@indigoai-us/hq-cli 5.121.2 → 5.122.1

package/dist/lib/agent-kit/paths.js

@@ -13,7 +13,16 @@
  * `HQ_AGENT_DIR` relocates the whole tree (tests, containers). The creds file
  * additionally honours `HQ_MACHINE_CREDS_FILE`, the override hq-cloud reads,
  * so a kit pointed at a custom creds path and hq-cloud's mint agree.
+ *
+ * LOCAL BOTS. A bot that runs on its owner's own computer cannot use the
+ * default tree: that machine already has the owner's HQ session, and an agent
+ * identity must not share a host account with a person's login. Such a bot
+ * enrolls into a SIBLING directory instead — `~/.hq-agent/<name>/` with the
+ * same layout — and every `hq agent …` command finds it here, so the bot does
+ * not have to carry environment variables around to be itself. Two or more
+ * local agents are ambiguous on purpose: pick one with `HQ_AGENT_DIR`.
  */
+import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 export const AGENT_DIR_ENV = "HQ_AGENT_DIR";
@@ -23,11 +32,62 @@ export const MACHINE_CREDS_NAME = "machine-creds.json";
 export const KIT_CONFIG_NAME = "kit.json";
 export const LAST_HEARTBEAT_NAME = "last-heartbeat.json";
 export const KIT_COMPONENTS = ["sync", "inbox"];
+/** Default name for a bot enrolled alongside its owner's own session. */
+export const DEFAULT_LOCAL_AGENT_NAME = "local";
+/** `~/.hq-agent` — the root, whether or not it holds an identity itself. */
+export function agentRootDir(home = os.homedir()) {
+    return path.join(home, ".hq-agent");
+}
+/** `~/.hq-agent/<name>` — an isolated home for one local bot. */
+export function localAgentDir(name, home = os.homedir()) {
+    return path.join(agentRootDir(home), name);
+}
+/**
+ * Local agent homes under `~/.hq-agent`, by name, oldest name order. A
+ * directory counts only once it holds a creds file, so a half-written tree is
+ * never mistaken for an identity.
+ */
+export function listLocalAgentDirs(home = os.homedir()) {
+    const root = agentRootDir(home);
+    let entries;
+    try {
+        entries = fs.readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    return entries
+        .filter((e) => e.isDirectory())
+        .map((e) => path.join(root, e.name))
+        .filter((dir) => {
+        try {
+            return fs.statSync(path.join(dir, MACHINE_CREDS_NAME)).isFile();
+        }
+        catch {
+            return false;
+        }
+    })
+        .sort();
+}
 export function agentDir(home = os.homedir(), env = process.env) {
     const override = env[AGENT_DIR_ENV]?.trim();
     if (override)
         return override;
-    return path.join(home, ".hq-agent");
+    const root = agentRootDir(home);
+    // An identity in the root wins: that is the dedicated-host layout, and a
+    // host that has one is not running a local bot beside a person.
+    try {
+        if (fs.statSync(path.join(root, MACHINE_CREDS_NAME)).isFile())
+            return root;
+    }
+    catch {
+        /* no identity in the root — fall through to the local homes */
+    }
+    const locals = listLocalAgentDirs(home);
+    // Exactly one is unambiguous. Two or more cannot be guessed, so keep the
+    // root and let the caller fail with a message naming HQ_AGENT_DIR rather
+    // than silently acting as whichever agent sorted first.
+    return locals.length === 1 ? locals[0] : root;
 }
 export function agentKitPaths(home = os.homedir(), env = process.env) {
     const dir = agentDir(home, env);

package/dist/lib/doctor/checks/work-context.js

@@ -178,7 +178,7 @@ function formatMigrationCapabilityCheck(cap, root) {
             status: "WARN",
             checkId: "work-context.migration-capability",
             target,
-            message: `Migration capability: offline at ${cap.checkedAt}; default-company stays locked.`,
+            message: `Migration capability: offline at ${cap.checkedAt}; selected-company membership is still verified when setting a default.`,
         };
     }
     const falseCount = cap.companies.filter((c) => !c.migration).length;

package/dist/lib/mesh/client.d.ts

@@ -73,8 +73,9 @@ export interface MigrationCapabilityProbe {
     companies: MigrationCapabilityCompanyResult[];
 }
 /**
- * Unlock rule for default-company mode (US-017B): migration must be true for
- * EVERY company the caller belongs to. Offline / empty memberships → locked.
+ * Diagnostic probe for migration capability across active memberships. The
+ * result is recorded and warned on, but does not gate a verified member from
+ * choosing a device-local default company.
  */
 export declare function probeMigrationCapabilityForMemberships(token: string, opts?: {
     listCompanies?: (token: string) => Promise<MeshCompany[]>;

package/dist/lib/mesh/client.js

@@ -119,8 +119,9 @@ export async function fetchMigrationCapability(token, companyUid) {
     }
 }
 /**
- * Unlock rule for default-company mode (US-017B): migration must be true for
- * EVERY company the caller belongs to. Offline / empty memberships → locked.
+ * Diagnostic probe for migration capability across active memberships. The
+ * result is recorded and warned on, but does not gate a verified member from
+ * choosing a device-local default company.
  */
 export async function probeMigrationCapabilityForMemberships(token, opts) {
     const now = (opts?.now ?? (() => new Date()))().toISOString();

package/dist/lib/mesh/live/backfill-held.d.ts

@@ -13,8 +13,9 @@
  * company (via the identity-file default resolver shipped in 5.108.22). The
  * daemon's next held retry then re-attributes and posts those events naturally.
  *
- * Constraints (owner directive):
- * - Explicit, opt-in only. Never automatic; never wired into a hook or daemon.
+ * Constraints:
+ * - The daemon runs this in bounded startup batches; the CLI command remains
+ *   available for an explicit full/manual recovery.
  * - Idempotent: sessions that already carry a companyUid are skipped.
  * - Never deletes held events; the daemon posts them on the next retry.
  * - Purely local to the box it runs on; no fleet fan-out.

package/dist/lib/mesh/live/backfill-held.js

@@ -13,8 +13,9 @@
  * company (via the identity-file default resolver shipped in 5.108.22). The
  * daemon's next held retry then re-attributes and posts those events naturally.
  *
- * Constraints (owner directive):
- * - Explicit, opt-in only. Never automatic; never wired into a hook or daemon.
+ * Constraints:
+ * - The daemon runs this in bounded startup batches; the CLI command remains
+ *   available for an explicit full/manual recovery.
  * - Idempotent: sessions that already carry a companyUid are skipped.
  * - Never deletes held events; the daemon posts them on the next retry.
  * - Purely local to the box it runs on; no fleet fan-out.

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -3,6 +3,7 @@
  * outbox/last-flush, and unhealthy when unacked spool age > 60s while online.
  */
 import { type CognitoActorKind, type CognitoTokenSource } from "../../../../utils/cognito-session.js";
+import { type UnattributedEventCounts } from "../spool.js";
 import { type DaemonStateFile } from "./state.js";
 export declare const UNHEALTHY_SPOOL_AGE_MS = 60000;
 export interface DaemonDoctorReport {
@@ -17,6 +18,8 @@ export interface DaemonDoctorReport {
     spoolDepth: number;
     heldCount: number;
     deadLetterCount: number;
+    /** Events in any local queue still marked no-company / NEEDS_COMPANY / NONE. */
+    unattributedEvents: UnattributedEventCounts;
     outboxDepth: number;
     lastFlushAt?: string;
     lastFlushResult?: DaemonStateFile["lastFlushResult"];

package/dist/lib/mesh/live/daemon/doctor.js

@@ -7,7 +7,7 @@ import * as os from "node:os";
 import { describeCognitoTokenSource, } from "../../../../utils/cognito-session.js";
 import { outboxStats, } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
-import { countJsonlLines, } from "../spool.js";
+import { countJsonlLines, countUnattributedEvents, } from "../spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../paths.js";
 import { daemonDir, daemonPidPath } from "./paths.js";
 import { readEmitState } from "../emit.js";
@@ -78,6 +78,7 @@ export function collectDaemonDoctor(deps = {}) {
     const spoolDepth = countJsonlLines(spoolPath);
     const heldCount = countJsonlLines(heldPath);
     const deadLetterCount = countJsonlLines(deadPath);
+    const unattributedEvents = countUnattributedEvents(meshRoot);
     const outbox = outboxStats(ctxRoot);
     const mqttState = state?.mqttState ?? (running ? "unknown" : "closed");
     const companiesOnline = state?.companiesOnline ?? [];
@@ -96,6 +97,13 @@ export function collectDaemonDoctor(deps = {}) {
     if (deadLetterCount > 0) {
         unhealthyReasons.push(`dead-letter count=${deadLetterCount}`);
     }
+    if (emitMode === "legacy" && heldCount > 0) {
+        unhealthyReasons.push(`held events awaiting company attribution=${heldCount}`);
+    }
+    if (unattributedEvents.total > 0) {
+        unhealthyReasons.push(`unattributed events=${unattributedEvents.total} ` +
+            `(spool=${unattributedEvents.spool} held=${unattributedEvents.held} dead-letter=${unattributedEvents.deadLetter})`);
+    }
     const presenceRefusal = state?.presenceRefusal ?? null;
     if (presenceRefusal) {
         unhealthyReasons.push(`presence credential refused (${presenceRefusal.code}); next retry ${presenceRefusal.nextRetryAt}`);
@@ -114,6 +122,7 @@ export function collectDaemonDoctor(deps = {}) {
         spoolDepth,
         heldCount,
         deadLetterCount,
+        unattributedEvents,
         outboxDepth: outbox.depth,
         lastFlushAt: state?.lastFlushAt,
         lastFlushResult: state?.lastFlushResult,
@@ -150,7 +159,8 @@ export function formatDaemonDoctor(report) {
         // receive-only (direct) mode.
         lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}`, `outbox depth: ${report.outboxDepth}`);
     }
-    lines.push(`dead-letter: ${report.deadLetterCount}`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`);
+    lines.push(`dead-letter: ${report.deadLetterCount}`, `unattributed events: ${report.unattributedEvents.total} ` +
+        `(spool=${report.unattributedEvents.spool} held=${report.unattributedEvents.held} dead-letter=${report.unattributedEvents.deadLetter})`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`);
     if (report.emitMode === "legacy") {
         lines.push(`last flush: ${report.lastFlushAt ?? "(never)"}${report.lastFlushResult
             ? ` ok=${report.lastFlushResult.ok} posted=${report.lastFlushResult.posted}`

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -9,6 +9,7 @@
  * - SIGTERM/SIGINT: flush once more, MQTT DISCONNECT (server derives offline), exit
  */
 import { type FlushSummary } from "../flush.js";
+import { type BackfillHeldResult } from "../backfill-held.js";
 import { type CredentialsFetcher, type TimerHost } from "./credentials.js";
 import { type PidLockDeps } from "./pid-lock.js";
 import { PresenceClient, type MqttConnectFn } from "./presence.js";
@@ -16,6 +17,8 @@ import { TranscriptWatcher, type TranscriptFs } from "./transcript-watch.js";
 import { type MeshEmitMode } from "./mode.js";
 export declare const SPOOL_DEBOUNCE_MS = 2000;
 export declare const FLUSH_INTERVAL_MS = 10000;
+/** Keep startup recovery bounded: the next daemon start continues the backlog. */
+export declare const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
 /**
  * Only producer appends to spool.jsonl should wake the watcher. Every other
  * file in the work-mesh root (held.jsonl, spool.<ts>.claimed, held.<ts>.claimed,
@@ -44,6 +47,10 @@ export interface DaemonRunDeps {
         quarantined: number;
         skipped?: number;
     }>;
+    /** Injected held-session recovery (tests). Runs once before the startup flush. */
+    backfillHeld?: () => Promise<BackfillHeldResult>;
+    /** Maximum distinct held sessions reconciled during one daemon startup. */
+    heldBackfillBatchSize?: number;
     /** Injected board refresh (tests). */
     refreshBoards?: () => Promise<{
         refreshed: number;

package/dist/lib/mesh/live/daemon/run.js

@@ -18,6 +18,8 @@ import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../session-events-client.js";
 import { flushSessionEvents, HELD_RETRY_INTERVAL_MS, } from "../flush.js";
+import { backfillHeldSessions, } from "../backfill-held.js";
+import { reconcileObservation } from "../../../work-context/reconcile.js";
 import { workMeshRoot, workMeshSpoolPath } from "../paths.js";
 import { createVaultBoardReader, refreshBoundSessionBoards, BOARD_REFRESH_INTERVAL_MS, } from "./board-refresh.js";
 import { createContract3Fetcher, realTimerHost, } from "./credentials.js";
@@ -31,6 +33,8 @@ import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, Transcript
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
+/** Keep startup recovery bounded: the next daemon start continues the backlog. */
+export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
 /**
  * Only producer appends to spool.jsonl should wake the watcher. Every other
  * file in the work-mesh root (held.jsonl, spool.<ts>.claimed, held.<ts>.claimed,
@@ -121,6 +125,26 @@ export async function runMeshDaemon(deps = {}) {
             const deliver = createWorkSessionDeliverer({ token: t });
             return replayOutbox(ctxRoot, deliver);
         });
+    const backfillFn = deps.backfillHeld ??
+        (async () => {
+            const token = await getToken();
+            const deliver = createWorkSessionDeliverer({ token });
+            return backfillHeldSessions({
+                workMeshRoot: meshRoot,
+                workContextRoot: ctxRoot,
+                limit: deps.heldBackfillBatchSize ?? HELD_BACKFILL_STARTUP_BATCH_SIZE,
+                env,
+                reconcile: (observation) => reconcileObservation(observation, {
+                    root: ctxRoot,
+                    env,
+                    deliver,
+                    validateMembership: async (slug) => {
+                        const membership = await resolveActiveMembershipCompany(token, slug);
+                        return membership ? { uid: membership.companyUid } : false;
+                    },
+                }),
+            });
+        });
     const boardLast = new Map();
     const refreshFn = deps.refreshBoards ??
         (async () => {
@@ -253,6 +277,23 @@ export async function runMeshDaemon(deps = {}) {
         }
         flushInFlight = (async () => {
             try {
+                // A held session has already ended, so no later hook will naturally
+                // revisit its context. Repair a bounded batch before the first flush;
+                // recovered state is then retried immediately in this same cycle.
+                if (reason === "start") {
+                    try {
+                        const recovered = await backfillFn();
+                        if (recovered.reconciled > 0 ||
+                            recovered.unresolved > 0 ||
+                            recovered.errors > 0) {
+                            log(dir, `held backfill: considered=${recovered.considered} reconciled=${recovered.reconciled} unresolved=${recovered.unresolved} errors=${recovered.errors}`);
+                        }
+                    }
+                    catch (err) {
+                        const msg = err instanceof Error ? err.message : String(err);
+                        log(dir, `held backfill error: ${msg.slice(0, 200)}`);
+                    }
+                }
                 // Record hook-emitted session ids from spool/held before claim/rename.
                 const at = now().getTime();
                 noteHookSessionsFromSpoolFile(workMeshSpoolPath(meshRoot), lastHookEventAt, at);

package/dist/lib/mesh/live/flush.js

@@ -10,7 +10,10 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { resolveCompany } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
 import { readSessionState } from "../../work-context/state.js";
+import { repairAckedRegisterStates } from "../../work-context/outbox.js";
 import { workContextRoot } from "../../work-context/paths.js";
 import { defaultSleep, FLUSH_MAX_ATTEMPTS, fullJitterDelayMs, } from "./backoff.js";
 import { LOCAL_ONLY_FIELDS, stripLocalOnlyFields } from "./format-spool-line.js";
@@ -60,6 +63,35 @@ function unwrapHeld(obj) {
 function heldEnvelope(event, heldReason, heldAt) {
     return JSON.stringify({ event, heldReason, heldAt });
 }
+/**
+ * A seven-day retention rule must never beat local recovery. An event can
+ * still carry enough trusted/deterministic context (or have a configured
+ * device default) to reconcile its session on the next daemon startup.
+ */
+function isLocallyReconcilableHeldEvent(event, state, workContextRoot) {
+    const sessionId = sessionIdOf(event);
+    if (!sessionId || state?.companyUid)
+        return Boolean(sessionId && state?.companyUid);
+    const text = (value) => typeof value === "string" && value.trim() ? value.trim() : undefined;
+    const cwd = text(event.cwd);
+    const hqRoot = text(event.hqRoot);
+    const remoteOwnerSlug = cwd
+        ? deriveRemoteOwnerSlug({ cwd, hqRoot }) ?? undefined
+        : undefined;
+    const repoIdentityKey = cwd ? deriveRepoIdentityKey({ cwd }) : null;
+    return (resolveCompany({
+        root: workContextRoot,
+        sessionId,
+        existingState: state,
+        trusted: text(event.companySlug)
+            ? { companySlug: text(event.companySlug) }
+            : undefined,
+        cwd,
+        hqRoot,
+        remoteOwnerSlug,
+        repoIdentityKey,
+    }).status === "resolved");
+}
 function deadLetterEnvelope(event, reason, responseCode, at) {
     return JSON.stringify({ event, reason, responseCode, at });
 }
@@ -157,10 +189,16 @@ export async function flushSessionEvents(deps) {
                     summary.deadLettered += 1;
                     continue;
                 }
-                // Expire held lines older than 7 days.
+                // Expire held lines older than 7 days only when local recovery cannot
+                // still resolve the session. The daemon backfill runs before startup
+                // flush, so retaining these lines gives that deterministic repair a
+                // chance rather than silently losing attributable work.
                 if (heldAt) {
                     const age = now().getTime() - Date.parse(heldAt);
-                    if (Number.isFinite(age) && age > HELD_TTL_MS) {
+                    const state = readSessionState(sessionIdOf(event), deps.workContextRoot);
+                    if (Number.isFinite(age) &&
+                        age > HELD_TTL_MS &&
+                        !isLocallyReconcilableHeldEvent(event, state, deps.workContextRoot)) {
                         appendDeadLetterLine(deadLetterEnvelope(event, "HELD_EXPIRED", "held_ttl", now().toISOString()), deps.workMeshRoot);
                         summary.deadLettered += 1;
                         continue;
@@ -171,6 +209,10 @@ export async function flushSessionEvents(deps) {
             }
         }
         const bySession = groupBySession(collected);
+        // Older clients acknowledged register operations without copying the
+        // authoritative company into the session projection. Repair those files
+        // before classification so a valid receipt cannot be held as NEEDS_COMPANY.
+        repairAckedRegisterStates(deps.workContextRoot, new Set(bySession.keys()), now);
         const markDisposed = (event) => {
             pendingRestore.delete(event);
         };

package/dist/lib/mesh/live/spool.d.ts

@@ -49,4 +49,17 @@ export declare function recoverOrphanClaims(root: string): {
 export declare function removeClaimFile(claimPath: string | null): void;
 export declare function deadLetterNonEmpty(root?: string): boolean;
 export declare function countJsonlLines(filePath: string): number;
+/** Local queues that still lack a usable company attribution. */
+export interface UnattributedEventCounts {
+    spool: number;
+    held: number;
+    deadLetter: number;
+    total: number;
+}
+/**
+ * Count the actionable, unfiled events across all local delivery queues.
+ * This deliberately does not inspect session state: the signal must stay
+ * visible even when state is absent or corrupt.
+ */
+export declare function countUnattributedEvents(root?: string): UnattributedEventCounts;
 //# sourceMappingURL=spool.d.ts.map

package/dist/lib/mesh/live/spool.js

@@ -195,4 +195,71 @@ export function countJsonlLines(filePath) {
     }
     return n;
 }
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+/**
+ * A queue line can be a raw event, a held envelope, or a dead-letter
+ * envelope. Count the line when it is explicitly marked NEEDS_COMPANY/NONE,
+ * or when its underlying event has no company identity at all.
+ */
+function isUnattributedLine(line) {
+    try {
+        const outer = record(JSON.parse(line));
+        if (!outer)
+            return false;
+        const event = record(outer.event) ?? outer;
+        const markers = [
+            outer.heldReason,
+            outer.reason,
+            outer.contextStatus,
+            event.heldReason,
+            event.reason,
+            event.contextStatus,
+            event.company,
+            event.companyUid,
+            event.companySlug,
+        ];
+        if (markers.some((value) => typeof value === "string" &&
+            ["NEEDS_COMPANY", "NONE"].includes(value.trim().toUpperCase()))) {
+            return true;
+        }
+        return ![
+            event.companyUid,
+            event.companySlug,
+            event.company,
+        ].some((value) => typeof value === "string" && value.trim().length > 0);
+    }
+    catch {
+        // Malformed lines are reported separately by the dead-letter count.
+        return false;
+    }
+}
+function countUnattributedJsonlLines(filePath) {
+    if (!fs.existsSync(filePath))
+        return 0;
+    try {
+        return fs
+            .readFileSync(filePath, "utf8")
+            .split("\n")
+            .filter((line) => line.trim() && isUnattributedLine(line)).length;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Count the actionable, unfiled events across all local delivery queues.
+ * This deliberately does not inspect session state: the signal must stay
+ * visible even when state is absent or corrupt.
+ */
+export function countUnattributedEvents(root) {
+    const meshRoot = root ?? workMeshRoot();
+    const spool = countUnattributedJsonlLines(workMeshSpoolPath(meshRoot));
+    const held = countUnattributedJsonlLines(workMeshHeldPath(meshRoot));
+    const deadLetter = countUnattributedJsonlLines(workMeshDeadLetterPath(meshRoot));
+    return { spool, held, deadLetter, total: spool + held + deadLetter };
+}
 //# sourceMappingURL=spool.js.map

package/dist/lib/work-context/config.d.ts

@@ -1,7 +1,6 @@
 /**
  * Device-local default company preference (~/.hq/work-context/config.json).
  * Preference only — never authority. activeCompany is never treated as default.
- * Default-company mode ships dark until migrationCapability (US-017A).
  */
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 export declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
@@ -61,9 +60,7 @@ export interface DeviceConfigDeps {
 }
 export declare function readDeviceConfig(deps: Pick<DeviceConfigDeps, "root">): WorkContextDeviceConfig;
 export declare function getDefaultCompany(deps: Pick<DeviceConfigDeps, "root">): DeviceDefaultCompany | null;
-export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps & {
-    allowWithoutMigration?: boolean;
-}): Promise<WorkContextDeviceConfig>;
+export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps): Promise<WorkContextDeviceConfig>;
 export declare function clearDefaultCompany(deps: DeviceConfigDeps): WorkContextDeviceConfig;
 /**
  * Read the persisted company mapping for a repo identity key (gap 4).

package/dist/lib/work-context/config.js

@@ -1,12 +1,11 @@
 /**
  * Device-local default company preference (~/.hq/work-context/config.json).
  * Preference only — never authority. activeCompany is never treated as default.
- * Default-company mode ships dark until migrationCapability (US-017A).
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
-import { DefaultCompanyLockedError, DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError, } from "./errors.js";
+import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError, } from "./errors.js";
 import { workContextConfigPath, workContextRoot } from "./paths.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 export const DEVICE_CONFIG_SCHEMA_VERSION = 1;
@@ -116,9 +115,6 @@ export async function setDefaultCompany(slug, deps) {
     if (!trimmed || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(trimmed)) {
         throw new WorkContextError("InvalidCompanySlug", `Invalid company slug: ${slug}`);
     }
-    if (!deps.migrationCapability && !deps.allowWithoutMigration) {
-        throw new DefaultCompanyLockedError();
-    }
     if (!deps.validateMembership) {
         throw new DefaultCompanyUnavailableError(`Cannot verify membership for company "${trimmed}" (no membership validator)`);
     }

package/dist/lib/work-context/outbox.d.ts

@@ -76,6 +76,14 @@ export declare function enqueueOutbox(input: OutboxEnqueueInput, root: string):
 export declare function readOutboxOperation(operationId: string, root: string): OutboxOperation | null;
 export declare function updateOutboxOperation(op: OutboxOperation, root: string): void;
 export declare function markOutboxAcked(operationId: string, root: string, receiptId: string, now?: () => Date): OutboxOperation | null;
+/**
+ * Write server-acknowledged register scope into the session projection.
+ * This closes the outbox → emitter handoff for both direct reconciliation and
+ * daemon replay. Non-register or incomplete legacy operations are ignored.
+ */
+export declare function writeAckedRegisterState(op: OutboxOperation, root: string, receiptId: string, now?: () => Date): void;
+/** Repair older unresolved session projections from acknowledged registrations. */
+export declare function repairAckedRegisterStates(root: string, sessionIds?: ReadonlySet<string>, now?: () => Date): number;
 export declare function markOutboxQueued(operationId: string, root: string, errorCode: string, now?: () => Date, random?: () => number): OutboxOperation | null;
 export declare function markOutboxQuarantined(operationId: string, root: string, errorCode: string, now?: () => Date): OutboxOperation | null;
 /**

package/dist/lib/work-context/outbox.js

@@ -8,6 +8,7 @@ import * as path from "node:path";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 import { atomicWriteJson, ensureOwnerDir } from "./atomic.js";
 import { NotTrackingError } from "./errors.js";
+import { readSessionState, writeAcknowledgedRegisterBinding, } from "./state.js";
 import { isSafeWorkContextSegment, workContextOutboxDir, workContextOutboxPath, } from "./paths.js";
 /** Fields allowed on a durable outbox operation (privacy allowlist). */
 export const OUTBOX_ALLOWLIST = [
@@ -258,6 +259,51 @@ export function markOutboxAcked(operationId, root, receiptId, now = () => new Da
     updateOutboxOperation(op, root);
     return op;
 }
+/**
+ * Write server-acknowledged register scope into the session projection.
+ * This closes the outbox → emitter handoff for both direct reconciliation and
+ * daemon replay. Non-register or incomplete legacy operations are ignored.
+ */
+export function writeAckedRegisterState(op, root, receiptId, now = () => new Date()) {
+    if (op.kind !== "register" || !op.companyUid)
+        return;
+    writeAcknowledgedRegisterBinding({
+        kind: "register",
+        sessionId: op.sessionId,
+        companyUid: op.companyUid,
+        companySlug: op.companySlug,
+        projectId: op.projectId,
+        taskId: op.taskId,
+        receiptId,
+    }, root, now);
+}
+/** Repair older unresolved session projections from acknowledged registrations. */
+export function repairAckedRegisterStates(root, sessionIds, now = () => new Date()) {
+    let repaired = 0;
+    for (const op of listOutboxOperations(root)) {
+        if (op.delivery !== "acked" ||
+            !op.receiptId ||
+            op.kind !== "register" ||
+            !op.companyUid ||
+            (sessionIds && !sessionIds.has(op.sessionId))) {
+            continue;
+        }
+        const before = readSessionState(op.sessionId, root);
+        const after = writeAcknowledgedRegisterBinding({
+            kind: "register",
+            sessionId: op.sessionId,
+            companyUid: op.companyUid,
+            companySlug: op.companySlug,
+            projectId: op.projectId,
+            taskId: op.taskId,
+            receiptId: op.receiptId,
+        }, root, now);
+        if (after && (before?.contextStatus === "unresolved" || !before?.companyUid)) {
+            repaired += 1;
+        }
+    }
+    return repaired;
+}
 export function markOutboxQueued(operationId, root, errorCode, now = () => new Date(), random = Math.random) {
     const op = readOutboxOperation(operationId, root);
     if (!op)
@@ -461,6 +507,7 @@ export async function replayOutbox(root, deliver, opts = {}) {
             const result = await deliver(op);
             if (result.ok) {
                 markOutboxAcked(op.operationId, root, result.receiptId, now);
+                writeAckedRegisterState(op, root, result.receiptId, now);
                 delivered += 1;
             }
             else if (result.retryable) {

package/dist/lib/work-context/reconcile.js

@@ -10,7 +10,7 @@ import { EXIT_INVALID_IDENTITY, EXIT_NOT_TRACKING, EXIT_OK, InvalidDecisionOrigi
 import { decisionFromCandidates, } from "./organize.js";
 import { resolveProjectTask, shouldAskAfter } from "./project.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "./repo-remote.js";
-import { enqueueOutbox, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, } from "./outbox.js";
+import { enqueueOutbox, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, writeAckedRegisterState, } from "./outbox.js";
 import { mergeLocalSessionFields, readSessionState, writeSessionState, } from "./state.js";
 function resultOf(parts) {
     const out = {
@@ -482,6 +482,15 @@ export async function reconcileObservation(obs, deps) {
         registerClassification === "unresolved") {
         registerClassification = "needs_project";
     }
+    // Do not let a weak later observation erase a server-acknowledged company
+    // binding. Keep the result unresolved so the normal candidate threshold can
+    // still advance the session, while preserving the durable emitter projection.
+    const stateClassification = registerClassification === "unresolved" &&
+        prior?.contextStatus === "needs_project" &&
+        prior.companyUid === resolvedCompany.uid &&
+        prior.bindingEpisodeId
+        ? "needs_project"
+        : registerClassification;
     let outboxOp;
     try {
         outboxOp = enqueueOutbox({
@@ -524,7 +533,7 @@ export async function reconcileObservation(obs, deps) {
             sessionId,
             companyUid: resolvedCompany.uid,
             companySlug: resolvedCompany.slug,
-            contextStatus: registerClassification,
+            contextStatus: stateClassification,
             projectId,
             taskId,
             updatedAt: nowIso,
@@ -578,6 +587,7 @@ export async function reconcileObservation(obs, deps) {
     const delivered = await deps.deliver(outboxOp);
     if (delivered.ok) {
         markOutboxAcked(outboxOp.operationId, deps.root, delivered.receiptId, nowFn);
+        writeAckedRegisterState(outboxOp, deps.root, delivered.receiptId, nowFn);
         // Persist binding episode on success for bound registrations.
         if (registerClassification === "bound") {
             writeSessionState(mergeLocalSessionFields({