@fleetless/contracts 4.0.0-next.1 → 5.0.0-next.1

package/CHANGELOG.md

@@ -11,13 +11,43 @@ version.
 
 ### Added
 
+- **Protocol 5: `unknown` jobs, external goals, and a hard cut of protocols 3
+  and 4.** `PROTOCOL_VERSION` is 5 and the only version served: protocols 2,
+  3 and 4 are unsupported from this release on, with no sunset window, and
+  `PROTOCOL_VERSIONS` holds the single entry `{ version: 5, bridge_from:
+  '6.0.0' }`; `LATEST_BRIDGE_VERSION` is `6.0.0`. `jobState` gains `unknown`,
+  a non-terminal state for a job the cloud has lost sight of — its error
+  `bridge_disconnected` or `bridge_timeout`, both of which used to settle the
+  job `lost` — so `lost` is final and only ever follows a statement of the
+  bridge. `job` gains a required `origin` (`jobOrigin`: `fleetless` or
+  `external`), and `job_update` gains a required `origin` and `goal_id`
+  (the ROS 2 goal id, `null` for a service job), because the bridge now
+  reports every goal on a published action, including ones it did not send.
+  New frames `job_query` (`cloudJobQuery`) and `job_status`
+  (`bridgeJobStatus`, `bridgeJobStatusEntry`) let the cloud ask a connected
+  bridge how specific jobs stand. New error codes: `bridge_too_old`, the
+  `hello_error` for a bridge below protocol 5, naming bridge `6.0.0`; and
+  `job_unknown_to_bridge`, the final `lost` reason when the bridge does not
+  know a job and nothing it cannot attribute runs on the job's action.
+
+### Removed
+
+- **Protocols 2, 3 and 4, and an origin-less `job`; this is why the release
+  is a major.** A bridge below `6.0.0` is refused at `hello`, and a `job` or
+  `job_update` literal without `origin` (or a `job_update` without
+  `goal_id`) no longer parses.
+
+## [4.0.0] — 2026-09-29
+
+### Added
+
 - **Protocol 4: a job heartbeat, and a vanished action server ends its job.**
-  Protocol bumped: bridges from `4.1.0`, and protocol 3 sunsets
-  2026-12-27 (protocol 2 sunset 2026-12-21). The bridge now sends a
+  Protocol bumped: bridges from `5.0.0`, and protocol 3 sunsets
+  2026-12-28 (protocol 2 sunset 2026-12-21). The bridge now sends a
   `job_update` heartbeat every `JOB_HEARTBEAT_INTERVAL_MS` for every running
-  job; `job_lost` gains an optional `error`, so a bridge that finds its
-  action server gone can say `action_server_lost` instead of leaving the
-  cloud to guess. `JOB_HEARTBEAT_TIMEOUT_MS` bounds a protocol-4 job's
+  job, and ends a job whose action server vanished `lost` with
+  `action_server_lost` instead of leaving the cloud to guess; `job_lost`
+  gains an optional `error` that can say the same. `JOB_HEARTBEAT_TIMEOUT_MS` bounds a protocol-4 job's
   silence once it has been heard from at all; `patience_ms` now bounds only
   the acceptance gap on such a job (unchanged for protocol 3, which sends no
   heartbeat). `JOB_OFFLINE_GRACE_MS` (five minutes) replaces the informal

package/artifacts/constants.json

@@ -1,25 +1,15 @@
 {
   "AUDIT_RETENTION_DAYS": 90,
-  "PROTOCOL_VERSION": 4,
+  "PROTOCOL_VERSION": 5,
   "PROTOCOL_VERSIONS": [
     {
-      "version": 2,
-      "bridge_from": "3.0.0",
-      "deprecated_at": "2026-09-22"
-    },
-    {
-      "version": 3,
-      "bridge_from": "4.0.0",
-      "deprecated_at": "2026-09-28"
-    },
-    {
-      "version": 4,
-      "bridge_from": "4.1.0",
+      "version": 5,
+      "bridge_from": "6.0.0",
       "deprecated_at": null
     }
   ],
   "PROTOCOL_SUNSET_DAYS": 90,
-  "LATEST_BRIDGE_VERSION": "4.1.0",
+  "LATEST_BRIDGE_VERSION": "6.0.0",
   "CLOSE_ROBOT_DELETED": 4004,
   "CLOSE_TOKEN_ROTATED": 4005,
   "JOB_HEARTBEAT_INTERVAL_MS": 1000,

package/artifacts/openapi.json

@@ -6730,10 +6730,11 @@
             "in": "query",
             "required": false,
             "schema": {
-              "description": "Only runs in this state — `running`, `succeeded`, `failed`, `cancelled` or `lost`.",
+              "description": "Only runs in this state — `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`.",
               "type": "string",
               "enum": [
                 "running",
+                "unknown",
                 "succeeded",
                 "failed",
                 "cancelled",
@@ -6878,7 +6879,7 @@
             }
           }
         },
-        "description": "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in — two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above.",
+        "description": "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in — two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A slug is `409 busy` while it holds a `running` job, an `unknown` one the robot has not accounted for yet, or an `external` goal someone else started; the refusal's `details.running` names that job, `state` and `origin` included. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above.",
         "requestBody": {
           "required": true,
           "content": {
@@ -7012,7 +7013,7 @@
             }
           }
         },
-        "description": "The body is optional: a bodyless `POST` was every caller's shape before `job_id` existed, and absent or `job_id: null` both mean \"cancel whatever is running\". A named `job_id` that is **not** what is running cancels nothing and answers `404` — the caller named an id and thereby ruled the other one out. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`.",
+        "description": "The body is optional: a bodyless `POST` was every caller's shape before `job_id` existed, and absent or `job_id: null` both mean \"cancel whatever is running\". A named `job_id` that is **not** what is running cancels nothing and answers `404` — the caller named an id and thereby ruled the other one out. An `external` job is cancelled the same way, through its goal id. Cancelling an `unknown` job also cancels every external goal on its action, since one of them may be that job. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`.",
         "requestBody": {
           "required": false,
           "content": {
@@ -8188,10 +8189,11 @@
             "in": "query",
             "required": false,
             "schema": {
-              "description": "Only runs in this state — `running`, `succeeded`, `failed`, `cancelled` or `lost`.",
+              "description": "Only runs in this state — `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`.",
               "type": "string",
               "enum": [
                 "running",
+                "unknown",
                 "succeeded",
                 "failed",
                 "cancelled",
@@ -14608,12 +14610,21 @@
                     "type": "string",
                     "enum": [
                       "running",
+                      "unknown",
                       "succeeded",
                       "failed",
                       "cancelled",
                       "lost"
                     ],
-                    "description": "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome — the bridge restarted mid-job and the result is gone — stated rather than left reading `running` by default."
+                    "description": "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome — the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+                  },
+                  "origin": {
+                    "type": "string",
+                    "enum": [
+                      "fleetless",
+                      "external"
+                    ],
+                    "description": "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it — no parameters, no starter, never written to `job_runs`."
                   },
                   "started_at": {
                     "type": "string",
@@ -14671,7 +14682,7 @@
                         "type": "null"
                       }
                     ],
-                    "description": "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+                    "description": "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` — where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
                   }
                 },
                 "required": [
@@ -14679,6 +14690,7 @@
                   "robot_id",
                   "slug",
                   "state",
+                  "origin",
                   "started_at",
                   "updated_at",
                   "seq",
@@ -14770,12 +14782,21 @@
                     "type": "string",
                     "enum": [
                       "running",
+                      "unknown",
                       "succeeded",
                       "failed",
                       "cancelled",
                       "lost"
                     ],
-                    "description": "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome — the bridge restarted mid-job and the result is gone — stated rather than left reading `running` by default."
+                    "description": "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome — the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+                  },
+                  "origin": {
+                    "type": "string",
+                    "enum": [
+                      "fleetless",
+                      "external"
+                    ],
+                    "description": "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it — no parameters, no starter, never written to `job_runs`."
                   },
                   "started_at": {
                     "type": "string",
@@ -14833,7 +14854,7 @@
                         "type": "null"
                       }
                     ],
-                    "description": "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+                    "description": "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` — where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
                   }
                 },
                 "required": [
@@ -14841,6 +14862,7 @@
                   "robot_id",
                   "slug",
                   "state",
+                  "origin",
                   "started_at",
                   "updated_at",
                   "seq",
@@ -14900,12 +14922,13 @@
                   "type": "string",
                   "enum": [
                     "running",
+                    "unknown",
                     "succeeded",
                     "failed",
                     "cancelled",
                     "lost"
                   ],
-                  "description": "How the run ended, or `running` while it is still going. `lost` means the bridge restarted mid-run and the outcome is unknowable rather than unknown."
+                  "description": "How the run ended, or `running` while it is still going. `unknown` while the robot has not accounted for it — offline or silent — and updated once the bridge says how it stands. `lost` is final: the bridge did not know the run and nothing else ran on its action, so the outcome is unknowable rather than unknown."
                 },
                 "started_at": {
                   "type": "string",
@@ -14924,7 +14947,7 @@
                       "type": "null"
                     }
                   ],
-                  "description": "When the run finished, as an ISO 8601 timestamp. `null` while it is still `running` — a run has an end only once it has one."
+                  "description": "When the run finished, as an ISO 8601 timestamp. `null` while it is still `running` or `unknown` — a run has an end only once it has one."
                 },
                 "duration_ms": {
                   "anyOf": [
@@ -14937,7 +14960,7 @@
                       "type": "null"
                     }
                   ],
-                  "description": "How long the run took, in milliseconds. `null` while it is still `running`, never `0` standing in for \"nothing so far\"."
+                  "description": "How long the run took, in milliseconds. `null` while it is still `running` or `unknown`, never `0` standing in for \"nothing so far\"."
                 },
                 "result": {
                   "anyOf": [
@@ -17361,12 +17384,21 @@
                   "type": "string",
                   "enum": [
                     "running",
+                    "unknown",
                     "succeeded",
                     "failed",
                     "cancelled",
                     "lost"
                   ],
-                  "description": "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome — the bridge restarted mid-job and the result is gone — stated rather than left reading `running` by default."
+                  "description": "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome — the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+                },
+                "origin": {
+                  "type": "string",
+                  "enum": [
+                    "fleetless",
+                    "external"
+                  ],
+                  "description": "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it — no parameters, no starter, never written to `job_runs`."
                 },
                 "started_at": {
                   "type": "string",
@@ -17424,7 +17456,7 @@
                       "type": "null"
                     }
                   ],
-                  "description": "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+                  "description": "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` — where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
                 }
               },
               "required": [
@@ -17432,6 +17464,7 @@
                 "robot_id",
                 "slug",
                 "state",
+                "origin",
                 "started_at",
                 "updated_at",
                 "seq",

package/artifacts/routes.json

@@ -4078,7 +4078,7 @@
         "internal_error"
       ],
       "transport": "http",
-      "notes": "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in — two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above."
+      "notes": "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in — two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A slug is `409 busy` while it holds a `running` job, an `unknown` one the robot has not accounted for yet, or an `external` goal someone else started; the refusal's `details.running` names that job, `state` and `origin` included. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above."
     },
     {
       "method": "GET",
@@ -4150,7 +4150,7 @@
         "robot_offline"
       ],
       "transport": "http",
-      "notes": "The body is optional: a bodyless `POST` was every caller's shape before `job_id` existed, and absent or `job_id: null` both mean \"cancel whatever is running\". A named `job_id` that is **not** what is running cancels nothing and answers `404` — the caller named an id and thereby ruled the other one out. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`."
+      "notes": "The body is optional: a bodyless `POST` was every caller's shape before `job_id` existed, and absent or `job_id: null` both mean \"cancel whatever is running\". A named `job_id` that is **not** what is running cancels nothing and answers `404` — the caller named an id and thereby ruled the other one out. An `external` job is cancelled the same way, through its goal id. Cancelling an `unknown` job also cancels every external goal on its action, since one of them may be that job. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`."
     },
     {
       "method": "POST",

package/artifacts/schema/bridge-hello.schema.json

@@ -41,6 +41,7 @@
             "type": "string",
             "enum": [
               "running",
+              "unknown",
               "succeeded",
               "failed",
               "cancelled",

package/artifacts/schema/bridge-job-status.schema.json

@@ -0,0 +1,114 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "type": {
+      "type": "string",
+      "const": "job_status"
+    },
+    "request_id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "jobs": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "job_id": {
+            "type": "string",
+            "format": "uuid",
+            "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+          },
+          "state": {
+            "type": "string",
+            "enum": [
+              "running",
+              "unknown",
+              "succeeded",
+              "failed",
+              "cancelled",
+              "lost"
+            ]
+          },
+          "feedback": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "progress": {
+            "anyOf": [
+              {
+                "type": "number",
+                "minimum": 0,
+                "maximum": 1
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "result": {
+            "anyOf": [
+              {},
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "error": {
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "message": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "details": {}
+                },
+                "required": [
+                  "code",
+                  "message"
+                ]
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "job_id",
+          "state",
+          "feedback",
+          "progress",
+          "result",
+          "error"
+        ]
+      }
+    },
+    "unknown_job_ids": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "format": "uuid",
+        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+      }
+    }
+  },
+  "required": [
+    "type",
+    "request_id",
+    "jobs",
+    "unknown_job_ids"
+  ]
+}

package/artifacts/schema/bridge-job-update.schema.json

@@ -21,12 +21,31 @@
       "type": "string",
       "enum": [
         "running",
+        "unknown",
         "succeeded",
         "failed",
         "cancelled",
         "lost"
       ]
     },
+    "origin": {
+      "type": "string",
+      "enum": [
+        "fleetless",
+        "external"
+      ]
+    },
+    "goal_id": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
     "feedback": {
       "anyOf": [
         {},
@@ -91,6 +110,8 @@
     "job_id",
     "slug",
     "state",
+    "origin",
+    "goal_id",
     "feedback",
     "progress",
     "result",

package/artifacts/schema/busy-details.schema.json

@@ -28,12 +28,21 @@
           "type": "string",
           "enum": [
             "running",
+            "unknown",
             "succeeded",
             "failed",
             "cancelled",
             "lost"
           ],
-          "description": "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome — the bridge restarted mid-job and the result is gone — stated rather than left reading `running` by default."
+          "description": "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome — the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+        },
+        "origin": {
+          "type": "string",
+          "enum": [
+            "fleetless",
+            "external"
+          ],
+          "description": "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it — no parameters, no starter, never written to `job_runs`."
         },
         "started_at": {
           "type": "string",
@@ -91,7 +100,7 @@
               "type": "null"
             }
           ],
-          "description": "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+          "description": "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` — where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
         }
       },
       "required": [
@@ -99,6 +108,7 @@
         "robot_id",
         "slug",
         "state",
+        "origin",
         "started_at",
         "updated_at",
         "seq",

package/artifacts/schema/cloud-job-query.schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "type": {
+      "type": "string",
+      "const": "job_query"
+    },
+    "request_id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "job_ids": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "string",
+        "format": "uuid",
+        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+      }
+    }
+  },
+  "required": [
+    "type",
+    "request_id",
+    "job_ids"
+  ]
+}

package/artifacts/schema/command-result.schema.json

@@ -42,12 +42,21 @@
               "type": "string",
               "enum": [
                 "running",
+                "unknown",
                 "succeeded",
                 "failed",
                 "cancelled",
                 "lost"
               ],
-              "description": "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome — the bridge restarted mid-job and the result is gone — stated rather than left reading `running` by default."
+              "description": "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome — the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+            },
+            "origin": {
+              "type": "string",
+              "enum": [
+                "fleetless",
+                "external"
+              ],
+              "description": "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it — no parameters, no starter, never written to `job_runs`."
             },
             "started_at": {
               "type": "string",
@@ -104,7 +113,7 @@
                   "type": "null"
                 }
               ],
-              "description": "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+              "description": "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` — where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
             }
           },
           "required": [
@@ -112,6 +121,7 @@
             "robot_id",
             "slug",
             "state",
+            "origin",
             "started_at",
             "updated_at",
             "seq",

package/artifacts/schema/invoke-or-service-response.schema.json

@@ -30,12 +30,21 @@
               "type": "string",
               "enum": [
                 "running",
+                "unknown",
                 "succeeded",
                 "failed",
                 "cancelled",
                 "lost"
               ],
-              "description": "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome — the bridge restarted mid-job and the result is gone — stated rather than left reading `running` by default."
+              "description": "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome — the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+            },
+            "origin": {
+              "type": "string",
+              "enum": [
+                "fleetless",
+                "external"
+              ],
+              "description": "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it — no parameters, no starter, never written to `job_runs`."
             },
             "started_at": {
               "type": "string",
@@ -93,7 +102,7 @@
                   "type": "null"
                 }
               ],
-              "description": "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+              "description": "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` — where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
             }
           },
           "required": [
@@ -101,6 +110,7 @@
             "robot_id",
             "slug",
             "state",
+            "origin",
             "started_at",
             "updated_at",
             "seq",