textus 0.50.0 → 0.52.0

data/lib/textus/read/freshness.rb

@@ -2,22 +2,28 @@ require "time"
 
 module Textus
   module Read
-    # Per-entry lifecycle scan (ADR 0079, 0085). Walks every entry declared in
-    # the manifest, consults `rules.for(key)` for a `lifecycle:` policy, and
-    # reports the unified verdict. Status is one of :fresh, :expired, or
-    # :no_policy; the row also carries the policy's :action (on_expire).
+    # Per-entry staleness scan (ADR 0079, 0085, 0093). Walks every entry declared
+    # in the manifest and reports a staleness verdict sourced from the two new
+    # policy slots (ADR 0093):
+    #   - intake entries: `entry.source.ttl_seconds` is the re-pull cadence;
+    #     basis = `_meta.last_fetched_at` (else file mtime). Past ttl ⇒ :expired.
+    #   - entries matched by a `retention:` rule: `retention.ttl_seconds` is the
+    #     GC age; basis = file mtime. Past ttl ⇒ :expired (:action = drop/archive).
+    # Intake cadence wins when both apply (freshness is content currency; GC dueness
+    # shows via `drain --dry-run`).
+    # Status is one of :fresh, :expired, or :no_policy; the row also carries
+    # :action (:refresh for intake, :drop/:archive for retention).
     #
     # ADR 0085 removed the public `freshness` verb: there is no `:cli`/`:mcp`
-    # surface. This is now a Ruby-only internal scan (empty `surfaces`, the
-    # honest home reserved by ADR 0073) consumed by `pulse` (which derives
-    # `stale` + `next_due_at` from it) and the hook `Context`. Humans drill
-    # into per-entry lifecycle detail via `get` (last_fetched_at) + `rule_explain`
-    # (the ttl / on_expire policy) instead of a dedicated verb.
+    # surface. This is now a Ruby-only internal scan consumed by `pulse` (which
+    # derives `stale` + `next_due_at` from it) and the hook `Context`. Humans drill
+    # into per-entry staleness detail via `get` (last_fetched_at) + `rule_explain`
+    # (the ttl / action policy) instead of a dedicated verb.
     class Freshness
       extend Textus::Contract::DSL
 
       verb     :freshness
-      summary  "Internal per-entry lifecycle scan (status, age, ttl, on_expire); backs pulse + hook context. No public surface (ADR 0085)."
+      summary  "Internal per-entry lifecycle scan (status, age, ttl, action); backs pulse + hook context. No public surface (ADR 0085)."
       arg :prefix, String, required: false, description: "filter to keys with this prefix"
       arg :zone,   String, required: false, description: "filter to entries in this zone"
 
@@ -54,29 +60,59 @@ module Textus
       private
 
       def row_for(mentry)
-        policy = lifecycle_for(mentry.key)
         envelope = safe_get(mentry.key)
         last = envelope&.meta&.dig("last_fetched_at")
+        ttl, action = policy_for(mentry)
+        return base_row(mentry, last).merge(status: :no_policy) if ttl.nil?
 
-        return base_row(mentry, last).merge(status: :no_policy) if policy.nil?
-
-        expired, reason = Textus::Domain::Lifecycle.verdict(
-          policy: policy,
-          last_fetched_at: last,
-          mtime: mtime_for(mentry.key),
-          now: @call.now,
-        )
+        basis = basis_for(mentry)
+        expired = expired?(mentry, basis, ttl)
         base_row(mentry, last).merge(
-          ttl_seconds: policy.ttl_seconds,
-          action: policy.on_expire,
+          ttl_seconds: ttl,
+          action: action,
           status: expired ? :expired : :fresh,
-          reason: reason,
-          next_due_at: next_due(last, policy.ttl_seconds),
+          next_due_at: basis.nil? ? nil : (basis + ttl).utc.iso8601,
         )
       end
 
-      def lifecycle_for(key)
-        @manifest.rules.for(key).lifecycle
+      # ADR 0093: staleness comes from the intake re-pull cadence (source.ttl)
+      # or a retention GC rule (retention.ttl). Intake cadence wins when an entry
+      # has both (freshness is about content currency; GC dueness still shows via
+      # `drain --dry-run`). Returns [ttl_seconds, action] or [nil, nil].
+      def policy_for(mentry)
+        if mentry.intake?
+          ttl = mentry.source.ttl_seconds
+          return [ttl, :refresh] unless ttl.nil?
+        end
+        ret = @manifest.rules.for(mentry.key).retention
+        return [ret.ttl_seconds, ret.action] unless ret.nil?
+
+        [nil, nil]
+      end
+
+      # Intake currency basis comes from the evaluator (single definition);
+      # retention dueness is keyed off file mtime.
+      def basis_for(mentry)
+        return evaluator.intake_basis(mentry) if mentry.intake? && mentry.source.ttl_seconds
+
+        mtime_for(mentry.key)
+      end
+
+      def expired?(mentry, basis, ttl)
+        if mentry.intake? && mentry.source.ttl_seconds
+          evaluator.verdict(mentry).stale
+        else
+          # Preserve pre-0099 pulse semantics: a never-recorded retention entry
+          # (no file => nil basis) is past due. Retention::Sweep.expired? alone
+          # returns false on nil mtime (it runs post-exists? in the sweep).
+          basis.nil? || Textus::Domain::Retention::Sweep.expired?(ttl_seconds: ttl, mtime: basis, now: @call.now)
+        end
+      end
+
+      def evaluator
+        @evaluator ||= Textus::Domain::Freshness::Evaluator.new(
+          manifest: @manifest, file_stat: Textus::Ports::Storage::FileStat.new, clock: @call,
+        )
       end
 
       def mtime_for(key)
@@ -111,12 +147,6 @@ module Textus
       rescue Textus::Error
         nil
       end
-
-      def next_due(last, ttl)
-        return nil if last.nil? || ttl.nil?
-
-        (Time.parse(last) + ttl).utc.iso8601
-      end
     end
   end
 end

data/lib/textus/read/get.rb

@@ -1,119 +1,59 @@
 module Textus
   module Read
-    # The one read path. `fetch:` controls behavior:
-    #   fetch: false (default) — pure read: the on-disk envelope annotated with
-    #     a lifecycle freshness verdict. NEVER builds the orchestrator and NEVER
-    #     mutates. Safe for direct callers (accept/reject/publish, materializer,
-    #     uid, validators, hooks).
-    #   fetch: true — read-through: after a stale verdict on a `refresh` policy,
-    #     hands off to the fetch orchestrator. A read NEVER performs a
-    #     destructive action (drop/archive) — those belong to the `tend` sweep
-    #     (ADR 0079).
-    #
-    # Lifecycle policy comes from the unified `lifecycle:` rule slot (ADR 0079).
+    # The one read path — a pure read (ADR 0089, 0093): the on-disk envelope
+    # annotated with a freshness annotation. It NEVER mutates and NEVER ingests.
+    # Quarantine freshness is system-pushed via `drain` (scheduled sweep) and
+    # `hook run` (event push). Lifecycle is removed from the get path (ADR 0093):
+    # intake cadence lives in `source.ttl`; GC lives in `retention:` rules; both
+    # are evaluated exclusively by the `drain` sweep, not by a read.
     class Get
       extend Textus::Contract::DSL
 
       verb     :get
-      summary  "Read one entry. Read-through by default — refreshes on stale per " \
-               "the entry's lifecycle rule (on_expire: refresh), degrading to a " \
-               "pure read when the key has no rule. Pass fetch:false for a " \
-               "guaranteed pure on-disk read. Returns the envelope (uid, etag, " \
-               "_meta, body, freshness)."
+      summary  "Read one entry — a pure on-disk read annotated with a freshness " \
+               "verdict; never ingests (quarantine freshness is drain + hook " \
+               "only, ADR 0089). Returns the envelope (uid, etag, _meta, body, " \
+               "freshness)."
       surfaces :cli, :mcp
       arg :key, String, required: true, positional: true,
                         description: "dotted entry key to read, e.g. 'knowledge.project'"
-      arg :fetch, :boolean, default: true,
-                            description: "read-through (refresh on stale per the " \
-                                         "entry's lifecycle rule) when true, the default; " \
-                                         "false returns the on-disk envelope without ever fetching"
       view { |v, _i| v.to_h_for_wire }
 
-      def initialize(container:, call:, orchestrator: nil, file_stat: Textus::Ports::Storage::FileStat.new)
+      def initialize(container:, call:, file_stat: Textus::Ports::Storage::FileStat.new)
         @container  = container
         @call       = call
         @manifest   = container.manifest
         @file_store = container.file_store
         @file_stat  = file_stat
-        @orchestrator = orchestrator # nil → built lazily on first fetch only
       end
 
-      def call(key, fetch: false)
-        envelope = annotated_envelope(key)
-        return envelope if envelope.nil?
-        return envelope unless fetch && envelope.freshness&.stale
-
-        policy = lifecycle_for(key)
-        return envelope unless policy&.on_expire == :refresh # only refresh acts on a read
-
-        verdict = Textus::Domain::Freshness::Verdict.stale(envelope.freshness.reason)
-        outcome = orchestrator.execute(refresh_policy(policy).decide(verdict), key: key)
-        resolve(outcome, envelope)
+      def call(key)
+        annotated_envelope(key)
       end
 
       # Strict variant: raises UnknownKey when the entry is missing.
       # Used by consumers (e.g. uid, Validator) that distinguish absence.
-      def get(key, fetch: false)
-        call(key, fetch: fetch) ||
+      def get(key)
+        call(key) ||
           raise(UnknownKey.new(key, suggestions: @manifest.resolver.suggestions_for(key)))
       end
 
       private
 
-      # Pure read + unified lifecycle verdict; no orchestrator dependency.
       def annotated_envelope(key)
         envelope = read_raw_envelope(key)
         return nil if envelope.nil?
 
-        policy = lifecycle_for(key)
-        return annotate_fresh(envelope) if policy.nil?
-
-        expired, reason = Textus::Domain::Lifecycle.verdict(
-          policy: policy,
-          last_fetched_at: envelope.meta&.dig("last_fetched_at"),
-          mtime: mtime_for(key),
-          now: @call.now,
-        )
-        envelope.with(freshness: Textus::Domain::Freshness.build(
-          stale: expired, reason: reason, fetching: false,
-        ))
-      end
-
-      def lifecycle_for(key)
-        @manifest.rules.for(key).lifecycle
+        entry = @manifest.resolver.resolve(key).entry
+        envelope.with(freshness: evaluator.verdict(entry))
       end
 
-      def refresh_policy(policy)
-        Textus::Domain::Freshness::Policy.new(
-          ttl_seconds: policy.ttl_seconds,
-          on_stale: policy.budget_ms ? :timed_sync : :sync,
-          sync_budget_ms: policy.budget_ms,
+      def evaluator
+        @evaluator ||= Textus::Domain::Freshness::Evaluator.new(
+          manifest: @manifest, file_stat: @file_stat, clock: @call,
         )
       end
 
-      def mtime_for(key)
-        path = @manifest.resolver.resolve(key).path
-        @file_stat.exists?(path) ? @file_stat.mtime(path) : nil
-      rescue Textus::Error
-        nil
-      end
-
-      def resolve(outcome, envelope)
-        case outcome
-        when Textus::Domain::Outcome::Skipped
-          envelope
-        when Textus::Domain::Outcome::Fetched
-          outcome.envelope.with(
-            freshness: Textus::Domain::Freshness.build(stale: false, reason: nil, fetching: false),
-          )
-        when Textus::Domain::Outcome::Detached
-          envelope.with(freshness: envelope.freshness.with(fetching: true))
-        when Textus::Domain::Outcome::Failed
-          envelope.with(freshness: envelope.freshness.with(fetch_error: outcome.error.message))
-        else raise "unexpected fetch outcome: #{outcome.class}"
-        end
-      end
-
       def read_raw_envelope(key)
         res = @manifest.resolver.resolve(key)
         mentry = res.entry
@@ -128,28 +68,6 @@ module Textus
           etag: Etag.for_bytes(raw), content: parsed["content"]
         )
       end
-
-      def annotate_fresh(envelope)
-        envelope.with(freshness: Textus::Domain::Freshness.build(
-          stale: false, reason: nil, fetching: false,
-        ))
-      end
-
-      def orchestrator
-        @orchestrator ||= build_orchestrator
-      end
-
-      def build_orchestrator
-        worker = Textus::Write::FetchWorker.new(container: @container, call: @call)
-        Textus::Write::FetchOrchestrator.new(
-          worker: worker, store_root: @container.root, events: @container.events,
-          hook_context: hook_context
-        )
-      end
-
-      def hook_context
-        @hook_context ||= Textus::Hooks::Context.for(container: @container, call: @call)
-      end
     end
   end
 end

data/lib/textus/read/jobs.rb

@@ -0,0 +1,31 @@
+module Textus
+  module Read
+    # Inspect and operate the job queue: list ids by state, retry a dead-lettered
+    # job, or purge a state. The agent's window into deferred convergence work.
+    class Jobs
+      extend Textus::Contract::DSL
+
+      verb     :jobs
+      summary  "List queued jobs by state; retry a dead-lettered job or purge a state."
+      surfaces :cli, :mcp
+      cli      "jobs"
+      arg :state,  String, default: "ready", description: "ready|leased|done|failed"
+      arg :action, String, default: nil, description: "retry|purge (optional)"
+      arg :job_id, String, default: nil, description: "job id (required for action=retry)"
+
+      def initialize(container:, call:)
+        @container = container
+        @call = call
+      end
+
+      def call(state: "ready", action: nil, job_id: nil)
+        queue = Textus::Ports::Queue.new(root: @container.root)
+        case action
+        when "retry" then queue.retry_failed(job_id)
+        when "purge" then queue.purge(state)
+        end
+        { "protocol" => Textus::PROTOCOL, "ok" => true, "state" => state, "jobs" => queue.list(state) }
+      end
+    end
+  end
+end

data/lib/textus/read/rdeps.rb

@@ -21,12 +21,12 @@ module Textus
 
       def dependents_of(key)
         @manifest.data.entries.each_with_object([]) do |e, acc|
-          next unless e.is_a?(Textus::Manifest::Entry::Derived)
+          next unless e.derived?
 
           src = e.source
-          sources = if src.is_a?(Textus::Manifest::Entry::Derived::Projection)
+          sources = if src.projection?
                       Array(src.select).compact
-                    elsif src.is_a?(Textus::Manifest::Entry::Derived::External)
+                    elsif src.external?
                       Array(src.sources).compact
                     else
                       []

data/lib/textus/read/rule_explain.rb

@@ -14,9 +14,9 @@ module Textus
       surfaces :cli, :mcp
       cli      "rule explain"
       arg :key,    String, required: true, positional: true,
-                           description: "dotted key whose effective rules you want (fetch ttl/action, write guard, ...)"
+                           description: "dotted key whose effective rules you want (lifecycle ttl/action, write guard, ...)"
       arg :detail, :boolean,
-          description: "defaults false: lean {fetch, guard}. detail: true adds matched blocks + guard predicates per transition."
+          description: "defaults false: lean {lifecycle, guard}. detail: true adds matched blocks + guard predicates per transition."
       view(:cli) { |r| { "verb" => "rule_explain" }.merge(r.transform_keys(&:to_s)) }
 
       def initialize(container:, call: nil) # rubocop:disable Lint/UnusedMethodArgument
@@ -24,6 +24,16 @@ module Textus
         @schemas  = container.schemas
       end
 
+      REGISTRY = Textus::Manifest::Schema::FIELD_REGISTRY
+      # Field membership is registry-driven (WS3). Lean shows the fields tagged
+      # for :lean; detail's matched_blocks flag every :detail field. The
+      # `effective` value-block shows the instantiated-policy fields (those with
+      # a policy_class) — guard, being a raw deferred field, is surfaced through
+      # the dedicated `guards:` predicate section instead.
+      LEAN_FIELDS    = REGISTRY.select { |_, m| m[:in_rule_explain].include?(:lean) }.keys.freeze
+      DETAIL_FIELDS  = REGISTRY.select { |_, m| m[:in_rule_explain].include?(:detail) }.keys.freeze
+      EFFECTIVE_FIELDS = DETAIL_FIELDS.select { |f| REGISTRY[f][:policy_class] }.freeze
+
       def call(key, detail: false)
         detail ? explain(key) : effective(key)
       end
@@ -33,14 +43,17 @@ module Textus
       # Lean: the effective winners only (formerly Read::Rules / the `rules` verb).
       def effective(key)
         set = @manifest.rules.for(key)
-        {
-          "lifecycle" => set.lifecycle && {
-            "ttl_seconds" => set.lifecycle.ttl_seconds,
-            "on_expire" => set.lifecycle.on_expire,
-            "budget_ms" => set.lifecycle.budget_ms,
-          },
-          "guard" => set.guard,
-        }.compact
+        LEAN_FIELDS.each_with_object({}) do |field, out|
+          value = set.public_send(field)
+          out[field.to_s] = lean_value(field, value) unless value.nil?
+        end
+      end
+
+      def lean_value(field, value)
+        case field
+        when :retention then retention_hash(value, string_keys: true)
+        else value
+        end
       end
 
       # Verbose: every matching block, per-slot effective value, and the
@@ -54,25 +67,30 @@ module Textus
         {
           key: key,
           matched_blocks: matching.map do |b|
-            {
-              match: b.match,
-              lifecycle: !b.lifecycle.nil?,
-              handler_allowlist: !b.handler_allowlist.nil?,
-              guard: !b.guard.nil?,
-            }
+            { match: b.match }.merge(DETAIL_FIELDS.to_h { |f| [f, !b.public_send(f).nil?] })
           end,
-          effective: {
-            lifecycle: winners.lifecycle && {
-              ttl_seconds: winners.lifecycle.ttl_seconds,
-              on_expire: winners.lifecycle.on_expire,
-            },
-            handler_allowlist: winners.handler_allowlist&.handlers,
-          },
+          effective: EFFECTIVE_FIELDS.to_h { |f| [f, effective_value(f, winners.public_send(f))] },
           guards: Textus::Domain::Policy::BaseGuards::BASE.keys.to_h do |transition|
             [transition, factory.for(transition, key).predicates.map(&:name)]
           end,
         }
       end
+
+      def effective_value(field, value)
+        return nil if value.nil?
+
+        case field
+        when :retention         then retention_hash(value, string_keys: false)
+        when :handler_allowlist then value.handlers
+        else value
+        end
+      end
+
+      # ADR 0093: retention is a flat GC policy (ttl + drop/archive action).
+      def retention_hash(retention, string_keys:)
+        h = { ttl_seconds: retention.ttl_seconds, action: retention.action }
+        string_keys ? h.transform_keys(&:to_s) : h
+      end
     end
   end
 end

data/lib/textus/read/rule_list.rb

@@ -17,21 +17,38 @@ module Textus
         @manifest = container.manifest
       end
 
+      # Fields shown here are driven by FIELD_REGISTRY (in_rule_list); only the
+      # per-field serialization below is field-specific.
+      LIST_FIELDS = Textus::Manifest::Schema::FIELD_REGISTRY.select { |_, m| m[:in_rule_list] }.keys.freeze
+
       def call
         @manifest.rules.blocks.map do |b|
           row = { "match" => b.match }
-          if b.lifecycle
-            row["lifecycle"] = {
-              "ttl_seconds" => b.lifecycle.ttl_seconds,
-              "on_expire" => b.lifecycle.on_expire,
-              "budget_ms" => b.lifecycle.budget_ms,
-            }
+          LIST_FIELDS.each do |field|
+            value = b.public_send(field)
+            row[field.to_s] = serialize(field, value) unless value.nil?
           end
-          row["handler_allowlist"] = b.handler_allowlist.handlers if b.handler_allowlist
-          row["guard"] = b.guard if b.guard
           row
         end
       end
+
+      private
+
+      def serialize(field, value)
+        case field
+        when :retention
+          serialize_retention(value)
+        when :handler_allowlist
+          value.handlers
+        else
+          value
+        end
+      end
+
+      # ADR 0093: retention is a flat GC policy.
+      def serialize_retention(retention)
+        { "ttl_seconds" => retention.ttl_seconds, "action" => retention.action.to_s }
+      end
     end
   end
 end

data/lib/textus/read/validate_all.rb

@@ -1,6 +1,20 @@
 module Textus
   module Read
+    # Store-wide schema + role-authority validation: walks every entry and runs
+    # the Validator over it. Consumed internally by `doctor`'s schema_violations
+    # check and exposed as a Ruby store method (`store.validate_all`).
+    #
+    # Ruby-only, like `Read::Freshness`: it declares a contract (so it round-trips
+    # through the routing<->contract bijection, ADR 0105) but omits `surfaces`, so
+    # it gets no CLI or MCP projection. The public `validate-all` CLI verb was
+    # removed in v0.5 (`doctor --check=schema_violations` replaces it).
     class ValidateAll
+      extend Textus::Contract::DSL
+
+      verb    :validate_all
+      summary "Internal store-wide schema + role-authority validation; backs " \
+              "doctor's schema_violations check. No public surface (ADR 0105)."
+
       def initialize(container:, call:)
         @container = container
         @call      = call

data/lib/textus/role.rb

@@ -1,7 +1,8 @@
 module Textus
   module Role
     # The three role archetypes, each string sourced exactly once: human curates
-    # canon, agent proposes, automation fetches/builds (explanation/concepts.md).
+    # canon, agent proposes, automation converges the machine-maintained lanes
+    # (refresh + materialize) (explanation/concepts.md).
     # Reference these constants instead of bare literals (ADR 0044).
     HUMAN      = "human".freeze
     AGENT      = "agent".freeze

data/lib/textus/schemas.rb

@@ -24,6 +24,14 @@ module Textus
       @schemas.values
     end
 
+    # Name-keyed view: { canonical_name => Schema }. The key is the schema's
+    # file stem, which is authoritative even when a schema file carries no
+    # top-level `name:` (Schema#name reads the body and may be nil). Symmetric
+    # with #all (values); use this when you need the names too.
+    def by_name
+      @schemas.dup
+    end
+
     private
 
     def load_all

data/lib/textus/store.rb

@@ -90,6 +90,7 @@ module Textus
 
     def bootstrap_hooks
       Ports::AuditSubscriber.new(audit_log).attach(events)
+      Ports::ProduceOnWriteSubscriber.new(container).attach(events)
       Hooks::Builtin.register_all(events: events, rpc: rpc)
       Hooks::Loader.new(events: events, rpc: rpc).load_dir(File.join(root, "hooks"))
     end

data/lib/textus/version.rb

@@ -1,4 +1,4 @@
 module Textus
-  VERSION = "0.50.0"
+  VERSION = "0.52.0"
   PROTOCOL = "textus/3"
 end

data/lib/textus/write/enqueue.rb

@@ -0,0 +1,50 @@
+module Textus
+  module Write
+    # Push a job of a REGISTERED type onto the convergence queue, to be run by
+    # drain/serve. The closed allow-list (Jobs::Handlers.registry) is the safety
+    # boundary: an unregistered type is refused, so the general runner can never
+    # execute arbitrary code. Authority is checked here (the caller must hold the
+    # type's required_role, if any) and frozen onto the job's `enqueued_by` — the
+    # worker runs it as exactly this role, no escalation via the queue.
+    class Enqueue
+      extend Textus::Contract::DSL
+
+      verb     :enqueue
+      summary  "Push a registered job type onto the convergence queue, to be run by drain/serve."
+      surfaces :cli, :mcp
+      cli      "enqueue"
+      arg :type, String, required: true, positional: true, description: "registered job type (e.g. materialize, re-pull, sweep)"
+      arg :args, Hash, positional: true, default: {}, description: "type-specific arguments (e.g. { key: ... } or { scope: ... })"
+
+      def initialize(container:, call:)
+        @container = container
+        @call = call
+      end
+
+      def call(type, args = {})
+        entry = Textus::Jobs::Handlers.registry.lookup(type) # raises UsageError for unregistered types
+        authorize!(entry)
+
+        job = Textus::Domain::Jobs::Job.new(
+          type: type, args: args, enqueued_by: @call.role, max_attempts: entry.max_attempts,
+        )
+        Textus::Ports::Queue.new(root: @container.root).enqueue(job)
+        { "protocol" => Textus::PROTOCOL, "ok" => true, "id" => job.id }
+      end
+
+      private
+
+      def authorize!(entry)
+        required = entry.required_role
+        return if required.nil? || @call.role == required
+
+        raise Textus::Error.new(
+          "forbidden",
+          "role '#{@call.role}' is not authorized to enqueue this job type (requires '#{required}')",
+          details: { "role" => @call.role, "required_role" => required },
+          exit_code: 77,
+        )
+      end
+    end
+  end
+end

data/lib/textus/write/put.rb

@@ -39,7 +39,7 @@ module Textus
           if_etag: if_etag,
         )
 
-        @events.publish(:entry_put,
+        @events.publish(:entry_written,
                         ctx: hook_context,
                         key: key,
                         envelope: envelope)