Review updates and session ownership

if record.owner ~= sessionId then return nil end
if record.expiresAt <= now then return nil end

Matching an old token is insufficient when its lease has already expired. Both conditions protect this update decision.

New syntax: updateasync, session-ownership, stale-writes

• pcall
• data-load
• failure-policy
• rate-limits
• duplicate-rewards
• idempotency

Main guided reference implementation; use the hierarchy’s stated Script or ModuleScript type.

local OwnedUpdate = {}
function OwnedUpdate.apply(current, sessionId, now, newCompleted)
    if type(current) ~= "table" or current.version ~= 1 then return nil end
    if current.owner ~= sessionId or type(current.expiresAt) ~= "number" or current.expiresAt <= now then return nil end
    return { version = 1, owner = current.owner, expiresAt = current.expiresAt, completed = table.clone(newCompleted) }
end
return OwnedUpdate

Controlled stale/expired/current session cases without live datastore writes.

local Update = require(script.Parent.OwnedUpdate)
local old = { version = 1, owner = "session-a", expiresAt = 100, completed = {"lamp"} }
assert(Update.apply(old, "session-b", 50, {"gate"}) == nil)
assert(Update.apply(old, "session-a", 100, {"gate"}) == nil)
local nextRecord = Update.apply(old, "session-a", 50, {"lamp","gate"})
assert(nextRecord and #nextRecord.completed == 2 and #old.completed == 1)
print("Ownership decision checks passed")

Shows the nonyielding trusted transform call. Store access, lease acquisition and retries remain external reviewed responsibilities.

-- Integration sketch for a separate reviewed test environment, not a complete save system.
local function updateOwnedRecord(store, key, sessionId, now, snapshot, OwnedUpdate)
    return pcall(function()
        return store:UpdateAsync(key, function(current)
            return OwnedUpdate.apply(current, sessionId, now, snapshot)
        end)
    end)
end
return updateOwnedRecord

Returning nil cancels a write; do not interpret a successful pcall alone as a confirmed updated record.

Session identity needs a unique server-generated token; Studio JobId may be empty, so a real design must account for that explicitly.

This is a bounded learning lab. It has not been executed in an approved Roblox Studio environment by this website.

A checked checklist records your own review, not automated project competence or a community verification.

UpdateAsync transforms the current value atomically. Returning nil cancels that update. Its callback may be called again and cannot yield, so it must not contain waits, remote calls or an external reward side effect.

An ownership token identifies the session permitted to write. A lease expires, so every save must check both token and expiry. A server that lost ownership must stop state-changing play and saving rather than keep overwriting.

This module tests one ownership decision with controlled records. It is not a datastore framework. Acquisition, renewal, ordered retries, release, shutdown, migration and crash recovery require an extensively tested reviewed design. The official reference also warns against using its sample unchanged.