@volter/supercode-orchestrator 0.5.205 → 0.5.206

package/mcp/mount.mjs

@@ -35,11 +35,12 @@ const ORCHESTRATOR_BIN = resolve(dirname(fileURLToPath(import.meta.url)), '../bi
  * `rh2` server, whatever it holds, is neither replaced nor relied on). */
 export const RH2_AGENT_SERVER = 'rh2-agent';
 
-/** `rh2 mcp` run as `agent`'s installed RH2 principal: `apps mcp` puts the record's origin, organization and token in
- * its environment, so no config file carries the token. Null when no rh2-agent is installed for it. */
-function rh2AgentServer(root, agent, program) {
-  if (!installedAgentRecord(root, agent)) return null;
-  return { command: program, args: [ORCHESTRATOR_BIN, 'apps', 'mcp', 'rh2-agent', '--root', root, '--profile', agent] };
+/** `rh2 mcp` run as the agent's installed RH2 principal: `apps mcp` puts the record's origin, organization and token in
+ * its environment, so no config file carries the token. Null when no rh2-agent record is the identity of `agentId` (its
+ * Teams id): a record is found by that id alone, so an agent sharing another's name is never mounted with its record. */
+function rh2AgentServer(root, agentId, program) {
+  if (!installedAgentRecord(root, agentId)) return null;
+  return { command: program, args: [ORCHESTRATOR_BIN, 'apps', 'mcp', 'rh2-agent', '--root', root, '--agent', agentId] };
 }
 
 const slug = (surfaceKey) => (surfaceKey ? String(surfaceKey).replace(/[^A-Za-z0-9_-]+/g, '-').replace(/^-+|-+$/g, '') || 'session' : 'session');
@@ -56,18 +57,18 @@ const slug = (surfaceKey) => (surfaceKey ? String(surfaceKey).replace(/[^A-Za-z0
  * @param {string} [o.socketPath]   defaults to `<root>/orchestrator.sock`
  * @param {string} [o.serverPath]   defaults to this package's `mcp/server.mjs`
  * @param {string} [o.program]      the interpreter, defaults to this node
- * @param {string|null} [o.agent]   the agent whose own session this is (its name), whose installed rh2-agent is mounted
- *                                  beside; null for a worker acting for an agent
+ * @param {string|null} [o.agentId] the Teams id of the agent whose own session this is, whose installed rh2-agent is
+ *                                  mounted beside; null for a worker acting for an agent
  * @returns {{door: string, ran: string, launch: object|undefined, mcp_servers: object[]|null, path: string|null}}
  */
-export function mountOrchestratorMcp({ root, profile, harness, surfaceKey = null, launch, socketPath, serverPath = SERVER_PATH, program = process.execPath, vault = new Map(), task = null, agent = null }) {
+export function mountOrchestratorMcp({ root, profile, harness, surfaceKey = null, launch, socketPath, serverPath = SERVER_PATH, program = process.execPath, vault = new Map(), task = null, agentId = null }) {
   const door = doorFor(harness);
   // the profile's own servers (`.mcp.json`, the workers' form; docs/plans/hermes-compat.md row 4), mounted
   // beside this one through the same door, `${VAR}` resolved from the profile's vault
   const own = resolveServers(mcpServers(profile.dir), vault);
   // an agent the RH2 organization declares acts there as its own principal, through its installed record (ADR 0017),
   // not through whatever `rh2` the machine's user configured; a profile's own `rh2-agent` entry wins
-  const rh2 = own[RH2_AGENT_SERVER] ? null : rh2AgentServer(root, agent, program);
+  const rh2 = own[RH2_AGENT_SERVER] ? null : rh2AgentServer(root, agentId, program);
   if (rh2) own[RH2_AGENT_SERVER] = rh2;
   const sock = socketPath ?? socketPathFor(root);
   const home = join(profile.dir, harness);

package/ontology.d.ts

@@ -389,6 +389,21 @@ export type FireStatus =
   /** The scheduler restarted under it. */
   | 'unknown';
 
+/** Observations a role can subscribe to, separate from a card's transition events. */
+export type FleetEventKind =
+  /** A native session process first observed running. */
+  | 'session_started'
+  /** A known native session observed running in a new process incarnation. */
+  | 'session_resumed'
+  /** A native source reports a session process ended; unavailable sources are not ends. */
+  | 'session_ended'
+  /** More than one observed live process incarnation names the same native session. */
+  | 'duplicate_session_process'
+  /** A card's native session reports that it needs its user's input. */
+  | 'card_waiting_on_user'
+  /** A machine's health source reports a critical alarm. */
+  | 'machine_health_crit';
+
 /** A conversation moved (or moving) to another surface — Hermes `handoff_*`. */
 export interface Handoff {
   /** The destination platform. */
@@ -721,6 +736,23 @@ export interface Reserve {
 /** Unmodeled source fields, keyed by the source's own field name. */
 export type Residue = Record<string, unknown>;
 
+/**
+ * One role's fleet listeners, written under `workflow.yaml` `listeners.<role>`.
+ * Mailboxes are explicit, preferably stable `sc:<machine>:agent:<role>` addresses;
+ * session addresses remain valid destinations but do not follow a replacement main.
+ */
+export interface RoleFleetListener {
+  /** The observed kinds this role receives; a nonempty list. */
+  events: FleetEventKind[];
+  /** The role's full mail addresses; a nonempty list. Existing mail authority still applies. */
+  addresses: string[];
+  /**
+   * Normalized machine names to hear; absent means every machine the runtime may read.
+   * An empty list deliberately hears none.
+   */
+  machines?: string[] | null;
+}
+
 /** One route. */
 export interface Route {
   /** Optional name. */
@@ -1102,6 +1134,11 @@ export interface Workflow {
   params?: Record<string, unknown>;
   /** Who acts on a card, each an expression naming a profile (`implementer: card.assignee`) or a person. */
   roles?: Record<string, Expr>;
+  /**
+   * Opt-in fleet observations delivered as mail to each role's declared addresses. These are not card
+   * transitions and grant no observation or machine authority. The manager is an implicit workflow role.
+   */
+  listeners?: Record<string, RoleFleetListener>;
   /** Where a new card starts: the first transition whose guard holds. */
   initial: Transition[];
   /** Every status, by name. */

package/operator.mjs

@@ -29,19 +29,21 @@
 //    look like a silent no-op.
 
 import { existsSync, mkdirSync, renameSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
 import { join } from 'node:path';
 import { keyFromString, parseSchedule } from './mcp/verbs.mjs';
 import { emptyProfile, parseTarget, renderTarget, surfaceKeyString, decodeContextFrom } from './ir.mjs';
-import { liveBinding } from './reducer.mjs';
+import { launchKeyString, liveBinding } from './reducer.mjs';
 import { compactStamp, gateFields, homeZone, nextRunAt, payloadError } from './cron.mjs';
 import * as events from './events.mjs';
-import { modelError } from './activation.mjs';
+import { activationCwd, modelError } from './activation.mjs';
 
 /** Every op the operator door answers, in §4.6 order. */
 export const OPERATOR_OPS = Object.freeze([
   'jobs.create', 'jobs.update', 'jobs.pause', 'jobs.resume', 'jobs.run', 'jobs.delete',
   'profiles.create', 'profiles.delete',
   'sessions.new', 'sessions.reset',
+  'sessions.launch', 'sessions.launch_status', 'sessions.launch_close',
   'access.pair_approve',
   'agents.fork',
 ]);
@@ -49,7 +51,7 @@ export const OPERATOR_OPS = Object.freeze([
 /** Where a deleted profile folder is renamed to, relative to the root. */
 export const TRASH_DIR = 'profiles/.trash';
 
-class Refused extends Error {}
+class Refused extends Error { constructor(message, code) { super(message); this.code = code; } }
 
 /**
  * Perform the reducer's `remove_profile_dir` effect (the ONLY effect this door
@@ -272,6 +274,9 @@ export async function applyOperator(state, op, args = {}, profileName = 'default
   }
   const send = async (verb, verbArgs, target = profileName) => {
     const effects = (await dispatch(events.operator({ verb, profile: target, args: verbArgs, at: now }))) ?? [];
+    // An explicit refusal (a launch's key held by another launch, a spent budget, no worker) names its code.
+    const refused = effects.find((e) => e.type === 'refused');
+    if (refused) throw new Refused(refused.message, refused.code);
     const refusal = refusalIn(effects);
     if (refusal) throw new Refused(refusal);
     return effects;
@@ -279,10 +284,58 @@ export async function applyOperator(state, op, args = {}, profileName = 'default
   try {
     return { ok: true, result: await run(state, profile, op, args ?? {}, now, send) };
   } catch (error) {
-    return { ok: false, error: error.message };
+    return { ok: false, error: error.message, ...(error instanceof Refused && error.code ? { code: error.code } : {}) };
   }
 }
 
+/** Where a launch stands: starting (no session yet), running (its native session named), or ended (and why); the agent
+ * it is for. A key no launch used reads as unknown. */
+function launchView(state, key) {
+  const keyString = launchKeyString(String(key));
+  // The home's launches, whichever profile holds the key: a key another agent's launch holds reads as that launch.
+  const slots = Object.values(state.profiles).flatMap((profile) => Object.entries(profile.bindings).filter(([slot]) => slot === keyString || slot.startsWith(`${keyString}#`)).map(([, binding]) => binding));
+  const binding = slots.find((each) => !each.ended_at) ?? slots.sort((a, b) => String(b.ended_at).localeCompare(String(a.ended_at)))[0];
+  if (!binding) return endedLaunch(state, key, keyString) ?? { key, state: 'unknown' };
+  const native = binding.worker?.session_id && binding.worker.session_id !== `launch_${key}` ? binding.worker.session_id : null;
+  return { key, agent_id: binding.residue?.launch_agent ?? null, harness: binding.worker?.harness ?? null, native_session: native,
+    state: binding.ended_at ? 'ended' : native ? 'running' : 'starting', end_reason: binding.end_reason ?? null,
+    // the words it ended with (a start that failed says why), kept on the session record
+    end_detail: binding.residue?.end_detail ?? null, started_at: binding.started_at,
+    // the folder its worker runs in (activationCwd), which a Teams sync root must cover for Teams to capture it
+    cwd: state.profiles[binding.agent] ? activationCwd(state.profiles[binding.agent]) : null,
+    // the orchestrator's own last word from or to it, beside what Teams captured
+    last_activity_at: binding.last_activity_at ?? null };
+}
+
+/**
+ * A launch no longer held in memory (a daemon restarted since it ended), read from the ended sessions the folder keeps:
+ * each profile's `state.db` table `supercode_ended_sessions` (codec/folder.rs write_ended), its latest row for the key.
+ * Read only. A store that cannot be read fails the read, never answers `unknown` (which a caller takes as no launch).
+ */
+function endedLaunch(state, key, keyString) {
+  let row = null;
+  for (const profile of Object.values(state.profiles)) {
+    const path = profile?.dir ? join(profile.dir, 'state.db') : null;
+    if (!path || !existsSync(path)) continue;
+    let db;
+    try {
+      db = new DatabaseSync(path, { readOnly: true });
+      if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='supercode_ended_sessions'").get()) continue;
+      // the key's own slot, or one of its ended slots (`<key>#<started_at>[#n]`: '#' then '$' bounds that range)
+      for (const each of db.prepare('SELECT * FROM supercode_ended_sessions WHERE slot = ? OR (slot >= ? AND slot < ?)').all(keyString, `${keyString}#`, `${keyString}$`)) {
+        if (!row || String(each.ended_at) > String(row.ended_at)) row = each;
+      }
+    } catch (error) {
+      throw new Error(`launch ${key}: the ended sessions of profile ${profile.name} could not be read (${path}: ${error.message})`);
+    } finally { db?.close(); }
+  }
+  if (!row) return null;
+  const native = row.session_id && row.session_id !== `launch_${key}` ? row.session_id : null;
+  return { key, agent_id: row.launch_agent ?? null, harness: row.harness ?? null, native_session: native, state: 'ended',
+    end_reason: row.end_reason ?? null, end_detail: row.end_detail ?? null, started_at: row.started_at ?? null, cwd: null,
+    last_activity_at: null };
+}
+
 async function run(state, profile, op, args, now, send) {
   switch (op) {
     case 'jobs.create': {
@@ -362,6 +415,21 @@ async function run(state, profile, op, args, now, send) {
       return { ran: `removed profile ${name}; its folder was moved into ${TRASH_DIR}/`, name, profile: null, deleted: true };
     }
 
+    // A concurrent session of this profile's agent, started on request (README § The operator door): the bridge checks
+    // the agent and composes the first input; `launch_status` reads where it stands, `launch_close` ends it.
+    case 'sessions.launch': {
+      await send('session_launch', { key: args.key, agent_id: args.agent_id, input: args.input });
+      return { ran: `launch ${args.key} of agent ${args.agent_id} in profile ${profile.name}`, ...launchView(state, args.key) };
+    }
+    case 'sessions.launch_status': {
+      if (typeof args.key !== 'string' || !args.key) throw new Error('sessions.launch_status needs the launch key');
+      return { ran: `launch ${args.key}`, ...launchView(state, args.key) };
+    }
+    case 'sessions.launch_close': {
+      if (typeof args.key !== 'string' || !args.key) throw new Error('sessions.launch_close needs the launch key');
+      await send('session_launch_end', { key: args.key, reason: typeof args.reason === 'string' ? args.reason.slice(0, 200) : 'closed' });
+      return { ran: `closed launch ${args.key}`, ...launchView(state, args.key) };
+    }
     case 'sessions.new':
     case 'sessions.reset': {
       const surface = String(args.surface ?? '').trim();

package/orchestration.mjs

@@ -163,9 +163,14 @@ export async function read(root) {
   return (await through((d) => d.orchestrationLoad({ root }))).orchestration;
 }
 
-/** `save(state, root)` — our folder, canonical and byte-stable: an artifact whose record has not changed keeps its bytes. */
+/**
+ * `save(state, root)` — our folder, canonical and byte-stable: an artifact whose record has not changed keeps its bytes.
+ * Answers the entries the door could not read (`rejected`, each `{ collection, key, reason, kept_stored }`): each was
+ * written as the home last held it, or left out when it held none, and none refuses the rest of the save.
+ */
 export async function save(state, root = state.root) {
-  await through((d) => d.orchestrationSave({ root, orchestration: persistedView(state) }));
+  const saved = await through((d) => d.orchestrationSave({ root, orchestration: persistedView(state) }));
+  return { rejected: Array.isArray(saved?.rejected) ? saved.rejected : [] };
 }
 
 /** Another harness's home as a state value (no secret value; `vault_keys` names the `.env` keys it would need). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.205",
+  "version": "0.5.206",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -13,6 +13,10 @@
       "import": "./index.mjs"
     },
     "./bin": "./bin/orchestrator.mjs",
+    "./board-input": {
+      "types": "./board-input.d.ts",
+      "import": "./board-input.mjs"
+    },
     "./apply": {
       "types": "./apply/index.d.ts",
       "import": "./apply/index.mjs"
@@ -28,10 +32,10 @@
     "check-types": "node scripts/generate-types.mjs --check"
   },
   "dependencies": {
-    "@volter/supercode-teams": "^0.3.337",
-    "@volter/supercode-terminal": "^0.3.8",
-    "@volter/supercode-harness-sdk": "^0.3.102",
-    "@volter/teams": "0.2.94",
+    "@volter/supercode-teams": "^0.3.343",
+    "@volter/supercode-terminal": "^0.3.9",
+    "@volter/supercode-harness-sdk": "^0.3.103",
+    "@volter/teams": "0.2.95",
     "@volter/ztrack": "^2.4.23",
     "yaml": "^2.9.0"
   },

package/reducer.mjs

@@ -6,7 +6,7 @@
 // effects (§5). It never performs I/O and imports no node module: the test
 // suite asserts that statically. Time comes from the event's `at`.
 
-import { surfaceKeyString, renderSurfaceKey, resolveRoute, sessionReset, homeChannel } from './ir.mjs';
+import { END_REASONS, surfaceKeyString, renderSurfaceKey, resolveRoute, sessionReset, homeChannel } from './ir.mjs';
 import { parseCommand, frame, REPLY } from './commands.mjs';
 import { cronTick, gateResult, fireFinal, fireFailed, finishHostedFire, homeZone, isSynthetic, nextRunAt, scheduleError, unattendedRequest } from './cron.mjs';
 import { handleWebhook } from './webhook.mjs';
@@ -88,12 +88,24 @@ export function accessPolicy(profile, platform) {
 }
 
 
-export function endBinding(state, profileName, keyString, reason, now, effects) {
+/**
+ * End the live binding at `keyString`. `reason` is why, as one of END_REASONS: the store refuses any other word, and a
+ * binding stored with one would refuse every later save of its home. `detail` is the free text of the cause (a worker's
+ * exit, a caller's own words), kept in the binding's residue as `end_detail`. A word that is not an end reason is never
+ * stored: the binding ends as `error`, the word goes to `end_detail`, and the log names the caller's mistake.
+ */
+export function endBinding(state, profileName, keyString, reason, now, effects, detail = null) {
   const profile = state.profiles[profileName];
   const b = profile.bindings[keyString];
   if (!b || b.ended_at) return;
+  if (!END_REASONS.has(reason)) {
+    effects.push({ type: 'log', level: 'warn', message: `session ${keyString} in profile ${profileName}: ${JSON.stringify(String(reason)).slice(0, 200)} is not an end reason; it ends as error` });
+    detail = detail ?? String(reason);
+    reason = 'error';
+  }
   b.ended_at = now;
   b.end_reason = reason;
+  if (detail != null && detail !== '') b.residue = { ...(b.residue ?? {}), end_detail: String(detail).slice(0, 2000) };
   if (b.residue) delete b.residue.runtime_id; // the lease is gone with the binding (§4.7)
   // ended bindings keep their history under a started_at-qualified slot;
   // two sessions ended within one clock instant get distinct slots
@@ -133,7 +145,13 @@ export function newObligation(profile, key, text, source, now) {
   return o;
 }
 
+/** A session started on request (`sessions.launch`) answers no surface: it is read, and written to, where it was asked
+ * for (a Workplace Room reads its transcript and sends it input), so nothing of it is delivered here. */
+export const LAUNCH_PLATFORM = 'launch';
+export const launchKeyString = (launchKey) => surfaceKeyString({ platform: LAUNCH_PLATFORM, kind: 'session', chat_id: launchKey });
+
 export function reply(state, profile, key, text, now, effects, source = { kind: 'turn' }) {
+  if (key?.platform === LAUNCH_PLATFORM) return null;
   const o = newObligation(profile, key, text, source, now);
   effects.push({ type: 'deliver', profile: profile.name, obligation_id: o.id });
   return o;
@@ -555,6 +573,13 @@ function handleWorker(state, ev, effects) {
       }
       // a cron fire or a webhook turn has nobody to ask: answered now (§4.2)
       if (unattendedRequest(state, profile, binding, ev.keyString, w, now, effects)) break;
+      // a launched session has no surface to ask on: the worker's unattended rule decides, as for a fire
+      if (binding.key?.platform === LAUNCH_PLATFORM) {
+        const approve = w.hermes?.verdict !== 'deny' && profile.worker?.permission?.unattended === 'approve';
+        effects.push({ type: 'respond', profile: profile.name, keyString: ev.keyString, request_id: String(w.id), response: permissionResponse(w.options, approve, `Denied: this session was started on request and nobody here approves its actions (worker.permission.unattended: ${approve ? 'approve' : 'deny'}).`) });
+        effects.push({ type: 'log', level: 'info', message: `launched session ${ev.keyString}: ${approve ? 'approved' : 'denied'} ${String(w.subject ?? 'a tool call').slice(0, 200)}` });
+        break;
+      }
       rt.pending_requests[String(w.id)] = { profile: profile.name, keyString: ev.keyString, runtime_id: rt.leases[lid]?.runtime_id ?? null, asked_at: now, options: w.options ?? [] };
       const options = (w.options ?? []).map((o, i) => `${i + 1}. ${o.name}`).join('\n');
       reply(state, profile, binding.key, `Permission needed: ${w.subject ?? 'the worker wants to act'}\nReply with a number:\n${options}`, now, effects);
@@ -565,10 +590,15 @@ function handleWorker(state, ev, effects) {
       delete rt.turns[lid];
       delete rt.starting[lid];
       releaseHandovers(rt, lid, now, effects);
-      const synthetic = binding ? fireFailed(state, profile, binding, w.message ?? w.reason ?? 'worker exited', now, effects) : false;
+      const why = String(w.message ?? w.reason ?? 'worker exited');
+      // Why it ended is kept where it can be read after the fact, not only answered to whoever was asking: the agent's
+      // log, and the session's own record (its residue, which every codec keeps), beside its end_reason. A start that
+      // failed (loop.mjs startRuntime: `start failed: …`) left both empty.
+      effects.push({ type: 'log', level: w.kind === 'error' ? 'warn' : 'info', message: `session ${ev.keyString} in profile ${profile.name} ended: ${why}` });
+      const synthetic = binding ? fireFailed(state, profile, binding, why, now, effects) : false;
       if (binding) {
-        endBinding(state, profile.name, ev.keyString, 'error', now, effects);
-        if (!synthetic) reply(state, profile, binding.key, `Session ended: ${w.message ?? w.reason ?? 'worker exited'}.`, now, effects);
+        endBinding(state, profile.name, ev.keyString, 'error', now, effects, why);
+        if (!synthetic) reply(state, profile, binding.key, `Session ended: ${why}.`, now, effects);
       } else {
         delete rt.leases[lid];
       }
@@ -778,6 +808,45 @@ function handleOperator(state, ev, effects) {
       effects.push({ type: 'save' });
       break;
     }
+    // A concurrent session of this profile's agent, started on request (operator `sessions.launch`): its own surface
+    // keyed by the launch key, its first input queued behind the start. A key names one agent's launch for good.
+    // Its refusals are `refused` effects with a code, which the operator door answers as the op's error.
+    case 'session_launch': {
+      const { key, agent_id: agentId, input } = ev.args ?? {};
+      if (typeof key !== 'string' || !/^[A-Za-z0-9._:-]{1,120}$/.test(key) || typeof agentId !== 'string' || !agentId || typeof input !== 'string' || !input.trim()) {
+        effects.push({ type: 'refused', code: 'invalid_request', message: 'session_launch: a launch key, the agent id and a first input are required' });
+        break;
+      }
+      const keyString = launchKeyString(key);
+      // A launch key is the home's: whichever profile's launch holds it, it names that launch for good.
+      const holder = Object.values(state.profiles).flatMap((each) => Object.entries(each.bindings).filter(([slot]) => slot === keyString || slot.startsWith(`${keyString}#`)).map(([, binding]) => ({ binding, profile: each.name })))[0];
+      if (holder && (holder.binding.residue?.launch_agent !== agentId || holder.profile !== profile.name)) { effects.push({ type: 'refused', code: 'conflict', message: `session_launch: launch key ${key} belongs to another launch in this home` }); break; }
+      if (holder) { effects.push({ type: 'save' }); break; } // the same launch, asked again: nothing new starts
+      if (!profile.worker) { effects.push({ type: 'refused', code: 'conflict', message: `session_launch: profile ${profile.name} has no worker configured` }); break; }
+      const refused = budgetRefusal(state, profile, profile.name, ev.at);
+      if (refused) { effects.push({ type: 'refused', code: 'budget', message: `session_launch: not started, ${refused}` }); break; }
+      profile.bindings[keyString] = {
+        key: { platform: LAUNCH_PLATFORM, kind: 'session', chat_id: key }, agent: profile.name,
+        worker: { harness: profile.worker.harness, session_id: `launch_${key}`, locator: null },
+        started_at: ev.at, last_activity_at: ev.at, ended_at: null, end_reason: null, recurrence: null,
+        residue: { launch: key, launch_agent: agentId },
+      };
+      const rt = ensureRuntime(state);
+      (rt.queues[leaseId(profile.name, keyString)] ??= []).push({ text: input, at: ev.at });
+      rt.starting[leaseId(profile.name, keyString)] = true;
+      effects.push({ type: 'runtime_start', profile: profile.name, keyString, worker: profile.worker, prompt: null, agent: profile.name, concurrent: true });
+      effects.push({ type: 'save' });
+      break;
+    }
+    case 'session_launch_end': {
+      const keyString = launchKeyString(String(ev.args?.key ?? ''));
+      if (!liveBinding(profile, keyString)) { effects.push({ type: 'save' }); break; }
+      // A launch its caller closed is left (an END_REASONS word); the caller's own words are its detail, never its reason.
+      const words = typeof ev.args?.reason === 'string' ? ev.args.reason : null;
+      endBinding(state, profile.name, keyString, 'left', ev.at, effects, words);
+      effects.push({ type: 'save' });
+      break;
+    }
     case 'sessions_new':
     case 'sessions_reset': {
       const keyString = ev.args.keyString;