// CLAIM — the conditional write. createNew is the CAS: exactly one caller
// wins the record for a free id; the loser reads who holds it. A won claim
// bumps the persistent counter so its epoch can never repeat. Shared with
// `std/node` through the acquire part below.
~pub tor claim { world: string, id: string, node: string, ttl-ms: u64 }
| claimed u32
| held-by string
| failed string

// OWNER — the routing probe: who holds this id, if anyone. celld answers
// this from its bucket records; we answer it from the same shared floor.
~pub tor owner { world: string, id: string }
| owned-by string
| free
| failed string

// SEIZE and RENEW live in the `lease` part below — seize is operator-decided
// takeover (the health check is upstream), renew refreshes a live lease.
//
// RELEASE — graceful handoff: only the record's owner may clear it. The
// epoch counter stays, so a stale claim token is fenced forever after.
~pub tor release { world: string, id: string, node: string }
| released
| not-owner
| free
| failed string

// GUARD — the fence at the write. celld's invariant as a runtime check:
// a holder presents its node-id + granted epoch; both must still be on the
// record or the holder is stale and the write must not proceed.
~pub tor guard { world: string, id: string, node: string, epoch: u32 }
| owner
| fenced u32
| free
| failed string

// RESET — operator/test hook: drop the whole `.fleet` directory. Not part
// of the protocol; exists so tests and tools can re-slate a world.
~pub tor reset { world: string }
| cleared
| failed string

// SEIZE — takeover: a peer claims an owned id after its owner is judged
// dead (leases make "dead" a clock fact; the operator path stays). The lock
// dir serializes concurrent takeovers; `contended` is single-attempt — the
// caller re-decides.
~pub tor seize { world: string, id: string, node: string, ttl-ms: u64 }
| seized u32
| free
| contended
| failed string

// SEND — post a message to an id's mailbox. `posted` even when the id is
// currently unowned: the mailbox is durable floor, the next owner drains it.
// Filename: <nanoTimestamp>-<from>-<rand> — chronological under lexical
// sort, collision-free across processes.
~pub tor send { world: string, id: string, from: string, body: string }
| posted
| failed string

// DRAIN — the owner of record takes delivery. Lock-serialized (`contended`
// if a takeover or another drain holds it), ownership-gated like `guard`:
// a lapsed or foreign node answers `held-by`/`free` and consumes nothing.
// Each message file parses `from=<sender>\n<body>`; the file deletes after
// the arm returns — at-least-once delivery.
~pub tor drain { world: string, id: string, node: string }
! mail *
| done i64
| held-by string
| free
| contended
| failed string

// RENEW — the owner refreshes its own deadline (celld renews at ttl/3; the
// cadence is the caller's — there is no heartbeat yet). Under the lock so a
// renew can never overwrite a committed takeover with its stale epoch. A
// lapsed own lease answers `free`: the way back is `claim`.
~pub tor renew { world: string, id: string, node: string, ttl-ms: u64 }
| renewed
| held-by string
| free
| failed string