dsh-zen-remote 2.0.0 → 2.0.1

package/src/client-data/model-group-side.ts

@@ -0,0 +1,65 @@
+/**
+ * T74: which side of the pairing a model-menu GROUP belongs to, as pure
+ * functions — the readable core of the browser effect
+ * (src/client/effects/model-group-side.ts).
+ *
+ * WHY: the merged catalog (merge-streams.ts mergeModelCatalogs) appends the
+ * server's provider groups everywhere, but a selection only runs on the side
+ * the open session lives on — the interceptor refuses the other side. Through
+ * DSH 0.1.7 every menu group carried its id in `aria-labelledby`
+ * (`<useId>-<group.id>`), so CSS keyed the hiding on the `zr~` prefix (T52).
+ * DSH 0.2.0 renders the groups with the primitives' MenuGroup, whose
+ * `aria-labelledby` is a bare useId — the id is gone — and the same component
+ * renders OTHER menus' groups too, so attribute scoping misfires in both
+ * directions. Classification therefore moved to the one mark every version
+ * renders: virtual group NAMES start with VIRTUAL_GROUP_NAME_MARK
+ * (virtual-id.ts), read off each group's heading text.
+ *
+ * The container rule is what keeps the effect inert wherever it cannot be
+ * sure: a container with not ONE marked heading — the model menu of a
+ * sub-client with no shared models, every other menu on the page, the whole
+ * rest of the page — classifies as `undefined` for every group, which the
+ * effect reads as "leave the DOM alone". Only a container holding at least
+ * one marked heading is decided, and inside it the unmarked groups are
+ * exactly the LOCAL ones: the merged catalog only ever APPENDS virtual
+ * groups to the local list, never mixes them the other way.
+ *
+ * Defensive like the rest of client-data: an empty or missing heading never
+ * counts as a mark, so it can never decide a container by accident.
+ */
+
+import { VIRTUAL_GROUP_NAME_MARK } from '../virtual-id.ts'
+
+/** One group's display description, as the DOM shows it. */
+export interface ModelGroupHeading {
+  /** Groups sharing one container share one key (the effect numbers the
+   * parent elements it scans). */
+  containerKey: number
+  /** The group's heading text ('' when no heading could be found). */
+  headingText: string
+}
+
+/** Per-group verdict, in input order: `remote` for marked headings, `local`
+ * for the rest of a container that has at least one, and `undefined` —
+ * "stamp nothing" — for every group of a container that holds no mark at
+ * all. */
+export type ModelGroupSide = 'remote' | 'local' | undefined
+
+export function classifyModelGroups(groups: readonly ModelGroupHeading[]): ModelGroupSide[] {
+  // Per container: did any heading carry the mark? Containers are decided
+  // independently — one mixed model menu must not turn an all-local
+  // container (a second menu elsewhere on the page) into "hide everything
+  // local" there.
+  const marked = new Map<number, boolean>()
+  for (const group of groups) {
+    const had = marked.get(group.containerKey) ?? false
+    marked.set(group.containerKey, had || group.headingText.startsWith(VIRTUAL_GROUP_NAME_MARK))
+  }
+  return groups.map((group) =>
+    marked.get(group.containerKey)
+      ? group.headingText.startsWith(VIRTUAL_GROUP_NAME_MARK)
+        ? 'remote'
+        : 'local'
+      : undefined,
+  )
+}

package/src/fingerprint.ts

@@ -8,8 +8,10 @@
  * definitions, the server puts its map into the handshake, the client
  * compares group by group, and the settings page lists the differing groups.
  * Identical maps mean fully compatible — the DSH version numbers themselves
- * are deliberately NOT compared (docs/spike-relay.md §2.3: 0.1.7 and 0.2.0
- * share byte-identical remote interfaces, so a version gate would misreject).
+ * are deliberately NOT compared (docs/spike-relay.md §2.3: 0.1.7-rc.2 and
+ * 0.2.0-rc.1 share byte-identical remote interfaces, so a version gate would
+ * misreject; 0.2.0-rc.2 then changed the session group within one minor —
+ * an additive optional field — which a version gate would have missed).
  *
  * What is hashed, per group, in priority order:
  *

package/src/intercept.ts

@@ -57,11 +57,14 @@
  *   `agentId` and `eventId` become `zr~<serverId>~…` virtual ids (those are
  *   the ONLY session ids a forwarded waterfall carries — the request bodies
  *   are tool/question data, verified against dsh-tools/dsh-user-questions),
- *   and the remote `ready`/`emit` frames are DROPPED: the client face of the
+ *   and the remote `ready`/`emit` frames are DROPPED — except, since T75, a
+ *   shared session's `api-session/status` emit, which crosses with its
+ *   session id virtualized (the one share-scoped emit; every other emit
+ *   broadcasts server-wide state the UI must not mistake for local
+ *   sessions). The client face of the
  *   gateway (dsh-api-gateway lib/client.js) accepts a ready frame only as
- *   the FIRST frame of the stream and would fail the stream on a second one,
- *   and emit events broadcast server-wide state the UI must not mistake for
- *   local sessions. Prompts this leg showed are closed when the leg dies —
+ *   the FIRST frame of the stream and would fail the stream on a second one.
+ *   Prompts this leg showed are closed when the leg dies —
  *   each gets a synthesized `cancel` — so a disconnect cannot leave an
  *   approval on screen that no server can settle anymore (T32-fix).
  * - `dispatchRpc('$events/result', …)` splits on the eventId: a virtual id
@@ -668,6 +671,14 @@ interface ForwardableCancelFrame extends Record<string, unknown> {
   eventId: string
 }
 
+/** T75: the one emit this client shows the UI (T75 — the server forwards no
+ * other). Same shape the server's own gate proved before forwarding. */
+interface ForwardableStatusEmitFrame extends Record<string, unknown> {
+  type: 'emit'
+  event: 'api-session/status'
+  args: [string, boolean]
+}
+
 function isForwardableWaterfall(frame: Record<string, unknown>): frame is ForwardableWaterfallFrame {
   return (
     Reflect.ownKeys(frame).length === 5 &&
@@ -690,6 +701,18 @@ function isForwardableCancel(frame: Record<string, unknown>): frame is Forwardab
   )
 }
 
+function isForwardableStatusEmit(frame: Record<string, unknown>): frame is ForwardableStatusEmitFrame {
+  return (
+    Reflect.ownKeys(frame).length === 3 &&
+    ['type', 'event', 'args'].every((key) => Object.hasOwn(frame, key)) &&
+    frame.event === 'api-session/status' &&
+    Array.isArray(frame.args) &&
+    frame.args.length === 2 &&
+    isEventId(frame.args[0]) &&
+    typeof frame.args[1] === 'boolean'
+  )
+}
+
 function messageOf(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
 }
@@ -1116,11 +1139,18 @@ export function rewriteResult(endpoint: string, value: unknown, serverId: string
  *   whole thing in `zr~<serverId>~`.
  * - `cancel`: `{type, eventId}` — the correlation id goes virtual so the UI
  *   can match it against the waterfall it showed and close the prompt.
- * - everything else — `ready`, `emit`, non-objects, unknown types, and any
- *   waterfall/cancel failing the client face's exact-keys shape — is
- *   DROPPED (T32-fix2 mirrors the server side). `ready` and `emit` carry
- *   facts the UI must never see (the local stream opened with ITS ready
- *   frame; emit broadcasts server-wide state); a malformed frame that
+ * - `emit`: dropped, with ONE exception (T75) — a well-formed
+ *   `api-session/status` frame (the only emit the server forwards, and only
+ *   for accessible sessions) has its `args[0]` session id virtualized and
+ *   its `args[1]` running flag passed through, so the UI's
+ *   `api-session/status` listener keeps the remote session's running state
+ *   in step with the host's (RT dsh-api-session-controller lib/client.js
+ *   `handleSessionStatus`).
+ * - everything else — `ready`, non-status emits, non-objects, unknown
+ *   types, and any frame failing the client face's exact-keys shape — is
+ *   DROPPED (T32-fix2 mirrors the server side). `ready` and the other emits
+ *   carry facts the UI must never see (the local stream opened with ITS
+ *   ready frame; emits broadcast server-wide state); a malformed frame that
  *   slipped through would fail `parseRemoteEventFrame` and take the UI's
  *   whole `$events` generation down with it, failing and reconnecting in a
  *   loop. Mirrors the server's own forwardable-shape gate, so the two ends
@@ -1130,7 +1160,10 @@ export function rewriteRemoteEventFrame(frame: unknown, serverId: string): unkno
   const virtualize = (id: string): string => toVirtual(serverId, id)
   if (!isPlainObject(frame)) return null
   if (frame.type === 'ready') return null
-  if (frame.type === 'emit') return null
+  if (frame.type === 'emit') {
+    if (!isForwardableStatusEmit(frame)) return null
+    return { type: 'emit', event: frame.event, args: [virtualize(frame.args[0]), frame.args[1]] }
+  }
   if (frame.type === 'waterfall') {
     if (!isForwardableWaterfall(frame)) return null
     return { ...frame, eventId: virtualize(frame.eventId), agentId: virtualize(frame.agentId) }
@@ -1791,6 +1824,17 @@ interface MergedEventsStreamDeps {
  * id the server did not return is retried on a 2s/10s backoff at most
  * twice before it counts as asked for good (a tombstone triggers at most
  * three syncs), and a fresh serving period clears the bookkeeping.
+ *
+ * T75 adds the serving-period STATUS sync: the UI's `session.running` for a
+ * remote session updates only on the forwarded `api-session/status` emit
+ * (RT dsh-api-session-controller lib/client.js `handleSessionStatus`) and
+ * the list summaries — so every flip inside an offline window was lost, and
+ * a session that ended (or started) while the link was down kept its stale
+ * badge until the next page load. Every new serving period now re-pulls the
+ * list once and pushes one synthesized status frame per row (see
+ * {@link runStatusSync}), guarded against overwriting a real-time frame
+ * that landed mid-fetch, and gated on the local `ready` like every
+ * synthesized frame.
  */
 async function* mergedEventsStream(deps: MergedEventsStreamDeps): AsyncGenerator<unknown, void, undefined> {
   const { local, relay, signal, recordFailure, log, clock } = deps
@@ -1969,6 +2013,90 @@ async function* mergedEventsStream(deps: MergedEventsStreamDeps): AsyncGenerator
     if (!ids.some((id) => !announced.has(id) && !askedForGood.has(id) && !retryAt.has(id))) return
     runSummarySync(ids)
   }
+  // T75 status-sync bookkeeping. `statusSeq` is a monotonic counter over
+  // status facts; `liveStatusSeq` maps session id → the seq of the newest
+  // REAL-TIME status frame the leg delivered since the in-flight fetch began
+  // (cleared at each fetch start, so it only ever holds frames NEWER than
+  // the snapshot being fetched — exactly the ids the snapshot must not
+  // overwrite). `deferred*`/`pending*` mirror the summary sync's gates: the
+  // local `ready` must come first, and a serving period that began while a
+  // fetch ran gets its own round once that fetch lands.
+  let statusSeq = 0
+  const liveStatusSeq = new Map<string, number>()
+  let statusSyncInFlight = false
+  let pendingStatusSync = false
+  let deferredStatusSync = false
+  /**
+   * T75: fetch the server's `session/list` once and push one synthesized
+   * `api-session/status` emit per row (args `[virtualId, row.running]`) — a
+   * NEW serving period's re-sync, because the status flips that happened
+   * while the relay was offline never traveled (the forwarded status emit
+   * only exists while the leg is up, and `runSummarySync`'s one-time row
+   * announcement is deduped by `announced`, so the running flags the UI
+   * holds would stay frozen at page-load state). Runs beside the summary
+   * sync per serving period (its own fetch: the summary round is nudge-
+   * driven and announce-deduped, and bolting a status mode onto it would
+   * tangle both features' bookkeeping for one saved request), gated on the
+   * local `ready` like every synthesized frame, and a failure is
+   * diagnostics only — the next serving period retries.
+   */
+  const runStatusSync = (): void => {
+    if (!alive) return
+    if (!localOpened) {
+      deferredStatusSync = true
+      return
+    }
+    if (statusSyncInFlight) {
+      pendingStatusSync = true
+      return
+    }
+    const identity = relayIdentityOf(relay)
+    if (identity === undefined || relay.state !== 'online') return
+    statusSyncInFlight = true
+    // The race guard arms HERE: only frames arriving after this point
+    // outrank the snapshot (anything older predates the fetch and is stale
+    // relative to it).
+    liveStatusSeq.clear()
+    const startSeq = ++statusSeq
+    // The wire shape is the host descriptor's (see runSummarySync — one
+    // strict `{ _request: {} }` parameter).
+    void relay.invoke('session', 'list', { _request: {} }, undefined).then(
+      (value) => {
+        statusSyncInFlight = false
+        if (!alive) return
+        const rows = isPlainObject(value) && Array.isArray(value.items) ? value.items : []
+        for (const row of rows) {
+          if (!isPlainObject(row) || typeof row.sessionId !== 'string' || row.sessionId === '') continue
+          // A real-time frame that landed while this fetch ran is fresher
+          // than the snapshot — never overwrite it (T75 race guard).
+          if ((liveStatusSeq.get(row.sessionId) ?? 0) > startSeq) continue
+          channel.push({
+            type: 'emit',
+            event: 'api-session/status',
+            args: [toVirtual(identity.serverId, row.sessionId), row.running === true],
+          })
+        }
+        // The serving period that queued mid-fetch is still unserved by THIS
+        // round (its snapshot predates it) — its own round runs now.
+        if (pendingStatusSync) {
+          pendingStatusSync = false
+          runStatusSync()
+        }
+      },
+      (error: unknown) => {
+        statusSyncInFlight = false
+        if (!alive) return
+        recordFailure('session/list', error instanceof RelayError ? error.code : 'internal')
+        // The queued serving period survives a failed fetch: it is still
+        // unserved, and one retry now beats waiting for the next period
+        // (bounded — no fetch runs while the relay is offline).
+        if (pendingStatusSync) {
+          pendingStatusSync = false
+          runStatusSync()
+        }
+      },
+    )
+  }
   const noteOnlineIdentity = (identity: MergerIdentity, firstOnline: boolean): void => {
     const key = `${identity.serverId}\u0000${identity.serverName}`
     if (!firstOnline && key === refreshKey) return
@@ -1986,6 +2114,10 @@ async function* mergedEventsStream(deps: MergedEventsStreamDeps): AsyncGenerator
         clock.clearTimeout(retryTimer)
         retryTimer = undefined
       }
+      // T75: a new serving period re-syncs RUNNING state too — the flips
+      // that happened inside the offline window never traveled, so every
+      // row's running flag is re-pushed from a fresh snapshot.
+      runStatusSync()
     }
     // T63: a NEW serving period is the page-load hole closing — the UI's
     // one list pull already ran (relay offline), so announce the rows now.
@@ -2079,6 +2211,12 @@ async function* mergedEventsStream(deps: MergedEventsStreamDeps): AsyncGenerator
             deferredSummarySync = false
             runSummarySync(pendingBatch)
           }
+          // T75: same rule for the status sync — a serving period that began
+          // before the ready runs its re-sync now, never before the ready.
+          if (deferredStatusSync) {
+            deferredStatusSync = false
+            runStatusSync()
+          }
         }
       }
     } catch (error) {
@@ -2127,6 +2265,16 @@ async function* mergedEventsStream(deps: MergedEventsStreamDeps): AsyncGenerator
             }
             const rewritten = rewriteRemoteEventFrame(frame, identity.serverId)
             if (rewritten === null) continue
+            // T75: a REAL-TIME status frame outranks any list snapshot a
+            // status sync may still be fetching — record it (keyed by the
+            // ORIGINAL id, the same ids the list rows carry) so the sync's
+            // answer cannot overwrite it with stale data. Status frames
+            // carry no eventId, so the orphan-close bookkeeping below is
+            // untouched.
+            if (isPlainObject(frame) && frame.type === 'emit' && frame.event === 'api-session/status') {
+              const rowId = Array.isArray(frame.args) ? frame.args[0] : undefined
+              if (typeof rowId === 'string' && rowId !== '') liveStatusSeq.set(rowId, ++statusSeq)
+            }
             // The orphan-close bookkeeping rides the two id-carrying frame
             // types: waterfalls enter the record (once per leg — a repeat
             // is not re-shown), cancels leave it.

package/src/merge-streams.ts

@@ -142,7 +142,7 @@
  * `zr~<serverId>~provider/model` fallback string (the pre-fix2 display).
  */
 
-import { fromVirtual, isVirtual, toVirtual } from './virtual-id.js'
+import { fromVirtual, isVirtual, toVirtual, VIRTUAL_GROUP_NAME_MARK } from './virtual-id.js'
 
 /** The (serverId, serverName) pair a merger virtualizes with. A re-handshake
  * with a different server retargets the SAME merger ({@link retarget}) so the
@@ -1119,8 +1119,13 @@ export function mergeSessionList(localResult: unknown, remoteResult: unknown, se
  *   order, RT dsh-client-ui-model-selection lib/client.js:510 — appended
  *   groups render last); each group id becomes the virtual group id
  *   `zr~<serverId>~<original>` and its name is prefixed
- *   `${serverName} · ${name}` — the same workspace title discipline the
- *   merger uses;
+ *   `${VIRTUAL_GROUP_NAME_MARK}${serverName} · ${name}` — the same workspace
+ *   title discipline the merger uses, PLUS the invisible WORD JOINER (T74):
+ *   the model menu's groups stopped carrying their id in the markup (0.2.0's
+ *   MenuGroup renders `aria-labelledby={useId()}` only), so the browser
+ *   classifies menu groups by this heading prefix instead
+ *   (client-data/model-group-side.ts). The sidebar's workspace TITLES stay
+ *   unmarked — those groups are keyed by their `zr~` row ids;
  * - `default` and `failures` stay LOCAL untouched: the default drives what a
  *   blank LOCAL session would run (a remote session's current model comes
  *   from its projection instead), and the UI renders every failure as a
@@ -1159,7 +1164,9 @@ export function mergeModelCatalogs(localValue: unknown, remoteValue: unknown, id
     virtualGroups.push({
       ...group,
       id,
-      ...(typeof group.name === 'string' ? { name: `${identity.serverName} · ${group.name}` } : {}),
+      ...(typeof group.name === 'string'
+        ? { name: `${VIRTUAL_GROUP_NAME_MARK}${identity.serverName} · ${group.name}` }
+        : {}),
     })
   }
   if (virtualGroups.length === 0) return localValue

package/src/relay-access.ts

@@ -176,9 +176,12 @@ interface RelayMethod {
   resultFilter?: InvokeFilter
   /** The one EVENT-FORWARDING entry (T32, `$zr/events`): the stream route
    * opens the gateway's `$events` wire stream (never `gw.stream`, spike §2.1
-   * 坑 1) and filters frames by the waterfall's `agentId`; the answer route
-   * matches `eventId`s against what was forwarded. Like the global reads it
-   * claims no session field — access is judged per frame / per answer. */
+   * 坑 1) and filters frames per frame — waterfalls by the `agentId`, and
+   * since T75 the one forwardable emit (`api-session/status`) by the
+   * session id in `args[0]`; every other emit is server-wide state and is
+   * dropped. The answer route matches `eventId`s against what was
+   * forwarded. Like the global reads it claims no session field — access is
+   * judged per frame / per answer. */
   events?: true
 }
 

package/src/relay-server.ts

@@ -399,6 +399,21 @@ interface ForwardableCancelFrame extends Record<string, unknown> {
   eventId: string
 }
 
+/**
+ * T75: the ONE emit shape the relay forwards — a single session's
+ * running-state flip (`api-session/status`), exactly what the host emits on
+ * `agent/status` (RT dsh-api-session-controller lib/index.js:2884-2886:
+ * `ctx.emit("api-session/status", agent.id, status === "running")`), carried
+ * on the wire as the client face's exact-keys emit with a JSON-array `args`
+ * (RT dsh-api-gateway lib/index.js:846-853 builds `{type, event, args}`;
+ * lib/client.js `parseRemoteEventFrame` demands that shape back).
+ */
+interface ForwardableStatusEmitFrame extends Record<string, unknown> {
+  type: 'emit'
+  event: 'api-session/status'
+  args: [string, boolean]
+}
+
 function isForwardableWaterfall(frame: Record<string, unknown>): frame is ForwardableWaterfallFrame {
   return (
     Reflect.ownKeys(frame).length === 5 &&
@@ -421,6 +436,18 @@ function isForwardableCancel(frame: Record<string, unknown>): frame is Forwardab
   )
 }
 
+function isForwardableStatusEmit(frame: Record<string, unknown>): frame is ForwardableStatusEmitFrame {
+  return (
+    Reflect.ownKeys(frame).length === 3 &&
+    ['type', 'event', 'args'].every((key) => Object.hasOwn(frame, key)) &&
+    frame.event === 'api-session/status' &&
+    Array.isArray(frame.args) &&
+    frame.args.length === 2 &&
+    isEventId(frame.args[0]) &&
+    typeof frame.args[1] === 'boolean'
+  )
+}
+
 /**
  * Constant-time secret comparison. Different lengths are trivially unequal
  * (timingSafeEqual itself throws on that); an empty configured secret refuses
@@ -867,17 +894,22 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
    * - CANCEL frames are forwarded only for events this subscription
    *   forwarded (an unshared session's activity timeline must not leak
    *   through cancels), and the entry goes with the forward.
-   * - EMIT frames are dropped entirely (T32-fix): they carry server-wide
-   *   state (`api-session/added` summaries and titles, account expirations,
-   *   cordis chatter) that is not share-scoped — forwarding them would leak
-   *   unshared sessions and feed the sub-client ids it would treat as
-   *   local. Everything a sub-client needs about a session's state travels
-   *   the workspace/control streams, which ARE share-filtered.
-   * - Anything not shaped exactly like a forwardable waterfall or cancel
-   *   (T32-fix2, mirroring the client face's `parseRemoteEventFrame`
-   *   exact-keys validation) is dropped too: a frame that slipped through
-   *   would fail the sub-client's whole `$events` generation and leave it
-   *   failing and reconnecting in a loop.
+   * - EMIT frames are dropped, with ONE exception (T75): a
+   *   `api-session/status` emit whose `args[0]` names an accessible session
+   *   crosses as a fresh `{type, event, args:[id, running]}` — it is the
+   *   only share-SCOPED emit the host produces (one session's running flip,
+   *   judged per frame by `isAccessible` like a waterfall's `agentId`).
+   *   Every other emit is server-wide state (`api-session/added` summaries
+   *   and titles, account expirations, cordis chatter) that is not
+   *   share-scoped: forwarding it would leak unshared sessions and feed the
+   *   sub-client ids it would treat as local. Everything else a sub-client
+   *   needs about a session's state travels the workspace/control streams,
+   *   which ARE share-filtered.
+   * - Anything not shaped exactly like a forwardable waterfall, cancel, or
+   *   status emit (T32-fix2, mirroring the client face's
+   *   `parseRemoteEventFrame` exact-keys validation) is dropped too: a frame
+   *   that slipped through would fail the sub-client's whole `$events`
+   *   generation and leave it failing and reconnecting in a loop.
    *
    * DROPPED DELIVERIES STAY PENDING (T32-fix2): a dropped waterfall used to
    * be abstained `next` on behalf. That is gone on purpose. DSH's `next`
@@ -917,6 +949,12 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
       sub.events.delete(frame.eventId)
       return { ...frame, eventId: `${sub.token}.${frame.eventId}` }
     }
+    if (frame.type === 'emit') {
+      // T75: the one share-scoped emit. A NEW frame with a fresh args array
+      // leaves — never the host's object itself.
+      if (!isForwardableStatusEmit(frame) || !isAccessible(frame.args[0])) return null
+      return { type: 'emit', event: frame.event, args: [frame.args[0], frame.args[1]] }
+    }
     return null
   }
 

package/src/virtual-id.ts

@@ -20,6 +20,21 @@
 /** The fixed prefix every virtual id starts with. */
 export const VIRTUAL_ID_PREFIX = 'zr~'
 
+/**
+ * The invisible WORD JOINER (U+2060) every virtual GROUP NAME starts with
+ * (T74). DSH 0.2.0 renders the model menu's provider groups with the
+ * primitives' MenuGroup, whose `aria-labelledby` carries only a useId — the
+ * group id is gone from the markup — so the browser half can no longer tell
+ * a virtual group from a local one by attribute. The merged catalog's group
+ * NAME (merge-streams.ts mergeModelCatalogs) is the one mark that survives
+ * in both 0.1.7 and 0.2.0, and effects/model-group-side.ts classifies each
+ * group container by which headings start with it. Zero-width: headings
+ * read exactly as before. Sidebar workspace TITLES deliberately do NOT
+ * carry it — those groups are told apart by their `zr~` row ids, not by
+ * text.
+ */
+export const VIRTUAL_GROUP_NAME_MARK = '\u2060'
+
 /** The server id half: exactly the 8 lowercase hex chars relay-server.ts
  * mints (`randomBytes(4).toString('hex')`). */
 const SERVER_ID_PATTERN = /^[0-9a-f]{8}$/