@gotcos/glasses-server 6.43.3 → 6.44.0

package/server/lib/morning-brief-scheduler.ts

@@ -70,6 +70,10 @@ export interface MorningBriefSchedulerDeps {
   now?: () => number
   tickMs?: number
   log?: (line: string) => void
+  dispatchDueTasks?: () => Promise<{ fired: number; reason?: string }>
+  reconcileDispatch?: () => Promise<{ fired: number; reason?: string }>
+  onDispatch?: (result: { fired: number; reason?: string }) => void
+  taskDigest?: (day: string) => string | Promise<string>
 }
 
 export class MorningBriefRunError extends Error {
@@ -108,6 +112,9 @@ export type TickResult =
 
 /** Deterministic v4-shaped client id for one local day, so a retry after a
  * crashed submission admits as the SAME job. The store dedupes on it. */
+/** The routine id every surface renders as ROUTINE for the morning brief. */
+export const MORNING_BRIEF_ROUTINE_ID = 'morning-brief'
+
 export function scheduledClientJobId(day: string, timezone: string): string {
   const digest = createHash('sha256').update(`morning-brief|${timezone}|${day}`).digest()
   const bytes = Buffer.from(digest.subarray(0, 16))
@@ -128,6 +135,13 @@ export class MorningBriefScheduler {
   private ledger: MorningBriefLedger
   private timer: ReturnType<typeof setInterval> | null = null
   private tickInFlight: Promise<TickResult> | null = null
+  /** One chain for tick() AND runNow(): the in-progress read in runNow and the
+   * ledger write in fire() must never interleave with a scheduled fire. */
+  private serial: Promise<unknown> = Promise.resolve()
+  private serialTasks: Promise<unknown> = Promise.resolve()
+  private serialTasksDepth = 0
+  private dispatchInFlight: Promise<unknown> | null = null
+  private reconcileInFlight: Promise<unknown> | null = null
   private readonly now: () => number
   private readonly log: (line: string) => void
   readonly quarantinedConfig?: string
@@ -151,7 +165,11 @@ export class MorningBriefScheduler {
   start(): void {
     if (this.timer) return
     const tickMs = Math.max(1_000, this.deps.tickMs ?? 30_000)
-    this.timer = setInterval(() => { void this.tick() }, tickMs)
+    // A rejected tick must never become an unhandled rejection (Node exits on
+    // one by default): log it and let the next interval try again.
+    this.timer = setInterval(() => {
+      this.tick().catch(error => this.log(`tick failed: ${error instanceof Error ? error.message : String(error)}`))
+    }, tickMs)
     this.timer.unref?.()
     this.log(`scheduled ${this.config.enabled ? `daily at ${this.config.time} ${this.config.timezone}` : 'off'} · next ${nextScheduledFire(this.config, this.now()) ?? 'none'}`)
   }
@@ -180,11 +198,50 @@ export class MorningBriefScheduler {
 
   /** One scheduler pass. Serialised: a slow submission never overlaps the next tick. */
   tick(): Promise<TickResult> {
+    if (this.deps.dispatchDueTasks && !this.dispatchInFlight) {
+      const mine = this.serializeTaskWork(() => this.deps.dispatchDueTasks!())
+      this.dispatchInFlight = mine
+      void mine.then(
+        result => this.deps.onDispatch?.(result),
+        () => undefined,
+      ).finally(() => {
+        if (this.dispatchInFlight === mine) this.dispatchInFlight = null
+      })
+    }
+    if (this.deps.reconcileDispatch && !this.reconcileInFlight) {
+      const mine = this.serializeTaskWork(() => this.deps.reconcileDispatch!())
+      this.reconcileInFlight = mine
+      void mine.finally(() => {
+        if (this.reconcileInFlight === mine) this.reconcileInFlight = null
+      })
+    }
     if (this.tickInFlight) return this.tickInFlight
-    this.tickInFlight = this.runTick().finally(() => { this.tickInFlight = null })
+    this.tickInFlight = this.serialize(() => this.runTick()).finally(() => { this.tickInFlight = null })
     return this.tickInFlight
   }
 
+  private serialize<T>(fn: () => Promise<T>): Promise<T> {
+    const next = this.serial.then(fn, fn)
+    this.serial = next.then(() => undefined, () => undefined)
+    return next
+  }
+
+  private serializeTaskWork<T>(fn: () => Promise<T> | T): Promise<T> {
+    if (this.serialTasksDepth > 0) {
+      return Promise.reject(new Error('nested serializeTaskWork'))
+    }
+    const run = this.serialTasks.then(async () => {
+      this.serialTasksDepth += 1
+      try {
+        return await fn()
+      } finally {
+        this.serialTasksDepth -= 1
+      }
+    })
+    this.serialTasks = run.then(() => undefined, () => undefined)
+    return run
+  }
+
   private async runTick(): Promise<TickResult> {
     if (!this.deps.durableJobsEnabled()) return { fired: false, reason: 'durable_jobs_off' }
     if (!this.deps.admissionsOpen()) return { fired: false, reason: 'admissions_closed' }
@@ -195,7 +252,11 @@ export class MorningBriefScheduler {
   }
 
   /** "Run now" from a settings surface. Bounded per day; refused while a brief is live. */
-  async runNow(): Promise<MorningBriefRun> {
+  runNow(): Promise<MorningBriefRun> {
+    return this.serialize(() => this.runNowInner())
+  }
+
+  private async runNowInner(): Promise<MorningBriefRun> {
     if (!this.deps.durableJobsEnabled()) {
       throw new MorningBriefRunError(409, 'durable_jobs_off', 'Turn on Background jobs in COS Control to run the brief.')
     }
@@ -227,14 +288,45 @@ export class MorningBriefScheduler {
       ? scheduledClientJobId(day, this.config.timezone)
       : randomUUID()
 
-    // Resume: a ledger row with no job id. Adopt an admission the coordinator
-    // may already hold for this identity before considering a fresh submit.
-    if (resume) {
+    // Adopt before minting, on EVERY scheduled fire — not only the crash-resume
+    // branch. A submit that threw after admission, a ledger row lost to
+    // quarantine, and a plain resume all find the coordinator already holding
+    // this day's identity. A manual fire mints a fresh UUID and can never hit,
+    // so it skips the round trip. Reusing `existing.globalMsgNum` is safe even
+    // though liveReservations() skips submitError rows: the store's own
+    // reservation source (query-job-runtime registers the coordinator's live
+    // identities) holds an admitted job's number independently of the ledger.
+    if (trigger === 'scheduled') {
       const existing = await this.deps.findByClientGeneration(clientJobId, 1).catch(() => undefined)
       if (existing) {
-        const adopted: MorningBriefRun = { ...resume, jobId: existing.jobId, lastKnownStatus: existing.status }
+        const priorRow = resume ?? this.ledger.runs.filter(r => r.day === day && r.trigger === trigger).at(-1)
+        // Carry every current and future ledger field from the row being
+        // replaced; drop only the submit error (the job exists), then override
+        // the identity and provenance columns from what is actually admitted.
+        const { submitError: _dropped, ...carried } = priorRow ?? {}
+        const adopted: MorningBriefRun = {
+          ...carried,
+          id: priorRow?.id ?? randomUUID(),
+          day,
+          trigger,
+          attempt,
+          firedAt: priorRow?.firedAt ?? existing.acceptedAt,
+          clientJobId,
+          generation: 1,
+          sessionId: priorRow?.sessionId ?? existing.sessionId,
+          messageEra: priorRow?.messageEra ?? existing.messageEra ?? this.deps.currentMessageEra(),
+          globalMsgNum: priorRow?.globalMsgNum ?? existing.globalMsgNum ?? this.deps.currentMessageMax() + 1,
+          sections: priorRow?.sections ?? briefSections(this.config, day),
+          jobId: existing.jobId,
+          lastKnownStatus: existing.status,
+        }
+        if (priorRow?.globalMsgNum == null && existing.globalMsgNum == null) {
+          this.log(`adopted job ${existing.jobId} carried no message number; minted #${adopted.globalMsgNum}`)
+        }
+        // Reusing the prior row's id makes replaceRun REPLACE the day's row
+        // rather than push a second one for the same job.
         this.replaceRun(adopted)
-        this.log(`adopted ${trigger} brief for ${day} as job ${existing.jobId}`)
+        this.log(`adopted ${trigger} brief for ${day} as job ${existing.jobId} (${priorRow ? `replacing ledger row ${priorRow.id}` : 'no ledger row'})`)
         return adopted
       }
     }
@@ -258,7 +350,14 @@ export class MorningBriefScheduler {
     // Ledger first. A crash after this line is a resume, not a second brief.
     this.replaceRun(run)
 
-    const prompt = composeMorningBriefPrompt({ config: this.config, day, ownerName: this.deps.ownerName(), trigger })
+    const digest = this.deps.taskDigest ? await this.deps.taskDigest(day) : undefined
+    const prompt = composeMorningBriefPrompt({
+      config: this.config,
+      day,
+      ownerName: this.deps.ownerName(),
+      trigger,
+      ...(digest ? { taskDigest: digest } : {}),
+    })
     try {
       const admission = await this.deps.submit({
         clientJobId,
@@ -272,6 +371,9 @@ export class MorningBriefScheduler {
         activityToolMode: 'status',
         attachmentIds: [],
         attachmentRefs: [],
+        // The label every surface renders as ROUTINE. Outside the fingerprint,
+        // so a run admitted on 6.43.3 still adopts here by identity.
+        origin: { kind: 'routine', id: MORNING_BRIEF_ROUTINE_ID },
       })
       const accepted: MorningBriefRun = { ...run, jobId: admission.job.jobId, lastKnownStatus: admission.job.status }
       this.replaceRun(accepted)

package/server/lib/python-bridge.ts

@@ -78,9 +78,9 @@ if (pythonAvailable) {
  * pipeline is configured; otherwise resolves to an empty/no-op result so the
  * context builder degrades gracefully on a standalone install.
  */
-export function callPython(args: string[], timeoutMs = 30_000): Promise<unknown> {
+export function callPython(args: string[], timeoutMs = 30_000, input?: string): Promise<unknown> {
   if (pythonAvailable) {
-    return callPythonDirect(args, timeoutMs)
+    return callPythonDirect(args, timeoutMs, input)
   }
   return Promise.resolve(standaloneNoop(args))
 }
@@ -186,6 +186,13 @@ function standaloneNoop(args: string[]): unknown {
       return { error: 'cos_pipeline_not_configured' }
     }
     case 'badges': return {}
+    case 'task-rows':
+    case 'task-capture':
+    case 'task-set-run-at':
+    case 'task-set-marker':
+    case 'task-move':
+    case 'task-check':
+      return { error: { code: 'cos_pipeline_not_configured' } }
     default: return {}
   }
 }
@@ -199,15 +206,18 @@ function argLimit(args: string[], fallback: number): number {
 }
 
 /** Full Python bridge — requires the user's venv + cos_api_bridge.py. */
-function callPythonDirect(args: string[], timeoutMs: number): Promise<unknown> {
+function callPythonDirect(args: string[], timeoutMs: number, input?: string): Promise<unknown> {
   return new Promise((resolvePromise, reject) => {
-    execFile(
+    const child = execFile(
       PYTHON_BIN!,
       [BRIDGE_SCRIPT!, ...args],
       { cwd: COS_SCRIPTS_DIR!, timeout: timeoutMs, maxBuffer: 1024 * 1024 },
       (err, stdout, stderr) => {
         if (err) {
           const msg = stderr?.trim() || err.message
+          if (typeof msg === 'string' && msg.includes('unknown command')) {
+            return resolvePromise({ error: { code: 'cos_pipeline_not_configured', message: msg } })
+          }
           return reject(new Error(`python-bridge: ${msg}`))
         }
         try {
@@ -217,5 +227,9 @@ function callPythonDirect(args: string[], timeoutMs: number): Promise<unknown> {
         }
       }
     )
+    if (input != null) {
+      child.stdin?.write(input)
+      child.stdin?.end()
+    }
   })
 }

package/server/lib/query-job-coordinator.ts

@@ -3,6 +3,7 @@ import {
   QueryJobStore,
   QueryJobStoreError,
   type QueryJobAdmissionResult,
+  type QueryJobMutationResult,
   type QueryJobSubscription,
 } from './query-job-store.js'
 import {
@@ -502,7 +503,7 @@ export class QueryJobCoordinator {
     }
   }
 
-  async cancel(jobId: string, generation: number): Promise<QueryJobSnapshot> {
+  async cancel(jobId: string, generation: number): Promise<QueryJobMutationResult> {
     const result = await this.store.cancel(jobId, generation)
     if (result.applied) {
       const active = this.active.get(jobId)
@@ -514,7 +515,12 @@ export class QueryJobCoordinator {
         this.finishActive(active)
       }
     }
-    return result.job
+    return result
+  }
+
+  finishIfActive(jobId: string): void {
+    const active = this.active.get(jobId)
+    if (active) this.finishActive(active)
   }
 
   getSnapshot(jobId: string, generation?: number): Promise<QueryJobSnapshot> {

package/server/lib/query-job-runtime.ts

@@ -92,8 +92,14 @@ export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<
   }
   try {
     const resolved = await resolveQueryAttachments(input)
+    const { dispatch: _strippedDispatch, origin: rawOrigin, ...rest } = input
+    const origin = (rawOrigin && typeof rawOrigin === 'object' && (rawOrigin as { kind?: string }).kind === 'task')
+      ? undefined
+      : rawOrigin
+    if (_strippedDispatch !== undefined || origin !== rawOrigin) queryJobStore.noteOriginStripped()
     return {
-      ...input,
+      ...rest,
+      ...(origin !== undefined ? { origin } : {}),
       messageEra: activeEra,
       attachmentIds: resolved.ids,
       attachmentRefs: resolved.refs,
@@ -112,11 +118,19 @@ function providerFor(model: ModelPreference): 'claude' | 'codex' | 'cursor' | 'o
   return isCodexModel(model) ? 'codex' : 'claude'
 }
 
+/** The origin label as it travels on the display bus and the message views:
+ * FLATTENED (`origin: 'routine', originId: 'morning-brief'`) so every client
+ * parses one shape, and identical on `start`, `done` and `error`. Spread LAST
+ * into each event so no provider metadata key can overwrite it. */
+function originStamp(request: QueryJobRequest): { origin?: NonNullable<QueryJobRequest['origin']>['kind']; originId?: string } {
+  return request.origin ? { origin: request.origin.kind, originId: request.origin.id } : {}
+}
+
 /** Project the authoritative terminal journal into the derived conversation
  * cache. Journaled request/response text always wins over bridge-written
  * partial rows; validated media refs may be merged because output media can
  * finish immediately before a crash. Exact provenance collapses duplicates. */
-async function projectPublicConversationTerminal(
+export async function projectPublicConversationTerminal(
   job: QueryJobSnapshot,
   request: QueryJobRequest,
 ): Promise<void> {
@@ -148,6 +162,7 @@ async function projectPublicConversationTerminal(
     request.attachmentRefs,
     request.messageEra,
     normalizeModelPreference(request.model),
+    request.origin,
   )
   reconcileExchangeByJobIdentity(
     request.sessionId,
@@ -158,6 +173,7 @@ async function projectPublicConversationTerminal(
     mergeMediaAttachmentRefs(outputAttachments, existingOutputAttachments),
     request.messageEra,
     normalizeModelPreference(request.model),
+    request.origin,
   )
   flushConversationToDisk()
 }
@@ -203,6 +219,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           sessionId,
           cliSessionId,
           ...metadata,
+          ...originStamp(request),
         } })
       },
       onProviderProcess: metadata => callbacks.onProviderProcess({
@@ -281,6 +298,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
             cliSessionId,
             ...runMetadata,
             ...(attachments.length > 0 ? { attachments } : {}),
+            ...originStamp(request),
           } })
         } finally {
           attachmentLease?.release()
@@ -296,6 +314,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           turnId,
           messageEra: request.messageEra,
           globalMsgNum: request.globalMsgNum,
+          ...originStamp(request),
           error,
         } })
       },
@@ -321,6 +340,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
       requestAttachments: resolvedAttachments.refs,
       attachmentPromptBlock: resolvedAttachments.promptBlock,
       sessionLockHeld: true,
+      ...(request.dispatch ? { dispatch: request.dispatch } : {}),
     },
   )
 }

package/server/lib/query-job-store.ts

@@ -13,6 +13,7 @@ import {
   isTerminalQueryJobStatus,
   normalizeQueryJobError,
   parseQueryJobOutputImageStats,
+  originWasDropped,
   parseQueryJobRequest,
   requestFingerprint,
   sanitizeQueryJobActivity,
@@ -317,6 +318,9 @@ export class QueryJobStore {
       journalFailures: 0,
       interruptedOnBoot: 0,
       evictedHydratedJobs: 0,
+      originDropped: 0,
+      originStripped: 0,
+      fingerprintMismatches: 0,
       lastErrorCode: null,
       lastSuccessfulWriteAt: null,
       rootFingerprint: createHash('sha256').update(options.root).digest('hex').slice(0, 16),
@@ -436,10 +440,25 @@ export class QueryJobStore {
     if (!hydrated) {
       if (record.type !== 'accepted' || !record.request || record.eventSeq !== 1) return undefined
       let request: QueryJobRequest
+      // Lenient: a record written by another build hydrates with an unknown
+      // origin dropped (and counted) rather than being discarded.
       try { request = parseQueryJobRequest(record.request) } catch { return undefined }
+      // Counted once per job: ensureHydrated replays this same record after an
+      // LRU eviction, and by then the identity is already registered below.
+      // (The mismatch counter needs no such guard: a mismatch returns before
+      // the identity is registered, so a replay can never reach it.)
+      if (!this.identitiesByJobId.has(record.jobId) && originWasDropped(record.request, request)) this.health.originDropped++
       const fingerprint = requestFingerprint(request)
-      if (fingerprint !== record.requestFingerprint
-        || request.clientJobId !== record.clientJobId
+      if (fingerprint !== record.requestFingerprint) {
+        // A mismatch DROPS the job from hydration. Say so once, loudly: a
+        // counter in /api/health is read after the history has already gone.
+        if (this.health.fingerprintMismatches === 0) {
+          console.error(`[query-jobs] journal fingerprint mismatch for ${record.jobId}; the job is not hydrated (the running build picks different identity keys than the writer, or the record was edited)`)
+        }
+        this.health.fingerprintMismatches++
+        return undefined
+      }
+      if (request.clientJobId !== record.clientJobId
         || request.generation !== record.generation) return undefined
       const acceptedAt = record.persistedAt
       const retentionUntil = new Date(new Date(acceptedAt).getTime() + this.retentionDays * 86_400_000).toISOString()
@@ -626,7 +645,13 @@ export class QueryJobStore {
 
   async admit(raw: unknown): Promise<QueryJobAdmissionResult> {
     await this.ensureInitialized()
-    const request = parseQueryJobRequest(raw)
+    // Strict only where strictness is safe on the public route: a KNOWN kind
+    // with an id this server cannot accept is a bug in the scheduler or the
+    // dispatcher that stamped it and throws (→ 400). An unknown kind, or the
+    // phone's bare-string stamp, is dropped and counted below — once per job
+    // created, never per retry of the same identity.
+    const request = parseQueryJobRequest(raw, { strictOrigin: true })
+    const originDropped = originWasDropped(raw, request)
     const fingerprint = requestFingerprint(request)
     const existingIdentity = this.identitiesByKey.get(identityKey(request.clientJobId, request.generation))
     if (existingIdentity) await this.ensureHydrated(existingIdentity.jobId)
@@ -663,6 +688,7 @@ export class QueryJobStore {
       const highestGeneration = lineage.reduce((max, item) => Math.max(max, item.generation), 0)
       if (request.generation <= highestGeneration) throw new QueryJobGenerationOrderError(request.clientJobId)
 
+      if (originDropped) this.health.originDropped++
       const now = this.now().toISOString()
       const jobId = randomUUID()
       const turnId = randomUUID()
@@ -1137,6 +1163,10 @@ export class QueryJobStore {
     this.health.counts = counts
   }
 
+  noteOriginStripped(): void {
+    this.health.originStripped++
+  }
+
   getHealth(): QueryJobStoreHealth {
     this.refreshHealth()
     return clone(this.health)

package/server/lib/query-job-types.ts

@@ -52,6 +52,36 @@ export interface QueryJobPromptReference {
   response: string
 }
 
+/**
+ * Who STARTED a job, when it was not the person holding the phone or the
+ * glasses. A label, nothing more: the server never infers anything from its
+ * absence (Miles, 2026-09-02). `routine` is the scheduler (`morning-brief`),
+ * `task` is a dispatch of a captured task (the id is the task's 12-hex id).
+ * Human prompts typed on the phone carry no origin. The phone stamps `g2`
+ * locally for prompts spoken on the glasses, as a bare string; if that string
+ * ever reaches this route it is dropped and counted, never rejected.
+ */
+export interface QueryJobOrigin {
+  kind: 'routine' | 'task'
+  id: string
+}
+
+/** One alphabet for both kinds: `morning-brief` and a 12-hex task id both fit.
+ * Up to 64 chars is this server's own bound (a routine slug, a 12-hex task id
+ * and a bare sha256 all fit); COS Control 0.5.185 mirrors it in its allowlist. */
+export const QUERY_JOB_ORIGIN_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/
+
+export interface ParseQueryJobRequestOptions {
+  /** Admission (the public job route reaches the parser with this on): a KNOWN
+   * kind whose id fails the alphabet is a bug in the server's own scheduler or
+   * dispatcher, and throws. An UNKNOWN kind never throws on any path — it is a
+   * label this build cannot render, dropped and counted, so a newer client is
+   * never refused. Hydration leaves this off: a record written by another
+   * build must still hydrate. A bare STRING origin is dropped on both paths —
+   * it is the phone's local `'g2'` shape, never an error. */
+  strictOrigin?: boolean
+}
+
 /** Immutable, persistence-safe request. Provider-only objects (paths, image
  * bytes, AbortControllers, handoff runtime state) deliberately do not fit. */
 export interface QueryJobRequest {
@@ -72,8 +102,16 @@ export interface QueryJobRequest {
   attachmentIds: string[]
   attachmentRefs: MediaAttachmentRef[]
   activityToolMode: QueryJobActivityMode
+  /** Present only on server-started jobs. NOT part of the request fingerprint
+   * (see `FINGERPRINT_KEYS`), so a rollback to a build that drops it still
+   * hydrates the journal. */
+  origin?: QueryJobOrigin
+  /** Read-only dispatch constraint. Excluded from the fingerprint. */
+  dispatch?: { restricted: true; tools: readonly string[] }
 }
 
+export const DISPATCH_ALLOWED_TOOLS = ['Read', 'Grep', 'Glob'] as const
+
 export interface QueryJobProviderLinkage {
   provider?: 'claude' | 'codex' | 'cursor' | 'ollama'
   resolvedModel?: string
@@ -177,6 +215,15 @@ export interface QueryJobStoreHealth {
   journalFailures: number
   interruptedOnBoot: number
   evictedHydratedJobs: number
+  /** Requests whose `origin` was present but not one this build recognises
+   * (a bare string, or an object of a later build's kind) and was dropped. */
+  originDropped: number
+  /** Public-route admissions that had `dispatch` or `origin.kind==='task'` stripped. */
+  originStripped: number
+  /** Journal `accepted` records whose stored fingerprint no longer matches the
+   * running build's `requestFingerprint` — each one is a job that did NOT
+   * hydrate. Zero is the only healthy value. */
+  fingerprintMismatches: number
   lastErrorCode: string | null
   lastSuccessfulWriteAt: string | null
   rootFingerprint: string
@@ -184,6 +231,10 @@ export interface QueryJobStoreHealth {
 }
 
 const CLIENT_JOB_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+
+export function isClientJobId(value: string): boolean {
+  return CLIENT_JOB_ID_RE.test(value.toLowerCase())
+}
 const SAFE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:@/-]*$/
 const CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g
 const SECRET_PATTERNS: RegExp[] = [
@@ -226,7 +277,7 @@ function boundedContent(value: unknown, field: string, max: number, allowEmpty =
 
 /** Parse untrusted admission input into the only request shape allowed in the
  * private journal. Unknown keys are dropped before fingerprinting. */
-export function parseQueryJobRequest(raw: unknown): QueryJobRequest {
+export function parseQueryJobRequest(raw: unknown, options: ParseQueryJobRequestOptions = {}): QueryJobRequest {
   if (!raw || typeof raw !== 'object') throw new QueryJobValidationError('invalid_request')
   const input = raw as Record<string, unknown>
   const clientJobId = requiredString(input.clientJobId, 'client_job_id', 36).toLowerCase()
@@ -272,6 +323,34 @@ export function parseQueryJobRequest(raw: unknown): QueryJobRequest {
     ? input.activityToolMode
     : 'status'
 
+  // `== null` covers both absent and JSON null, the way `reference` and
+  // `globalMsgNum` are read above. A non-object (the phone's local `'g2'`
+  // string) is silently absent on every path; the store counts the drop.
+  let origin: QueryJobOrigin | undefined
+  if (input.origin != null && typeof input.origin === 'object') {
+    const candidate = input.origin as Record<string, unknown>
+    const kind = candidate.kind
+    const id = candidate.id
+    if (kind === 'routine' || kind === 'task') {
+      if (typeof id === 'string' && QUERY_JOB_ORIGIN_ID_RE.test(id)) {
+        origin = { kind, id }
+      } else if (options.strictOrigin) {
+        // A kind this build knows with an id it cannot accept is a bug in the
+        // caller that stamped it (the scheduler, the dispatcher): loud.
+        throw new QueryJobValidationError('invalid_origin')
+      }
+    }
+    // A kind this build does NOT know is a label it cannot render, never a
+    // reason to refuse the job: the public job route reaches this parser with
+    // strictOrigin, so an unknown kind must degrade to unlabeled (and be
+    // counted by the store), or a newer client would have every prompt 400'd.
+  }
+
+  const dispatch = parseDispatch(input.dispatch)
+  if (options.strictOrigin && origin?.kind === 'task' && !dispatch) {
+    throw new QueryJobValidationError('invalid_dispatch')
+  }
+
   const attachmentIds = parseMediaIdList(input.attachmentIds)
   const attachmentRefs = parseMediaAttachmentRefs(input.attachmentRefs ?? input.attachments)
   if (!query.trim() && attachmentIds.length === 0 && attachmentRefs.length === 0) {
@@ -295,7 +374,32 @@ export function parseQueryJobRequest(raw: unknown): QueryJobRequest {
     attachmentIds,
     attachmentRefs,
     activityToolMode,
+    ...(origin ? { origin } : {}),
+    ...(dispatch ? { dispatch } : {}),
+  }
+}
+
+function parseDispatch(raw: unknown): QueryJobRequest['dispatch'] | undefined {
+  if (raw == null) return undefined
+  if (!raw || typeof raw !== 'object') throw new QueryJobValidationError('invalid_dispatch')
+  const rec = raw as Record<string, unknown>
+  if (rec.restricted !== true || !Array.isArray(rec.tools) || rec.tools.length === 0) {
+    throw new QueryJobValidationError('invalid_dispatch')
   }
+  const tools = rec.tools.map(String)
+  if (tools.some(tool => !(DISPATCH_ALLOWED_TOOLS as readonly string[]).includes(tool))) {
+    throw new QueryJobValidationError('invalid_dispatch')
+  }
+  return { restricted: true, tools }
+}
+
+/** True when the raw admission/journal input carried an `origin` the parser
+ * did not keep — a bare string, or an object shape this build does not know.
+ * The store counts these; the parser stays pure. */
+export function originWasDropped(raw: unknown, request: QueryJobRequest): boolean {
+  if (!raw || typeof raw !== 'object') return false
+  const rawOrigin = (raw as Record<string, unknown>).origin
+  return rawOrigin != null && request.origin == null
 }
 
 function canonical(value: unknown): unknown {
@@ -305,8 +409,49 @@ function canonical(value: unknown): unknown {
   return Object.fromEntries(Object.keys(record).sort().map(key => [key, canonical(record[key])]))
 }
 
+/**
+ * The request keys that make up a job's IDENTITY — frozen at the sixteen keys
+ * `QueryJobRequest` had before `origin` existed. Provenance and enforcement
+ * keys (`origin`, and any later `trustMode`/`toolAllowlist`) are deliberately
+ * outside it: a build that does not know a key must still hydrate the journal
+ * a newer build wrote, and a rollback must never discard a week of jobs.
+ *
+ * Consequence, stated: two submissions for the same (clientJobId, generation)
+ * that differ only in those excluded keys are the SAME job, and the second
+ * returns the first. The scheduled brief reuses one identity per DAY across
+ * its three attempts, and its excluded keys never differ between attempts; a
+ * genuine resubmit differs in `globalMsgNum`, which IS in the fingerprint, so
+ * it conflicts rather than silently adopting. Phone prompts never send an
+ * excluded key.
+ *
+ * Pick contract: an absent key stays absent. The parser never materialises an
+ * optional as null/''/0/[] (every optional is a conditional spread in its
+ * return literal), and `JSON.stringify` drops an undefined value, so the pick
+ * needs no guard of its own. A `?? null` pick WOULD re-hash every stored
+ * request and silently drop the journal; the test pins that property.
+ */
+export const FINGERPRINT_KEYS = [
+  'clientJobId', 'generation', 'query', 'sessionId', 'model', 'effort',
+  'cursorExecutionMode', 'messageEra', 'globalMsgNum', 'reference', 'handoffCode',
+  'handoffLatest', 'clientQueueItemId', 'attachmentIds', 'attachmentRefs',
+  'activityToolMode',
+] as const satisfies readonly (keyof QueryJobRequest)[]
+
+/** The request keys deliberately OUTSIDE the identity. Every key of
+ * `QueryJobRequest` must appear in exactly one of the two lists: adding a key
+ * without naming it here or above fails to compile, so the author picks a side. */
+export const FINGERPRINT_EXCLUDED = ['origin', 'dispatch'] as const satisfies readonly (keyof QueryJobRequest)[]
+type FingerprintUncovered = Exclude<keyof QueryJobRequest, typeof FINGERPRINT_KEYS[number] | typeof FINGERPRINT_EXCLUDED[number]>
+export const FINGERPRINT_KEYS_COVER_REQUEST: FingerprintUncovered extends never ? true : never = true
+
+function pickFingerprintKeys(request: QueryJobRequest): Record<string, unknown> {
+  const picked: Record<string, unknown> = {}
+  for (const key of FINGERPRINT_KEYS) picked[key] = request[key]
+  return picked
+}
+
 export function requestFingerprint(request: QueryJobRequest): string {
-  return createHash('sha256').update(JSON.stringify(canonical(request))).digest('hex')
+  return createHash('sha256').update(JSON.stringify(canonical(pickFingerprintKeys(request)))).digest('hex')
 }
 
 export function isTerminalQueryJobStatus(status: QueryJobStatus): status is QueryJobTerminalStatus {