@astrosheep/square 0.3.70 → 0.3.72

package/dist/square-actions.js

@@ -3,221 +3,153 @@ import { isSquareError, nameKey, SquareError, validateName } from './model.js';
 import { participantIdentity } from './participant-identity.js';
 import { deliverPending } from './delivery-operations.js';
 import { decideCatch } from './catch-decisions.js';
+import { inSquareCount } from './runtime.js';
 import { claimSessionParticipant, claimSessionTakeover, presenceEpoch, releaseSessionParticipantClaim, readParticipantOwner } from './registry.js';
-import { assertLiveOwner, ensureLocalPresence, identityRouteDraft, processIdentity, publishIdentityRoute, retireIdentityRoute } from './participant-host.js';
-import { applyWakeRouteToState, dropEndedSessionWakeRoutesFromState, dropParticipantWakeRoutesFromState, dropSessionWakeRoutesFromState, sessionCanEndParticipant } from './routes.js';
+import { assertLiveOwner, ensureLocalPresence, identityRouteDraft, processIdentity, publishCommittedIdentity, retireIdentityRoute } from './participant-host.js';
+import { applyWakeRoute, dropEndedSessionWakeRoutes, dropParticipantWakeRoutes, dropSessionWakeRoutes, sessionCanEndParticipant } from './routes.js';
 import { parseRequiredActivityId, toPublicActivity } from './views.js';
 function throwIfAborted(control) { if (control?.signal?.aborted)
     throw control.signal.reason ?? new Error('Operation aborted'); }
-function exposeCaught(activity, perception) {
-    const result = toPublicActivity(activity);
-    if (perception === 'full' || !('body' in result))
-        return { ...result, perception };
-    const { body: _body, ...withoutBody } = result;
-    return { ...withoutBody, perception };
-}
-export async function catchUp(square, name, options = {}, project, control) {
-    const idle = options.idle ?? 0;
-    if (!Number.isFinite(idle) || idle < 0)
-        throw new SquareError('invalid_args', 'Catch idle duration must be a non-negative number');
-    const deadline = Date.now() + idle;
-    if (control?.signal?.aborted)
-        throw control.signal.reason ?? new Error('Operation aborted');
-    while (true) {
-        if (!await assertLiveOwner(square, name)) {
-            throw new SquareError('already_joined', `✕ ${participantIdentity(name)} already stands here — another session holds the name`);
-        }
-        const attempt = await square.artifact.transact((state, version) => {
-            const decision = decideCatch(state, name, options, square.clock(), project);
-            return { ...(decision.changed ? { state } : {}), result: { version, decision } };
-        }, control?.signal);
-        await ensureLocalPresence(square, name);
-        await publishIdentityRoute(square, name);
-        if (attempt.decision.delivered.length > 0 || idle === 0) {
-            return {
-                activities: attempt.decision.delivered.map((activity) => exposeCaught(activity, attempt.decision.perceptions.get(activity.index) ?? 'full')),
-                consumedThrough: attempt.decision.consumedThrough,
-                idleExpired: false,
-                remaining: attempt.decision.remaining,
-            };
-        }
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-            return { activities: [], consumedThrough: attempt.decision.consumedThrough, idleExpired: true, remaining: 0 };
-        }
-        // Publication above is a semantic no-op while the route and presence stay unchanged and
-        // unexpired, so only a real external change can move the artifact version. Establish the
-        // wait baseline after those self-side effects; if the version moved anyway (own refresh or
-        // a racing external commit), re-snapshot instead of waiting on a stale baseline.
-        const baseline = (await square.artifact.read(control?.signal)).version;
-        if (baseline !== attempt.version)
-            continue;
-        if (!await square.artifact.changed(baseline, remaining, control?.signal)) {
-            return { activities: [], consumedThrough: attempt.decision.consumedThrough, idleExpired: true, remaining: 0 };
-        }
-    }
-}
-function storeActs(state, acts) {
-    const stored = [];
-    for (const act of acts) {
-        const item = { ...act, index: state.runtime.nextActIndex };
-        state.runtime.nextActIndex += 1;
-        state.acts.push(item);
-        stored.push(item);
-    }
-    return stored;
-}
-function committedActivity(stored, verb) {
-    const activity = stored[0];
-    if (activity === undefined)
-        throw new Error(`${verb} activity did not commit`);
-    return activity;
+export async function catchUp(square, name, options = {}, control, leaseId) {
+    throwIfAborted(control);
+    if (!await assertLiveOwner(square, name))
+        throw new SquareError('already_joined', `${participantIdentity(name)} already stands here — another session holds the name`);
+    const selected = (await square.artifact.transact((facts) => {
+        // Replacement and selection share the receipt transaction: an old waiter cannot
+        // consume a later activity between its heartbeat and its selection.
+        if (leaseId !== undefined && facts.lease(name)?.leaseId !== leaseId)
+            return null;
+        return decideCatch(facts, name, options, square.clock());
+    }, control?.signal)).value;
+    if (selected !== null)
+        await publishCommittedIdentity(square, selected.participant);
+    return selected;
 }
 export async function join(square, name, control) {
-    // Rejected validation must not perform an ownership claim.
     throwIfAborted(control);
     validateName(name);
     const hostLedger = square.hostLedger;
-    const preview = await square.artifact.read(control?.signal);
-    const previewDecision = decideJoin(preview.state, name, square.clock());
-    if (previewDecision.joinAct === undefined) {
-        // An active artifact participant is idempotent only for its current session.
-        // A different owner must still pass through the registry CAS so it is refused
-        // instead of silently reconnecting as a foreign session.
-        if (hostLedger !== undefined) {
-            const identity = processIdentity(square.env ?? process.env);
-            const owner = await readParticipantOwner(square.location, previewDecision.joinedName, hostLedger);
-            if (owner === undefined) {
-                // Keep the claim path for an active artifact whose ledger owner is not
-                // visible yet; concurrent callers must still serialize through CAS.
-            }
-            else if (owner.session !== identity.session) {
-                // Continue into the ownership claim below; it will produce the stable
-                // already_joined error without mutating the artifact.
-            }
-            else {
-                return { name: previewDecision.joinedName, activity: null };
-            }
-        }
-        else {
-            return { name: previewDecision.joinedName, activity: null };
-        }
+    const preview = (await square.artifact.read((facts) => ({
+        ...decideJoin(facts, name, square.clock()),
+        participantCount: facts.roster().filter((p) => p.joined || p.done).length,
+    }), control?.signal)).value;
+    if (preview.joinAct === undefined) {
+        if (hostLedger === undefined)
+            return { name: preview.joinedName, activity: null, participantCount: preview.participantCount, reconnected: false };
+        const identity = processIdentity(square.env ?? process.env);
+        const owner = await readParticipantOwner(square.location, preview.joinedName, hostLedger);
+        if (owner?.session === identity.session)
+            return {
+                name: preview.joinedName, activity: null, participantCount: preview.participantCount,
+                reconnected: identity.channel !== 'unknown',
+            };
+        // Missing or foreign owner must pass CAS, not become a silent reconnect.
     }
     let epoch;
     let ownershipClaim;
     if (hostLedger !== undefined) {
-        const claim = await claimSessionParticipant(square.location, name, hostLedger, square.env ?? process.env, control?.signal);
-        ownershipClaim = claim;
-        epoch = claim?.epoch;
+        ownershipClaim = await claimSessionParticipant(square.location, name, hostLedger, square.env ?? process.env, control?.signal);
+        epoch = ownershipClaim?.epoch;
     }
     let committed;
     try {
-        const now = square.clock();
-        const route = await identityRouteDraft(square, name);
+        const now = square.clock(), route = await identityRouteDraft(square, name);
         throwIfAborted(control);
-        committed = await square.artifact.transact((state) => {
-            const decision = decideJoin(state, name, now);
-            if (decision.joinAct === undefined) {
-                return { result: { name: decision.joinedName, stored: null } };
+        committed = (await square.artifact.transact((facts) => {
+            const decision = decideJoin(facts, name, now);
+            if (decision.joinAct !== undefined) {
+                if (square.location !== undefined && square.location !== 'memory')
+                    dropParticipantWakeRoutes(facts, square.location, decision.joinedName);
+                if (route !== undefined)
+                    applyWakeRoute(facts, route, now);
             }
-            if (square.location !== undefined && square.location !== 'memory')
-                dropParticipantWakeRoutesFromState(state, square.location, decision.joinedName);
-            if (route !== undefined)
-                applyWakeRouteToState(state, route, now);
-            return { state, result: { name: decision.joinedName, stored: committedActivity(storeActs(state, [decision.joinAct]), 'join') } };
-        }, control?.signal);
+            const stored = decision.joinAct === undefined ? null : facts.land(decision.joinAct);
+            return {
+                name: decision.joinedName, stored,
+                participantCount: facts.roster().filter((p) => p.joined || p.done).length,
+            };
+        }, control?.signal)).value;
     }
     catch (error) {
         if (hostLedger !== undefined)
             await releaseSessionParticipantClaim(hostLedger, ownershipClaim).catch(() => undefined);
         throw error;
     }
-    await ensureLocalPresence(square, committed.name, epoch);
-    await publishIdentityRoute(square, committed.name, epoch);
-    return { name: committed.name, activity: committed.stored === null ? null : toPublicActivity(committed.stored) };
+    await publishCommittedIdentity(square, committed.name, epoch);
+    return {
+        name: committed.name, activity: committed.stored === null ? null : toPublicActivity(committed.stored),
+        participantCount: committed.participantCount, reconnected: false,
+    };
 }
-/** End the standing participant and immediately let the caller reclaim the name. */
+/** Takeover holds the host CAS fence across the single done+join artifact transaction. */
 export async function takeover(square, name, _oldSessionIds = [], control) {
-    // Rejected validation must not perform an ownership claim.
     throwIfAborted(control);
     validateName(name);
     const hostLedger = square.hostLedger;
     const commitLifecycle = async () => {
         throwIfAborted(control);
         const now = square.clock();
-        const committed = await square.artifact.transact((state) => {
-            const joinedName = resolveKnownName(state, name);
-            const done = coreDone(state, joinedName, '', now);
-            const storedDone = committedActivity(storeActs(state, [done]), 'kick');
-            const decision = decideJoin(state, joinedName, now);
+        return (await square.artifact.transact((facts) => {
+            const joinedName = resolveKnownName(facts, name);
+            const storedDone = facts.land(coreDone(facts, joinedName, '', now));
+            const decision = decideJoin(facts, joinedName, now);
             if (decision.joinAct === undefined)
                 throw new SquareError('already_joined', `${participantIdentity(joinedName)} could not be reclaimed`);
-            const storedJoin = committedActivity(storeActs(state, [decision.joinAct]), 'join');
-            state.routes = (state.routes ?? []).filter((route) => nameKey(route.participant) !== nameKey(joinedName));
-            return { state, result: { name: joinedName, stored: [storedDone, storedJoin] } };
-        }, control?.signal);
-        return committed;
+            const storedJoin = facts.land(decision.joinAct);
+            facts.replaceRoutes(facts.routes().filter((route) => nameKey(route.participant) !== nameKey(joinedName)));
+            return {
+                name: joinedName, stored: [storedDone, storedJoin],
+                participantCount: facts.roster().filter((p) => p.joined || p.done).length,
+            };
+        }, control?.signal)).value;
     };
     if (hostLedger !== undefined) {
-        const env = square.env ?? process.env;
-        // Gate the ownership claim on the artifact's authoritative state: a takeover that cannot
-        // commit its lifecycle (a name that never joined, or a standing participant that is no
-        // longer joined) must not claim or remove presence. The refusals mirror the transaction.
-        const { state } = await square.artifact.read(control?.signal);
-        const joinedName = resolveKnownName(state, name); // invalid_args when the name never joined
-        coreDone(state, joinedName, '', square.clock()); // already_done/not_joined when not standing
+        // Gate the claim on authoritative admission, so a refused takeover never claims presence.
+        await square.artifact.read((facts) => coreDone(facts, resolveKnownName(facts, name), '', square.clock()), control?.signal);
         const owner = await readParticipantOwner(square.location, name, hostLedger);
         throwIfAborted(control);
-        // The claim and the artifact lifecycle are one fenced critical section: a losing or refused
-        // takeover never mutates the winner, and no second takeover can interleave mid-commit.
-        const outcome = await claimSessionTakeover(square.location, name, hostLedger, env, {
-            expectedEpoch: presenceEpoch(owner),
-            expectedSession: owner?.session ?? '',
+        const outcome = await claimSessionTakeover(square.location, name, hostLedger, square.env ?? process.env, {
+            expectedEpoch: presenceEpoch(owner), expectedSession: owner?.session ?? '',
         }, async (claim) => {
             throwIfAborted(control);
             const committed = await commitLifecycle();
-            await ensureLocalPresence(square, committed.name, claim.epoch);
-            await publishIdentityRoute(square, committed.name, claim.epoch);
+            await publishCommittedIdentity(square, committed.name, claim.epoch);
             return committed;
         }, control?.signal);
         if (outcome.status === 'busy')
-            throw new SquareError('already_joined', `✕ ${participantIdentity(name)} already stands here — another session holds the name`);
-        return { name: outcome.result.name, activities: outcome.result.stored.map(toPublicActivity), epoch: outcome.epoch };
+            throw new SquareError('already_joined', `${participantIdentity(name)} already stands here — another session holds the name`);
+        return { name: outcome.result.name, activities: outcome.result.stored.map(toPublicActivity), participantCount: outcome.result.participantCount, epoch: outcome.epoch };
     }
     const committed = await commitLifecycle();
-    await ensureLocalPresence(square, committed.name);
-    await publishIdentityRoute(square, committed.name);
-    return { name: committed.name, activities: committed.stored.map(toPublicActivity) };
+    await publishCommittedIdentity(square, committed.name);
+    return { name: committed.name, activities: committed.stored.map(toPublicActivity), participantCount: committed.participantCount };
 }
 export async function implicitJoin(square, name, control) {
     throwIfAborted(control);
-    const now = square.clock();
-    const route = await identityRouteDraft(square, name);
+    const now = square.clock(), route = await identityRouteDraft(square, name);
     throwIfAborted(control);
-    const committed = await square.artifact.transact((state) => {
-        const decision = decideImplicitJoin(state, name, now);
+    const committed = (await square.artifact.transact((facts) => {
+        const decision = decideImplicitJoin(facts, name, now);
         if (decision.state === 'done') {
             if (square.location !== undefined && square.location !== 'memory')
-                dropSessionWakeRoutesFromState(state, square.location, processIdentity(square.env ?? process.env).session);
-            return { state, result: { name: decision.joinedName, state: decision.state, stored: null } };
+                dropSessionWakeRoutes(facts, square.location, processIdentity(square.env ?? process.env).session);
+        }
+        else if (decision.joinAct !== undefined) {
+            if (square.location !== undefined && square.location !== 'memory')
+                dropParticipantWakeRoutes(facts, square.location, decision.joinedName);
+            if (route !== undefined)
+                applyWakeRoute(facts, { ...route, participant: decision.joinedName }, now);
         }
-        if (decision.joinAct === undefined)
-            return { result: { name: decision.joinedName, state: decision.state, stored: null } };
-        if (square.location !== undefined && square.location !== 'memory')
-            dropParticipantWakeRoutesFromState(state, square.location, decision.joinedName);
-        if (route !== undefined)
-            applyWakeRouteToState(state, { ...route, participant: decision.joinedName }, now);
-        return { state, result: { name: decision.joinedName, state: decision.state, stored: committedActivity(storeActs(state, [decision.joinAct]), 'join') } };
-    }, control?.signal);
-    await ensureLocalPresence(square, committed.name);
+        return { name: decision.joinedName, state: decision.state, stored: decision.joinAct === undefined ? null : facts.land(decision.joinAct) };
+    }, control?.signal)).value;
+    if (committed.stored !== null)
+        await publishCommittedIdentity(square, committed.name);
+    else
+        await ensureLocalPresence(square, committed.name);
     if (committed.state === 'done')
         await retireIdentityRoute(square, committed.name);
-    else if (committed.stored !== null)
-        await publishIdentityRoute(square, committed.name);
     return { name: committed.name, state: committed.state, activity: committed.stored === null ? null : toPublicActivity(committed.stored) };
 }
-/** Only admission failures can advertise a safe retry; storage and post-commit
- * failures must not be mistaken for a rejected send merely by their error code. */
 function rejectUnsentActivity(operation) {
     try {
         return operation();
@@ -229,27 +161,32 @@ function rejectUnsentActivity(operation) {
     }
 }
 export async function express(square, name, body, options = {}, control) {
-    if (control?.signal?.aborted)
-        throw control.signal.reason ?? new Error('Operation aborted');
-    if (!await assertLiveOwner(square, name)) {
-        throw new SquareError('already_joined', `✕ ${participantIdentity(name)} already stands here — another session holds the name`, { activityUnsent: true });
-    }
+    throwIfAborted(control);
+    if (!await assertLiveOwner(square, name))
+        throw new SquareError('already_joined', `${participantIdentity(name)} already stands here — another session holds the name`, { activityUnsent: true });
     throwIfAborted(control);
     const now = square.clock();
-    const reply = rejectUnsentActivity(() => options.reply === undefined ? undefined : parseRequiredActivityId(options.reply));
-    const committed = await square.artifact.transact((state) => {
+    const reply = rejectUnsentActivity(() => {
+        try {
+            return options.reply === undefined ? undefined : parseRequiredActivityId(options.reply);
+        }
+        catch (error) {
+            if (isSquareError(error))
+                error.facts = { ...error.facts, reason: 'invalid_reply', activityId: options.reply };
+            throw error;
+        }
+    });
+    const committed = (await square.artifact.transact((facts) => {
+        // Selected-row decoding is storage work, not evidence that admission safely refused.
+        const proposed = decideAct(facts, { name, body, force: options.force ?? false, now, mentions: options.mentions,
+            ...(options.reach === undefined ? {} : { reach: options.reach }), ...(options.noMention === undefined ? {} : { noMention: options.noMention }), ...('requireExplicitReach' in options ? { requireExplicitReach: options.requireExplicitReach === true } : {}), ...(reply === undefined ? {} : { reply }) });
+        const holder = proposed.type === 'held' ? facts.hold().actor : undefined;
         const decision = rejectUnsentActivity(() => {
-            const decision = decideAct(state, { name, body, force: options.force ?? false, now, mentions: options.mentions, ...(options.reach === undefined ? {} : { reach: options.reach }), ...(options.noMention === undefined ? {} : { noMention: options.noMention }), ...(reply === undefined ? {} : { reply }) });
-            if (decision.type === 'blocked') {
-                const pending = decision.activitySummaries.reduce((count, summary) => count + summary.count, 0);
-                throw new SquareError('behind', `${participantIdentity(name)} has pending activity`, { pending });
-            }
+            const decision = proposed;
+            if (decision.type === 'blocked')
+                throw new SquareError('behind', `${participantIdentity(name)} has pending activity`, { pending: decision.activitySummaries.reduce((count, summary) => count + summary.count, 0) });
             if (decision.type === 'held') {
-                const holder = state.acts.filter((activity) => activity.kind === 'hold').at(-1)?.actor;
-                throw new SquareError('held', 'The square is held', {
-                    ...(holder === undefined ? {} : { holder }),
-                    ...(decision.reason === undefined ? {} : { holdReason: decision.reason }),
-                });
+                throw new SquareError('held', 'The square is held', { ...(holder === undefined ? {} : { holder }), ...(decision.reason === undefined ? {} : { holdReason: decision.reason }) });
             }
             if (decision.type === 'capped')
                 throw new SquareError('capped', `${participantIdentity(name)} reached the activity cap`);
@@ -259,85 +196,69 @@ export async function express(square, name, body, options = {}, control) {
                 throw new SquareError('bell_quota', `${participantIdentity(name)} cannot ring the bell yet`, { retryAfterMs: Math.max(1, decision.nextAt - now) });
             return decision;
         });
-        const stored = committedActivity(storeActs(state, [decision.act]), 'express');
-        return { state, result: { stored, ...(decision.replyAuthorNotHere === undefined ? {} : { replyAuthorNotHere: decision.replyAuthorNotHere }) } };
-    }, control?.signal);
-    await ensureLocalPresence(square, name);
-    await publishIdentityRoute(square, name);
-    let delivery;
-    if (square.wakeTransport !== undefined && square.hostLedger !== undefined && square.location !== undefined && square.location !== 'memory') {
-        delivery = await deliverPending({ artifact: square.artifact, hostLedger: square.hostLedger, transport: square.wakeTransport, location: square.location, activity: committed.stored.index, now }).catch(() => ({ attempted: 0, accepted: 0, failed: 0, unknown: 0, notCapable: 1 }));
-    }
-    else {
-        delivery = { attempted: 0, accepted: 0, failed: 0, unknown: 0, notCapable: 1 };
-    }
-    return { activity: toPublicActivity(committed.stored), delivery, ...(committed.replyAuthorNotHere === undefined ? {} : { replyAuthorNotHere: committed.replyAuthorNotHere }) };
+        const stored = facts.land(decision.act);
+        return {
+            stored,
+            observation: {
+                standingCount: inSquareCount(facts), held: facts.hold().active, now,
+                ownActivityCount: facts.participant(name).sayCount, hardCap: facts.header().hardCap,
+            },
+            ...(decision.replyAuthorNotHere === undefined ? {} : { replyAuthorNotHere: decision.replyAuthorNotHere }),
+        };
+    }, control?.signal)).value;
+    await publishCommittedIdentity(square, name);
+    const delivery = square.wakeTransport !== undefined && square.hostLedger !== undefined && square.location !== undefined && square.location !== 'memory'
+        ? await deliverPending({ artifact: square.artifact, hostLedger: square.hostLedger, transport: square.wakeTransport, location: square.location, activity: committed.stored.index, now })
+            .catch(() => ({ attempted: 0, accepted: 0, failed: 0, unknown: 0, notCapable: 1 }))
+        : { attempted: 0, accepted: 0, failed: 0, unknown: 0, notCapable: 1 };
+    return {
+        activity: toPublicActivity(committed.stored), delivery, observation: committed.observation,
+        ...(committed.replyAuthorNotHere === undefined ? {} : { replyAuthorNotHere: committed.replyAuthorNotHere }),
+    };
 }
 async function landListenerChange(square, verb, actor, target, control) {
     throwIfAborted(control);
     const now = square.clock();
-    const stored = await square.artifact.transact((state) => {
-        const act = verb === 'listen' ? coreListen(state, actor, target, now) : coreIgnore(state, actor, target, now);
-        if (act === undefined)
-            return { result: null };
-        return { state, result: committedActivity(storeActs(state, [act]), verb) };
-    }, control?.signal);
+    const stored = (await square.artifact.transact((facts) => {
+        const act = verb === 'listen' ? coreListen(facts, actor, target, now) : coreIgnore(facts, actor, target, now);
+        return act === undefined ? null : facts.land(act);
+    }, control?.signal)).value;
     return { activity: stored === null ? null : toPublicActivity(stored) };
 }
 export function listen(square, actor, target, control) { return landListenerChange(square, 'listen', actor, target, control); }
 export function ignore(square, actor, target, control) { return landListenerChange(square, 'ignore', actor, target, control); }
-export async function listening(square, actor, control) { const { state } = await square.artifact.read(control?.signal); return coreListening(state, actor); }
+export async function listening(square, actor, control) { return (await square.artifact.read((facts) => coreListening(facts, actor), control?.signal)).value; }
 async function landCore(square, verb, actor, body = '', fence = {}, control) {
     if (verb === 'done')
         validateDoneBody(body);
-    // Done completes ownership: the live-owner validation, the artifact commit, the ended
-    // session's route retirement, and presence cleanup share one ownership critical section.
-    // A takeover finalizing between validation and commit can never be completed by a stale
-    // done, and no post-lock cleanup can remove a replacement owner's fresh rows.
     const hostLedger = verb === 'done' ? square.hostLedger : undefined;
-    const fenced = hostLedger !== undefined;
-    const session = fenced ? processIdentity(square.env ?? process.env).session : undefined;
+    const session = hostLedger === undefined ? undefined : processIdentity(square.env ?? process.env).session;
     const commitAndCleanup = async () => {
-        if (verb === 'done' && !await assertLiveOwner(square, actor, fence.expectedEpoch)) {
-            throw new SquareError('already_done', `✕ ${participantIdentity(actor)} already stands here — another session holds the name`);
-        }
-        let ownerRecords = [];
-        if (fenced && session !== undefined) {
-            ownerRecords = (await hostLedger.listPresence({ location: square.location, participant: actor }))
-                .filter((row) => row.session === session);
-        }
+        // Owner admission, commit and route/presence cleanup share the host claim critical section.
+        if (verb === 'done' && !await assertLiveOwner(square, actor, fence.expectedEpoch))
+            throw new SquareError('already_done', `${participantIdentity(actor)} already stands here — another session holds the name`);
+        const owners = hostLedger === undefined ? [] : (await hostLedger.listPresence({ location: square.location, participant: actor })).filter((row) => row.session === session);
         const now = square.clock();
-        const stored = await square.artifact.transact((state) => {
-            const act = verb === 'done' ? coreDone(state, actor, body, now) : verb === 'hold' ? coreHold(state, actor, body, now) : coreResume(state, actor, now);
-            const result = committedActivity(storeActs(state, [act]), verb);
-            if (fenced && session !== undefined) {
-                dropEndedSessionWakeRoutesFromState(state, square.location, session, { expectedEpoch: fence.expectedEpoch, force: true, participant: actor });
-            }
-            return { state, result };
-        }, control?.signal);
-        for (const ownerRecord of ownerRecords) {
-            await hostLedger.removePresenceIfUnchanged(ownerRecord).catch((error) => {
+        const stored = (await square.artifact.transact((facts) => {
+            const result = facts.land(verb === 'done' ? coreDone(facts, actor, body, now) : verb === 'hold' ? coreHold(facts, actor, body, now) : coreResume(facts, actor, now));
+            if (session !== undefined)
+                dropEndedSessionWakeRoutes(facts, square.location, session, { expectedEpoch: fence.expectedEpoch, force: true, participant: actor });
+            return result;
+        }, control?.signal)).value;
+        for (const row of owners)
+            await hostLedger.removePresenceIfUnchanged(row).catch((error) => {
                 process.stderr.write(`! host presence cleanup degraded: ${error instanceof Error ? error.message : String(error)}\n`);
             });
-        }
         return stored;
     };
-    const stored = fenced
-        ? await hostLedger.withClaimLock(commitAndCleanup, control?.signal)
-        : await commitAndCleanup();
+    const stored = hostLedger === undefined ? await commitAndCleanup() : await hostLedger.withClaimLock(commitAndCleanup, control?.signal);
     return { activity: toPublicActivity(stored) };
 }
 export function done(square, name, body = '', fence = {}, control) { return landCore(square, 'done', name, body, fence, control); }
 function liveClaimedParticipants(rows, sessionId) {
-    const claimed = new Set();
-    const foreign = new Set();
-    for (const row of rows) {
-        const key = nameKey(row.participant);
-        if (row.session === sessionId)
-            claimed.add(key);
-        else
-            foreign.add(key);
-    }
+    const claimed = new Set(), foreign = new Set();
+    for (const row of rows)
+        (row.session === sessionId ? claimed : foreign).add(nameKey(row.participant));
     for (const key of foreign)
         claimed.delete(key);
     return claimed;
@@ -350,30 +271,19 @@ async function readLiveClaimedParticipants(hostLedger, location, sessionId, now)
         return undefined;
     }
 }
-/**
- * End one session's ownership of a participant inside the ownership claim critical
- * section. The artifact `done` (when this session is still the owner) and retirement of
- * this session's routes share one transaction, and the exact captured presence row is
- * removed only while the lock is still held. A rejoin or takeover therefore lands either
- * before the whole cleanup — and is part of the state being ended — or after it, with
- * fresh presence and route rows that this cleanup can never touch.
- */
 export async function endOwnedSession(square, name, sessionId, expectedEpoch) {
-    const location = square.location;
-    const hostLedger = square.hostLedger;
+    const { location, hostLedger } = square;
     const run = async () => {
         const now = square.clock();
-        let currentSessionId;
-        let ownerMatches = expectedEpoch === undefined;
+        let currentSessionId, ownerMatches = expectedEpoch === undefined;
         let ownerRecords = [];
         let liveParticipants = new Set();
         if (location !== undefined && location !== 'memory' && hostLedger !== undefined) {
             try {
                 const rows = await hostLedger.listPresence({ location, now });
                 const bindings = rows.filter((row) => nameKey(row.participant) === nameKey(name));
-                currentSessionId = bindings.find((binding) => binding.session !== sessionId)?.session
-                    ?? bindings.toSorted((left, right) => (right.updatedAt ?? 0) - (left.updatedAt ?? 0))[0]?.session;
-                ownerRecords = rows.filter((row) => row.session === sessionId && nameKey(row.participant) === nameKey(name));
+                currentSessionId = bindings.find((row) => row.session !== sessionId)?.session ?? bindings.toSorted((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0))[0]?.session;
+                ownerRecords = bindings.filter((row) => row.session === sessionId);
                 liveParticipants = liveClaimedParticipants(rows, sessionId);
                 if (expectedEpoch !== undefined) {
                     const owner = await readParticipantOwner(location, name, hostLedger);
@@ -381,55 +291,41 @@ export async function endOwnedSession(square, name, sessionId, expectedEpoch) {
                 }
             }
             catch {
-                liveParticipants = undefined; /* unknown evidence preserves routes; artifact routes still fence ownership */
+                liveParticipants = undefined;
             }
         }
-        const stored = await square.artifact.transact((state) => {
+        const stored = (await square.artifact.transact((facts) => {
             let committed = null;
-            if (location !== undefined && location !== 'memory' && ownerMatches && sessionCanEndParticipant(state, location, name, sessionId, currentSessionId)) {
+            if (location !== undefined && location !== 'memory' && ownerMatches && sessionCanEndParticipant(facts, location, name, sessionId, currentSessionId)) {
                 try {
-                    committed = committedActivity(storeActs(state, [coreDone(state, name, '', now)]), 'done');
+                    committed = facts.land(coreDone(facts, name, '', now));
                 }
                 catch (error) {
                     if (!isSquareError(error) || (error.code !== 'already_done' && error.code !== 'not_joined'))
                         throw error;
                 }
             }
-            if (location !== undefined && location !== 'memory') {
-                dropEndedSessionWakeRoutesFromState(state, location, sessionId, { expectedEpoch, liveParticipants, force: committed !== null, participant: name });
-            }
-            return { state, result: committed };
-        });
-        if (stored !== null) {
-            for (const ownerRecord of ownerRecords) {
-                await hostLedger.removePresenceIfUnchanged(ownerRecord).catch((error) => {
+            if (location !== undefined && location !== 'memory')
+                dropEndedSessionWakeRoutes(facts, location, sessionId, { expectedEpoch, liveParticipants, force: committed !== null, participant: name });
+            return committed;
+        })).value;
+        if (stored !== null)
+            for (const row of ownerRecords)
+                await hostLedger.removePresenceIfUnchanged(row).catch((error) => {
                     process.stderr.write(`! host presence cleanup degraded: ${error instanceof Error ? error.message : String(error)}\n`);
                 });
-            }
-        }
         return stored;
     };
-    const stored = hostLedger !== undefined
-        ? await hostLedger.withClaimLock(run)
-        : await run();
+    const stored = hostLedger === undefined ? await run() : await hostLedger.withClaimLock(run);
     return stored === null ? null : { activity: toPublicActivity(stored) };
 }
-/**
- * Retire an ended session's orphan routes when no participant name is known. The
- * ownership claim lock is held across the ledger read and the artifact transaction, so a
- * rejoin that claims first is seen as a live participant and its route survives.
- */
 export async function retireEndedSessionRoutes(square, sessionId) {
-    const location = square.location;
-    const hostLedger = square.hostLedger;
+    const { location, hostLedger } = square;
     if (location === undefined || hostLedger === undefined)
         return;
     await hostLedger.withClaimLock(async () => {
         const liveParticipants = await readLiveClaimedParticipants(hostLedger, location, sessionId, square.clock());
-        await square.artifact.transact((state) => {
-            dropEndedSessionWakeRoutesFromState(state, location, sessionId, { liveParticipants, force: false });
-            return { state, result: undefined };
-        });
+        await square.artifact.transact((facts) => { dropEndedSessionWakeRoutes(facts, location, sessionId, { liveParticipants, force: false }); });
     });
 }
 export function hold(square, name, reason = '', control) { return landCore(square, 'hold', name, reason, {}, control); }