Ledger

Player data as a ledger, not a document.

What is this?

A datastore library for Roblox with no session locks. You never write state. You write down the change you want, a function you own decides whether it is legal, and state is what falls out of replaying those changes.

local Store = Ledger.New({
	Name = "PlayerData",
	Default = { Gold = 100, Items = {} },
	Reducer = function(State, Op)
		if Op.Kind == "SpendGold" then
			if Op.Amount > State.Gold then
				return nil -- refused, on every server, forever
			end
			local Next = table.clone(State)
			Next.Gold -= Op.Amount
			return Next
		end
		return nil
	end,
})

Store:Load(Player)
Store:Expect(Player):Apply("SpendGold", { Amount = 25 })

Two servers spend the same 100 gold, both writes land, the fold accepts one and refuses the other. Every server agrees, every time.

A session lock serializes writers. A validating fold makes the invalid state unreachable, which is a stronger guarantee that also costs nothing when a server crashes: no lease to wait out, no locked player join stall, no side channel to touch someone offline or on another server. What you pay instead is discipline. Changes are ops with names, and a reducer validates them.

Features

• Lock-free validating fold. Invalid state is unreachable, not rejected after the fact, and every server computes the same result without a lock.
• Apply for gameplay, Commit for side effects. Apply is an instant local call. Commit is durable and tells you whether your op won, so exactly one server lands a one time grant.
• Cross-server writes. Edit, Transfer and Tx work on any player, online here, elsewhere, or offline.
• Entity stores. Keys = "String" gives you clans, listings, world records: shared state no single server owns.
• Transfers. One balance moved through an escrow, deduped by id, self healing after a crash. Name the transfer and a retry is safe.
• Atomic transactions. Lock-free two phase commit across two to four keys, which may span two stores. Both sides move or neither does, and a stale one aborts itself within a minute.
• Migrations with rolling deploy safety. Versioned shape upgrades, a hard guard against old servers folding new formats down, and a `Compat