textus 0.50.0 → 0.51.0

data/lib/textus/hooks/context.rb

@@ -28,16 +28,11 @@ module Textus
         @scope
       end
 
-      # read — a deliberately pure-observation surface: NOTHING here fetches
-      # (`list`/`deps`/`freshness` don't either). The invariant is that a hook
-      # observes current state and never triggers an I/O cascade. `get` bypasses
-      # the read-through behavior (ADR 0062) and reads with fetch:false directly,
-      # because read-through inside a hook would: (1) fire fetch events → hooks →
-      # unbounded reentrancy; (2) spawn the orchestrator's threads/fork from
-      # inside a hook callback; (3) probe the single-flight fetch lock its own
-      # enclosing fetch may hold (deadlock); (4) inject network latency into
-      # every hook read. With the merged Read::Get class, `fetch:false` (the
-      # method default) guarantees no orchestrator is built.
+      # read — a pure-observation surface: nothing here ingests. Since ADR 0089
+      # `get` itself is a pure read (the read-through that once forced this
+      # surface to opt out is gone, so the old re-entrancy/deadlock guard is no
+      # longer needed); `list`/`deps`/`freshness` are reads too. A hook observes
+      # current state and never triggers an I/O cascade.
       def get(key)                = pure_reader.call(key)
       def list(**)                = @scope.list(**)
       def deps(key)               = @scope.deps(key)

data/lib/textus/init/templates/machine_intake.rb

@@ -1,15 +1,15 @@
 # .textus/hooks/machine_intake.rb
 # Scaffolded by `textus init` — CUSTOMIZE FREELY, or delete the feeds.machines
 # entry from manifest.yaml if you don't want it.
-# Feeds a per-host SNAPSHOT into feeds.machines.<host> on `textus fetch` (never
-# on the per-turn boot/pulse path). It is NESTED so it grows to a fleet: the
+# Feeds a per-host SNAPSHOT into feeds.machines.<host> on `textus reconcile`
+# (never on the per-turn boot/pulse path). It is NESTED so it grows to a fleet: the
 # `local` leaf scans THIS host; add ssh hosts with the cookbook recipe
 # (docs/cookbook/environment-scan.md). tracked:false → gitignored. Keep this an
 # ALLOWLIST of versions and counts — NEVER secrets, raw `env`, or package lists.
 Textus.hook do |reg|
-  reg.on(:resolve_intake, :machines) do |config:, args:, **|
+  reg.on(:resolve_handler, :machines) do |config:, args:, **|
     machine = args[:leaf_segments].first or
-      raise "fetch a host leaf, e.g. `textus fetch feeds.machines.local`"
+      raise "machines intake needs a host leaf, e.g. the 'local' in feeds.machines.local"
     spec = (config["machines"] || {}).fetch(machine) { raise "unknown machine: #{machine}" }
     unless (spec["via"] || "local").to_s == "local"
       raise "machine #{machine}: only `via: local` is scaffolded — see " \

data/lib/textus/init.rb

@@ -3,45 +3,44 @@ require "pathname"
 
 module Textus
   module Init
-    ZONES = %w[knowledge notebook feeds proposals artifacts].freeze
+    ZONES = %w[knowledge notebook proposals artifacts].freeze
 
     DEFAULT_MANIFEST = <<~YAML
       version: textus/3
       roles:
         - { name: human,      can: [author, propose] }
         - { name: agent,      can: [propose, keep] }
-        - { name: automation, can: [fetch, build] }
+        - { name: automation, can: [reconcile] }
       zones:
         - { name: knowledge, kind: canon,     desc: "the maintained source of truth (identity.* lives here)" }
         - { name: notebook,  kind: workspace, owner: agent, desc: "the agent's own durable working notes" }
-        - { name: feeds,     kind: quarantine, desc: "external inputs pulled in" }
         - { name: proposals, kind: queue,     desc: "changes awaiting your accept" }
-        - { name: artifacts, kind: derived,   desc: "computed, shippable outputs" }
+        - { name: artifacts, kind: machine,   desc: "machine-maintained: external inputs (artifacts.feeds.*) + computed outputs (artifacts.derived.*)" }
       entries:
         - { key: knowledge.identity, path: knowledge/identity.md, zone: knowledge, schema: null, owner: human:self, kind: leaf }
         - { key: knowledge.notes,    path: knowledge/notes,       zone: knowledge, schema: null, owner: human:self, nested: true, kind: nested }
         - { key: notebook.notes,     path: notebook/notes,        zone: notebook,  schema: null, owner: agent:self, nested: true, kind: nested }
         - { key: proposals.notes,    path: proposals/notes,       zone: proposals, schema: null, owner: agent:self, nested: true, kind: nested }
-        # A per-host snapshot, pulled by `textus fetch feeds.machines.local --as=automation`.
-        # Nested so it grows to a fleet — add feeds.machines.<host> leaves over SSH
+        # A per-host snapshot, refreshed from its declared intake by `textus reconcile` (scheduled, or on demand).
+        # Nested so it grows to a fleet — add artifacts.feeds.machines.<host> leaves over SSH
         # (see docs/cookbook/environment-scan.md) without renaming. tracked:false →
         # gitignored (machine info can be sensitive/noisy) but still protocol-readable
-        # via `textus get feeds.machines.local`. Delete to opt out. (ADR 0043)
-        - key: feeds.machines
-          path: feeds/machines
-          zone: feeds
+        # via `textus get artifacts.feeds.machines.local`. Delete to opt out. (ADR 0043)
+        - key: artifacts.feeds.machines
+          path: artifacts/feeds/machines
+          zone: artifacts
           format: yaml
           nested: true
           tracked: false
-          kind: intake
-          intake:
+          kind: produced
+          source:
+            from: handler
             handler: machines
+            ttl: 1h # cadence on a long-running server
             config:
               machines:
                 local: { via: local }
-      rules:
-        - match: feeds.machines.**
-          lifecycle: { ttl: 1h, on_expire: warn } # meaningful on a long-running server
+      rules: []
     YAML
 
     HOOKS_README = <<~MD
@@ -56,71 +55,72 @@ module Textus
 
       ```ruby
       Textus.hook do |reg|
-        reg.on(:resolve_intake, :my_source) do |config:, args:, **|
+        reg.on(:resolve_handler, :my_source) do |config:, args:, **|
           { _meta: { "last_fetched_at" => Time.now.utc.iso8601 }, body: "…" }
         end
 
         reg.on(:transform_rows, :my_source) { |rows:, **| rows.map { |r| r.merge(processed: true) } }
         reg.on(:validate,       :my_check)  { |caps:, **| [] }
-        reg.on(:entry_put,      :my_listener, keys: ["knowledge.*"]) { |key:, envelope:, **| }
+        reg.on(:entry_written,      :my_listener, keys: ["knowledge.*"]) { |key:, envelope:, **| }
 
         # Run a side-effect every time textus writes a file to your repo:
-        reg.on(:file_published, :notify) do |key:, target:, **|
+        reg.on(:entry_published, :notify) do |key:, target:, **|
           warn "wrote \#{target} (from \#{key})"
         end
       end
       ```
 
-      The intake handler above is paired with a manifest entry plus a
-      top-level `rules:` block for lifecycle (ttl/on_expire live in
-      rules, not in the entry):
+      The intake handler above is paired with a manifest entry whose
+      `source:` block declares the handler and its refresh cadence
+      (`ttl`). Age GC (drop/archive) lives in a top-level `retention:`
+      rule, not on the entry:
 
       ```yaml
       entries:
-        - key: feeds.foo
-          kind: intake
-          path: feeds/foo.md
-          zone: feeds
-          intake:
+        - key: artifacts.feeds.foo
+          kind: produced
+          path: artifacts/feeds/foo.md
+          zone: artifacts
+          source:
+            from: handler
             handler: my_source
+            ttl: 10m        # refresh cadence for this intake
 
       rules:
-        - match: feeds.foo
-          lifecycle:
-            ttl: 10m
-            on_expire: refresh   # refresh | warn (intake); drop | archive (stored)
+        - match: artifacts.feeds.foo
+          retention:
+            ttl: 30d
+            action: archive   # drop | archive (age GC of stored rows)
       ```
 
-      Events: :resolve_intake, :transform_rows, :validate (rpc — return value used)
-              :entry_put, :entry_deleted, :entry_fetched, :entry_renamed,
-              :build_completed, :proposal_accepted, :proposal_rejected,
-              :file_published, :store_loaded, :session_opened,
-              :fetch_started, :fetch_failed, :fetch_backgrounded (pub-sub — return discarded)
+      Events: :resolve_handler, :transform_rows, :validate (rpc — return value used)
+              :entry_written, :entry_deleted, :entry_fetched, :entry_renamed,
+              :entry_produced, :produce_failed, :reconcile_failed,
+              :proposal_accepted, :proposal_rejected,
+              :entry_published, :store_loaded, :session_opened,
+              :entry_fetch_started, :entry_fetch_failed (pub-sub — return discarded)
 
       See SPEC.md §5.10 for the full table.
     MD
 
     AGENT_ENTRIES = <<~YAML.gsub(/^/, "  ")
       # --with-agent profile: project facts + runbooks feed the orientation
-      # projection below, which `textus build` renders to CLAUDE.md/AGENTS.md.
+      # projection below, which `textus reconcile` renders to CLAUDE.md/AGENTS.md.
       - { key: knowledge.project, path: knowledge/project.md, zone: knowledge, schema: project, owner: human:self, kind: leaf }
       - { key: knowledge.runbooks, path: knowledge/runbooks, zone: knowledge, schema: runbook, owner: human:self, nested: true, kind: nested }
-      - key: artifacts.orientation
-        path: artifacts/orientation.md
+      - key: artifacts.derived.orientation
+        path: artifacts/derived/orientation.json
         zone: artifacts
-        template: orientation.mustache
-        inject_boot: true
         publish:
-          to:
-          - CLAUDE.md
-          - AGENTS.md
-        compute:
-          kind: projection
+        - { to: CLAUDE.md, template: orientation.mustache, inject_boot: true }
+        - { to: AGENTS.md, template: orientation.mustache, inject_boot: true }
+        source:
+          from: project
           select:
           - knowledge.project
           - knowledge.runbooks
           transform: orientation_reducer
-        kind: derived
+        kind: produced
     YAML
 
     def self.run(target_root, with_agent: false)
@@ -193,7 +193,7 @@ module Textus
       manifest = Textus::Manifest.load(target_root)
       root = Pathname.new(target_root)
       untracked = manifest.data.entries.reject(&:tracked?).map do |e|
-        if e.nested? # a whole subtree of leaf files (feeds.machines.* → zones/feeds/machines/)
+        if e.nested? # a whole subtree of leaf files (artifacts.feeds.machines.* → zones/artifacts/feeds/machines/)
           "#{File.join("zones", e.path)}/"
         else
           Pathname.new(Textus::Key::Path.resolve(manifest.data, e)).relative_path_from(root).to_s

data/lib/textus/key/matching.rb

@@ -0,0 +1,24 @@
+module Textus
+  module Key
+    # Dotted-key scope matching, shared by all prefix-scoped sweeps
+    # (WS4 / ADR 0089-era cleanup). Canonicalised here so every consumer
+    # uses a consistent dotted-boundary check with proper Nested ancestor
+    # handling. ADR 0093: Produce is the sole engine calling this.
+    module Matching
+      module_function
+
+      # Is `key` within the `prefix` scope?
+      #   - exact match, or a dotted descendant (the `prefix.` boundary, so
+      #     prefix "art" does NOT match key "artifacts"), and
+      #   - for a nested entry, also when `prefix` descends INTO it — the nested
+      #     parent owns the leaf the prefix names (e.g. prefix
+      #     "feeds.machines.host1" still selects the nested entry
+      #     "feeds.machines").
+      def matches_prefix?(key, prefix, nested: false)
+        return true if key == prefix || key.start_with?("#{prefix}.")
+
+        nested && prefix.start_with?("#{key}.")
+      end
+    end
+  end
+end

data/lib/textus/maintenance/reconcile.rb

@@ -0,0 +1,160 @@
+require "fileutils"
+
+module Textus
+  module Maintenance
+    # Two-phase convergence pass (ADR 0093). Replaces the old Lifecycle-reporter
+    # sweep.
+    #
+    # Phase 1 — Produce (non-destructive): re-render ALL derived entries (cheap,
+    # idempotent) plus every intake entry past its source.ttl (stale-only, so
+    # external sources are not hammered). Driven by Produce::Engine.
+    #
+    # Phase 2 — Retention sweep (destructive): drop or archive entries past their
+    # retention ttl. Driven by Domain::Retention::Sweep. The old refresh/warn
+    # actions are gone — intake re-pull is now Produce's responsibility.
+    class Reconcile
+      extend Textus::Contract::DSL
+
+      verb     :reconcile
+      summary  "Run the convergence pass: produce derived + stale intake, then drop/archive aged entries; report health."
+      surfaces :cli, :mcp
+      cli      "reconcile"
+      arg :prefix,  String, description: "restrict the sweep to keys under this dotted prefix"
+      arg :zone,    String, description: "restrict the sweep to entries in this zone"
+      arg :dry_run, :boolean, default: false,
+                              description: "when true, report what the pass WOULD do without applying; " \
+                                           "defaults to false, so omitting it produces + drops/archives immediately"
+
+      def initialize(container:, call:)
+        @container = container
+        @call      = call
+      end
+
+      def call(prefix: nil, zone: nil, dry_run: false)
+        file_stat = Textus::Ports::Storage::FileStat.new
+        retention_rows = Textus::Domain::Retention::Sweep.new(
+          manifest: @container.manifest, file_stat: file_stat, clock: Textus::Ports::Clock.new,
+        ).call(prefix: prefix, zone: zone)
+
+        produce_keys = produce_scope(prefix, zone, file_stat)
+        health = Read::Doctor.new(container: @container, call: @call).call
+        return dry_run_result(produce_keys, retention_rows, health) if dry_run
+
+        # reconcile is the authoritative "make everything current now" pass, so
+        # it subsumes any in-flight reactive produce: drain pending async
+        # produce-on-write threads first, both to fold their work in and to free
+        # the shared maintenance lock (BuildLock is non-blocking — a thread still
+        # holding it would make the acquire below raise BuildInProgress). ADR 0093.
+        Textus::Produce::Engine::AsyncRunner.drain
+
+        Textus::Ports::BuildLock.with(root: @container.root) do
+          produced = Textus::Produce::Engine.new(container: @container, call: @call).call(keys: produce_keys)
+          swept = apply(retention_rows)
+          publish_failed(swept[:failed]) unless swept[:failed].empty?
+          apply_result(produced, swept, health)
+        end
+      end
+
+      private
+
+      # The full produce scope (ADR 0093): every derived entry (always
+      # re-render — cheap, idempotent), every entry that mirrors a publish_tree
+      # (the nested-subtree publishers, ADR 0047 — mirrored each pass so a
+      # removed source leaf is swept from the published tree), every authored
+      # leaf with a `publish.to` target (the single-file canon publishers —
+      # docs/README.md, the architecture index, the root README; ADR 0103 —
+      # converged each pass so a stale published copy is rewritten and the
+      # `reconcile`-is-a-no-op check guards them), plus every intake entry past
+      # its source.ttl (re-pull only when due, so external sources aren't
+      # hammered). Ttl-less intake entries (:no_policy) are skipped — they have
+      # no freshness contract and are never auto-re-pulled (ADR 0099). All are
+      # idempotent: publish writes only when the target's content changed.
+      def produce_scope(prefix, zone, file_stat)
+        publishable = @container.manifest.data.entries
+                                .select { |e| e.derived? || !e.publish_tree.nil? || !e.publish_to.empty? }
+                                .select { |e| in_scope?(e, prefix, zone) }.map(&:key)
+        stale_intake = Textus::Domain::Freshness::Evaluator.new(
+          manifest: @container.manifest, file_stat: file_stat, clock: Textus::Ports::Clock.new,
+        ).stale_intake_keys(prefix: prefix, zone: zone)
+        (publishable + stale_intake).uniq
+      end
+
+      def in_scope?(entry, prefix, zone)
+        return false if zone && entry.zone != zone
+        return false if prefix && !entry.key.start_with?(prefix)
+
+        true
+      end
+
+      def dry_run_result(produce_keys, rows, health)
+        {
+          "protocol" => Textus::PROTOCOL, "ok" => true, "dry_run" => true,
+          "would_produce" => produce_keys,
+          "would_drop" => action_keys(rows, "drop"),
+          "would_archive" => action_keys(rows, "archive"),
+          "health" => health
+        }
+      end
+
+      def apply_result(produced, swept, health)
+        {
+          "protocol" => Textus::PROTOCOL,
+          "ok" => produced[:failed].empty? && swept[:failed].empty?,
+          "dry_run" => false,
+          "produced" => produced[:produced],
+          "produce_failed" => produced[:failed],
+          "dropped" => swept[:dropped], "archived" => swept[:archived],
+          "failed" => swept[:failed],
+          "health" => health
+        }
+      end
+
+      def action_keys(rows, action)
+        rows.select { |r| r["action"] == action }.map { |r| r["key"] }
+      end
+
+      def publish_failed(failed)
+        @container.events.publish(
+          :reconcile_failed,
+          ctx: Textus::Hooks::Context.for(container: @container, call: @call),
+          failed: failed,
+        )
+      end
+
+      # Phase 2: destructive retention only (drop/archive). No refresh — intake
+      # re-pull is Produce's job (Phase 1). ADR 0093.
+      def apply(rows)
+        out = { dropped: [], archived: [], failed: [] }
+        delete = Write::KeyDelete.new(container: @container, call: @call)
+        rows.each do |row|
+          key = row["key"]
+          begin
+            case row["action"]
+            when "drop"
+              delete.call(key)
+              out[:dropped] << key
+            when "archive"
+              archive_leaf(row)
+              delete.call(key)
+              out[:archived] << key
+            end
+          rescue Textus::Error => e
+            out[:failed] << { "key" => key, "error" => e.message }
+          end
+        end
+        out
+      end
+
+      # Copy the leaf into <store>/archive/<relative-path> before deletion.
+      # (Lifted from the retired RetentionSweep#archive_leaf.)
+      def archive_leaf(row)
+        src  = row["path"]
+        root = @container.root.to_s
+        rel  = src.delete_prefix("#{root}/")
+        dest = File.join(root, "archive", rel)
+        FileUtils.mkdir_p(File.dirname(dest))
+        FileUtils.cp(src, dest)
+      end
+    end
+  end
+end

data/lib/textus/manifest/capabilities.rb

@@ -13,7 +13,7 @@ module Textus
       DEFAULT_MAPPING = {
         Textus::Role::HUMAN => %w[author propose].freeze,
         Textus::Role::AGENT => %w[propose].freeze,
-        Textus::Role::AUTOMATION => %w[fetch build].freeze,
+        Textus::Role::AUTOMATION => %w[reconcile].freeze,
       }.freeze
 
       # Returns { role_name => [verbs] }. When `roles:` is declared we use

data/lib/textus/manifest/data.rb

@@ -49,8 +49,8 @@ module Textus
         @audit_config = build_audit_config(raw)
         @role_caps = Capabilities.resolve(raw["roles"])
         # Policy is constructed before entries because Entry validators
-        # call `entry.in_generator_zone?(policy)` and similar helpers
-        # that take Policy as an argument.
+        # use the entry's own `derived?` and similar helpers that call into
+        # Policy; Policy must exist before entries are built.
         @policy = Policy.new(self)
         @entries = build_entries(raw)
         validate_declared_keys!

data/lib/textus/manifest/entry/base.rb

@@ -2,10 +2,10 @@ module Textus
   class Manifest
     class Entry
       class Base < Entry
-        attr_reader :raw, :key, :path, :zone, :schema, :owner, :format, :publish_to
+        attr_reader :raw, :key, :path, :zone, :schema, :owner, :format, :publish_targets
 
         # rubocop:disable Metrics/ParameterLists, Lint/MissingSuper
-        def initialize(raw:, key:, path:, zone:, schema:, owner:, format:, publish_to: [])
+        def initialize(raw:, key:, path:, zone:, schema:, owner:, format:, publish_targets: [])
           @raw = raw
           @key = key
           @path = path
@@ -13,7 +13,7 @@ module Textus
           @schema = schema
           @owner = owner
           @format = format
-          @publish_to = Array(publish_to)
+          @publish_targets = Array(publish_targets)
         end
         # rubocop:enable Metrics/ParameterLists, Lint/MissingSuper
 
@@ -23,28 +23,34 @@ module Textus
           raise UsageError.new("entry '#{@key}': #{e.message}")
         end
 
-        def in_generator_zone?(policy) = policy.derived_zone?(@zone)
-        def in_proposal_zone?(policy)  = policy.queue_zone?(@zone)
+        def in_proposal_zone?(policy) = policy.queue_zone?(@zone)
 
         def nested?  = false
         def derived? = false
         def intake?  = false
         def leaf?    = false
 
+        # Production traits. Default false on Base (a leaf/intake entry is neither
+        # an out-of-band command nor a projection); Produced overrides both from
+        # its source. Lets publish modes call these without a `respond_to?` guard.
+        def external?   = false
+        def projection? = false
+
         # Whether git should track this entry's file. Default true; an entry
         # marked `tracked: false` in the manifest stays protocol-readable but is
         # listed in the generated `.gitignore` (ADR 0043). Cross-cutting, so it
         # reads from raw here rather than threading through every constructor.
         def tracked? = @raw["tracked"] != false
 
+        # Single source of truth is @publish_targets (ADR 0094). These
+        # derive the ADR-0049/0052 views the publish modes consume.
+        def publish_to   = @publish_targets.select(&:to_target?).map(&:to)
+        def publish_tree = @publish_targets.find(&:tree_target?)&.tree
+
         # Nil stubs for cross-cutting optional attrs. Subclasses override the
         # ones they own. Validators and serializers can call these directly
         # without `respond_to?` guards.
-        def template       = nil
-        def inject_boot    = false # rubocop:disable Naming/PredicateMethod
-        def provenance     = true  # rubocop:disable Naming/PredicateMethod
         def events         = {}
-        def publish_tree   = nil
         def ignore         = []
 
         # Per-entry ignore (ADR 0042). Base entries enumerate no tree, so
@@ -69,6 +75,19 @@ module Textus
             events.publish(event, ctx: hook_context, **payload)
           end
 
+          # Read a named template from the store's templates/ directory.
+          # Raises TemplateError when the file doesn't exist.
+          def read_template(name)
+            path = File.join(container.root.to_s, "templates", name)
+            unless File.exist?(path)
+              raise Textus::TemplateError.new(
+                "template '#{name}' not found",
+                template_name: name,
+              )
+            end
+            File.read(path)
+          end
+
           private
 
           def scope_for_hooks

data/lib/textus/manifest/entry/nested.rb

@@ -6,11 +6,10 @@ module Textus
       # Entry::Publish::* — Nested is just the value (attributes + ignore
       # predicate) those modes read.
       class Nested < Base
-        attr_reader :publish_tree, :ignore
+        attr_reader :ignore
 
-        def initialize(publish_tree: nil, ignore: nil, **rest)
+        def initialize(ignore: nil, **rest)
           super(**rest)
-          @publish_tree = publish_tree
           @ignore = Array(ignore)
         end
 
@@ -24,8 +23,8 @@ module Textus
         KIND = :nested
 
         def self.from_raw(common, raw)
+          # publish_tree is derived from publish_targets (ADR 0094) via Base#publish_tree
           new(
-            publish_tree: raw.dig("publish", "tree"), # ADR 0052: typed publish block
             ignore: raw["ignore"],
             **common,
           )

data/lib/textus/manifest/entry/parser.rb

@@ -2,8 +2,6 @@ module Textus
   class Manifest
     class Entry
       module Parser
-        COMPUTE_KINDS = %w[projection external].freeze
-
         def self.call(raw)
           key = raw["key"] or raise UsageError.new("manifest entry missing key")
           path = raw["path"] or raise UsageError.new("manifest entry '#{key}' missing path")
@@ -11,6 +9,12 @@ module Textus
 
           raw_kind = raw["kind"] or raise BadManifest.new("entry '#{key}' missing required `kind:` (#{Entry::REGISTRY.keys.join("|")})")
           kind = raw_kind.to_sym
+          if %i[derived intake].include?(kind)
+            raise BadManifest.new(
+              "entry '#{key}': kind: #{kind} was collapsed into `kind: produced` (ADR 0095) — " \
+              "the produce method is `source.from` (#{kind == :intake ? "handler" : "project|command"})",
+            )
+          end
           format = resolve_format(raw, path)
 
           common = {
@@ -18,10 +22,7 @@ module Textus
             key: key, path: path, zone: zone,
             schema: raw["schema"], owner: raw["owner"],
             format: format,
-            # ADR 0052: publish config is one typed block; the internal
-            # publish_to/publish_tree readers (the ADR 0049 modes) are sourced
-            # from it (publish_to <- publish.to, publish_tree <- publish.tree).
-            publish_to: raw.dig("publish", "to")
+            publish_targets: publish_targets(raw)
           }
 
           klass = Entry::REGISTRY[kind] or
@@ -29,26 +30,29 @@ module Textus
           klass.from_raw(common, raw)
         end
 
+        # ADR 0093: an entry's production block is the unified `source:`. Returns a
+        # Domain::Policy::Source; kind (intake/derived) is read from source.from.
         def self.parse_source(raw, key)
-          compute = raw["compute"]
-          raise BadManifest.new("derived entry '#{key}' requires compute: { kind: projection|external } or template:") if compute.nil?
+          block = raw["source"] or
+            raise BadManifest.new("entry '#{key}' requires a source: { from: project|handler|command, ... }")
 
-          unless COMPUTE_KINDS.include?(compute["kind"])
-            raise BadManifest.new(
-              "entry '#{key}': compute.kind must be one of #{COMPUTE_KINDS.join(", ")} (got #{compute["kind"].inspect})",
-            )
-          end
+          Textus::Domain::Policy::Source.new(block)
+        end
 
-          if compute["kind"] == "projection"
-            Entry::Derived::Projection.new(
-              select: compute["select"],
-              pluck: compute["pluck"],
-              sort_by: compute["sort_by"],
-              transform: compute["transform"],
+        # ADR 0094: `publish:` is a LIST of target objects — to-targets
+        # [{to, template?, inject_boot?}] and/or a tree-target [{tree}]. The
+        # ADR-0052 map forms ({to: […]} / {tree: …}) are retired.
+        def self.publish_targets(raw)
+          block = raw["publish"]
+          return [] if block.nil?
+
+          unless block.is_a?(Array)
+            raise BadManifest.new(
+              "entry '#{raw["key"]}': `publish:` must be a list of targets " \
+              "[{to:, template:?} | {tree:}] (ADR 0094); the `publish: { … }` map form was retired",
             )
-          else
-            Entry::Derived::External.new(sources: compute["sources"], command: compute["command"])
           end
+          block.map { |t| Textus::Domain::Policy::PublishTarget.new(t) }
         end
 
         def self.resolve_format(raw, path)