@gotcos/glasses-server 6.43.2 → 6.43.4

package/CHANGELOG.md

@@ -1,16 +1,76 @@
+## 6.43.4
+
+Every message now says who started it.
+
+- **Server-started jobs carry an origin label.** A durable job request may
+  carry `origin: { kind: 'routine' | 'task', id }`; the scheduled morning
+  brief sends `{ kind: 'routine', id: 'morning-brief' }`. The label lands on
+  both halves of the projected exchange (`origin`, `originId`), on the display
+  bus (`start`, `done`, `error`, flattened to the same two keys), and on the
+  today/all-messages and day-archive views the phone and COS Control read.
+  A prompt typed on the phone carries nothing; the phone's own `G2` stamp
+  never reaches the server. Nothing is inferred from the label's absence.
+- **The request fingerprint is pinned to the sixteen identity keys it always
+  had.** `origin` (and any future provenance or enforcement key) is outside
+  it, so a build that does not know the key still hydrates a journal written
+  by one that does, and a rollback from this version to 6.43.3 keeps every
+  retained job. Stored fingerprints are byte-identical before and after.
+- **Admission is strict only about a known kind with a bad id (400
+  `invalid_origin`).** An unknown kind, and the phone's bare-string stamp, are
+  dropped and counted on both paths, so a newer client's label degrades to
+  unlabeled and never refuses the job; hydration is lenient throughout. Two new
+  store counters on `/api/health`: `originDropped` (once per job created, once
+  per journal record hydrated) and `fingerprintMismatches` — the second is a
+  job that did NOT hydrate, and the first mismatch logs at error level. No
+  client reads either yet; `/api/health` is where a human sees them.
+- **The label is validated at every boundary it crosses.** The conversation
+  store drops an unknown kind (and an orphan id) when it loads from disk, and
+  the bus stamp is spread after provider metadata so no provider key can
+  overwrite it. A real 6.43.3-written journal is committed as a fixture and
+  hydrated by the suite, in addition to the in-process hash oracle.
+- **The scheduler adopts an admitted brief on every scheduled fire**, not only
+  on the crash-resume branch, and replaces the last of the day's scheduled
+  ledger rows instead of pushing another; "Run now" and the scheduled tick
+  are serialised, so two overlapping admissions can no longer interleave. A
+  manual and a scheduled brief on the same day remain two briefs, by design.
+- Briefs that ran on 6.43.0–6.43.3 stay unlabeled; badges start with runs
+  from this version. A routine's reply is unlabeled while it is still running
+  and gains the label when it lands.
+
+## 6.43.3
+
+Managed-server updates no longer hinge on one vendor's meter.
+
+- **The readiness proof reports why it failed, as a code.** COS Control
+  verifies a candidate server with one real no-tool query per installed
+  provider. On 2026-09-01 Claude had hit its session limit, Codex proved in
+  seven seconds, and six 6.43.1 updates still rolled back because the only
+  answer was "provider process exited 1". `POST /api/diagnostics/provider-proof`
+  now returns `code`: `provider_quota` (vendor session or usage limit),
+  `provider_auth` (not signed in), `provider_context_overflow`,
+  `provider_missing`, `provider_timeout`, `provider_canceled`,
+  `provider_bad_answer`, or `provider_failed`. The `error` sentence is one
+  fixed phrase per code; vendor text never leaves the server. COS Control
+  0.5.184 uses the code to treat a quota as a skip when another provider
+  proves (on 6.43.2 and older it classifies the error sentence instead).
+- **Cursor is a proof provider.** `{"provider":"cursor"}` runs the Cursor
+  `agent` in documented read-only ask mode with the prompt on stdin and reads
+  the result event, so a Mac with Cursor signed in can prove an update while
+  Claude and Codex are both at their limits.
+
 ## 6.43.2
 
-Managed-server updates pass their Claude readiness proof again.
-
-- **The proof no longer loads your MCP catalog.** COS Control verifies a
-  candidate server by running one real `claude -p --model haiku` query with
-  no tools. On Claude Code 2.1.251, `--tools ''` still loads every MCP
-  server's tool definitions, and on a Mac with a large fleet that alone was
-  about 244,000 tokens against Haiku's 200,000-token window: "Prompt is too
-  long", exit 1, zero API time, and the update rolled back to the previous
-  server every time (six attempts on 6.43.1). The proof now passes
-  `--strict-mcp-config` with an empty MCP config, which keeps it under
-  20,000 tokens and answers in about two seconds. Nothing else changed.
+What actually reached npm under this number (published 2026-09-02 07:27 CDT
+from the commit before the proof codes landed):
+
+- **The Claude proof states its empty MCP config explicitly**
+  (`--strict-mcp-config --mcp-config '{"mcpServers":{}}'`) instead of relying
+  on `CLAUDE_CODE_SAFE_MODE` alone. Without safe mode, `--tools ''` on Claude
+  Code 2.1.251 still loads the whole catalog, which on a large fleet is a
+  244K-token request Haiku refuses before any API call. Belt and braces; the
+  2026-09-01 rollbacks were the session limit, not this.
+- The message-reservation rationale in code and changelog states the
+  observed double #74 accurately (one exchange shown twice by the companion).
 
 ## 6.43.1
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.43.2",
+  "version": "6.43.4",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/__fixtures__/query-jobs-6.43.3/2099-01-01.jsonl

@@ -0,0 +1,2 @@
+{"schemaVersion":1,"recordId":"02b09947-ed7d-47ef-99c5-4985af3ec924","partitionDay":"2099-01-01","persistedAt":"2099-01-01T12:00:00.000Z","bootId":"boot-6-43-3-fixture","jobId":"43b397bd-dd67-4312-9a5c-4c5d4b246f1d","clientJobId":"11111111-1111-4111-8111-111111111111","generation":2,"turnId":"a456fd1d-1e82-4b2d-8a20-5d34681201fd","requestFingerprint":"024966024134bf0d46090335da03a732a7fb7eaea161b1fd07dc4c5b9d536e95","eventSeq":1,"type":"accepted","status":"accepted","request":{"clientJobId":"11111111-1111-4111-8111-111111111111","generation":2,"query":"written by 6.43.3","sessionId":"session-6-43-3","model":"opus","effort":"high","cursorExecutionMode":"ask","messageEra":"era1","globalMsgNum":78,"reference":{"query":"earlier q","response":"earlier a"},"handoffCode":"ABCD","handoffLatest":true,"clientQueueItemId":"q1","attachmentIds":[],"attachmentRefs":[],"activityToolMode":"status"},"patch":{},"eventData":{"requestFingerprint":"024966024134bf0d46090335da03a732a7fb7eaea161b1fd07dc4c5b9d536e95"}}
+{"schemaVersion":1,"recordId":"a1145a40-2ced-4da3-9cf7-76d84cffc946","partitionDay":"2099-01-01","persistedAt":"2099-01-01T12:00:00.000Z","bootId":"boot-6-43-3-fixture","jobId":"64c5b502-13f2-4871-b6c4-007b91be2414","clientJobId":"22222222-2222-4222-8222-222222222222","generation":1,"turnId":"843e633f-0f92-4fe3-b2a1-9dc683715791","requestFingerprint":"91edfdeeb088e9fb3b1ffab4202bca02d3e7a23674d8b54dd51a50ce9adbf638","eventSeq":1,"type":"accepted","status":"accepted","request":{"clientJobId":"22222222-2222-4222-8222-222222222222","generation":1,"query":"minimal by 6.43.3","sessionId":"session-6-43-3-min","attachmentIds":[],"attachmentRefs":[],"activityToolMode":"status"},"patch":{},"eventData":{"requestFingerprint":"91edfdeeb088e9fb3b1ffab4202bca02d3e7a23674d8b54dd51a50ce9adbf638"}}

package/server/lib/archive.ts

@@ -472,7 +472,8 @@ export function getArchiveChats(date: string): ArchiveChatSummary[] {
 }
 
 /** Get paired Q&A messages for a specific chat within a day. Request refs on
- * the user turn and model-output refs on the assistant turn surface together. */
+ * the user turn and model-output refs on the assistant turn surface together.
+ * Deliberately no origin label here (6.43.4): the day view carries it. */
 export function getArchiveChatMessages(
   date: string,
   chatIndex: number,
@@ -507,11 +508,11 @@ export function getArchiveChatMessages(
  *  (sessionId, timestamp) instead of bare timestamp (collision-prone). */
 export function getArchiveDayMessages(
   date: string,
-): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> {
+): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; origin?: 'routine' | 'task'; originId?: string; attachments?: MediaAttachmentRef[] }> {
   const archive = loadArchive(date)
   if (!archive) return []
 
-  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> = []
+  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; origin?: 'routine' | 'task'; originId?: string; attachments?: MediaAttachmentRef[] }> = []
   for (const chat of archive.chats) {
     for (let i = 0; i < chat.exchanges.length; i++) {
       const ex = chat.exchanges[i]
@@ -522,6 +523,8 @@ export function getArchiveDayMessages(
           const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
           const messageEra = ex.messageEra ?? next.messageEra
           const modelPreference = resolveExchangePairModel(ex, next, null)
+          // Same one-half rule as the live view (routes/sessions.ts).
+          const stamped = ex.origin ? ex : next
           messages.push({
             query: ex.content,
             text: next.content,
@@ -531,6 +534,7 @@ export function getArchiveDayMessages(
             ...(globalMsgNum != null ? { no: globalMsgNum, globalMsgNum } : {}),
             ...(messageEra ? { messageEra } : {}),
             ...(modelPreference ? { modelPreference } : {}),
+            ...(stamped.origin ? { origin: stamped.origin, ...(stamped.originId ? { originId: stamped.originId } : {}) } : {}),
             ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++

package/server/lib/conversation.ts

@@ -37,6 +37,20 @@ export interface Exchange {
    * photos on the user exchange, model-published images on the assistant
    * exchange. Bytes, filesystem paths, and capabilities never persist here. */
   attachments?: MediaAttachmentRef[]
+  /** Who started the job that produced this pair, when it was not the person
+   * on the phone or the glasses: `routine` (the scheduler) or `task` (a
+   * dispatched task). Absent on every human prompt. The phone's own `g2` stamp
+   * never reaches the server; this is the server's half of the label. */
+  origin?: 'routine' | 'task'
+  /** `morning-brief`, or a task's 12-hex id. */
+  originId?: string
+}
+
+/** Structural twin of `QueryJobOrigin` so the conversation store takes no
+ * import from the job module. */
+export interface ExchangeOriginStamp {
+  kind: 'routine' | 'task'
+  id: string
 }
 
 export interface ExchangeJobProvenance {
@@ -159,6 +173,14 @@ function loadFromDisk(): void {
         if (refs.length > 0) exchange.attachments = refs
         else delete exchange.attachments
       }
+      // Same boundary for the origin label (6.43.4): only the two kinds this
+      // build renders survive a load, and an id never survives without its kind.
+      if (exchange.origin !== 'routine' && exchange.origin !== 'task') {
+        delete exchange.origin
+        delete exchange.originId
+      } else if (typeof exchange.originId !== 'string' || !exchange.originId) {
+        delete exchange.originId
+      }
     }
     sessions.set(id, session)
     loaded++
@@ -528,6 +550,7 @@ export function reconcileExchangeByJobIdentity(
   attachments?: MediaAttachmentRef[],
   messageEra?: string,
   modelPreference?: ModelPreference | null,
+  origin?: ExchangeOriginStamp,
 ): ReconciledExchange {
   if (!validClientJobId(identity.clientJobId) || !validGeneration(identity.generation)) {
     throw new Error('conversation: invalid durable job identity')
@@ -572,6 +595,7 @@ export function reconcileExchangeByJobIdentity(
       generation: identity.generation,
       ...(stampedModel ? { modelPreference: stampedModel } : {}),
       ...(validatedAttachments.length > 0 ? { attachments: validatedAttachments } : {}),
+      ...(origin ? { origin: origin.kind, originId: origin.id } : {}),
     }
     session.exchanges.push(exchange)
   } else {
@@ -580,6 +604,9 @@ export function reconcileExchangeByJobIdentity(
     exchange.globalMsgNum = globalMsgNum
     exchange.messageEra = projectedMessageEra
     if (stampedModel) exchange.modelPreference = stampedModel
+    // Guarded like the model: the cursor and ollama bridges reconcile the user
+    // half mid-run WITHOUT an origin, and must not erase the runtime's stamp.
+    if (origin) { exchange.origin = origin.kind; exchange.originId = origin.id }
     if (validatedAttachments.length > 0) exchange.attachments = validatedAttachments
     else delete exchange.attachments
 

package/server/lib/morning-brief-scheduler.ts

@@ -108,6 +108,9 @@ export type TickResult =
 
 /** Deterministic v4-shaped client id for one local day, so a retry after a
  * crashed submission admits as the SAME job. The store dedupes on it. */
+/** The routine id every surface renders as ROUTINE for the morning brief. */
+export const MORNING_BRIEF_ROUTINE_ID = 'morning-brief'
+
 export function scheduledClientJobId(day: string, timezone: string): string {
   const digest = createHash('sha256').update(`morning-brief|${timezone}|${day}`).digest()
   const bytes = Buffer.from(digest.subarray(0, 16))
@@ -128,6 +131,9 @@ export class MorningBriefScheduler {
   private ledger: MorningBriefLedger
   private timer: ReturnType<typeof setInterval> | null = null
   private tickInFlight: Promise<TickResult> | null = null
+  /** One chain for tick() AND runNow(): the in-progress read in runNow and the
+   * ledger write in fire() must never interleave with a scheduled fire. */
+  private serial: Promise<unknown> = Promise.resolve()
   private readonly now: () => number
   private readonly log: (line: string) => void
   readonly quarantinedConfig?: string
@@ -151,7 +157,11 @@ export class MorningBriefScheduler {
   start(): void {
     if (this.timer) return
     const tickMs = Math.max(1_000, this.deps.tickMs ?? 30_000)
-    this.timer = setInterval(() => { void this.tick() }, tickMs)
+    // A rejected tick must never become an unhandled rejection (Node exits on
+    // one by default): log it and let the next interval try again.
+    this.timer = setInterval(() => {
+      this.tick().catch(error => this.log(`tick failed: ${error instanceof Error ? error.message : String(error)}`))
+    }, tickMs)
     this.timer.unref?.()
     this.log(`scheduled ${this.config.enabled ? `daily at ${this.config.time} ${this.config.timezone}` : 'off'} · next ${nextScheduledFire(this.config, this.now()) ?? 'none'}`)
   }
@@ -181,10 +191,16 @@ export class MorningBriefScheduler {
   /** One scheduler pass. Serialised: a slow submission never overlaps the next tick. */
   tick(): Promise<TickResult> {
     if (this.tickInFlight) return this.tickInFlight
-    this.tickInFlight = this.runTick().finally(() => { this.tickInFlight = null })
+    this.tickInFlight = this.serialize(() => this.runTick()).finally(() => { this.tickInFlight = null })
     return this.tickInFlight
   }
 
+  private serialize<T>(fn: () => Promise<T>): Promise<T> {
+    const next = this.serial.then(fn, fn)
+    this.serial = next.then(() => undefined, () => undefined)
+    return next
+  }
+
   private async runTick(): Promise<TickResult> {
     if (!this.deps.durableJobsEnabled()) return { fired: false, reason: 'durable_jobs_off' }
     if (!this.deps.admissionsOpen()) return { fired: false, reason: 'admissions_closed' }
@@ -195,7 +211,11 @@ export class MorningBriefScheduler {
   }
 
   /** "Run now" from a settings surface. Bounded per day; refused while a brief is live. */
-  async runNow(): Promise<MorningBriefRun> {
+  runNow(): Promise<MorningBriefRun> {
+    return this.serialize(() => this.runNowInner())
+  }
+
+  private async runNowInner(): Promise<MorningBriefRun> {
     if (!this.deps.durableJobsEnabled()) {
       throw new MorningBriefRunError(409, 'durable_jobs_off', 'Turn on Background jobs in COS Control to run the brief.')
     }
@@ -227,14 +247,45 @@ export class MorningBriefScheduler {
       ? scheduledClientJobId(day, this.config.timezone)
       : randomUUID()
 
-    // Resume: a ledger row with no job id. Adopt an admission the coordinator
-    // may already hold for this identity before considering a fresh submit.
-    if (resume) {
+    // Adopt before minting, on EVERY scheduled fire — not only the crash-resume
+    // branch. A submit that threw after admission, a ledger row lost to
+    // quarantine, and a plain resume all find the coordinator already holding
+    // this day's identity. A manual fire mints a fresh UUID and can never hit,
+    // so it skips the round trip. Reusing `existing.globalMsgNum` is safe even
+    // though liveReservations() skips submitError rows: the store's own
+    // reservation source (query-job-runtime registers the coordinator's live
+    // identities) holds an admitted job's number independently of the ledger.
+    if (trigger === 'scheduled') {
       const existing = await this.deps.findByClientGeneration(clientJobId, 1).catch(() => undefined)
       if (existing) {
-        const adopted: MorningBriefRun = { ...resume, jobId: existing.jobId, lastKnownStatus: existing.status }
+        const priorRow = resume ?? this.ledger.runs.filter(r => r.day === day && r.trigger === trigger).at(-1)
+        // Carry every current and future ledger field from the row being
+        // replaced; drop only the submit error (the job exists), then override
+        // the identity and provenance columns from what is actually admitted.
+        const { submitError: _dropped, ...carried } = priorRow ?? {}
+        const adopted: MorningBriefRun = {
+          ...carried,
+          id: priorRow?.id ?? randomUUID(),
+          day,
+          trigger,
+          attempt,
+          firedAt: priorRow?.firedAt ?? existing.acceptedAt,
+          clientJobId,
+          generation: 1,
+          sessionId: priorRow?.sessionId ?? existing.sessionId,
+          messageEra: priorRow?.messageEra ?? existing.messageEra ?? this.deps.currentMessageEra(),
+          globalMsgNum: priorRow?.globalMsgNum ?? existing.globalMsgNum ?? this.deps.currentMessageMax() + 1,
+          sections: priorRow?.sections ?? briefSections(this.config, day),
+          jobId: existing.jobId,
+          lastKnownStatus: existing.status,
+        }
+        if (priorRow?.globalMsgNum == null && existing.globalMsgNum == null) {
+          this.log(`adopted job ${existing.jobId} carried no message number; minted #${adopted.globalMsgNum}`)
+        }
+        // Reusing the prior row's id makes replaceRun REPLACE the day's row
+        // rather than push a second one for the same job.
         this.replaceRun(adopted)
-        this.log(`adopted ${trigger} brief for ${day} as job ${existing.jobId}`)
+        this.log(`adopted ${trigger} brief for ${day} as job ${existing.jobId} (${priorRow ? `replacing ledger row ${priorRow.id}` : 'no ledger row'})`)
         return adopted
       }
     }
@@ -272,6 +323,9 @@ export class MorningBriefScheduler {
         activityToolMode: 'status',
         attachmentIds: [],
         attachmentRefs: [],
+        // The label every surface renders as ROUTINE. Outside the fingerprint,
+        // so a run admitted on 6.43.3 still adopts here by identity.
+        origin: { kind: 'routine', id: MORNING_BRIEF_ROUTINE_ID },
       })
       const accepted: MorningBriefRun = { ...run, jobId: admission.job.jobId, lastKnownStatus: admission.job.status }
       this.replaceRun(accepted)

package/server/lib/provider-proof.ts

@@ -1,8 +1,28 @@
 import { spawn } from 'node:child_process'
 import { cosBrainDir } from './launch-dir.js'
+import { resolveAgentBinary } from './cursor-model-catalog.js'
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
 
-export type ProofProvider = 'claude' | 'codex'
+export type ProofProvider = 'claude' | 'codex' | 'cursor'
+export const PROOF_PROVIDERS: readonly ProofProvider[] = ['claude', 'codex', 'cursor']
+
+/**
+ * Why a proof did not pass, as a stable code COS Control can branch on
+ * without reading logs. `provider_quota` is the one that matters: a vendor
+ * session or usage limit is a fact about the vendor's meter, not about the
+ * candidate server, and an update must not roll back on it when another
+ * provider proves. (2026-09-01: six 6.43.1 updates rolled back on Claude's
+ * session limit while Codex proved in 7 s.)
+ */
+export type ProviderProofCode =
+  | 'provider_quota'
+  | 'provider_auth'
+  | 'provider_context_overflow'
+  | 'provider_missing'
+  | 'provider_timeout'
+  | 'provider_canceled'
+  | 'provider_bad_answer'
+  | 'provider_failed'
 
 export interface ProviderProofResult {
   provider: ProofProvider
@@ -10,6 +30,7 @@ export interface ProviderProofResult {
   durationMs: number
   cached: boolean
   error?: string
+  code?: ProviderProofCode
 }
 
 const PROOF_TOKEN = 'COS_CONTROL_OK'
@@ -110,13 +131,14 @@ export function runBounded(
 export const CLAUDE_PROOF_MODEL = 'haiku'
 export const CLAUDE_PROOF_TIMEOUT_MS = 45_000
 
-/** No MCP servers for the proof. Claude Code 2.1.251 turns `--tools ''`
- * into "load the whole catalog, expose none of it", and on a Mac with a
- * large MCP fleet that catalog alone was ~244K tokens against Haiku's 200K
- * window: "Prompt is too long", exit 1, zero API time. Six 6.43.1 update
- * attempts rolled back on 2026-09-01/02 before a single request was made.
- * An explicit empty config with --strict-mcp-config keeps the proof under
- * 20K tokens and is what a readiness check should be anyway. */
+/** No MCP servers for the proof, stated explicitly rather than relied on
+ * from CLAUDE_CODE_SAFE_MODE alone. Without safe mode, Claude Code 2.1.251
+ * turns `--tools ''` into "load the whole catalog, expose none of it", and
+ * on a Mac with a large MCP fleet that catalog alone is ~244K tokens against
+ * Haiku's 200K window ("Prompt is too long", exit 1, zero API time). Safe
+ * mode currently prevents that; an explicit empty config with
+ * --strict-mcp-config keeps the proof under 20K tokens whatever a future
+ * CLI does with the safe-mode flag. */
 export const CLAUDE_PROOF_MCP_CONFIG = '{"mcpServers":{}}'
 
 export function claudeProofArgs(): string[] {
@@ -172,11 +194,85 @@ function safeProofError(result: ProcessResult): string {
   return 'provider returned no valid proof response'
 }
 
+const QUOTA_RE = /usage limit|hit your (?:usage |session )?limit|session limit|rate.?limit|too many requests|\b429\b|\bquota\b|resets? (?:at|in) |over capacity|overloaded|\b529\b|plan limit/i
+const AUTH_RE = /not logged in|please (?:log ?in|sign in)|invalid api key|authentication|unauthori[sz]ed|\b401\b|\b403\b|login required|token (?:has )?expired|no credentials/i
+const OVERFLOW_RE = /prompt is too long|context window|too many tokens|exceeds the (?:model|context)/i
+const MISSING_RE = /ENOENT|command not found|no such file/i
+
+/** Vendor text the provider printed, so the code can be derived without ever
+ * returning that text to a caller. Claude's JSON `result` carries the error
+ * sentence on `is_error`; Codex and Cursor print it on stderr or as a
+ * result/error event. */
+export function classifyProofFailure(result: ProcessResult, answer: string, expected = PROOF_TOKEN): ProviderProofCode {
+  if (result.aborted) return 'provider_canceled'
+  if (result.timedOut) return 'provider_timeout'
+  const haystack = `${result.stderr}\n${result.stdout}`.slice(0, 40_000)
+  if (result.code === null && MISSING_RE.test(haystack)) return 'provider_missing'
+  if (OVERFLOW_RE.test(haystack)) return 'provider_context_overflow'
+  if (QUOTA_RE.test(haystack)) return 'provider_quota'
+  if (AUTH_RE.test(haystack)) return 'provider_auth'
+  if (result.code === 0) return answer === expected ? 'provider_failed' : 'provider_bad_answer'
+  return 'provider_failed'
+}
+
+/** One safe sentence per code; never the vendor's text. */
+export function describeProofCode(code: ProviderProofCode, result: ProcessResult): string {
+  switch (code) {
+    case 'provider_quota': return 'provider session or usage limit reached'
+    case 'provider_auth': return 'provider is not signed in'
+    case 'provider_context_overflow': return 'provider refused the proof prompt as too long'
+    case 'provider_missing': return 'provider binary is not installed or not on PATH'
+    case 'provider_timeout': return 'provider proof timed out'
+    case 'provider_canceled': return 'provider proof canceled'
+    case 'provider_bad_answer': return 'provider answered but not with the proof token'
+    default: return safeProofError(result)
+  }
+}
+
+export const CURSOR_PROOF_TIMEOUT_MS = 120_000
+
+/** Cursor `agent` in documented read-only ask mode, one stream-json turn, the
+ * prompt on stdin like the bridge. No `--model`: the account default is the
+ * readiness question, not any particular model. */
+export function cursorProofArgs(workspace = cosBrainDir() ?? process.cwd()): string[] {
+  return ['-p', '--mode', 'ask', '--output-format', 'stream-json', '--trust', '--workspace', workspace]
+}
+
+/** The final `result` event wins; assistant deltas with a timestamp are the
+ * fallback, mirroring cursor-bridge's extractCursorResponseText. */
+export function cursorProofText(stdout: string): string {
+  let deltas = ''
+  for (const line of stdout.split('\n')) {
+    if (!line.trim()) continue
+    let event: any
+    try { event = JSON.parse(line) } catch { continue }
+    const type = String(event?.type ?? '').toLowerCase()
+    if (type === 'result') {
+      if (event?.subtype === 'success' && event?.is_error !== true && typeof event?.result === 'string') return event.result.trim()
+      continue
+    }
+    if (type !== 'assistant' || typeof event?.timestamp_ms !== 'number') continue
+    if (event?.model_call_id != null && event.model_call_id !== '') continue
+    const content = event?.message?.content
+    if (Array.isArray(content)) {
+      for (const block of content) {
+        if (typeof block === 'string') deltas += block
+        else if (typeof block?.text === 'string') deltas += block.text
+      }
+    } else if (typeof event?.text === 'string') {
+      deltas += event.text
+    }
+  }
+  return deltas.trim()
+}
+
 async function executeProof(provider: ProofProvider, signal?: AbortSignal): Promise<ProviderProofResult> {
   const started = Date.now()
-  const result = provider === 'claude'
-    ? await runBounded('claude', claudeProofArgs(), '', CLAUDE_PROOF_TIMEOUT_MS, signal)
-    : await runBounded('codex', [
+  let result: ProcessResult
+  if (provider === 'claude') {
+    result = await runBounded('claude', claudeProofArgs(), '', CLAUDE_PROOF_TIMEOUT_MS, signal)
+  } else if (provider === 'codex') {
+    result = await runBounded('codex', [
       'exec',
       '--sandbox', 'read-only',
       '--skip-git-repo-check',
@@ -185,16 +281,25 @@ async function executeProof(provider: ProofProvider, signal?: AbortSignal): Prom
       '--ephemeral',
       '-',
     ], PROOF_PROMPT, 120_000, signal)
+  } else {
+    const binary = resolveAgentBinary()
+    result = binary
+      ? await runBounded(binary, cursorProofArgs(), PROOF_PROMPT, CURSOR_PROOF_TIMEOUT_MS, signal)
+      : { code: null, stdout: '', stderr: 'ENOENT: cursor agent binary not found', timedOut: false, aborted: false }
+  }
   const text = provider === 'claude'
     ? claudeProofText(result.stdout)
-    : codexProofText(result.stdout)
+    : provider === 'codex' ? codexProofText(result.stdout) : cursorProofText(result.stdout)
   const ok = result.code === 0 && text === PROOF_TOKEN
+  if (ok) return { provider, ok, durationMs: Date.now() - started, cached: false }
+  const code = classifyProofFailure(result, text)
   return {
     provider,
-    ok,
+    ok: false,
     durationMs: Date.now() - started,
     cached: false,
-    ...(ok ? {} : { error: safeProofError(result) }),
+    error: describeProofCode(code, result),
+    code,
   }
 }
 

package/server/lib/query-job-runtime.ts

@@ -112,6 +112,14 @@ function providerFor(model: ModelPreference): 'claude' | 'codex' | 'cursor' | 'o
   return isCodexModel(model) ? 'codex' : 'claude'
 }
 
+/** The origin label as it travels on the display bus and the message views:
+ * FLATTENED (`origin: 'routine', originId: 'morning-brief'`) so every client
+ * parses one shape, and identical on `start`, `done` and `error`. Spread LAST
+ * into each event so no provider metadata key can overwrite it. */
+function originStamp(request: QueryJobRequest): { origin?: NonNullable<QueryJobRequest['origin']>['kind']; originId?: string } {
+  return request.origin ? { origin: request.origin.kind, originId: request.origin.id } : {}
+}
+
 /** Project the authoritative terminal journal into the derived conversation
  * cache. Journaled request/response text always wins over bridge-written
  * partial rows; validated media refs may be merged because output media can
@@ -148,6 +156,7 @@ async function projectPublicConversationTerminal(
     request.attachmentRefs,
     request.messageEra,
     normalizeModelPreference(request.model),
+    request.origin,
   )
   reconcileExchangeByJobIdentity(
     request.sessionId,
@@ -158,6 +167,7 @@ async function projectPublicConversationTerminal(
     mergeMediaAttachmentRefs(outputAttachments, existingOutputAttachments),
     request.messageEra,
     normalizeModelPreference(request.model),
+    request.origin,
   )
   flushConversationToDisk()
 }
@@ -203,6 +213,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           sessionId,
           cliSessionId,
           ...metadata,
+          ...originStamp(request),
         } })
       },
       onProviderProcess: metadata => callbacks.onProviderProcess({
@@ -281,6 +292,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
             cliSessionId,
             ...runMetadata,
             ...(attachments.length > 0 ? { attachments } : {}),
+            ...originStamp(request),
           } })
         } finally {
           attachmentLease?.release()
@@ -296,6 +308,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           turnId,
           messageEra: request.messageEra,
           globalMsgNum: request.globalMsgNum,
+          ...originStamp(request),
           error,
         } })
       },

package/server/lib/query-job-store.ts

@@ -13,6 +13,7 @@ import {
   isTerminalQueryJobStatus,
   normalizeQueryJobError,
   parseQueryJobOutputImageStats,
+  originWasDropped,
   parseQueryJobRequest,
   requestFingerprint,
   sanitizeQueryJobActivity,
@@ -317,6 +318,8 @@ export class QueryJobStore {
       journalFailures: 0,
       interruptedOnBoot: 0,
       evictedHydratedJobs: 0,
+      originDropped: 0,
+      fingerprintMismatches: 0,
       lastErrorCode: null,
       lastSuccessfulWriteAt: null,
       rootFingerprint: createHash('sha256').update(options.root).digest('hex').slice(0, 16),
@@ -436,10 +439,25 @@ export class QueryJobStore {
     if (!hydrated) {
       if (record.type !== 'accepted' || !record.request || record.eventSeq !== 1) return undefined
       let request: QueryJobRequest
+      // Lenient: a record written by another build hydrates with an unknown
+      // origin dropped (and counted) rather than being discarded.
       try { request = parseQueryJobRequest(record.request) } catch { return undefined }
+      // Counted once per job: ensureHydrated replays this same record after an
+      // LRU eviction, and by then the identity is already registered below.
+      // (The mismatch counter needs no such guard: a mismatch returns before
+      // the identity is registered, so a replay can never reach it.)
+      if (!this.identitiesByJobId.has(record.jobId) && originWasDropped(record.request, request)) this.health.originDropped++
       const fingerprint = requestFingerprint(request)
-      if (fingerprint !== record.requestFingerprint
-        || request.clientJobId !== record.clientJobId
+      if (fingerprint !== record.requestFingerprint) {
+        // A mismatch DROPS the job from hydration. Say so once, loudly: a
+        // counter in /api/health is read after the history has already gone.
+        if (this.health.fingerprintMismatches === 0) {
+          console.error(`[query-jobs] journal fingerprint mismatch for ${record.jobId}; the job is not hydrated (the running build picks different identity keys than the writer, or the record was edited)`)
+        }
+        this.health.fingerprintMismatches++
+        return undefined
+      }
+      if (request.clientJobId !== record.clientJobId
         || request.generation !== record.generation) return undefined
       const acceptedAt = record.persistedAt
       const retentionUntil = new Date(new Date(acceptedAt).getTime() + this.retentionDays * 86_400_000).toISOString()
@@ -626,7 +644,13 @@ export class QueryJobStore {
 
   async admit(raw: unknown): Promise<QueryJobAdmissionResult> {
     await this.ensureInitialized()
-    const request = parseQueryJobRequest(raw)
+    // Strict only where strictness is safe on the public route: a KNOWN kind
+    // with an id this server cannot accept is a bug in the scheduler or the
+    // dispatcher that stamped it and throws (→ 400). An unknown kind, or the
+    // phone's bare-string stamp, is dropped and counted below — once per job
+    // created, never per retry of the same identity.
+    const request = parseQueryJobRequest(raw, { strictOrigin: true })
+    const originDropped = originWasDropped(raw, request)
     const fingerprint = requestFingerprint(request)
     const existingIdentity = this.identitiesByKey.get(identityKey(request.clientJobId, request.generation))
     if (existingIdentity) await this.ensureHydrated(existingIdentity.jobId)
@@ -663,6 +687,7 @@ export class QueryJobStore {
       const highestGeneration = lineage.reduce((max, item) => Math.max(max, item.generation), 0)
       if (request.generation <= highestGeneration) throw new QueryJobGenerationOrderError(request.clientJobId)
 
+      if (originDropped) this.health.originDropped++
       const now = this.now().toISOString()
       const jobId = randomUUID()
       const turnId = randomUUID()

package/server/lib/query-job-types.ts

@@ -52,6 +52,36 @@ export interface QueryJobPromptReference {
   response: string
 }
 
+/**
+ * Who STARTED a job, when it was not the person holding the phone or the
+ * glasses. A label, nothing more: the server never infers anything from its
+ * absence (Miles, 2026-09-02). `routine` is the scheduler (`morning-brief`),
+ * `task` is a dispatch of a captured task (the id is the task's 12-hex id).
+ * Human prompts typed on the phone carry no origin. The phone stamps `g2`
+ * locally for prompts spoken on the glasses, as a bare string; if that string
+ * ever reaches this route it is dropped and counted, never rejected.
+ */
+export interface QueryJobOrigin {
+  kind: 'routine' | 'task'
+  id: string
+}
+
+/** One alphabet for both kinds: `morning-brief` and a 12-hex task id both fit.
+ * Up to 64 chars is this server's own bound (a routine slug, a 12-hex task id
+ * and a bare sha256 all fit); COS Control 0.5.185 mirrors it in its allowlist. */
+export const QUERY_JOB_ORIGIN_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/
+
+export interface ParseQueryJobRequestOptions {
+  /** Admission (the public job route reaches the parser with this on): a KNOWN
+   * kind whose id fails the alphabet is a bug in the server's own scheduler or
+   * dispatcher, and throws. An UNKNOWN kind never throws on any path — it is a
+   * label this build cannot render, dropped and counted, so a newer client is
+   * never refused. Hydration leaves this off: a record written by another
+   * build must still hydrate. A bare STRING origin is dropped on both paths —
+   * it is the phone's local `'g2'` shape, never an error. */
+  strictOrigin?: boolean
+}
+
 /** Immutable, persistence-safe request. Provider-only objects (paths, image
  * bytes, AbortControllers, handoff runtime state) deliberately do not fit. */
 export interface QueryJobRequest {
@@ -72,6 +102,10 @@ export interface QueryJobRequest {
   attachmentIds: string[]
   attachmentRefs: MediaAttachmentRef[]
   activityToolMode: QueryJobActivityMode
+  /** Present only on server-started jobs. NOT part of the request fingerprint
+   * (see `FINGERPRINT_KEYS`), so a rollback to a build that drops it still
+   * hydrates the journal. */
+  origin?: QueryJobOrigin
 }
 
 export interface QueryJobProviderLinkage {
@@ -177,6 +211,13 @@ export interface QueryJobStoreHealth {
   journalFailures: number
   interruptedOnBoot: number
   evictedHydratedJobs: number
+  /** Requests whose `origin` was present but not one this build recognises
+   * (a bare string, or an object of a later build's kind) and was dropped. */
+  originDropped: number
+  /** Journal `accepted` records whose stored fingerprint no longer matches the
+   * running build's `requestFingerprint` — each one is a job that did NOT
+   * hydrate. Zero is the only healthy value. */
+  fingerprintMismatches: number
   lastErrorCode: string | null
   lastSuccessfulWriteAt: string | null
   rootFingerprint: string
@@ -226,7 +267,7 @@ function boundedContent(value: unknown, field: string, max: number, allowEmpty =
 
 /** Parse untrusted admission input into the only request shape allowed in the
  * private journal. Unknown keys are dropped before fingerprinting. */
-export function parseQueryJobRequest(raw: unknown): QueryJobRequest {
+export function parseQueryJobRequest(raw: unknown, options: ParseQueryJobRequestOptions = {}): QueryJobRequest {
   if (!raw || typeof raw !== 'object') throw new QueryJobValidationError('invalid_request')
   const input = raw as Record<string, unknown>
   const clientJobId = requiredString(input.clientJobId, 'client_job_id', 36).toLowerCase()
@@ -272,6 +313,29 @@ export function parseQueryJobRequest(raw: unknown): QueryJobRequest {
     ? input.activityToolMode
     : 'status'
 
+  // `== null` covers both absent and JSON null, the way `reference` and
+  // `globalMsgNum` are read above. A non-object (the phone's local `'g2'`
+  // string) is silently absent on every path; the store counts the drop.
+  let origin: QueryJobOrigin | undefined
+  if (input.origin != null && typeof input.origin === 'object') {
+    const candidate = input.origin as Record<string, unknown>
+    const kind = candidate.kind
+    const id = candidate.id
+    if (kind === 'routine' || kind === 'task') {
+      if (typeof id === 'string' && QUERY_JOB_ORIGIN_ID_RE.test(id)) {
+        origin = { kind, id }
+      } else if (options.strictOrigin) {
+        // A kind this build knows with an id it cannot accept is a bug in the
+        // caller that stamped it (the scheduler, the dispatcher): loud.
+        throw new QueryJobValidationError('invalid_origin')
+      }
+    }
+    // A kind this build does NOT know is a label it cannot render, never a
+    // reason to refuse the job: the public job route reaches this parser with
+    // strictOrigin, so an unknown kind must degrade to unlabeled (and be
+    // counted by the store), or a newer client would have every prompt 400'd.
+  }
+
   const attachmentIds = parseMediaIdList(input.attachmentIds)
   const attachmentRefs = parseMediaAttachmentRefs(input.attachmentRefs ?? input.attachments)
   if (!query.trim() && attachmentIds.length === 0 && attachmentRefs.length === 0) {
@@ -295,9 +359,19 @@ export function parseQueryJobRequest(raw: unknown): QueryJobRequest {
     attachmentIds,
     attachmentRefs,
     activityToolMode,
+    ...(origin ? { origin } : {}),
   }
 }
 
+/** True when the raw admission/journal input carried an `origin` the parser
+ * did not keep — a bare string, or an object shape this build does not know.
+ * The store counts these; the parser stays pure. */
+export function originWasDropped(raw: unknown, request: QueryJobRequest): boolean {
+  if (!raw || typeof raw !== 'object') return false
+  const rawOrigin = (raw as Record<string, unknown>).origin
+  return rawOrigin != null && request.origin == null
+}
+
 function canonical(value: unknown): unknown {
   if (Array.isArray(value)) return value.map(canonical)
   if (!value || typeof value !== 'object') return value
@@ -305,8 +379,49 @@ function canonical(value: unknown): unknown {
   return Object.fromEntries(Object.keys(record).sort().map(key => [key, canonical(record[key])]))
 }
 
+/**
+ * The request keys that make up a job's IDENTITY — frozen at the sixteen keys
+ * `QueryJobRequest` had before `origin` existed. Provenance and enforcement
+ * keys (`origin`, and any later `trustMode`/`toolAllowlist`) are deliberately
+ * outside it: a build that does not know a key must still hydrate the journal
+ * a newer build wrote, and a rollback must never discard a week of jobs.
+ *
+ * Consequence, stated: two submissions for the same (clientJobId, generation)
+ * that differ only in those excluded keys are the SAME job, and the second
+ * returns the first. The scheduled brief reuses one identity per DAY across
+ * its three attempts, and its excluded keys never differ between attempts; a
+ * genuine resubmit differs in `globalMsgNum`, which IS in the fingerprint, so
+ * it conflicts rather than silently adopting. Phone prompts never send an
+ * excluded key.
+ *
+ * Pick contract: an absent key stays absent. The parser never materialises an
+ * optional as null/''/0/[] (every optional is a conditional spread in its
+ * return literal), and `JSON.stringify` drops an undefined value, so the pick
+ * needs no guard of its own. A `?? null` pick WOULD re-hash every stored
+ * request and silently drop the journal; the test pins that property.
+ */
+export const FINGERPRINT_KEYS = [
+  'clientJobId', 'generation', 'query', 'sessionId', 'model', 'effort',
+  'cursorExecutionMode', 'messageEra', 'globalMsgNum', 'reference', 'handoffCode',
+  'handoffLatest', 'clientQueueItemId', 'attachmentIds', 'attachmentRefs',
+  'activityToolMode',
+] as const satisfies readonly (keyof QueryJobRequest)[]
+
+/** The request keys deliberately OUTSIDE the identity. Every key of
+ * `QueryJobRequest` must appear in exactly one of the two lists: adding a key
+ * without naming it here or above fails to compile, so the author picks a side. */
+export const FINGERPRINT_EXCLUDED = ['origin'] as const satisfies readonly (keyof QueryJobRequest)[]
+type FingerprintUncovered = Exclude<keyof QueryJobRequest, typeof FINGERPRINT_KEYS[number] | typeof FINGERPRINT_EXCLUDED[number]>
+export const FINGERPRINT_KEYS_COVER_REQUEST: FingerprintUncovered extends never ? true : never = true
+
+function pickFingerprintKeys(request: QueryJobRequest): Record<string, unknown> {
+  const picked: Record<string, unknown> = {}
+  for (const key of FINGERPRINT_KEYS) picked[key] = request[key]
+  return picked
+}
+
 export function requestFingerprint(request: QueryJobRequest): string {
-  return createHash('sha256').update(JSON.stringify(canonical(request))).digest('hex')
+  return createHash('sha256').update(JSON.stringify(canonical(pickFingerprintKeys(request)))).digest('hex')
 }
 
 export function isTerminalQueryJobStatus(status: QueryJobStatus): status is QueryJobTerminalStatus {

package/server/routes/health.ts

@@ -101,6 +101,9 @@ function durableQueryJobStatus() {
       retainedIdentities: runtime.store.retainedIdentities,
       subscribers: runtime.store.subscribers,
       malformedRows: runtime.store.malformedRows,
+      originDropped: runtime.store.originDropped,
+      fingerprintMismatches: runtime.store.fingerprintMismatches,
+      evictedHydratedJobs: runtime.store.evictedHydratedJobs,
       journalFailures: runtime.store.journalFailures,
       interruptedOnBoot: runtime.store.interruptedOnBoot,
       lastErrorCode: runtime.store.lastErrorCode,

package/server/routes/message-ref.ts

@@ -126,7 +126,8 @@ export function resolveFromArchiveDir(
  *  global numbers (the archive-lib read path strips globalMsgNum; the browser
  *  needs it so "reference message N" is self-evident from the screen). Same
  *  user->next-assistant pairing as the lib; the pair's number is the user
- *  turn's stamp (falling back to the assistant's). Dir-param form for tests. */
+ *  turn's stamp (falling back to the assistant's). Dir-param form for tests.
+ *  Deliberately no origin label here (6.43.4): the day view carries it. */
 export function readArchiveChatNumbered(
   dir: string,
   date: string,

package/server/routes/provider-proof.ts

@@ -1,5 +1,5 @@
 import { Router } from 'express'
-import { runProviderProof, type ProofProvider } from '../lib/provider-proof.js'
+import { PROOF_PROVIDERS, runProviderProof, type ProofProvider } from '../lib/provider-proof.js'
 import {
   acquireMaintenanceWork,
   maintenanceErrorPayload,
@@ -17,8 +17,8 @@ providerProofRouter.post('/diagnostics/provider-proof', async (req, res) => {
     || address.startsWith('127.') || address.startsWith('::ffff:127.')
   if (!loopback) return res.status(403).json({ error: 'loopback_required' })
   const provider = req.body?.provider
-  if (provider !== 'claude' && provider !== 'codex') {
-    return res.status(400).json({ error: 'provider must be claude or codex' })
+  if (!PROOF_PROVIDERS.includes(provider)) {
+    return res.status(400).json({ error: 'provider must be claude, codex, or cursor', code: 'provider_unknown' })
   }
   const controllerProof = maintenanceOperationCredentialsValid({
     leaseId: typeof req.headers['x-cos-maintenance-lease'] === 'string'

package/server/routes/sessions.ts

@@ -79,7 +79,9 @@ sessionsRouter.post('/sessions/:id/context-break', (req, res) => {
   res.json({ ok: true })
 })
 
-// GET /api/sessions/:id/messages — client-compatible format (paired Q&A)
+// GET /api/sessions/:id/messages — client-compatible format (paired Q&A).
+// Deliberately carries no origin/originId (6.43.4): this is the legacy paired
+// shape. The labelled views are today/all-messages and the day archive.
 sessionsRouter.get('/sessions/:id/messages', (req, res) => {
   const exchanges = getHistory(req.params.id)
   if (exchanges.length === 0) {
@@ -315,6 +317,8 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
     globalMsgNum?: number
     messageEra?: string
     modelPreference?: string
+    origin?: 'routine' | 'task'
+    originId?: string
     attachments?: MediaAttachmentRef[]
   }> = []
   const liveSessions = getActiveSessions()
@@ -331,6 +335,10 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
           const messageEra = ex.messageEra ?? next.messageEra
           const attachments = turnAttachments(session.id, globalMsgNum, messageEra, activeEra, ex.attachments, next.attachments)
           const modelPreference = resolveExchangePairModel(ex, next, session.modelPreference)
+          // Both halves of a pair are stamped together by the terminal
+          // projection; pick BOTH fields from ONE half so a mid-run insert
+          // (stamped later) can never pair one half's kind with the other's id.
+          const stamped = ex.origin ? ex : next
           liveMessages.push({
             query: ex.content,
             text: next.content,
@@ -341,6 +349,7 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
             ...(globalMsgNum != null ? { no: globalMsgNum, globalMsgNum } : {}),
             ...(messageEra ? { messageEra } : {}),
             ...(modelPreference ? { modelPreference } : {}),
+            ...(stamped.origin ? { origin: stamped.origin, ...(stamped.originId ? { originId: stamped.originId } : {}) } : {}),
             ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++