textus 0.50.0 → 0.52.0

data/lib/textus/errors.rb

@@ -127,10 +127,10 @@ module Textus
     def initialize(holder)
       super(
         "build_in_progress",
-        "textus build already running (#{holder})",
+        "a textus maintenance pass is already running (#{holder})",
         details: { "holder" => holder },
         exit_code: 75,
-        hint: "wait for the running build to finish, or check for a recursive hook trigger"
+        hint: "wait for the running maintenance pass to finish, or check for a recursive hook trigger"
       )
     end
   end
@@ -166,9 +166,9 @@ module Textus
     def initialize(m, format: nil)
       hint =
         if format
-          "the template rendered invalid #{format}; try rendering with mock data and parsing the output before re-running build"
+          "the template rendered invalid #{format}; try rendering with mock data and parsing the output before re-running drain"
         else
-          "the template rendered invalid content; try rendering with mock data and parsing the output before re-running build"
+          "the template rendered invalid content; try rendering with mock data and parsing the output before re-running drain"
         end
       super("bad_render", m, hint: hint)
     end

data/lib/textus/hooks/builtin.rb

@@ -8,21 +8,21 @@ module Textus
     module Builtin
       # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
       def self.register_all(events:, rpc:) # rubocop:disable Lint/UnusedMethodArgument
-        rpc.register(:resolve_intake, :json) do |caps:, config:, args:|
+        rpc.register(:resolve_handler, :json) do |caps:, config:, args:|
           _ = caps
           _ = args
           data = JSON.parse(config["bytes"].to_s)
           { _meta: {}, body: YAML.dump(data) }
         end
 
-        rpc.register(:resolve_intake, :csv) do |caps:, config:, args:|
+        rpc.register(:resolve_handler, :csv) do |caps:, config:, args:|
           _ = caps
           _ = args
           rows = CSV.parse(config["bytes"].to_s, headers: true).map(&:to_h)
           { _meta: {}, body: YAML.dump(rows) }
         end
 
-        rpc.register(:resolve_intake, :"markdown-links") do |caps:, config:, args:|
+        rpc.register(:resolve_handler, :"markdown-links") do |caps:, config:, args:|
           _ = caps
           _ = args
           links = config["bytes"].to_s.scan(%r{\[([^\]]+)\]\((https?://[^)\s]+)\)}).map do |text, href|
@@ -31,7 +31,7 @@ module Textus
           { _meta: {}, body: YAML.dump(links) }
         end
 
-        rpc.register(:resolve_intake, :"ical-events") do |caps:, config:, args:|
+        rpc.register(:resolve_handler, :"ical-events") do |caps:, config:, args:|
           _ = caps
           _ = args
           events_list = []
@@ -50,7 +50,7 @@ module Textus
           { _meta: {}, body: YAML.dump(events_list) }
         end
 
-        rpc.register(:resolve_intake, :rss) do |caps:, config:, args:|
+        rpc.register(:resolve_handler, :rss) do |caps:, config:, args:|
           _ = caps
           _ = args
           doc = REXML::Document.new(config["bytes"].to_s)

data/lib/textus/hooks/catalog.rb

@@ -11,24 +11,24 @@ module Textus
     module Catalog
       # Pub-sub events: 0..N handlers, fire-and-forget, receive `ctx:`.
       PUBSUB = {
-        entry_put: %i[ctx key envelope],
+        entry_written: %i[ctx key envelope],
         entry_deleted: %i[ctx key],
         entry_fetched: %i[ctx key envelope change],
         entry_renamed: %i[ctx key from_key to_key envelope],
-        build_completed: %i[ctx key envelope sources],
+        entry_produced: %i[ctx key envelope sources],
+        produce_failed: %i[ctx keys error],
         proposal_accepted: %i[ctx key target_key],
         proposal_rejected: %i[ctx key target_key],
-        file_published: %i[ctx key envelope source target],
+        entry_published: %i[ctx key envelope source target],
         store_loaded: %i[ctx],
         session_opened: %i[ctx role cursor],
-        fetch_started: %i[ctx key mode],
-        fetch_failed: %i[ctx key error_class error_message],
-        fetch_backgrounded: %i[ctx key started_at budget_ms],
+        entry_fetch_started: %i[ctx key mode],
+        entry_fetch_failed: %i[ctx key error_class error_message],
       }.freeze
 
       # RPC events: single handler, return value matters, receive `caps:`.
       RPC = {
-        resolve_intake: %i[caps config args],
+        resolve_handler: %i[caps config args],
         transform_rows: %i[caps rows config],
         validate: %i[caps],
       }.freeze

data/lib/textus/hooks/context.rb

@@ -28,16 +28,11 @@ module Textus
         @scope
       end
 
-      # read — a deliberately pure-observation surface: NOTHING here fetches
-      # (`list`/`deps`/`freshness` don't either). The invariant is that a hook
-      # observes current state and never triggers an I/O cascade. `get` bypasses
-      # the read-through behavior (ADR 0062) and reads with fetch:false directly,
-      # because read-through inside a hook would: (1) fire fetch events → hooks →
-      # unbounded reentrancy; (2) spawn the orchestrator's threads/fork from
-      # inside a hook callback; (3) probe the single-flight fetch lock its own
-      # enclosing fetch may hold (deadlock); (4) inject network latency into
-      # every hook read. With the merged Read::Get class, `fetch:false` (the
-      # method default) guarantees no orchestrator is built.
+      # read — a pure-observation surface: nothing here ingests. Since ADR 0089
+      # `get` itself is a pure read (the read-through that once forced this
+      # surface to opt out is gone, so the old re-entrancy/deadlock guard is no
+      # longer needed); `list`/`deps`/`freshness` are reads too. A hook observes
+      # current state and never triggers an I/O cascade.
       def get(key)                = pure_reader.call(key)
       def list(**)                = @scope.list(**)
       def deps(key)               = @scope.deps(key)

data/lib/textus/init/templates/machine_intake.rb

@@ -1,15 +1,15 @@
 # .textus/hooks/machine_intake.rb
 # Scaffolded by `textus init` — CUSTOMIZE FREELY, or delete the feeds.machines
 # entry from manifest.yaml if you don't want it.
-# Feeds a per-host SNAPSHOT into feeds.machines.<host> on `textus fetch` (never
-# on the per-turn boot/pulse path). It is NESTED so it grows to a fleet: the
+# Feeds a per-host SNAPSHOT into feeds.machines.<host> on `textus drain`
+# (never on the per-turn boot/pulse path). It is NESTED so it grows to a fleet: the
 # `local` leaf scans THIS host; add ssh hosts with the cookbook recipe
 # (docs/cookbook/environment-scan.md). tracked:false → gitignored. Keep this an
 # ALLOWLIST of versions and counts — NEVER secrets, raw `env`, or package lists.
 Textus.hook do |reg|
-  reg.on(:resolve_intake, :machines) do |config:, args:, **|
+  reg.on(:resolve_handler, :machines) do |config:, args:, **|
     machine = args[:leaf_segments].first or
-      raise "fetch a host leaf, e.g. `textus fetch feeds.machines.local`"
+      raise "machines intake needs a host leaf, e.g. the 'local' in feeds.machines.local"
     spec = (config["machines"] || {}).fetch(machine) { raise "unknown machine: #{machine}" }
     unless (spec["via"] || "local").to_s == "local"
       raise "machine #{machine}: only `via: local` is scaffolded — see " \

data/lib/textus/init.rb

@@ -3,45 +3,44 @@ require "pathname"
 
 module Textus
   module Init
-    ZONES = %w[knowledge notebook feeds proposals artifacts].freeze
+    ZONES = %w[knowledge notebook proposals artifacts].freeze
 
     DEFAULT_MANIFEST = <<~YAML
       version: textus/3
       roles:
         - { name: human,      can: [author, propose] }
         - { name: agent,      can: [propose, keep] }
-        - { name: automation, can: [fetch, build] }
+        - { name: automation, can: [converge] }
       zones:
         - { name: knowledge, kind: canon,     desc: "the maintained source of truth (identity.* lives here)" }
         - { name: notebook,  kind: workspace, owner: agent, desc: "the agent's own durable working notes" }
-        - { name: feeds,     kind: quarantine, desc: "external inputs pulled in" }
         - { name: proposals, kind: queue,     desc: "changes awaiting your accept" }
-        - { name: artifacts, kind: derived,   desc: "computed, shippable outputs" }
+        - { name: artifacts, kind: machine,   desc: "machine-maintained: external inputs (artifacts.feeds.*) + computed outputs (artifacts.derived.*)" }
       entries:
         - { key: knowledge.identity, path: knowledge/identity.md, zone: knowledge, schema: null, owner: human:self, kind: leaf }
         - { key: knowledge.notes,    path: knowledge/notes,       zone: knowledge, schema: null, owner: human:self, nested: true, kind: nested }
         - { key: notebook.notes,     path: notebook/notes,        zone: notebook,  schema: null, owner: agent:self, nested: true, kind: nested }
         - { key: proposals.notes,    path: proposals/notes,       zone: proposals, schema: null, owner: agent:self, nested: true, kind: nested }
-        # A per-host snapshot, pulled by `textus fetch feeds.machines.local --as=automation`.
-        # Nested so it grows to a fleet — add feeds.machines.<host> leaves over SSH
+        # A per-host snapshot, refreshed from its declared intake by `textus drain` (scheduled, or on demand).
+        # Nested so it grows to a fleet — add artifacts.feeds.machines.<host> leaves over SSH
         # (see docs/cookbook/environment-scan.md) without renaming. tracked:false →
         # gitignored (machine info can be sensitive/noisy) but still protocol-readable
-        # via `textus get feeds.machines.local`. Delete to opt out. (ADR 0043)
-        - key: feeds.machines
-          path: feeds/machines
-          zone: feeds
+        # via `textus get artifacts.feeds.machines.local`. Delete to opt out. (ADR 0043)
+        - key: artifacts.feeds.machines
+          path: artifacts/feeds/machines
+          zone: artifacts
           format: yaml
           nested: true
           tracked: false
-          kind: intake
-          intake:
+          kind: produced
+          source:
+            from: handler
             handler: machines
+            ttl: 1h # cadence on a long-running server
             config:
               machines:
                 local: { via: local }
-      rules:
-        - match: feeds.machines.**
-          lifecycle: { ttl: 1h, on_expire: warn } # meaningful on a long-running server
+      rules: []
     YAML
 
     HOOKS_README = <<~MD
@@ -56,71 +55,72 @@ module Textus
 
       ```ruby
       Textus.hook do |reg|
-        reg.on(:resolve_intake, :my_source) do |config:, args:, **|
+        reg.on(:resolve_handler, :my_source) do |config:, args:, **|
           { _meta: { "last_fetched_at" => Time.now.utc.iso8601 }, body: "…" }
         end
 
         reg.on(:transform_rows, :my_source) { |rows:, **| rows.map { |r| r.merge(processed: true) } }
         reg.on(:validate,       :my_check)  { |caps:, **| [] }
-        reg.on(:entry_put,      :my_listener, keys: ["knowledge.*"]) { |key:, envelope:, **| }
+        reg.on(:entry_written,      :my_listener, keys: ["knowledge.*"]) { |key:, envelope:, **| }
 
         # Run a side-effect every time textus writes a file to your repo:
-        reg.on(:file_published, :notify) do |key:, target:, **|
+        reg.on(:entry_published, :notify) do |key:, target:, **|
           warn "wrote \#{target} (from \#{key})"
         end
       end
       ```
 
-      The intake handler above is paired with a manifest entry plus a
-      top-level `rules:` block for lifecycle (ttl/on_expire live in
-      rules, not in the entry):
+      The intake handler above is paired with a manifest entry whose
+      `source:` block declares the handler and its refresh cadence
+      (`ttl`). Age GC (drop/archive) lives in a top-level `retention:`
+      rule, not on the entry:
 
       ```yaml
       entries:
-        - key: feeds.foo
-          kind: intake
-          path: feeds/foo.md
-          zone: feeds
-          intake:
+        - key: artifacts.feeds.foo
+          kind: produced
+          path: artifacts/feeds/foo.md
+          zone: artifacts
+          source:
+            from: handler
             handler: my_source
+            ttl: 10m        # refresh cadence for this intake
 
       rules:
-        - match: feeds.foo
-          lifecycle:
-            ttl: 10m
-            on_expire: refresh   # refresh | warn (intake); drop | archive (stored)
+        - match: artifacts.feeds.foo
+          retention:
+            ttl: 30d
+            action: archive   # drop | archive (age GC of stored rows)
       ```
 
-      Events: :resolve_intake, :transform_rows, :validate (rpc — return value used)
-              :entry_put, :entry_deleted, :entry_fetched, :entry_renamed,
-              :build_completed, :proposal_accepted, :proposal_rejected,
-              :file_published, :store_loaded, :session_opened,
-              :fetch_started, :fetch_failed, :fetch_backgrounded (pub-sub — return discarded)
+      Events: :resolve_handler, :transform_rows, :validate (rpc — return value used)
+              :entry_written, :entry_deleted, :entry_fetched, :entry_renamed,
+              :entry_produced, :produce_failed,
+              :proposal_accepted, :proposal_rejected,
+              :entry_published, :store_loaded, :session_opened,
+              :entry_fetch_started, :entry_fetch_failed (pub-sub — return discarded)
 
       See SPEC.md §5.10 for the full table.
     MD
 
     AGENT_ENTRIES = <<~YAML.gsub(/^/, "  ")
       # --with-agent profile: project facts + runbooks feed the orientation
-      # projection below, which `textus build` renders to CLAUDE.md/AGENTS.md.
+      # projection below, which `textus drain` renders to CLAUDE.md/AGENTS.md.
       - { key: knowledge.project, path: knowledge/project.md, zone: knowledge, schema: project, owner: human:self, kind: leaf }
       - { key: knowledge.runbooks, path: knowledge/runbooks, zone: knowledge, schema: runbook, owner: human:self, nested: true, kind: nested }
-      - key: artifacts.orientation
-        path: artifacts/orientation.md
+      - key: artifacts.derived.orientation
+        path: artifacts/derived/orientation.json
         zone: artifacts
-        template: orientation.mustache
-        inject_boot: true
         publish:
-          to:
-          - CLAUDE.md
-          - AGENTS.md
-        compute:
-          kind: projection
+        - { to: CLAUDE.md, template: orientation.mustache, inject_boot: true }
+        - { to: AGENTS.md, template: orientation.mustache, inject_boot: true }
+        source:
+          from: project
           select:
           - knowledge.project
           - knowledge.runbooks
           transform: orientation_reducer
-        kind: derived
+        kind: produced
     YAML
 
     def self.run(target_root, with_agent: false)
@@ -193,7 +193,7 @@ module Textus
       manifest = Textus::Manifest.load(target_root)
       root = Pathname.new(target_root)
       untracked = manifest.data.entries.reject(&:tracked?).map do |e|
-        if e.nested? # a whole subtree of leaf files (feeds.machines.* → zones/feeds/machines/)
+        if e.nested? # a whole subtree of leaf files (artifacts.feeds.machines.* → zones/artifacts/feeds/machines/)
           "#{File.join("zones", e.path)}/"
         else
           Pathname.new(Textus::Key::Path.resolve(manifest.data, e)).relative_path_from(root).to_s

data/lib/textus/jobs/handlers.rb

@@ -0,0 +1,62 @@
+module Textus
+  module Jobs
+    # Wires the closed allow-list of convergence job types to the existing
+    # convergence code. Authority is read from the job's frozen `enqueued_by`
+    # and turned into the Call the handler runs under: produce self-elevates
+    # inside Produce::Engine regardless; destructive sweep runs AS the caller.
+    module Handlers
+      module_function
+
+      def registry
+        reg = Textus::Domain::Jobs::Registry.new
+        # produce is pure (self-elevates) — any caller may request a rematerialize.
+        reg.register("materialize", handler: method(:produce))
+        reg.register("re-pull",     handler: method(:produce))
+        # sweep is destructive — gate ad-hoc enqueue to the automation authority.
+        reg.register("sweep",       handler: method(:sweep), required_role: Textus::Role::AUTOMATION)
+        reg
+      end
+
+      # produce: render derived / re-pull intake for a single key. Engine
+      # self-elevates to the build actor internally; the passed call carries
+      # only correlation/dry_run plus the stamped role for audit. Engine#call
+      # isolates per-key produce errors into its result hash rather than raising,
+      # so surface them as :produce_failed events (the converge result hash used
+      # to carry them; the worker drops the return, so re-publish here).
+      def produce(job:, container:)
+        call = call_for(job)
+        result = Textus::Produce::Engine.converge(container: container, call: call, keys: [job.args["key"]])
+        return unless result.is_a?(Hash)
+
+        Array(result[:failed]).each do |failure|
+          container.events.publish(
+            :produce_failed,
+            ctx: Textus::Hooks::Context.for(container: container, call: call),
+            keys: [failure["key"]], error: failure["error"]
+          )
+        end
+      end
+
+      # sweep: compute retention rows for the scope, then apply destructively AS
+      # the job's role (no self-elevation).
+      def sweep(job:, container:)
+        call = call_for(job)
+        scope = job.args["scope"]
+        rows = Textus::Domain::Retention::Sweep.new(
+          manifest: container.manifest,
+          file_stat: Textus::Ports::Storage::FileStat.new,
+          clock: Textus::Ports::Clock.new,
+        ).call(prefix: scope_prefix(scope), zone: scope_zone(scope))
+        Textus::Maintenance::Retention::Apply.new(container: container, call: call).call(rows)
+      end
+
+      def call_for(job)
+        Textus::Call.build(role: job.enqueued_by || Textus::Role::AUTOMATION)
+      end
+
+      # A scope is `{ "prefix" => ..., "zone" => ... }` or nil (whole store).
+      def scope_prefix(scope) = scope.is_a?(Hash) ? scope["prefix"] : nil
+      def scope_zone(scope)   = scope.is_a?(Hash) ? scope["zone"]   : nil
+    end
+  end
+end

data/lib/textus/jobs/scheduler.rb

@@ -0,0 +1,36 @@
+module Textus
+  module Jobs
+    # Time-based seeding for the daemon: at each tick, enqueue a re-pull job for
+    # every intake key past its source.ttl and a sweep job to GC entries past
+    # retention.ttl. Dedup means a job already queued from a prior tick is a
+    # no-op. Both are stamped automation (the daemon's own authority); the sweep
+    # handler runs retention as that role.
+    class Scheduler
+      def initialize(container:, queue:)
+        @container = container
+        @queue = queue
+      end
+
+      def run_once
+        stale_intake.each do |key|
+          @queue.enqueue(job("re-pull", { "key" => key }))
+        end
+        @queue.enqueue(job("sweep", { "scope" => { "prefix" => nil, "zone" => nil } }))
+      end
+
+      private
+
+      def stale_intake
+        Textus::Domain::Freshness::Evaluator.new(
+          manifest: @container.manifest,
+          file_stat: Textus::Ports::Storage::FileStat.new,
+          clock: Textus::Ports::Clock.new,
+        ).stale_intake_keys(prefix: nil, zone: nil)
+      end
+
+      def job(type, args)
+        Textus::Domain::Jobs::Job.new(type: type, args: args, enqueued_by: Textus::Role::AUTOMATION)
+      end
+    end
+  end
+end

data/lib/textus/jobs/seeder.rb

@@ -0,0 +1,57 @@
+module Textus
+  module Jobs
+    # Enqueues the full convergence set for a scope: a produce job per derived /
+    # publish_tree / publish.to entry, a re-pull job per stale intake key, and a
+    # single sweep job for the scope. The scope logic mirrors
+    # the converge scope (Produce::Engine) so `drain` and `serve` converge identically.
+    # Produce jobs self-elevate (stamped automation); the sweep job carries the
+    # caller's role (destructive runs as caller).
+    class Seeder
+      def initialize(container:, queue:, call:)
+        @container = container
+        @queue = queue
+        @call = call
+        @manifest = container.manifest
+      end
+
+      def seed(prefix:, zone:)
+        file_stat = Textus::Ports::Storage::FileStat.new
+
+        producible_keys(prefix, zone).each do |key|
+          @queue.enqueue(job("materialize", { "key" => key }, Textus::Role::AUTOMATION))
+        end
+        stale_intake_keys(prefix, zone, file_stat).each do |key|
+          @queue.enqueue(job("re-pull", { "key" => key }, Textus::Role::AUTOMATION))
+        end
+        @queue.enqueue(job("sweep", { "scope" => { "prefix" => prefix, "zone" => zone } }, @call.role))
+      end
+
+      private
+
+      def job(type, args, role)
+        Textus::Domain::Jobs::Job.new(type: type, args: args, enqueued_by: role)
+      end
+
+      # Mirrors the converge scope (the publishable arm).
+      def producible_keys(prefix, zone)
+        @manifest.data.entries
+                 .select { |e| e.derived? || !e.publish_tree.nil? || !e.publish_to.empty? }
+                 .select { |e| in_scope?(e, prefix, zone) }
+                 .map(&:key)
+      end
+
+      def stale_intake_keys(prefix, zone, file_stat)
+        Textus::Domain::Freshness::Evaluator.new(
+          manifest: @manifest, file_stat: file_stat, clock: Textus::Ports::Clock.new,
+        ).stale_intake_keys(prefix: prefix, zone: zone)
+      end
+
+      def in_scope?(entry, prefix, zone)
+        return false if zone && entry.zone != zone
+        return false if prefix && !entry.key.start_with?(prefix)
+
+        true
+      end
+    end
+  end
+end

data/lib/textus/key/matching.rb

@@ -0,0 +1,24 @@
+module Textus
+  module Key
+    # Dotted-key scope matching, shared by all prefix-scoped sweeps
+    # (WS4 / ADR 0089-era cleanup). Canonicalised here so every consumer
+    # uses a consistent dotted-boundary check with proper Nested ancestor
+    # handling. ADR 0093: Produce is the sole engine calling this.
+    module Matching
+      module_function
+
+      # Is `key` within the `prefix` scope?
+      #   - exact match, or a dotted descendant (the `prefix.` boundary, so
+      #     prefix "art" does NOT match key "artifacts"), and
+      #   - for a nested entry, also when `prefix` descends INTO it — the nested
+      #     parent owns the leaf the prefix names (e.g. prefix
+      #     "feeds.machines.host1" still selects the nested entry
+      #     "feeds.machines").
+      def matches_prefix?(key, prefix, nested: false)
+        return true if key == prefix || key.start_with?("#{prefix}.")
+
+        nested && prefix.start_with?("#{key}.")
+      end
+    end
+  end
+end

data/lib/textus/layout.rb

@@ -25,6 +25,14 @@ module Textus
       File.join(run(root), "build.lock")
     end
 
+    def self.queue(root)
+      File.join(run(root), "queue")
+    end
+
+    def self.queue_state(root, state)
+      File.join(queue(root), state.to_s)
+    end
+
     def self.audit_dir(root)
       File.join(run(root), "audit")
     end

data/lib/textus/maintenance/drain.rb

@@ -0,0 +1,42 @@
+module Textus
+  module Maintenance
+    # Converge-and-exit: seed the full convergence set for the scope, run the
+    # worker until the queue is empty, return a health summary. Exits not-ok if
+    # any job dead-lettered. This is the converge entry point and what CI
+    # runs. Single-pass (serial) on purpose: each produce job self-locks via
+    # Produce::Engine.converge, so running them in turn keeps the build lock
+    # uncontended; a concurrent pool would make all-but-one produce job hit
+    # BuildInProgress and skip.
+    class Drain
+      extend Textus::Contract::DSL
+
+      verb     :drain
+      summary  "Converge everything now: seed produce + retention jobs and drain the queue to empty."
+      surfaces :cli, :mcp
+      cli      "drain"
+      arg :prefix, String, description: "restrict convergence to keys under this dotted prefix"
+      arg :zone,   String, description: "restrict convergence to entries in this zone"
+
+      def initialize(container:, call:)
+        @container = container
+        @call = call
+      end
+
+      def call(prefix: nil, zone: nil)
+        queue = Textus::Ports::Queue.new(root: @container.root)
+        Textus::Jobs::Seeder.new(container: @container, queue: queue, call: @call).seed(prefix: prefix, zone: zone)
+
+        summary = Worker.for(container: @container, queue: queue).drain
+        health = Read::Doctor.new(container: @container, call: @call).call
+
+        {
+          "protocol" => Textus::PROTOCOL,
+          "ok" => summary.failed.zero?,
+          "completed" => summary.completed,
+          "failed" => summary.failed,
+          "health" => health,
+        }
+      end
+    end
+  end
+end

data/lib/textus/maintenance/retention/apply.rb

@@ -0,0 +1,52 @@
+require "fileutils"
+
+module Textus
+  module Maintenance
+    module Retention
+      # The destructive half of convergence: apply retention rows (drop/archive).
+      # Lifted verbatim from the legacy reconcile apply/archive_leaf so drain/serve and
+      # the `sweep` job handler share one path. Runs as the caller's role — never
+      # self-elevates (ADR 0079/0093: destructiveness decides authority).
+      class Apply
+        def initialize(container:, call:)
+          @container = container
+          @call = call
+        end
+
+        def call(rows)
+          out = { dropped: [], archived: [], failed: [] }
+          delete = Write::KeyDelete.new(container: @container, call: @call)
+          rows.each do |row|
+            key = row["key"]
+            begin
+              case row["action"]
+              when "drop"
+                delete.call(key)
+                out[:dropped] << key
+              when "archive"
+                archive_leaf(row)
+                delete.call(key)
+                out[:archived] << key
+              end
+            rescue Textus::Error => e
+              out[:failed] << { "key" => key, "error" => e.message }
+            end
+          end
+          out
+        end
+
+        private
+
+        # Copy the leaf into <store>/archive/<relative-path> before deletion.
+        def archive_leaf(row)
+          src  = row["path"]
+          root = @container.root.to_s
+          rel  = src.delete_prefix("#{root}/")
+          dest = File.join(root, "archive", rel)
+          FileUtils.mkdir_p(File.dirname(dest))
+          FileUtils.cp(src, dest)
+        end
+      end
+    end
+  end
+end

data/lib/textus/maintenance/serve.rb

@@ -0,0 +1,30 @@
+module Textus
+  module Maintenance
+    # The convergence daemon loop: seed scheduled work (TTL re-pull + sweep),
+    # reclaim crashed leases, drain the queue, sleep, repeat. `tick` is one
+    # iteration (unit-testable); `run` loops forever. Drains serially for the
+    # same reason as Drain — each produce job self-locks, so running them in turn
+    # keeps the build lock uncontended.
+    class Serve
+      def initialize(container:, call:)
+        @container = container
+        @call = call
+        @queue = Textus::Ports::Queue.new(root: container.root)
+      end
+
+      def tick
+        Textus::Jobs::Scheduler.new(container: @container, queue: @queue).run_once
+        @queue.reclaim(now: Textus::Ports::Clock.new.now)
+        Worker.for(container: @container, queue: @queue).drain
+      end
+
+      def run(poll: nil)
+        interval = poll || @container.manifest.data.worker_config[:poll]
+        loop do
+          tick
+          sleep(interval)
+        end
+      end
+    end
+  end
+end