 @@ module Textus
         def collect_declared_handlers
           set = Set.new
           manifest.data.entries.each do |mentry|
-            set << mentry.handler.to_sym if mentry.is_a?(Textus::Manifest::Entry::Intake)
+            set << mentry.handler.to_sym if mentry.intake?
           end
           set
         end

data/lib/textus/doctor/check/rule_ambiguity.rb

@@ -2,11 +2,11 @@ module Textus
   module Doctor
     class Check
       # Flags entries whose key is matched by two or more rule blocks of the
-      # SAME specificity in the same slot (fetch / handler_allowlist /
-      # guard). Ties are non-deterministic in the parser's pick step, so
+      # SAME specificity in the same slot (lifecycle / handler_allowlist /
+      # guard / materialize). Ties are non-deterministic in the parser's pick step, so
       # they're a configuration smell — surface them.
       class RuleAmbiguity < Check
-        SLOTS = %i[lifecycle handler_allowlist guard].freeze
+        SLOTS = Textus::Manifest::Schema::FIELD_REGISTRY.select { |_, m| m[:in_ambiguity] }.keys.freeze
 
         def call
           out = []

data/lib/textus/doctor/check/sentinels.rb

@@ -31,7 +31,7 @@ module Textus
             "level" => "warning",
             "subject" => sentinel_path,
             "message" => "sentinel is not valid JSON",
-            "fix" => "delete #{sentinel_path} and re-run 'textus build' to regenerate",
+            "fix" => "delete #{sentinel_path} and re-run 'textus reconcile' to regenerate",
           }
         end
 
@@ -51,7 +51,7 @@ module Textus
             "level" => "warning",
             "subject" => sentinel.target,
             "message" => "published file at #{sentinel.target} was modified out-of-band",
-            "fix" => "re-run 'textus build' to overwrite, or copy the manual edit back into the store source",
+            "fix" => "re-run 'textus reconcile' to overwrite, or copy the manual edit back into the store source",
           }
         end
       end

data/lib/textus/doctor/check/templates.rb

@@ -5,19 +5,21 @@ module Textus
         def call
           out = []
           manifest.data.entries.each do |entry|
-            template = entry.respond_to?(:template) ? entry.template : nil
-            next if template.nil?
+            entry.publish_targets.each do |target|
+              template = target.template
+              next if template.nil?
 
-            tp = File.join(root, "templates", template)
-            next if File.exist?(tp)
+              tp = File.join(root, "templates", template)
+              next if File.exist?(tp)
 
-            out << {
-              "code" => "template.missing",
-              "level" => "error",
-              "subject" => entry.key,
-              "message" => "template '#{template}' not found at #{tp}",
-              "fix" => "create the file at #{tp} or update the entry's template: field",
-            }
+              out << {
+                "code" => "template.missing",
+                "level" => "error",
+                "subject" => entry.key,
+                "message" => "template '#{template}' not found at #{tp}",
+                "fix" => "create the file at #{tp} or update the publish target's template: field",
+              }
+            end
           end
           out
         end

data/lib/textus/doctor.rb

@@ -23,11 +23,9 @@ module Textus
       Check::SchemaViolations,
       Check::RuleAmbiguity,
       Check::HandlerAllowlist,
-      Check::FetchLocks,
       Check::OrphanedPublishTargets,
       Check::PublishTreeIndexOverlap,
       Check::ProposalTargets,
-      Check::LifecycleActionInvalid,
       Check::GeneratorDrift,
     ].freeze
 

data/lib/textus/domain/freshness/evaluator.rb

@@ -2,27 +2,163 @@ require "time"
 
 module Textus
   module Domain
-    class Freshness
-      module Evaluator
-        module_function
+    module Freshness
+      # The single currency evaluator (ADR 0099). Answers "is the stored data
+      # stale relative to its source?" for every produce-method:
+      #   - intake (source.from: handler) -> AGE signal: now - basis > source.ttl,
+      #     basis = _meta.last_fetched_at (else file mtime). No ttl -> :no_policy
+      #     (skipped — a cadence-less handler is not auto-re-pulled).
+      #   - derived/external -> DRIFT signal: a source changed since generated.at
+      #     (surfaced by the doctor generator_drift check; derived entries annotate
+      #     fresh at read time because reconcile converges them reactively).
+      # Replaces Domain::IntakeStaleness and Domain::Staleness::GeneratorCheck and
+      # the inline copies in Read::Get / Read::Freshness.
+      class Evaluator
+        def initialize(manifest:, file_stat:, clock:)
+          @manifest  = manifest
+          @file_stat = file_stat
+          @clock     = clock
+        end
+
+        # Per-entry currency Verdict (drives Read::Get's annotation). Non-intake
+        # entries are always fresh (retention is GC, not content currency).
+        def verdict(mentry)
+          return fresh unless mentry.intake?
+
+          ttl = mentry.source.ttl_seconds
+          return fresh if ttl.nil?
+
+          stale = age_stale?(intake_basis(mentry), ttl)
+          Verdict.build(stale: stale, reason: stale ? "ttl exceeded" : nil, fetching: false)
+        end
+
+        # Keys of intake entries past their source.ttl — the reconcile produce
+        # scope (replaces Domain::IntakeStaleness#call). A ttl-less intake entry
+        # is :no_policy and skipped; a never-recorded one (with a ttl) is stale.
+        def stale_intake_keys(prefix: nil, zone: nil)
+          @manifest.data.entries.select { |m| due?(m, prefix: prefix, zone: zone) }.map(&:key)
+        end
+
+        # Age basis as a Time (or nil): _meta.last_fetched_at when present, else
+        # file mtime. The single definition the three call sites used to repeat.
+        def intake_basis(mentry)
+          path = @manifest.resolver.resolve(mentry.key).path
+          return nil unless @file_stat.exists?(path)
+
+          last_fetched_at(mentry, path) || @file_stat.mtime(path)
+        end
+
+        # Generator-drift rows for one entry (replaces Staleness::GeneratorCheck#
+        # rows_for) — consumed by the doctor generator_drift check.
+        def drift_rows(mentry)
+          return [] unless drift_applicable?(mentry)
+
+          path = Textus::Key::Path.resolve(@manifest.data, mentry)
+          reason = drift_reason(mentry, path)
+          reason ? [drift_row(mentry, path, reason)] : []
+        end
+
+        private
+
+        def fresh = Verdict.build(stale: false, reason: nil, fetching: false)
+
+        def due?(mentry, prefix:, zone:)
+          return false unless mentry.intake?
+          return false if zone && mentry.zone != zone
+          return false if prefix && !mentry.key.start_with?(prefix)
+
+          ttl = mentry.source.ttl_seconds
+          return false if ttl.nil? # no declared cadence -> :no_policy, skip (ADR 0099)
+
+          path = @manifest.resolver.resolve(mentry.key).path
+          return true unless @file_stat.exists?(path)
+
+          age_stale?(intake_basis(mentry), ttl)
+        end
+
+        # The one age comparison. A never-recorded entry (nil basis) is stale.
+        def age_stale?(basis, ttl)
+          return true if basis.nil?
+
+          (@clock.now - basis).to_i > ttl
+        end
 
-        def call(policy, envelope, now:)
-          return Verdict.fresh if policy.ttl_seconds.nil?
+        def last_fetched_at(mentry, path)
+          meta = Entry.for_format(mentry.format).parse(@file_stat.read(path), path: path)["_meta"]
+          Time.parse(meta["last_fetched_at"].to_s) if meta && meta["last_fetched_at"]
+        rescue StandardError
+          nil
+        end
+
+        # --- generator drift (lifted from Staleness::GeneratorCheck) ---
+
+        def drift_applicable?(mentry) = mentry.derived? && mentry.external?
+
+        def drift_reason(mentry, path)
+          return "derived entry has never been generated" unless @file_stat.exists?(path)
+
+          generated_at = generated_at_of(mentry, path)
+          return "missing generated.at frontmatter" unless generated_at
+
+          gen_time = parse_time(generated_at)
+          return "unparseable generated.at: #{generated_at.inspect}" unless gen_time
 
-          last_str = envelope&.meta&.dig("last_fetched_at")
-          return Verdict.stale("never fetched") if last_str.nil?
+          offender = newest_source_after(mentry.source, gen_time)
+          "source '#{offender}' modified after generated.at" if offender
+        end
+
+        def generated_at_of(mentry, path)
+          Entry.for_format(mentry.format).parse(@file_stat.read(path), path: path)["_meta"].dig("generated", "at")
+        end
 
-          last = begin
-            Time.parse(last_str.to_s)
-          rescue ArgumentError, TypeError
+        def parse_time(str)
+          Time.parse(str.to_s)
+        rescue StandardError
+          nil
+        end
+
+        def newest_source_after(external_src, gen_time)
+          Array(external_src.sources).each do |src|
+            offender = check_source(src, gen_time)
+            return offender if offender
+          end
+          nil
+        end
+
+        def check_source(src, gen_time)
+          if src.match?(/\A[a-z0-9.][a-z0-9._-]*\z/) && !src.include?("/")
+            @manifest.resolver.enumerate(prefix: src).each do |row|
+              return src if @file_stat.mtime(row[:path]) > gen_time
+            end
             nil
+          else
+            check_filesystem_source(src, gen_time)
+          end
+        end
+
+        def check_filesystem_source(src, gen_time)
+          abs = absolutize_source(src)
+          if @file_stat.directory?(abs)
+            dir_has_newer_file?(abs, gen_time) ? src : nil
+          elsif @file_stat.exists?(abs) && @file_stat.mtime(abs) > gen_time
+            src
           end
-          return Verdict.stale("unparseable last_fetched_at: #{last_str.inspect}") if last.nil?
+        end
+
+        def absolutize_source(src)
+          File.absolute_path?(src) ? src : File.join(File.dirname(@manifest.data.root), src)
+        end
+
+        def dir_has_newer_file?(abs, gen_time)
+          @file_stat.glob(File.join(abs, "**", "*")).any? do |fpath|
+            file?(fpath) && @file_stat.mtime(fpath) > gen_time
+          end
+        end
 
-          age = now - last
-          return Verdict.fresh if age <= policy.ttl_seconds
+        def file?(fpath) = !@file_stat.directory?(fpath) && @file_stat.exists?(fpath)
 
-          Verdict.stale("ttl exceeded (age=#{age.to_i}s, ttl=#{policy.ttl_seconds}s)")
+        def drift_row(mentry, path, reason)
+          { "key" => mentry.key, "path" => path, "generator" => mentry.raw["compute"], "reason" => reason }
         end
       end
     end

data/lib/textus/domain/freshness/verdict.rb

@@ -1,11 +1,33 @@
+# frozen_string_literal: true
+
 module Textus
   module Domain
-    class Freshness
-      Verdict = Data.define(:fresh, :reason) do
-        def self.fresh         = new(fresh: true, reason: nil)
-        def self.stale(reason) = new(fresh: false, reason: reason)
-        def fresh? = fresh
-        def stale? = !fresh
+    module Freshness
+      # Value object describing the freshness annotation attached to an Envelope
+      # after a currency evaluation (ADR 0099 — was Domain::Freshness).
+      #
+      # Note on wire format: `#to_h_for_wire` is intentionally narrower than the
+      # full field set. It emits the legacy keys ("stale", "stale_reason",
+      # "fetching", and "fetch_error" when present) so the CLI JSON wire stays
+      # byte-identical with textus/3. The gem-side fields `checked_at` and
+      # `ttl_remaining_ms` are NOT emitted on the wire.
+      Verdict = Data.define(
+        :stale, :fetching, :reason, :fetch_error, :checked_at, :ttl_remaining_ms
+      ) do
+        def self.build(stale:, fetching: false, reason: nil, fetch_error: nil,
+                       checked_at: nil, ttl_remaining_ms: nil)
+          new(
+            stale: stale, fetching: fetching, reason: reason,
+            fetch_error: fetch_error, checked_at: checked_at,
+            ttl_remaining_ms: ttl_remaining_ms
+          )
+        end
+
+        def to_h_for_wire
+          h = { "stale" => stale, "stale_reason" => reason, "fetching" => fetching }
+          h["fetch_error"] = fetch_error unless fetch_error.nil?
+          h
+        end
       end
     end
   end

data/lib/textus/domain/freshness.rb

@@ -2,39 +2,10 @@
 
 module Textus
   module Domain
-    # Value object describing the freshness annotation attached to an Envelope
-    # after a freshness evaluation. Replaces the loose Hash that used to live
-    # on `Envelope#freshness`.
-    #
-    # Note on wire format: `#to_h_for_wire` is intentionally narrower than the
-    # full field set. It emits the legacy keys ("stale", "stale_reason",
-    # "fetching", and "fetch_error" when present) so the CLI JSON wire
-    # stays byte-identical with textus/3. The gem-side fields `checked_at`
-    # and `ttl_remaining_ms` are NOT emitted on the wire in this phase.
-    Freshness = Data.define(
-      :stale, :fetching, :reason, :fetch_error, :checked_at, :ttl_remaining_ms
-    ) do
-      def self.build(stale:, fetching: false, reason: nil, fetch_error: nil,
-                     checked_at: nil, ttl_remaining_ms: nil)
-        new(
-          stale: stale,
-          fetching: fetching,
-          reason: reason,
-          fetch_error: fetch_error,
-          checked_at: checked_at,
-          ttl_remaining_ms: ttl_remaining_ms,
-        )
-      end
-
-      def to_h_for_wire
-        h = {
-          "stale" => stale,
-          "stale_reason" => reason,
-          "fetching" => fetching,
-        }
-        h["fetch_error"] = fetch_error unless fetch_error.nil?
-        h
-      end
+    # Currency — "is the stored data stale relative to its source?" (ADR 0099).
+    # The home of the single Freshness evaluator and its Verdict value object.
+    # Distinct from Domain::Retention (GC dueness, Q2).
+    module Freshness
     end
   end
 end

data/lib/textus/domain/policy/base_guards.rb

@@ -15,7 +15,7 @@ module Textus
           key_mv: %w[zone_writable_by],
           accept: %w[author_held target_is_canon],
           reject: %w[author_held],
-          fetch: %w[zone_writable_by],
+          reconcile: %w[zone_writable_by],
         }.freeze
 
         def self.for(transition) = BASE.fetch(transition, [])

data/lib/textus/domain/policy/predicates/fresh_within.rb

@@ -25,7 +25,7 @@ module Textus
             written = written_at(eval.envelope)
             return true if written.nil?
 
-            now = @now || Textus::Ports::Clock.now
+            now = @now || Textus::Ports::Clock.new.now
             return true if now - written <= @seconds
 
             @reason = "entry older than #{@seconds}s (written #{written.iso8601})"

data/lib/textus/domain/policy/publish_target.rb

@@ -0,0 +1,34 @@
+module Textus
+  module Domain
+    module Policy
+      # One publish destination (ADR 0094). Exactly one of:
+      #   to-target   { to:, template:?, inject_boot:? }  — render data through a
+      #               template, or copy verbatim when no template
+      #   tree-target { tree: }                           — ADR 0052 subtree mirror
+      # Provenance is NOT a publish flag — it lives in the data's `_meta`.
+      class PublishTarget
+        attr_reader :to, :tree, :template, :inject_boot
+
+        def initialize(raw)
+          if raw.key?("provenance")
+            raise Textus::BadManifest.new("publish `provenance:` was removed (ADR 0094): provenance lives in the data's `_meta`")
+          end
+
+          @to   = raw["to"]
+          @tree = raw["tree"]
+          raise Textus::BadManifest.new("a publish target needs exactly one of `to:` or `tree:`") unless @to.nil? ^ @tree.nil?
+
+          @template    = raw["template"]
+          @inject_boot = raw["inject_boot"] == true
+          return unless tree_target? && (@template || @inject_boot)
+
+          raise Textus::BadManifest.new("a tree target takes no template/inject_boot (ADR 0094)")
+        end
+
+        def to_target?   = !@to.nil?
+        def tree_target? = !@tree.nil?
+        def renders?     = to_target? && !@template.nil?
+      end
+    end
+  end
+end

data/lib/textus/domain/policy/retention.rb

@@ -0,0 +1,29 @@
+module Textus
+  module Domain
+    module Policy
+      # Garbage collection (ADR 0093). A glob-matched rule slot: when an entry
+      # ages past `ttl`, retire it. Destructive only — runs on the full
+      # `reconcile` pass, never on a write (ADR 0079's invariant). Orthogonal to
+      # production (`source:`): an intake entry can re-pull hourly AND archive
+      # after 90 days. `warn`/`refresh` are gone (refresh is implied by an
+      # intake source; warn never fired after ADR 0089's pure-read get).
+      class Retention
+        ACTIONS = %i[drop archive].freeze
+
+        attr_reader :action
+
+        def initialize(raw)
+          @ttl = raw["ttl"] or
+            raise Textus::BadManifest.new("retention requires a 'ttl:'")
+          @action = (raw["action"] || "").to_s.to_sym
+          return if ACTIONS.include?(@action)
+
+          raise Textus::BadManifest.new("retention action must be one of #{ACTIONS.join("|")}, got #{raw["action"].inspect}")
+        end
+
+        def ttl_seconds = Textus::Domain::Duration.seconds(@ttl)
+        def destructive? = true
+      end
+    end
+  end
+end

data/lib/textus/domain/policy/source.rb

@@ -0,0 +1,79 @@
+module Textus
+  module Domain
+    module Policy
+      # An entry's data-acquisition declaration (ADR 0094). `source:` says HOW the
+      # entry's data is acquired; rendering is a publish concern, so there are no
+      # template/render fields here. `from` is the acquire + staleness axis:
+      #   from: project -> derived  (internal projection; observable -> rdeps staleness)
+      #   from: handler -> intake   (external fetch; unobservable -> ttl staleness)
+      #   from: command -> external (out-of-band runner; staleness only, textus never runs it)
+      # `on_write` (sync|async, default async) is the write-trigger strategy for
+      # observable (project) sources; meaningless for intake/command.
+      class Source
+        FROMS      = %w[project handler command].freeze
+        STRATEGIES = %w[async sync].freeze
+
+        attr_reader :from, :handler, :config, :command, :sources
+
+        def initialize(raw)
+          @from = raw["from"].to_s
+          unless FROMS.include?(@from)
+            raise Textus::BadManifest.new("source.from must be one of #{FROMS.join("|")}, got #{raw["from"].inspect}")
+          end
+
+          @on_write = (raw["on_write"] || "async").to_s
+          unless STRATEGIES.include?(@on_write)
+            raise Textus::BadManifest.new("source.on_write must be one of #{STRATEGIES.join("/")}, got #{@on_write.inspect}")
+          end
+
+          @ttl = raw["ttl"]
+          @projection = {}
+
+          case @from
+          when "project" then init_project(raw)
+          when "handler" then init_handler(raw)
+          when "command" then init_command(raw)
+          end
+        end
+
+        def kind        = @from == "handler" ? :intake : :derived
+        def external?   = @from == "command"
+        def projection? = @from == "project"
+        def sync?       = @on_write == "sync"
+        def ttl_seconds = @ttl.nil? ? nil : Textus::Domain::Duration.seconds(@ttl)
+
+        # Flattened projection accessors (ADR 0094) — read directly off the source
+        # block; nil when absent or not a projection source.
+        def select    = @projection["select"]
+        def pluck     = @projection["pluck"]
+        def sort_by   = @projection["sort_by"]
+        def transform = @projection["transform"]
+
+        # The projection spec hash fed to Textus::Projection (string keys, only the
+        # present fields). {} when not a projection.
+        def projection_spec = @projection.dup
+
+        private
+
+        def init_project(raw)
+          %w[select pluck sort_by transform].each { |f| @projection[f] = raw[f] if raw.key?(f) }
+          return unless @projection["select"].nil? && @projection["transform"].nil?
+
+          raise Textus::BadManifest.new("source (from: project) requires `select:` and/or `transform:`")
+        end
+
+        def init_handler(raw)
+          @handler = raw["handler"] or
+            raise Textus::BadManifest.new("source (from: handler) requires a `handler:` field")
+          @config = raw["config"] || {}
+        end
+
+        def init_command(raw)
+          @command = raw["command"] or
+            raise Textus::BadManifest.new("source (from: command) requires a `command:` field")
+          @sources = raw["sources"] || []
+        end
+      end
+    end
+  end
+end

data/lib/textus/domain/retention/sweep.rb

@@ -0,0 +1,57 @@
+require "time"
+
+module Textus
+  module Domain
+    module Retention
+      # Retention sweep reporter (ADR 0093/0099). Which entries are past their
+      # `retention:` ttl and the destructive action that applies. Age basis: file
+      # mtime. Only drop/archive. Renamed off the Domain::Retention vs
+      # Domain::Policy::Retention collision (ADR 0099).
+      class Sweep
+        def self.expired?(ttl_seconds:, mtime:, now:)
+          return false if ttl_seconds.nil? || mtime.nil?
+
+          (now - mtime).to_i > ttl_seconds
+        end
+
+        def initialize(manifest:, file_stat:, clock:)
+          @manifest = manifest
+          @file_stat = file_stat
+          @clock = clock
+        end
+
+        def call(prefix: nil, zone: nil)
+          @manifest.data.entries
+                   .select { |m| matches?(m, prefix: prefix, zone: zone) }
+                   .flat_map { |m| rows_for(m) }
+        end
+
+        private
+
+        def matches?(mentry, prefix:, zone:)
+          return false if zone && mentry.zone != zone
+          return false if prefix && !Textus::Key::Matching.matches_prefix?(
+            mentry.key, prefix, nested: mentry.is_a?(Textus::Manifest::Entry::Nested)
+          )
+
+          true
+        end
+
+        def rows_for(mentry)
+          policy = @manifest.rules.for(mentry.key).retention
+          return [] if policy.nil?
+
+          @manifest.resolver.enumerate(prefix: mentry.key).filter_map do |row|
+            path = row[:path]
+            next unless @file_stat.exists?(path)
+            next unless self.class.expired?(
+              ttl_seconds: policy.ttl_seconds, mtime: @file_stat.mtime(path), now: @clock.now,
+            )
+
+            { "key" => row[:key], "path" => path, "action" => policy.action.to_s }
+          end
+        end
+      end
+    end
+  end
+end