A scanner — the fourth seam, alongside ReactiveDag.RecomputeStrategy, ReactiveDag.KeyRule, and ReactiveDag.CoordinationWriter.

A source reads external state (a fleet API, a cloud estate, a repo, an LLM) and writes a leaf cell in a poll phase that is deliberately OUTSIDE the drain:

1. poll — run each source's poll/1: fetch → write its leaf tuples → return the leaf keys that CHANGED (so the caller can mark parents dirty). Sources are independent; a failure is contained to its own leaf.
2. drain — the engine recomputes everything downstream from the dirty frontier (ReactiveDag.Drain). No source runs here.

This split is a design invariant, not an accident: the drain is pure set/graph computation over tuples already present — deterministic, re-runnable, and it never fails on a network outage. Effectful, non-deterministic, fallible I/O (that's every scanner) stays in phase 1.

The scanner↔leaf binding has ONE home, chosen by cardinality:

• 1:1 (the common case) — inline on the leaf. source :fleet_scan / driver MyApp.Sources.FleetScan in the leaf's reactive block co-locates the leaf and its scanner in one declaration (they travel together). ReactiveDag.Source.drivers/2 reads these off the graph (each leaf cell's meta.driver).
• fan-out (rare) — on the driver. A scanner that writes cells no single leaf owns (e.g. many guarantee sub-cells) has no inline driver and names its cells via its own leaf_cells/1; the host passes it as an extra driver.

Either way verify!/2 confirms every named leaf is a real cell in the built plan (an inline driver's leaf is the node it's declared on).

The contract

Two apps (a data pipeline and a compliance model) independently grew the same three-callback shape — id / leaf_cells / poll → changed-keys — which is why it lives here rather than in either app. A single-leaf source (the common case) may export leaf_cell/0 instead of leaf_cells/1; cells_of/2 resolves whichever is present.

defmodule MyApp.Sources.FleetScan do
  @behaviour ReactiveDag.Source

  @impl true
  def id, do: :fleet_scan

  @impl true
  def leaf_cells(_graph), do: ["machines"]

  @impl true
  def poll(_opts) do
    # fetch the fleet, write the "machines" leaf's tuples, return changed keys
    {:ok, %{changed: ["host-1", "host-7"]}}
  rescue
    e -> {:error, Exception.message(e)}
  end
end

Fan-out and multi-leaf sources

leaf_cells/1 takes the lowered graph and returns a list of cell ids, so a source that feeds many leaves (e.g. one per discovered kind) computes them from the graph, and a source that direct-writes several cells lists them all. A single-leaf source returns [one_id]. This list is what verify/2 checks.