clay-server 4.3.0-beta.4 → 4.3.0-beta.6

package/lib/session-split-group-roles.js

@@ -0,0 +1,164 @@
+// Shared role and target identity rules for Split Groups.
+//
+// Version 1 is the persisted two-session pair shape. Version 2 describes one
+// Driver and up to two Workers, but callers must explicitly opt into it until
+// all production consumers can address more than one Worker.
+// Remaining direct pair.workerId reads are deliberate compatibility branches:
+// session-split-groups owns legacy-only create and Driver-transfer transactions,
+// while session-split-group-anchors and persistence resolve legacy records.
+// Production activation must still migrate the client hierarchy, pane lock, and
+// split-group helper projections before the server gate is enabled.
+
+var MAX_WORKERS = 2;
+
+function isInteger(value) {
+  return Number.isInteger(value);
+}
+
+function containsOnce(values, value) {
+  var count = 0;
+  for (var i = 0; i < values.length; i++) if (values[i] === value) count++;
+  return count === 1;
+}
+
+function validateMembers(members) {
+  if (!Array.isArray(members) || (members.length !== 2 && members.length !== 3)) {
+    return { ok: false, error: "A split group requires exactly two sessions until multi-Worker consumers are enabled" };
+  }
+  for (var i = 0; i < members.length; i++) {
+    if (!isInteger(members[i])) return { ok: false, error: "Split group members must be distinct integer session ids" };
+    if (!containsOnce(members, members[i])) return { ok: false, error: "Split group members must be distinct integer session ids" };
+  }
+  return { ok: true };
+}
+
+function validateRoleIds(driverId, workerIds, members) {
+  if (!isInteger(driverId)) return { ok: false, error: "The Driver role must reference an integer session id" };
+  if (!Array.isArray(workerIds) || workerIds.length < 1 || workerIds.length > MAX_WORKERS) {
+    return { ok: false, error: "A configured role requires one to two Workers" };
+  }
+  if (!containsOnce(members, driverId)) return { ok: false, error: "The Driver role must reference exactly one split group member" };
+  var seen = [driverId];
+  for (var i = 0; i < workerIds.length; i++) {
+    if (!isInteger(workerIds[i]) || seen.indexOf(workerIds[i]) !== -1 || !containsOnce(members, workerIds[i])) {
+      return { ok: false, error: "Worker roles must reference distinct split group members" };
+    }
+    seen.push(workerIds[i]);
+  }
+  if (seen.length !== members.length) return { ok: false, error: "Every split group member must have exactly one role" };
+  return { ok: true };
+}
+
+function normalizePair(pair, members) {
+  var memberCheck = validateMembers(members);
+  if (!memberCheck.ok) return memberCheck;
+  if (pair == null) {
+    if (members.length !== 2) return { ok: false, error: "An ad-hoc split group requires exactly two sessions" };
+    return { ok: true, kind: "adhoc", version: null, driverId: null, workerIds: [] };
+  }
+  if (!pair || typeof pair !== "object" || Array.isArray(pair)) return { ok: false, error: "Split group roles must be an object" };
+
+  var hasVersion = Object.prototype.hasOwnProperty.call(pair, "version");
+  var hasLegacyWorker = Object.prototype.hasOwnProperty.call(pair, "workerId");
+  var hasWorkerIds = Object.prototype.hasOwnProperty.call(pair, "workerIds");
+  if (hasVersion && pair.version !== 2) return { ok: false, error: "Unknown split group role version" };
+  if (hasVersion && hasLegacyWorker) return { ok: false, error: "Versioned roles cannot also define legacy workerId" };
+  if (hasVersion && !hasWorkerIds) return { ok: false, error: "Version 2 roles require workerIds" };
+  if (!hasVersion && hasWorkerIds) return { ok: false, error: "workerIds requires version 2 roles" };
+  if (!hasVersion && !hasLegacyWorker) return { ok: false, error: "Legacy roles require workerId" };
+
+  var workerIds = hasVersion ? pair.workerIds : [pair.workerId];
+  var checked = validateRoleIds(pair.driverId, workerIds, members);
+  if (!checked.ok) return checked;
+  return {
+    ok: true,
+    kind: hasVersion ? "versioned" : "legacy",
+    version: hasVersion ? 2 : null,
+    driverId: pair.driverId,
+    workerIds: workerIds.slice(),
+  };
+}
+
+function validateStorePair(pair, members) {
+  var normalized = normalizePair(pair, members);
+  if (!normalized.ok) return normalized;
+  if (normalized.kind === "versioned") {
+    return { ok: false, error: "Version 2 split group roles are reserved until multi-Worker consumers are migrated" };
+  }
+  if (normalized.kind === "adhoc" && members.length !== 2) {
+    return { ok: false, error: "An ad-hoc split group requires exactly two sessions" };
+  }
+  return normalized;
+}
+
+function isUnsupportedPair(pair) {
+  return !!(pair && typeof pair === "object" && Object.prototype.hasOwnProperty.call(pair, "version"));
+}
+
+function validateStoredGroup(group, sessions) {
+  if (!group || typeof group.id !== "string" || !Array.isArray(group.members) || group.members.length !== 2) return false;
+  if (!sessions.has(group.members[0]) || !sessions.has(group.members[1])) return false;
+  return validateStorePair(group.pair, group.members).ok;
+}
+
+function resolveWorkerTarget(role, requestedWorkerId) {
+  if (!role || !role.ok || role.kind === "adhoc") return { ok: false, error: "The split group has no configured Workers" };
+  if (requestedWorkerId != null) {
+    if (!isInteger(requestedWorkerId) || role.workerIds.indexOf(requestedWorkerId) === -1) {
+      return { ok: false, error: "workerId must identify an exact configured Worker" };
+    }
+    return { ok: true, workerId: requestedWorkerId };
+  }
+  if (role.workerIds.length !== 1) return { ok: false, error: "workerId is required when more than one Worker is configured" };
+  return { ok: true, workerId: role.workerIds[0] };
+}
+
+function resolveLiveRoles(sm, group) {
+  var normalized = normalizePair(group && group.pair, group && group.members);
+  if (!normalized.ok || normalized.kind === "adhoc") return null;
+  var driver = sm.sessions.get(normalized.driverId);
+  if (!driver || sm.sessions.get(driver.localId) !== driver || driver.destroying) return null;
+  var workers = [];
+  for (var i = 0; i < normalized.workerIds.length; i++) {
+    var worker = sm.sessions.get(normalized.workerIds[i]);
+    if (!worker || sm.sessions.get(worker.localId) !== worker || worker.destroying) return null;
+    if ((worker.ownerId || null) !== (driver.ownerId || null)) return null;
+    workers.push(worker);
+  }
+  return { group: group, role: normalized, driver: driver, workers: workers };
+}
+
+function matchesLiveTarget(sm, group, caller, worker) {
+  if (!group || !caller || !worker) return false;
+  if (sm.sessions.get(caller.localId) !== caller || sm.sessions.get(worker.localId) !== worker) return false;
+  if ((caller.ownerId || null) !== (worker.ownerId || null)) return false;
+  var normalized = normalizePair(group.pair, group.members);
+  if (!normalized.ok) return false;
+  if (normalized.kind === "adhoc") {
+    return group.members.indexOf(caller.localId) !== -1 && group.members.indexOf(worker.localId) !== -1 && caller !== worker;
+  }
+  var roles = resolveLiveRoles(sm, group);
+  return !!(roles && roles.driver === caller && roles.workers.indexOf(worker) !== -1);
+}
+
+function taskGeneration(worker) {
+  return worker && (worker._pairGeneration || worker.sessionProvenance && worker.sessionProvenance.generation) || null;
+}
+
+function tokenMatchesWorker(worker, token) {
+  return !!(worker && token && token.workerSessionId === worker.localId && token.generation === taskGeneration(worker));
+}
+
+module.exports = {
+  MAX_WORKERS: MAX_WORKERS,
+  normalizePair: normalizePair,
+  matchesLiveTarget: matchesLiveTarget,
+  resolveLiveRoles: resolveLiveRoles,
+  resolveWorkerTarget: resolveWorkerTarget,
+  tokenMatchesWorker: tokenMatchesWorker,
+  validateMembers: validateMembers,
+  validateRoleIds: validateRoleIds,
+  validateStoredGroup: validateStoredGroup,
+  validateStorePair: validateStorePair,
+  isUnsupportedPair: isUnsupportedPair,
+};

package/lib/session-split-group-v2-store.js

@@ -0,0 +1,146 @@
+var multiWorkerFeature = require("./multi-worker-feature");
+var splitRoles = require("./session-split-group-roles");
+
+function sameOwner(session, ownerId) {
+  return !!session && (session.ownerId || null) === (ownerId || null);
+}
+
+function generationOf(session) {
+  return session && (session._pairGeneration ||
+    session.sessionProvenance && session.sessionProvenance.generation) || null;
+}
+
+function clone(value) { return JSON.parse(JSON.stringify(value)); }
+
+function replace(target, source) {
+  var keys = Object.keys(target);
+  for (var i = 0; i < keys.length; i++) delete target[keys[i]];
+  Object.assign(target, clone(source));
+}
+
+function attachVersionedMutations(ctx) {
+  function authorized(feature) {
+    return ctx.enabled && multiWorkerFeature.isEnabled(feature);
+  }
+
+  function rejectCapability(capability) {
+    if (authorized(capability)) return null;
+    return { ok: false, error: "Version 2 split groups require the server multi-Worker feature" };
+  }
+
+  function exactGroup(ownerId, msg, targetRequired) {
+    var group = ctx.groups().find(function (item) { return item.id === (msg && msg.groupId); });
+    if (!group) return { error: "Split group not found" };
+    if (msg.expectedGroup && msg.expectedGroup !== group) return { error: "The exact split group changed" };
+    if ((group.ownerId || null) !== (ownerId || null)) return { error: "Split group owner changed" };
+    var normalized = splitRoles.normalizePair(group.pair, group.members);
+    if (!normalized.ok || normalized.kind === "adhoc") return { error: "Split group roles changed" };
+    if (normalized.driverId !== msg.driverId) return { error: "The configured Driver changed" };
+    if (Array.isArray(msg.expectedWorkerIds) &&
+        normalized.workerIds.join(",") !== msg.expectedWorkerIds.join(",")) {
+      return { error: "The configured Worker membership changed" };
+    }
+    var driver = ctx.sessions.get(msg.driverId);
+    if (!sameOwner(driver, ownerId) || ctx.sessions.get(driver.localId) !== driver ||
+        (msg.driverOriginId || null) !== (driver.sessionOriginId || null)) {
+      return { error: "The exact Driver identity changed" };
+    }
+    var target = null;
+    if (targetRequired) {
+      if (normalized.workerIds.indexOf(msg.workerId) === -1) return { error: "The selected Worker changed" };
+      target = ctx.sessions.get(msg.workerId);
+      if (!sameOwner(target, ownerId) || ctx.sessions.get(target.localId) !== target ||
+          (msg.workerOriginId || null) !== (target.sessionOriginId || null) ||
+          msg.generation !== generationOf(target)) {
+        return { error: "The exact Worker identity or generation changed" };
+      }
+    }
+    return { group: group, normalized: normalized, driver: driver, target: target };
+  }
+
+  function newWorker(ownerId, msg) {
+    var worker = ctx.sessions.get(msg.newWorkerId);
+    if (!sameOwner(worker, ownerId) || ctx.sessions.get(worker.localId) !== worker ||
+        (msg.newWorkerOriginId || null) !== (worker.sessionOriginId || null)) {
+      return { error: "The exact replacement Worker identity changed" };
+    }
+    if (ctx.membershipGroup(worker.localId)) return { error: "The Worker already belongs to a split group" };
+    return { worker: worker };
+  }
+
+  function commit(group, nextMembers, nextPair, hooks) {
+    var before = clone(group);
+    group.members = nextMembers;
+    group.pair = nextPair;
+    try { ctx.save(); }
+    catch (error) {
+      replace(group, before);
+      return { ok: false, error: error.message || String(error) };
+    }
+    var committed = clone(group);
+    if (hooks && typeof hooks.afterPersist === "function") {
+      replace(group, before);
+      var accepted;
+      try { accepted = hooks.afterPersist(); }
+      catch (error) { accepted = { ok: false, error: error.message || String(error) }; }
+      if (!accepted || accepted.ok === false) {
+        try { ctx.save(); }
+        catch (rollbackError) {
+          return { ok: false, error: (accepted && accepted.error || "close transaction rejected") +
+            "; persistence rollback failed: " + (rollbackError.message || String(rollbackError)) };
+        }
+        return { ok: false, error: accepted && accepted.error || "close transaction rejected" };
+      }
+      replace(group, committed);
+    }
+    ctx.changed(group);
+    return { ok: true, group: group };
+  }
+
+  function addWorker(ownerId, msg, capability) {
+    var denied = rejectCapability(capability);
+    if (denied) return denied;
+    var exact = exactGroup(ownerId, msg || {}, false);
+    if (exact.error) return { ok: false, error: exact.error };
+    if (exact.normalized.workerIds.length >= splitRoles.MAX_WORKERS) {
+      return { ok: false, error: "A Driver can have at most two Workers" };
+    }
+    var added = newWorker(ownerId, msg);
+    if (added.error) return { ok: false, error: added.error };
+    var workerIds = exact.normalized.workerIds.concat([added.worker.localId]);
+    return commit(exact.group, [exact.driver.localId].concat(workerIds), {
+      version: 2, driverId: exact.driver.localId, workerIds: workerIds,
+    });
+  }
+
+  function replaceWorker(ownerId, msg, capability) {
+    var denied = rejectCapability(capability);
+    if (denied) return denied;
+    var exact = exactGroup(ownerId, msg || {}, true);
+    if (exact.error) return { ok: false, error: exact.error };
+    var added = newWorker(ownerId, msg);
+    if (added.error) return { ok: false, error: added.error };
+    var workerIds = exact.normalized.workerIds.slice();
+    workerIds[workerIds.indexOf(exact.target.localId)] = added.worker.localId;
+    var pair = exact.normalized.kind === "legacy"
+      ? { driverId: exact.driver.localId, workerId: added.worker.localId }
+      : { version: 2, driverId: exact.driver.localId, workerIds: workerIds };
+    return commit(exact.group, [exact.driver.localId].concat(workerIds), pair);
+  }
+
+  function removeWorker(ownerId, msg, capability, hooks) {
+    var denied = rejectCapability(capability);
+    if (denied) return denied;
+    var exact = exactGroup(ownerId, msg || {}, true);
+    if (exact.error) return { ok: false, error: exact.error };
+    var workerIds = exact.normalized.workerIds.filter(function (id) { return id !== exact.target.localId; });
+    if (workerIds.length === 0) return ctx.remove(exact.group, hooks);
+    return commit(exact.group, [exact.driver.localId].concat(workerIds), {
+      version: 2, driverId: exact.driver.localId, workerIds: workerIds,
+    }, hooks);
+  }
+
+  return { addWorker: addWorker, replaceWorker: replaceWorker, removeWorker: removeWorker };
+}
+
+module.exports = { attachVersionedMutations: attachVersionedMutations, generationOf: generationOf };

package/lib/session-split-groups.js

@@ -1,7 +1,9 @@
 var crypto = require("crypto");
-var fs = require("fs");
-var path = require("path");
 var durableAnchors = require("./session-split-group-anchors");
+var splitRoles = require("./session-split-group-roles");
+var versionedStore = require("./session-split-group-v2-store");
+var multiWorkerFeature = require("./multi-worker-feature");
+var groupPersistence = require("./session-split-group-persistence");
 function truncateTitle(title) {
   var value = String(title || "New Session");
   return value.length > 20 ? value.slice(0, 19) + "…" : value;
@@ -11,92 +13,14 @@ function autoGroupName(leftTitle, rightTitle) {
 }
 function createSplitGroupStore(opts) {
   var sessions = opts.sessions;
-  var groupsFile = path.join(opts.sessionsDir, "split-groups.json");
   var usersModule = opts.usersModule;
   var broadcast = opts.broadcast || function () {};
   var onPairChanged = opts.onPairChanged || function () {};
   var groups = [];
   var stagedTransfers = [];
-  function refreshPairAnchors(group) {
-    if (!group.pair) return;
-    var anchors = durableAnchors.pairAnchors(group, sessions);
-    group.pairCliIds = anchors.cli;
-    group.pairOriginIds = anchors.origin;
-  }
-  function save() {
-    for (var gi = 0; gi < groups.length; gi++) {
-      var anchors = durableAnchors.memberAnchors(groups[gi], sessions);
-      groups[gi].memberCliIds = anchors.cli;
-      groups[gi].memberOriginIds = anchors.origin;
-      refreshPairAnchors(groups[gi]);
-    }
-    var serialized = JSON.stringify(groups, null, 2) + "\n";
-    if (typeof opts.persistGroups === "function") {
-      if (opts.persistGroups(groupsFile, serialized) === false) throw new Error("Split group persistence returned false");
-      return;
-    }
-    var tmp = groupsFile + ".tmp." + process.pid;
-    fs.mkdirSync(opts.sessionsDir, { recursive: true });
-    fs.writeFileSync(tmp, serialized);
-    if (process.platform !== "win32") {
-      try { fs.chmodSync(tmp, 0o600); } catch (e) {}
-    }
-    fs.renameSync(tmp, groupsFile);
-  }
-  function validRecord(group) {
-    return group && typeof group.id === "string" && Array.isArray(group.members) &&
-      group.members.length === 2 && group.members[0] !== group.members[1] &&
-      Number.isInteger(group.members[0]) && Number.isInteger(group.members[1]) &&
-      sessions.has(group.members[0]) && sessions.has(group.members[1]);
-  }
-  function load() {
-    var loaded = [];
-    var shouldRewrite = false;
-    try {
-      loaded = JSON.parse(fs.readFileSync(groupsFile, "utf8"));
-      if (!Array.isArray(loaded)) loaded = [];
-    } catch (e) {
-      if (e.code !== "ENOENT") shouldRewrite = true;
-    }
-    var claimed = {};
-    groups = loaded.filter(function (group) {
-      // Remap members from the durable cliSessionIds; the stored localIds
-      // are only trusted for legacy records that predate memberCliIds.
-      if (group && (Array.isArray(group.memberCliIds) || Array.isArray(group.memberOriginIds))) {
-        var memberCliIds = Array.isArray(group.memberCliIds) ? group.memberCliIds : [null, null];
-        var memberOriginIds = Array.isArray(group.memberOriginIds) ? group.memberOriginIds : [null, null];
-        var left = durableAnchors.findSession(sessions, memberCliIds[0], memberOriginIds[0]);
-        var right = durableAnchors.findSession(sessions, memberCliIds[1], memberOriginIds[1]);
-        if (!left || !right || left === right) return false;
-        if (group.members[0] !== left.localId || group.members[1] !== right.localId) {
-          group.members = [left.localId, right.localId];
-          shouldRewrite = true;
-        }
-      }
-      if (group && group.pair && (Array.isArray(group.pairCliIds) || Array.isArray(group.pairOriginIds))) {
-        var pairCliIds = Array.isArray(group.pairCliIds) ? group.pairCliIds : [null, null];
-        var pairOriginIds = Array.isArray(group.pairOriginIds) ? group.pairOriginIds : [null, null];
-        var driver = durableAnchors.findSession(sessions, pairCliIds[0], pairOriginIds[0]);
-        var worker = durableAnchors.findSession(sessions, pairCliIds[1], pairOriginIds[1]);
-        if (driver && worker) {
-          group.pair.driverId = driver.localId;
-          group.pair.workerId = worker.localId;
-        }
-      }
-      if (group && group.pair) {
-        var pairValid = Array.isArray(group.members) && group.pair.driverId !== group.pair.workerId &&
-          group.members.indexOf(group.pair.driverId) !== -1 &&
-          group.members.indexOf(group.pair.workerId) !== -1;
-        if (!pairValid) return false;
-      }
-      if (!validRecord(group) || claimed[group.members[0]] || claimed[group.members[1]]) return false;
-      claimed[group.members[0]] = true;
-      claimed[group.members[1]] = true;
-      return true;
-    });
-    if (groups.length !== loaded.length) shouldRewrite = true;
-    if (shouldRewrite) save();
-  }
+  var versionedEnabled = multiWorkerFeature.isEnabled(opts.multiWorkerFeature);
+  var persistence = groupPersistence.attachPersistence(Object.assign({}, opts, { versionedEnabled: versionedEnabled }));
+  function save() { return persistence.save(groups); }
   function isMultiUser() {
     return !!(usersModule && usersModule.isMultiUser && usersModule.isMultiUser());
   }
@@ -153,6 +77,8 @@ function createSplitGroupStore(opts) {
     if (!left || !right) return { ok: false, error: "Session not found" };
     if (!canAccess(ws, left) || !canAccess(ws, right)) return { ok: false, error: "Session access denied" };
     if (membershipGroup(members[0]) || membershipGroup(members[1])) return { ok: false, error: "A session can belong to only one split group" };
+    var roleCheck = splitRoles.validateStorePair(msg.pair, members);
+    if (!roleCheck.ok) return { ok: false, error: roleCheck.error };
     var requestedName = typeof msg.name === "string" ? msg.name.trim().slice(0, 80) : "";
     var group = {
       id: "sg_" + Date.now().toString(36) + "_" + crypto.randomBytes(3).toString("hex"),
@@ -183,7 +109,8 @@ function createSplitGroupStore(opts) {
     if ((left.ownerId || null) !== (ownerId || null) || (right.ownerId || null) !== (ownerId || null)) return { ok: false, error: "Session owner does not match the scheduled task owner" };
     if (membershipGroup(left.localId) || membershipGroup(right.localId)) return { ok: false, error: "A session can belong to only one split group" };
     var pair = msg && msg.pair;
-    if (!pair || pair.driverId !== left.localId || pair.workerId !== right.localId) return { ok: false, error: "Pair roles must reference both split group members" };
+    var roleCheck = splitRoles.validateStorePair(pair, members);
+    if (!roleCheck.ok || !pair || pair.driverId !== left.localId || pair.workerId !== right.localId) return { ok: false, error: roleCheck.error || "Pair roles must reference both split group members" };
     var requestedName = typeof msg.name === "string" ? msg.name.trim().slice(0, 80) : "";
     var group = {
       id: "sg_" + Date.now().toString(36) + "_" + crypto.randomBytes(3).toString("hex"),
@@ -206,12 +133,13 @@ function createSplitGroupStore(opts) {
     onPairChanged(removed);
     return true;
   }
-  // Runtime pair lookup sees this isolated projection while ordinary list,
-  // save, anchor refresh, broadcast, and unrelated mutations keep using the
-  // durable source-owned record until commit.
   function beginOwnedDriverTransfer(ownerId, msg) {
     var group = groups.find(function (item) { return item.id === (msg && msg.id); });
     if (!group || (group.ownerId || null) !== (ownerId || null)) return { ok: false, error: "Split group not found" };
+    var transferRoles = splitRoles.normalizePair(group.pair, group.members);
+    if (transferRoles.ok && transferRoles.kind === "versioned") {
+      return { ok: false, error: "Version 2 Driver transfer is not enabled" };
+    }
     if (!group.pair || group.pair.driverId !== msg.sourceDriverId || group.pair.workerId !== msg.workerId) {
       return { ok: false, error: "The split pair changed before Driver transfer" };
     }
@@ -391,6 +319,8 @@ function createSplitGroupStore(opts) {
       return { ok: false, error: "Driver must be a member of the split group" };
     }
     var workerId = group.members[0] === msg.driverId ? group.members[1] : group.members[0];
+    var roleCheck = splitRoles.validateStorePair({ driverId: msg.driverId, workerId: workerId }, group.members);
+    if (!roleCheck.ok) return { ok: false, error: roleCheck.error };
     group.pair = { driverId: msg.driverId, workerId: workerId };
     save();
     broadcast();
@@ -398,22 +328,57 @@ function createSplitGroupStore(opts) {
     return { ok: true, group: group };
   }
 
-  function dissolve(ws, msg) {
+  function dissolve(ws, msg, hooks) {
     var index = groups.findIndex(function (item) { return item.id === (msg && msg.id); });
     if (index === -1) return { ok: false, error: "Split group not found" };
     if (!canOwn(ws, groups[index])) return { ok: false, error: "Only the group owner can separate it" };
     var removed = groups.splice(index, 1)[0];
-    save();
+    try { save(); }
+    catch (error) { groups.splice(index, 0, removed); return { ok: false, error: error.message || String(error) }; }
+    if (hooks && typeof hooks.afterPersist === "function") {
+      groups.splice(index, 0, removed);
+      var accepted;
+      try { accepted = hooks.afterPersist(); }
+      catch (error) { accepted = { ok: false, error: error.message || String(error) }; }
+      if (!accepted || accepted.ok === false) {
+        try { save(); }
+        catch (rollbackError) {
+          return { ok: false, error: (accepted && accepted.error || "close transaction rejected") +
+            "; persistence rollback failed: " + (rollbackError.message || String(rollbackError)) };
+        }
+        return { ok: false, error: accepted && accepted.error || "close transaction rejected" };
+      }
+      groups.splice(index, 1);
+    }
     broadcast();
     return { ok: true, group: removed };
   }
 
   function dissolveBySession(localId) {
-    var before = groups.length;
-    groups = groups.filter(function (group) { return group.members.indexOf(localId) === -1; });
-    if (groups.length === before) return false;
-    save();
+    var index = groups.findIndex(function (group) { return group.members.indexOf(localId) !== -1; });
+    if (index === -1) return false;
+    var group = groups[index];
+    var normalized = splitRoles.normalizePair(group.pair, group.members);
+    var beforeMembers = group.members.slice();
+    var beforePair = group.pair && Object.assign({}, group.pair);
+    if (beforePair && Array.isArray(beforePair.workerIds)) beforePair.workerIds = beforePair.workerIds.slice();
+    var removed = null;
+    if (normalized.ok && normalized.kind === "versioned" && normalized.driverId !== localId &&
+        normalized.workerIds.length > 1) {
+      var remaining = normalized.workerIds.filter(function (id) { return id !== localId; });
+      group.members = [normalized.driverId].concat(remaining);
+      group.pair = { version: 2, driverId: normalized.driverId, workerIds: remaining };
+    } else {
+      removed = groups.splice(index, 1)[0];
+    }
+    try { save(); }
+    catch (error) {
+      if (removed) groups.splice(index, 0, removed);
+      else { group.members = beforeMembers; group.pair = beforePair; }
+      return false;
+    }
     broadcast();
+    onPairChanged(group);
     return true;
   }
 
@@ -421,6 +386,11 @@ function createSplitGroupStore(opts) {
     var group = groupForMember(localId);
     if (!group) return false;
     var fresh = durableAnchors.memberAnchors(group, sessions);
+    if (fresh && fresh.version === 2) {
+      if (JSON.stringify(fresh) === JSON.stringify(group.memberAnchors || null)) return false;
+      save();
+      return true;
+    }
     var prevCli = Array.isArray(group.memberCliIds) ? group.memberCliIds : [null, null];
     var prevOrigin = Array.isArray(group.memberOriginIds) ? group.memberOriginIds : [null, null];
     if (fresh.cli[0] === prevCli[0] && fresh.cli[1] === prevCli[1] &&
@@ -445,11 +415,54 @@ function createSplitGroupStore(opts) {
     return true;
   }
 
-  load();
+  function removeVersionedGroup(group, hooks) {
+    var index = groups.indexOf(group);
+    if (index === -1) return { ok: false, error: "Split group not found" };
+    groups.splice(index, 1);
+    try { save(); }
+    catch (error) {
+      groups.splice(index, 0, group);
+      return { ok: false, error: error.message || String(error) };
+    }
+    if (hooks && typeof hooks.afterPersist === "function") {
+      groups.splice(index, 0, group);
+      var accepted;
+      try { accepted = hooks.afterPersist(); }
+      catch (error) { accepted = { ok: false, error: error.message || String(error) }; }
+      if (!accepted || accepted.ok === false) {
+        try { save(); }
+        catch (rollbackError) {
+          return { ok: false, error: (accepted && accepted.error || "close transaction rejected") +
+            "; persistence rollback failed: " + (rollbackError.message || String(rollbackError)) };
+        }
+        return { ok: false, error: accepted && accepted.error || "close transaction rejected" };
+      }
+      groups.splice(index, 1);
+    }
+    broadcast();
+    onPairChanged(group);
+    return { ok: true, group: group };
+  }
+  function versionedChanged(group) {
+    broadcast();
+    onPairChanged(group);
+  }
+  var versionedMutations = versionedStore.attachVersionedMutations({
+    sessions: sessions,
+    enabled: versionedEnabled,
+    groups: function () { return groups; },
+    membershipGroup: membershipGroup,
+    save: save,
+    remove: removeVersionedGroup,
+    changed: versionedChanged,
+  });
+  groups = persistence.load();
   return { create: create, createOwned: createOwned, dissolveOwned: dissolveOwned,
     beginOwnedDriverTransfer: beginOwnedDriverTransfer, commitOwnedDriverTransfer: commitOwnedDriverTransfer,
     rollbackOwnedDriverTransfer: rollbackOwnedDriverTransfer,
     rename: rename, setPair: setPair, dissolve: dissolve, dissolveBySession: dissolveBySession,
+    addWorker: versionedMutations.addWorker, replaceWorker: versionedMutations.replaceWorker,
+    removeWorker: versionedMutations.removeWorker,
     refreshAutoName: refreshAutoName, refreshAnchors: refreshAnchors,
     listFor: listFor, groupForMember: groupForMember, get groups() { return groups; } };
 }
@@ -461,13 +474,11 @@ function attachSplitGroups(ctx) {
     usersModule: ctx.usersModule,
     broadcast: broadcast,
     onPairChanged: ctx.onPairChanged,
+    multiWorkerFeature: ctx.multiWorkerFeature,
   });
 
   function sendState(ws) {
     if (!ws) return;
-    // Pane clients need the same owner-scoped pair roles as the parent shell.
-    // The Worker composer lock resolves its role from this projection; hiding
-    // the projection from panes leaves a configured Worker looking editable.
     ctx.sendTo(ws, { type: "split_groups", groups: store.listFor(ws) });
   }
 
@@ -495,5 +506,4 @@ function attachSplitGroups(ctx) {
   return { handleMessage: handleMessage, sendConnectionState: sendState, store: store };
 }
 
-module.exports = { attachSplitGroups: attachSplitGroups, createSplitGroupStore: createSplitGroupStore,
-  autoGroupName: autoGroupName };
+module.exports = { attachSplitGroups: attachSplitGroups, createSplitGroupStore: createSplitGroupStore, autoGroupName: autoGroupName };