diff --git a/src/commands/handlers.js b/src/commands/handlers.js
index 46d1797..9253ad7 100644
--- a/src/commands/handlers.js
+++ b/src/commands/handlers.js
@@ -23,12 +23,20 @@ function _gate(source, action, msg) {
     if (!source.isValidActionForMode(action, source.mode)) return false;
   }
   if (typeof source?.isValidSourceForMode === 'function') {
-    const src = (typeof msg?.source === 'string' && msg.source) ? msg.source : 'parent';
-    if (!source.isValidSourceForMode(src, source.mode)) return false;
+    if (!source.isValidSourceForMode(_origin(msg), source.mode)) return false;
   }
   return true;
 }
 
+// Resolve the command origin (control authority: parent | GUI | fysical).
+// The shared commandRegistry stamps msg.origin (default 'parent'); legacy flows
+// carried it as msg.source. Prefer the legacy field when present so existing
+// flows keep working, otherwise use the registry-stamped msg.origin.
+function _origin(msg) {
+  if (typeof msg?.source === 'string' && msg.source) return msg.source;
+  return (typeof msg?.origin === 'string' && msg.origin) ? msg.origin : 'parent';
+}
+
 exports.setMode = (source, msg) => {
   // set.mode is a status-level operation — allowed in every mode by the
   // default schema (incl. maintenance). The gate still fires so an