Close presence when a Visit ends, and let an operator close a stray entry

[xmap]

Stacked on #605. Base is fix/presence-names-the-caller, because this fills the gap that PR deliberately opened. Sibling of #608, not dependent on it.

Why

Dropping the caller-asserted actor from check-in and check-out closed a real hole and left a real gap: somebody who went home without checking out had an entry nobody could close. That capability existed only because of the hole. This restores it in two forms, neither of which reopens it.

Auto-close on terminal transition

A Visit reaching Completed / Cancelled / Aborted / Voided now closes every open presence entry at the transition's own timestamp.

No new event. "The Visit ended at T" already implies "nobody is present after T", so the evolver derives it and the terminal deciders stay ignorant of presence.

The projection subscribes to the same four events, and that is the part worth reviewing. The fold and the read model must agree: a Visit that folded to nobody-present while proj_trust_visit_presence still showed open rows would make presence useless as evidence for the one query it exists to answer. There is a test asserting they agree, not just that each works.

The explicit command

close_visit_presence covers the mid-Visit case, where somebody left but the beamtime is still running. Separate command rather than a nullable actor on check-out, so closing another person's record needs its own Policy grant.

Note the deliberate asymmetry at the wire, which looks inconsistent until you see why:

	actor_id in body
check_in_visit	forbidden (422)
check_out_visit	forbidden (422)
close_visit_presence	required

Naming the target is the entire intent of the third command.

An architecture test overturned my first design

It originally emitted VisitCheckedOut, reasoning that the envelope's principal_id and command_name already disambiguate. test_command_name_derives_event_name rejected that, and it was right.

Reading presence as evidence means "did this person leave, or did somebody close their record for them" should be one predicate over the event stream, not a join against envelope metadata. And CORA already models cause-distinguished events for a single structural transition: VisitCancelled / VisitAborted / VisitVoided.

So it emits VisitPresenceClosed. The feared duplication came to ~15 lines: the evolver takes both in one match arm and the projection routes both to the same UPDATE, because they differ in cause rather than effect. Who did the closing stays on the envelope; a closed_by payload field would duplicate principal_id and, being a *_by attribution field, would then demand a paired timestamp it does not need.

Tests

The slice-coverage fitness tests drove the surface: decider, handler, endpoint contract, MCP tool contract, and a paired PBT.

Two worth pointing at:

• Bystander isolation (PBT). With several actors open at once, closing one never emits an event naming another. This catches a decider that closes the first open entry rather than the named one, which is the plausible way this slice would go wrong.
• Prior check-out keeps its own timestamp. A terminal transition must not overwrite an already-closed entry.

The lifecycle-independence property is scoped to non-terminal statuses deliberately: a terminal Visit has already had its entries closed, so "terminal Visit with an open entry" is unreachable rather than untested. That reasoning is in the test, because the next reader will be tempted to widen it back.

Verification

ruff + pyright     clean
unit + contract    16,146 passed, 1 skipped
architecture       30,186 passed, 614 skipped
openapi snapshot   regenerated
pre-commit hooks   all passed

🤖 Generated with Claude Code

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
apps/api/src/cora/trust
routes.py
tools.py
apps/api/src/cora/trust/aggregates/visit
events.py
evolver.py
apps/api/src/cora/trust/features/close_visit_presence
__init__.py
command.py
decider.py
handler.py
route.py
tool.py					49
apps/api/src/cora/trust/projections
visit_presence.py
Project Total

This report was generated by python-coverage-comment-action