clay-server 4.2.0 → 4.3.0-beta.10

package/lib/project-pair-lifecycle-status.js

@@ -0,0 +1,34 @@
+var pairUsage = require("./project-pair-usage");
+
+var MAX_TASK_PREVIEW_CHARS = 200;
+
+function clampText(value, max) {
+  var text = typeof value === "string" ? value.replace(/\s+/g, " ").trim() : "";
+  if (text.length > max) text = text.slice(0, max - 1) + "…";
+  return text;
+}
+
+function continuityStatus(session) {
+  var history = session.history || [];
+  var userTurns = 0;
+  var errors = 0;
+  for (var i = 0; i < history.length; i++) {
+    if (!history[i]) continue;
+    if (history[i].type === "user_message") userTurns++;
+    else if (history[i].type === "error") errors++;
+  }
+  var lastActivity = typeof session.lastActivity === "number" ? session.lastActivity : null;
+  return { historyEntries: history.length, userTurns: userTurns, errorEntries: errors,
+    idleSeconds: lastActivity ? Math.max(0, Math.round((Date.now() - lastActivity) / 1000)) : null };
+}
+
+function activityStatus(session) {
+  var token = session._pairDelegation || null;
+  return { isProcessing: !!(session.isProcessing || session._queryStarting), delegated: !!token,
+    currentTask: token ? clampText(token.message, MAX_TASK_PREVIEW_CHARS) : "",
+    currentTaskId: token && token.taskId || null, interruption: session._pairInterruption || null,
+    lastTurnInterrupted: !!session._lastTurnInterrupted };
+}
+
+module.exports = { activityStatus: activityStatus, clampText: clampText, continuityStatus: continuityStatus,
+  contextStatus: pairUsage.contextStatus, firstNumber: pairUsage.firstNumber };

package/lib/project-pair-lifecycle.js

@@ -1,27 +1,16 @@
-// Split Worker lifecycle internals: bounded status, transactional replacement,
-// and the per-generation evaluation ledger. The Driver-facing tool posts a
-// user-controlled runtime card before accepted replacement reaches this module.
-//
-// Everything is bound to the exact live pair. The Driver is re-resolved from
-// the split store on every call, its structural capability is re-checked every time, and
-// ownership must match on both sessions. No active-tab or global-session
-// fallback exists in this module.
-//
-// What replacement deliberately does NOT do: delete history. Dissolving a pair
-// leaves both sessions in the project exactly as close_partner already does, so
-// the previous Worker's conversation stays browsable and recoverable under the
-// existing session semantics. There is no archive concept in the repo to hook
-// into, and inventing a destructive one would lose work.
-
 var eligibility = require("./session-driver-eligibility");
 var replacementState = require("./project-pair-replacement-state");
-var pairUsage = require("./project-pair-usage");
-var contextStatus = pairUsage.contextStatus;
-var firstNumber = pairUsage.firstNumber;
+var lifecycleStatus = require("./project-pair-lifecycle-status");
+var contextStatus = lifecycleStatus.contextStatus;
+var firstNumber = lifecycleStatus.firstNumber;
+var continuityStatus = lifecycleStatus.continuityStatus;
+var activityStatus = lifecycleStatus.activityStatus;
+var clampText = lifecycleStatus.clampText;
+var pairTarget = require("./session-pair-target");
+var splitRoles = require("./session-split-group-roles");
 
 var MAX_GENERATIONS = 5;
 var MAX_NOTE_CHARS = 400;
-var MAX_TASK_PREVIEW_CHARS = 200;
 
 var EVALUATION_OUTCOMES = ["succeeded", "partial", "failed", "abandoned"];
 
@@ -36,60 +25,23 @@ function toolError(message) {
   });
 }
 
-function clampText(value, max) {
-  var text = typeof value === "string" ? value.replace(/\s+/g, " ").trim() : "";
-  if (text.length > max) text = text.slice(0, max - 1) + "…";
-  return text;
-}
-
 function replacementFingerprint(args, worker) {
   return JSON.stringify({ sourceWorkerId: worker.localId, interrupt: args.interrupt === true,
     vendor: args.workerVendor || "", model: args.workerModel || "", effort: args.workerEffort || "",
     message: args.message || "", evaluation: args.evaluation || null });
 }
 
-function continuityStatus(session) {
-  var history = session.history || [];
-  var userTurns = 0;
-  var errors = 0;
-  for (var i = 0; i < history.length; i++) {
-    if (!history[i]) continue;
-    if (history[i].type === "user_message") userTurns++;
-    else if (history[i].type === "error") errors++;
-  }
-  var lastActivity = typeof session.lastActivity === "number" ? session.lastActivity : null;
-  return {
-    historyEntries: history.length,
-    userTurns: userTurns,
-    errorEntries: errors,
-    idleSeconds: lastActivity ? Math.max(0, Math.round((Date.now() - lastActivity) / 1000)) : null,
-  };
-}
-
-// The current task, as a bounded preview of the delegated instruction only.
-// Never the transcript: a Driver deciding reuse needs to know what the Worker
-// is on, not to re-read its conversation.
-function activityStatus(session) {
-  var token = session._pairDelegation || null;
-  return {
-    isProcessing: !!(session.isProcessing || session._queryStarting),
-    delegated: !!token,
-    currentTask: token ? clampText(token.message, MAX_TASK_PREVIEW_CHARS) : "",
-    currentTaskId: token && token.taskId || null,
-    interruption: session._pairInterruption || null,
-    lastTurnInterrupted: !!session._lastTurnInterrupted,
-  };
-}
-
 function attachPairLifecycle(ctx) {
   var sm = ctx.sm;
   var store = ctx.splitStore;
   var turnControl = ctx.turnControl;
 
-  function ledgerFor(driver) {
+  function ledgerFor(driver, selectedWorker) {
     if (!Array.isArray(driver._workerGenerations)) driver._workerGenerations = [];
     var group = store.groupForMember(driver.localId);
-    var worker = group && group.pair && sm.sessions.get(group.pair.workerId);
+    var normalized = splitRoles.normalizePair(group && group.pair, group && group.members);
+    var fallbackId = normalized.ok && normalized.kind !== "adhoc" && normalized.workerIds.length === 1 ? normalized.workerIds[0] : null;
+    var worker = selectedWorker || fallbackId != null && sm.sessions.get(fallbackId);
     var generation = worker && (worker._pairGeneration || worker.sessionProvenance && worker.sessionProvenance.generation);
     if (worker && Number.isInteger(generation) && generation > 0 && !findGeneration(driver, worker)) {
       driver._workerGenerations.push({
@@ -109,7 +61,7 @@ function attachPairLifecycle(ctx) {
     return driver._workerGenerations;
   }
   function recordGenerationStart(driver, worker) {
-    var ledger = ledgerFor(driver);
+    var ledger = ledgerFor(driver, worker);
     var existing = findGeneration(driver, worker);
     if (existing && !existing.endedAt) {
       worker._pairGeneration = existing.generation;
@@ -184,11 +136,9 @@ function attachPairLifecycle(ctx) {
     return record;
   }
   function resolveDriverPair(caller) {
+    var args = arguments[1];
+    var options = arguments[2];
     if (!caller) throw new Error("pair lifecycle tools require a session-bound tool server");
-    // Exact live object identity, before anything is read off the caller. A
-    // tool handler captured by a query outlives the session it was bound to, so
-    // a stale object — or a different object that happens to carry the same
-    // localId — must not be able to act as the Driver.
     if (sm.sessions.get(caller.localId) !== caller) {
       throw new Error("this session is no longer live; the pair tools are bound to an exact session");
     }
@@ -198,24 +148,25 @@ function attachPairLifecycle(ctx) {
     if (!group) throw new Error("this session is not in a split group");
     if (!group.pair) throw new Error("this split group has no Driver/Split Worker roles");
     if (group.pair.driverId !== caller.localId) throw new Error("only the configured Driver can direct this pair");
-    var worker = sm.sessions.get(group.pair.workerId);
-    if (!worker) throw new Error("split partner session was not found");
+    var targetOptions = Object.assign({}, options || { mutation: true }, {
+      multiWorkerFeature: ctx.multiWorkerFeature,
+    });
+    var resolved = pairTarget.resolveGroupTarget(sm, group, caller, args, targetOptions);
+    var worker = resolved.partner;
     if ((caller.ownerId || null) !== (worker.ownerId || null)) throw new Error("split partner access denied");
-    return { group: group, worker: worker };
+    return { group: resolved.group, worker: resolved.partner, role: resolved.role, workerId: resolved.workerId };
   }
-
   function replaceBlockedReason(worker) {
     if (worker.isProcessing || worker._queryStarting) return "the Split Worker is mid-turn";
     if (worker._pairDelegation) return "a delegated task is still open";
     return null;
   }
-
-  function partnerStatus(caller) {
-    var resolved = resolveDriverPair(caller);
+  function partnerStatus(caller, args) {
+    var resolved = resolveDriverPair(caller, args, { readOnly: true });
     var worker = resolved.worker;
     var blocked = turnControl.blockedReason(caller) || replaceBlockedReason(worker);
     var resumeBlocked = turnControl.blockedReason(caller) || (worker.isProcessing || worker._queryStarting ? "the Split Worker is mid-turn" : (!worker._pairInterruption ? "the Split Worker has no interrupted task" : null));
-    var ledger = ledgerFor(caller).map(function (record) {
+    var ledger = ledgerFor(caller, worker).map(function (record) {
       return {
         generation: record.generation,
         vendor: record.vendor,
@@ -267,21 +218,49 @@ function attachPairLifecycle(ctx) {
       generations: ledger,
     };
   }
-
+  function sourcePairRegistered(caller, worker) {
+    try {
+      if (sm.sessions.get(caller.localId) !== caller || sm.sessions.get(worker.localId) !== worker) return false;
+      if ((caller.ownerId || null) !== (worker.ownerId || null)) return false;
+      var group = store.groupForMember(caller.localId);
+      var normalized = splitRoles.normalizePair(group && group.pair, group && group.members);
+      return !!(normalized.ok && normalized.kind !== "adhoc" && normalized.driverId === caller.localId &&
+        normalized.workerIds.indexOf(worker.localId) !== -1);
+    } catch (e) { return false; }
+  }
+  function restoreSourcePair(ws, caller, worker) {
+    try {
+      return store.create(ws, {
+        members: [caller.localId, worker.localId],
+        pair: { driverId: caller.localId, workerId: worker.localId },
+      });
+    } catch (e) { return { ok: false, error: e.message || String(e) }; }
+  }
+  function replacementTargetRegistered(caller, oldWorker, sourceWorkerIds) {
+    try {
+      if (sm.sessions.get(caller.localId) !== caller || sm.sessions.get(oldWorker.localId) !== oldWorker) return null;
+      var group = store.groupForMember(caller.localId);
+      var normalized = splitRoles.normalizePair(group && group.pair, group && group.members);
+      if (!normalized.ok || normalized.kind === "adhoc" || normalized.driverId !== caller.localId) return null;
+      var candidates = normalized.workerIds.filter(function (id) { return sourceWorkerIds.indexOf(id) === -1; });
+      if (candidates.length !== 1) return null;
+      var target = sm.sessions.get(candidates[0]);
+      if (!target || sm.sessions.get(target.localId) !== target) return null;
+      return (caller.ownerId || null) === (target.ownerId || null) ? target : null;
+    } catch (e) { return null; }
+  }
   function replacePartner(args, caller) {
-    var resolved = resolveDriverPair(caller);
+    var resolved = resolveDriverPair(caller, args, { mutation: true });
     var group = resolved.group;
     var oldWorker = resolved.worker;
+    var versioned = resolved.role.kind === "versioned";
+    var sourceWorkerIds = resolved.role.workerIds.slice();
     ledgerFor(caller);
     turnControl.assertWorkerAction(caller);
     var replacementEntry = replacementState.begin(caller, args.transactionId, oldWorker, replacementFingerprint(args, oldWorker));
     var replay = replacementState.replayValue(replacementEntry);
     if (replay) return Promise.resolve(replay);
 
-    // Validate the replacement while the old pair is still fully intact. An
-    // uninstalled vendor, an unavailable model or an unsupported effort must
-    // never cost the user their running Worker, so this precedes the interrupt,
-    // the permission cancellation and the dissolve.
     try {
       ctx.preflightWorkerForDriver(caller, {
         workerVendor: args.workerVendor,
@@ -309,72 +288,77 @@ function attachPairLifecycle(ctx) {
       throw validationError;
     }
 
-    if (blocked) {
-      replacementState.stage(replacementEntry.transaction, "stopping_source");
-      replacementEntry.transaction.sourceStopped = true;
-      if (ctx.markInterruption) ctx.markInterruption(oldWorker, "driver", "The Driver accepted replacement of this Worker generation.");
-      oldWorker.taskStopRequested = true;
-      if (oldWorker.abortController) {
-        try { oldWorker.abortController.abort(); } catch (e) {}
-      }
-      if (oldWorker._pairDelegation && typeof ctx.finishDelegation === "function") {
-        if (typeof ctx.completeInterruptedTask === "function") ctx.completeInterruptedTask(oldWorker, caller, oldWorker._pairDelegation);
-        ctx.finishDelegation(group, caller, oldWorker, oldWorker._pairDelegation);
+    var ws = { _clayUser: caller.ownerId ? { id: caller.ownerId } : null };
+    try {
+      if (blocked) {
+        replacementState.stage(replacementEntry.transaction, "stopping_source");
+        replacementEntry.transaction.sourceStopped = true;
+        if (ctx.markInterruption) ctx.markInterruption(oldWorker, "driver", "The Driver accepted replacement of this Worker generation.");
+        oldWorker.taskStopRequested = true;
+        if (oldWorker.abortController) {
+          try { oldWorker.abortController.abort(); } catch (e) {}
+        }
+        if (oldWorker._pairDelegation && typeof ctx.finishDelegation === "function") {
+          if (typeof ctx.completeInterruptedTask === "function") ctx.completeInterruptedTask(oldWorker, caller, oldWorker._pairDelegation);
+          ctx.finishDelegation(group, caller, oldWorker, oldWorker._pairDelegation);
+        }
       }
-    }
 
-    // Any permission decision the old Worker was waiting on dies with the pair.
-    replacementState.stage(replacementEntry.transaction, "cancelling_source_waits");
-    if (typeof ctx.cancelWorkerPermissions === "function") {
-      ctx.cancelWorkerPermissions(oldWorker, "The Driver replaced this Split Worker.");
-    }
+      replacementState.stage(replacementEntry.transaction, "cancelling_source_waits");
+      if (typeof ctx.cancelWorkerPermissions === "function") {
+        ctx.cancelWorkerPermissions(oldWorker, "The Driver replaced this Split Worker.");
+      }
 
-    var ws = { _clayUser: caller.ownerId ? { id: caller.ownerId } : null };
-    replacementState.stage(replacementEntry.transaction, "dissolving_source_pair");
-    var dissolved = store.dissolve(ws, { id: group.id });
-    if (!dissolved.ok) {
+      if (!versioned) {
+        replacementState.stage(replacementEntry.transaction, "dissolving_source_pair");
+        var dissolved = store.dissolve(ws, { id: group.id });
+        if (!dissolved.ok) throw new Error(dissolved.error || "could not dissolve the existing pair");
+      }
+    } catch (precreateError) {
+      var sourceIntact = sourcePairRegistered(caller, oldWorker);
+      var precreateRestored = sourceIntact ? { ok: true } : restoreSourcePair(ws, caller, oldWorker);
+      var rollback = precreateRestored && precreateRestored.ok ? (sourceIntact ? "safe_retry" : "source_pair_restored") : "source_pair_restore_failed";
       turnControl.releaseCreation(creationTicket);
-      replacementState.fail(replacementEntry.transaction, "dissolve_failed", new Error(dissolved.error || "could not dissolve"), "not_required");
-      throw new Error(dissolved.error || "could not dissolve the existing pair");
+      replacementState.fail(replacementEntry.transaction, "precreate_failed", precreateError, rollback);
+      throw precreateError;
     }
 
-    // History is preserved: the old Worker session stays in the project.
-    //
-    // Preflight already cleared every input, but the group write itself can
-    // still fail, so the dissolve is rolled back rather than leaving the Driver
-    // with no pair at all. The restored group is an equivalent record with the
-    // same members and roles; its group id is newly issued.
-    //
-    // What rollback can and cannot undo:
-    //   - Idle replacement failure is fully recoverable. The Worker session,
-    //     its history and its still-open ledger generation are all preserved,
-    //     and the pair is restored.
-    //   - An explicit interrupt=true is NOT reversible. Stopping a mid-turn
-    //     Worker aborts its query and cancels the permission decisions it was
-    //     waiting on; a later creation failure cannot resume that turn. The
-    //     session and its history survive, but the interrupted work does not
-    //     come back. The error says so rather than implying a clean restore.
     var created;
     try {
       replacementState.stage(replacementEntry.transaction, "creating_target");
-      created = ctx.createWorkerForDriver(caller, {
+      var createReplacement = versioned ? ctx.replaceWorkerForDriver : ctx.createWorkerForDriver;
+      created = createReplacement(caller, versioned ? oldWorker : {
         workerVendor: typeof args.workerVendor === "string" ? args.workerVendor : "",
         workerModel: typeof args.workerModel === "string" ? args.workerModel : "",
         workerEffort: typeof args.workerEffort === "string" ? args.workerEffort : "",
-      });
+      }, versioned ? {
+        workerVendor: typeof args.workerVendor === "string" ? args.workerVendor : "",
+        workerModel: typeof args.workerModel === "string" ? args.workerModel : "",
+        workerEffort: typeof args.workerEffort === "string" ? args.workerEffort : "",
+        expectedGroup: group,
+        expectedWorkerIds: sourceWorkerIds,
+      } : undefined);
     } catch (e) {
-      var restored = store.create(ws, {
-        members: [caller.localId, oldWorker.localId],
-        pair: { driverId: caller.localId, workerId: oldWorker.localId },
-      });
-      var restoreNote = restored && restored.ok
+      var target = replacementTargetRegistered(caller, oldWorker, sourceWorkerIds);
+      if (target) {
+        var targetClosed = closeGeneration(caller, oldWorker);
+        var targetGeneration = recordGenerationStart(caller, target);
+        replacementEntry.transaction.targetWorkerId = target.localId;
+        replacementEntry.transaction.targetGeneration = targetGeneration;
+        replacementEntry.transaction.previousGeneration = targetClosed ? targetClosed.generation : null;
+        replacementState.fail(replacementEntry.transaction, "postcommit_delivery_failed", e, "target_created");
+        throw new Error("the replacement Split Worker was created, but its delivery confirmation failed. Reuse Worker " + target.localId + " generation " + targetGeneration + " with send_to_partner; do not replace it again. " + (e.message || String(e)));
+      }
+      var restored = restoreSourcePair(ws, caller, oldWorker);
+      var restoredLive = restored && restored.ok && sourcePairRegistered(caller, oldWorker);
+      var restoreNote = restoredLive
         ? "The previous pair was restored with its session, history and open generation intact."
         : "The previous pair could not be restored; both sessions are intact and unpaired.";
       var interruptNote = blocked
         ? " Its interrupted turn cannot be resumed, because stopping it was explicitly requested."
         : "";
       turnControl.releaseCreation(creationTicket);
-      replacementState.fail(replacementEntry.transaction, "creation_failed", e, restored && restored.ok ? "source_pair_restored" : "source_pair_restore_failed");
+      replacementState.fail(replacementEntry.transaction, "creation_failed", e, restoredLive ? "source_pair_restored" : "source_pair_restore_failed");
       throw new Error("could not create the replacement Split Worker: " + (e.message || String(e)) +
         ". " + restoreNote + interruptNote);
     }
@@ -384,7 +368,6 @@ function attachPairLifecycle(ctx) {
       if (typeof sm.saveSessionFile === "function") sm.saveSessionFile(caller);
     }
     var generation = recordGenerationStart(caller, created.worker);
-
     var result = {
       status: "replaced",
       previousWorkerSessionId: oldWorker.localId,
@@ -403,14 +386,13 @@ function attachPairLifecycle(ctx) {
 
     var message = typeof args.message === "string" ? args.message.trim() : "";
     if (!message) return Promise.resolve(result);
-    return Promise.resolve(ctx.sendToPartner({ message: message, wait: args.wait, timeoutSeconds: args.timeoutSeconds }, caller))
+    return Promise.resolve(ctx.sendToPartner({ message: message, wait: args.wait, timeoutSeconds: args.timeoutSeconds, workerId: created.worker.localId }, caller))
       .then(function (delivered) {
         result.delivery = delivered;
         return result;
       });
   }
 
-  // No global or cross-user ranking is formed from Worker evaluations.
   function validateEvaluation(raw) {
     var input = typeof raw === "string" ? { outcome: raw } : (raw && typeof raw === "object" ? raw : {});
     var outcome = typeof input.outcome === "string" ? input.outcome.trim().toLowerCase() : "";
@@ -430,8 +412,8 @@ function attachPairLifecycle(ctx) {
   }
 
   function recordEvaluation(args, caller) {
-    var resolved = resolveDriverPair(caller);
-    var ledger = ledgerFor(caller);
+    var resolved = resolveDriverPair(caller, args, { mutation: true });
+    var ledger = ledgerFor(caller, resolved.worker);
     var target = Number.isInteger(args.generation)
       ? (function () {
         for (var i = 0; i < ledger.length; i++) {
@@ -453,14 +435,14 @@ function attachPairLifecycle(ctx) {
     };
   }
 
-  function optionalStatus(boundSession) {
-    try { return partnerStatus(boundSession); } catch (e) { return null; }
+  function optionalStatus(boundSession, args) {
+    try { return partnerStatus(boundSession, args); } catch (e) { return null; }
   }
 
   function toolHandlers(boundSession) {
     return {
-      status: function () {
-        try { return toolResult(partnerStatus(boundSession)); }
+      status: function (args) {
+        try { return toolResult(partnerStatus(boundSession, args || {})); }
         catch (e) { return toolError(e.message || String(e)); }
       },
       replace: function (args) {

package/lib/project-pair-message.js

@@ -17,7 +17,7 @@ function attachPairMessage(ctx) {
     if (!id) return toolResult({ status: "rejected", requestId: null, reason: "requestId is invalid" });
     try {
       ctx.turnControl.assertWorkerAction(caller);
-      var resolved = ctx.resolvePair(caller);
+      var resolved = ctx.resolvePair(caller, args, { mutation: true });
       var worker = resolved.partner;
       var message = typeof args.message === "string" ? args.message.trim() : "";
       if (!message) return toolResult({ status: "rejected", requestId: id, partnerId: worker.localId, reason: "message is required" });

package/lib/project-pair-owned-stop.js

@@ -1,10 +1,13 @@
 function stopOwnedPair(session, roles, turnControl, taskControl, workerPermission, reason) {
   if (!roles) return false;
   turnControl.markHumanStop(session);
-  taskControl.cancelAll(roles.worker);
-  taskControl.markInterruption(roles.worker, "user", reason || "The human stopped this scheduled run.");
-  workerPermission.cancelForSession(roles.worker, reason || "The human stopped this scheduled run.");
-  var members = [roles.driver, roles.worker];
+  var workers = roles.workers || [roles.worker];
+  for (var wi = 0; wi < workers.length; wi++) {
+    taskControl.cancelAll(workers[wi]);
+    taskControl.markInterruption(workers[wi], "user", reason || "The human stopped this scheduled run.");
+    workerPermission.cancelForSession(workers[wi], reason || "The human stopped this scheduled run.");
+  }
+  var members = [roles.driver].concat(workers);
   for (var i = 0; i < members.length; i++) {
     members[i].taskStopRequested = true;
     if (members[i].queryInstance && typeof members[i].queryInstance.close === "function") {

package/lib/project-pair-replacement-state.js

@@ -46,7 +46,11 @@ function fail(transaction, stageName, error, rollback) {
   transaction.stage = stageName;
   transaction.updatedAt = Date.now();
   transaction.completedAt = transaction.updatedAt;
-  transaction.failure = { message: error && (error.message || String(error)) || "Unknown replacement failure", rollback: rollback || "not_required" };
+  transaction.failure = {
+    message: error && (error.message || String(error)) || "Unknown replacement failure",
+    rollback: rollback || "not_required",
+    retryable: rollback === "safe_retry" || (stageName === "creation_failed" && rollback === "source_pair_restored"),
+  };
   transaction.sourcePairRestored = rollback === "source_pair_restored" ? true : (rollback === "source_pair_restore_failed" ? false : null);
   return transaction;
 }

package/lib/project-pair-result-capture.js

@@ -0,0 +1,116 @@
+function attachPairResultCapture(ctx) {
+  var splitRoles = require("./session-split-group-roles");
+  function current(caller, partner, token) {
+    var group = ctx.store.groupForMember(partner.localId);
+    return !!(group && group.id === token.groupId && partner._pairDelegation === token &&
+      splitRoles.matchesLiveTarget(ctx.sm, group, caller, partner) && splitRoles.tokenMatchesWorker(partner, token));
+  }
+  function begin(caller, partner, token, message, projectSlug) {
+    if (!ctx.resultOutbox) return { ok: true };
+    var driverOriginId = ctx.resultOutbox.stableOrigin(caller), workerOriginId = ctx.resultOutbox.stableOrigin(partner);
+    if (!driverOriginId || !workerOriginId) return { ok: false, error: "durable session origins are required before dispatch" };
+    var started = ctx.resultOutbox.begin({ ownerId: caller.ownerId, projectSlug: projectSlug,
+      driverOriginId: driverOriginId, workerOriginId: workerOriginId,
+      taskId: token.taskId, generation: token.generation, driverSessionId: caller.localId,
+      workerSessionId: partner.localId, groupId: token.groupId,
+      historyStartIndex: token.startIndex, message: message,
+      deliveryRoute: token.wait === true ? "blocking" : "callback" });
+    if (started.ok) token.outboxKey = started.key;
+    return started;
+  }
+  function finish(caller, partner, token, delivered) {
+    var group = ctx.store.groupForMember(partner.localId);
+    if (token._captureFinished || !current(caller, partner, token)) return false;
+    token._captureFinished = true;
+    try {
+      if (typeof ctx.onPartnerResult === "function") ctx.onPartnerResult(caller, partner, token);
+      if (token.outboxKey && ctx.resultOutbox) {
+        var finalized = ctx.resultOutbox.markFinalized(token.outboxKey);
+        if (!finalized.ok) throw new Error(finalized.error || "completed result finalization could not be saved");
+      }
+      ctx.finishDelegation(group, caller, partner, token);
+      if (typeof ctx.onStateChange === "function" && token.outboxKey) ctx.onStateChange(caller, ctx.resultOutbox.get(token.outboxKey));
+    } catch (error) {
+      token._captureFinished = false;
+      token._capturePending = true;
+      token._captureHookError = error.message || String(error);
+      if (token.outboxKey && ctx.resultOutbox) {
+        var failed = ctx.resultOutbox.markFinalizationFailure(token.outboxKey, token._captureHookError);
+        if (typeof ctx.onStateChange === "function") ctx.onStateChange(caller, Object.assign({}, failed.record || ctx.resultOutbox.get(token.outboxKey), {
+          finalizationState: "failed", finalizationError: token._captureHookError, persistenceError: failed.ok ? null : failed.error,
+        }));
+      }
+      return false;
+    }
+    delete token._capturePending;
+    var resumed = delivered ? true : ctx.resumeDriverWithResult(caller, partner, token);
+    if (!partner._pairClosing) ctx.drain(caller, partner);
+    return resumed;
+  }
+  function capture(caller, partner, token, outcome) {
+    if (!ctx.resultOutbox || !token.outboxKey) return finish(caller, partner, token);
+    if (token._captureInProgress || token._captureComplete) return false;
+    token._captureInProgress = true;
+    var saved;
+    try {
+      saved = ctx.resultOutbox.capture(token.outboxKey, outcome, function (retryResult) {
+        token._captureInProgress = false;
+        if (retryResult && retryResult.ok) {
+          token._captureComplete = true;
+          var capturedRecord = ctx.resultOutbox.get(token.outboxKey);
+          if (typeof ctx.onStateChange === "function") ctx.onStateChange(caller, capturedRecord);
+          if (capturedRecord && capturedRecord.deliveryRoute === "callback") deliver(caller, partner, token);
+          else finish(caller, partner, token);
+        }
+      }, function () { return current(caller, partner, token); });
+    } catch (error) {
+      token._captureInProgress = false;
+      token._capturePending = true;
+      token._captureHookError = error.message || String(error);
+      return false;
+    }
+    if (saved.ok) { token._captureInProgress = false; token._captureComplete = true; }
+    if (saved.ok) {
+      var capturedRecord = ctx.resultOutbox.get(token.outboxKey);
+      if (typeof ctx.onStateChange === "function") ctx.onStateChange(caller, capturedRecord);
+      var delivered = capturedRecord && capturedRecord.deliveryRoute === "callback" ? deliver(caller, partner, token) : finish(caller, partner, token);
+      return delivered === false && token._capturePending ? false : delivered;
+    }
+    token._capturePending = true;
+    if (!token._captureFailureReported) {
+      token._captureFailureReported = true;
+      try { ctx.sm.sendAndRecord(caller, { type: "error", text: "The Split Worker completed, but its result could not be durably captured yet. The task remains retained for bounded server retry." }); } catch (error) { token._captureNoticeError = error.message || String(error); }
+    }
+    return false;
+  }
+  function prepare(caller, partner, token, outcome) {
+    if (!ctx.resultOutbox || !token.outboxKey) return { ok: true, prepared: false };
+    var saved = ctx.resultOutbox.prepareCapture(token.outboxKey, outcome);
+    return saved.ok ? { ok: true, prepared: true, duplicate: !!saved.duplicate } : saved;
+  }
+  function rollbackPrepared(token, outcome) {
+    if (!ctx.resultOutbox || !token.outboxKey) return { ok: true };
+    return ctx.resultOutbox.rollbackPreparedCapture(token.outboxKey, outcome);
+  }
+  function finalizePrepared(token, outcome) {
+    if (!ctx.resultOutbox || !token.outboxKey) return { ok: true, record: null };
+    return ctx.resultOutbox.finalizePreparedCapture(token.outboxKey, outcome);
+  }
+  function acceptPrepared(caller, partner, token) {
+    if (ctx.resultOutbox && token.outboxKey) {
+      token._captureComplete = true;
+      var record = ctx.resultOutbox.get(token.outboxKey);
+      if (typeof ctx.onStateChange === "function") ctx.onStateChange(caller, record);
+      return record && record.deliveryRoute === "callback" ? deliver(caller, partner, token) : finish(caller, partner, token);
+    }
+    return finish(caller, partner, token);
+  }
+  function deliver(caller, partner, token) {
+    if (!ctx.delivery) return finish(caller, partner, token);
+    return ctx.delivery.wake(caller, partner, token);
+  }
+  return { begin: begin, capture: capture, prepare: prepare, finalizePrepared: finalizePrepared, rollbackPrepared: rollbackPrepared,
+    acceptPrepared: acceptPrepared, deliver: deliver, finish: finish };
+}
+
+module.exports = { attachPairResultCapture: attachPairResultCapture };