@indigoai-us/hq-cli 5.124.0 → 5.125.0

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.125.0] — 2026-09-20
+
+### Fixed
+
+- Work Mesh now preserves an acknowledged company binding through later
+  company-less hook writes, preventing repeated registrations and held events.
+  Held recovery accepts only durable registrations, canonical metadata under a
+  verified HQ root, or manifest-backed repository ownership; conflicting or
+  event-only hints stay unresolved. Its batch cursor rotates across restarts.
+  Both legacy and direct-mode daemons detect an upgraded CLI, and systemd units
+  use `Restart=always` so the installed service reloads the new code.
+
+- Held-session recovery now accepts session metadata only from the daemon's
+  configured HQ root, requires current-session evidence before restoring an
+  acknowledged registration, and retains batch position when held records are
+  compacted. Repeated hook activity no longer re-registers an unchanged binding.
+  CLI updates report installed system units that need their host service manager
+  to restart them. Daemon installs persist verified HQ-root allowlists, inject
+  the primary root into service environments, and rewrite/reload existing user
+  units so upgraded daemons restart reliably.
+
+### Added
+
+- Work Mesh now activates a device default company automatically when a signed-in
+  person has exactly one active membership. Devices with several memberships ask
+  for a choice in interactive CLI paths and show the stored state in `hq mesh
+  context default get --json`. Clearing the default is a durable opt-out until
+  the person explicitly sets one again. Historical held sessions remain unchanged
+  unless `hq mesh context backfill-held --use-device-default` is supplied; those
+  repaired records are labeled lower-confidence and counted by daemon doctor.
+
 ## [5.124.0] — 2026-09-20
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -5729,7 +5729,10 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "Cap sessions processed (default 0 = no cap)";
             }, {
                 readonly flags: "--company <slug>";
-                readonly description: "Optional non-forcing company hint (resolver default still wins)";
+                readonly description: "Optional non-forcing company hint";
+            }, {
+                readonly flags: "--use-device-default";
+                readonly description: "Opt in to historical repair using the device default (lower-confidence attribution)";
             }, {
                 readonly flags: "--json";
                 readonly description: "Print machine-readable JSON";
@@ -5869,6 +5872,9 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly options: readonly [{
                     readonly flags: "--allow-without-migration";
                     readonly description: "Deprecated compatibility no-op; selected-company membership is always verified";
+                }, {
+                    readonly flags: "--repair-held-with-default";
+                    readonly description: "Persist opt-in for lower-confidence historical held-session repair";
                 }, {
                     readonly flags: "--company <slug|uid>";
                     readonly description: "Deprecated no-op; the selected company is verified directly";

package/dist/command-catalog.generated.js

@@ -7391,7 +7391,11 @@ export const COMMAND_CATALOG = [
                             },
                             {
                                 "flags": "--company <slug>",
-                                "description": "Optional non-forcing company hint (resolver default still wins)"
+                                "description": "Optional non-forcing company hint"
+                            },
+                            {
+                                "flags": "--use-device-default",
+                                "description": "Opt in to historical repair using the device default (lower-confidence attribution)"
                             },
                             {
                                 "flags": "--json",
@@ -7573,6 +7577,10 @@ export const COMMAND_CATALOG = [
                                         "flags": "--allow-without-migration",
                                         "description": "Deprecated compatibility no-op; selected-company membership is always verified"
                                     },
+                                    {
+                                        "flags": "--repair-held-with-default",
+                                        "description": "Persist opt-in for lower-confidence historical held-session repair"
+                                    },
                                     {
                                         "flags": "--company <slug|uid>",
                                         "description": "Deprecated no-op; the selected company is verified directly"

package/dist/commands/login.js

@@ -4,6 +4,11 @@
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
+import * as readline from "node:readline/promises";
+import { listActiveMembershipCompanies } from "../lib/mesh/api.js";
+import { setDefaultCompany } from "../lib/work-context/config.js";
+import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
+import { workContextRoot } from "../lib/work-context/paths.js";
 function peekIdToken(idToken) {
     try {
         const payload = idToken.split('.')[1];
@@ -24,21 +29,59 @@ export function registerLoginCommand(program) {
         .description('Authenticate with HQ via Cognito')
         .option('--provider <provider>', 'OAuth provider to use: google, microsoft, or picker')
         .action(async (options) => {
+        let accessToken;
         try {
             const existing = loadCachedTokens();
             if (existing && !isExpiring(existing, 120)) {
                 const who = peekIdToken(existing.idToken).email ?? 'cached session';
                 console.log(chalk.green(`Already logged in as ${who}. Run \`hq logout\` to switch accounts.`));
-                return;
+                accessToken = existing.accessToken;
+            }
+            else {
+                console.log('Opening browser for authentication...');
+                const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
+                const who = peekIdToken(tokens.idToken).email ?? 'HQ';
+                console.log(chalk.green(`Logged in as ${who}`));
+                accessToken = tokens.accessToken;
             }
-            console.log('Opening browser for authentication...');
-            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
-            const who = peekIdToken(tokens.idToken).email ?? 'HQ';
-            console.log(chalk.green(`Logged in as ${who}`));
         }
         catch (error) {
             console.error(chalk.red('Login failed:'), error instanceof Error ? error.message : 'Unknown error');
-            process.exit(1);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const root = workContextRoot();
+            const activation = await ensureDefaultCompany({
+                root,
+                listMemberships: () => listActiveMembershipCompanies(accessToken),
+                log: (message) => console.error(chalk.dim(message)),
+            });
+            if (activation.status === "needs_choice" && process.stdin.isTTY && process.stdout.isTTY) {
+                const choices = activation.memberships
+                    .map((membership, index) => `${index + 1}. ${membership.slug}`)
+                    .join("\n");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
+                    const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
+                    if (selected) {
+                        await setDefaultCompany(selected.slug, {
+                            root,
+                            validateMembership: (candidate) => candidate === selected.slug ? { uid: selected.uid } : false,
+                        });
+                    }
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            else if (activation.status === "needs_choice") {
+                console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
+            }
+        }
+        catch (error) {
+            console.error(chalk.yellow('Default-company setup failed:'), error instanceof Error ? error.message : 'Unknown error');
         }
     });
 }

package/dist/commands/mesh.js

@@ -12,13 +12,15 @@ import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js
 import * as readline from "node:readline/promises";
 import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveMembershipCompanies, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
-import { clearDefaultCompany, getDefaultCompany, readDeviceConfig, recordMigrationCapabilitySnapshot, setDefaultCompany, } from "../lib/work-context/config.js";
+import { clearDefaultCompany, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, } from "../lib/work-context/config.js";
+import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
 import { DefaultCompanyUnavailableError, } from "../lib/work-context/errors.js";
 import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
 import { CLI_KIND_TO_SCHEMA, resolveEnqueueSessionId, } from "../lib/mesh/live/index.js";
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
 import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
+const MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
 import { buildEmitEvidence } from "../lib/mesh/live/emit-evidence.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
 import { emitEvents } from "../lib/mesh/live/emit.js";
@@ -153,25 +155,73 @@ async function runContextReconcile(opts) {
     let fetchCandidates;
     let validateMembership;
     let offline = Boolean(opts.offline);
-    if (!offline) {
-        try {
-            const token = await requireToken();
-            deliver = createWorkSessionDeliverer({ token });
-            fetchCandidates = createCandidatesFetcher({ token });
-            validateMembership = async (candidate) => {
-                const membership = await resolveActiveMembershipCompany(token, candidate);
-                if (!membership)
-                    return false;
-                return { uid: membership.companyUid };
-            };
+    let token;
+    try {
+        // Offline is outbox-only delivery. It still refreshes a device default's
+        // token-backed membership so a revoked default cannot be preflighted.
+        token = await requireToken();
+        const sessionToken = token;
+        validateMembership = async (candidate) => {
+            const membership = await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => reject(new Error("membership validation timed out")), MEMBERSHIP_VALIDATION_TIMEOUT_MS);
+                void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
+                    clearTimeout(timer);
+                    resolve(value);
+                }, (error) => {
+                    clearTimeout(timer);
+                    reject(error);
+                });
+            });
+            if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
+                return false;
+            }
+            return { uid: membership.companyUid };
+        };
+        if (!offline) {
+            deliver = createWorkSessionDeliverer({ token: sessionToken });
+            fetchCandidates = createCandidatesFetcher({ token: sessionToken });
         }
-        catch {
+    }
+    catch {
+        if (!offline) {
             offline = true;
             if (!opts.machine) {
                 console.error(chalk.yellow("No Cognito session; reconciling offline (outbox only)."));
             }
         }
     }
+    if (token) {
+        const activation = await ensureDefaultCompany({
+            root,
+            listMemberships: () => listActiveMembershipCompanies(token),
+            log: (message) => console.error(chalk.dim(message)),
+        });
+        if (activation.status === "needs_choice") {
+            const interactive = !opts.machine && Boolean(process.stdin.isTTY && process.stdout.isTTY) && !isMachineIdentity();
+            if (interactive) {
+                const choices = activation.memberships
+                    .map((membership, index) => `${index + 1}. ${membership.slug}`)
+                    .join("\n");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
+                    const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
+                    if (selected) {
+                        await setDefaultCompany(selected.slug, {
+                            root,
+                            validateMembership: (candidate) => candidate === selected.slug ? { uid: selected.uid } : false,
+                        });
+                    }
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            else if (!opts.machine) {
+                console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
+            }
+        }
+    }
     const outcome = await reconcileObservation(obs, {
         root,
         env: process.env,
@@ -295,6 +345,7 @@ async function runContextBackfillHeld(opts) {
     const parsedLimit = opts.limit ? Number.parseInt(opts.limit, 10) : 0;
     const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 0;
     const companyHint = opts.company?.trim() || undefined;
+    const useDeviceDefault = opts.useDeviceDefault === true || readDeviceConfig({ root }).repairHeldWithDefault === true;
     // Build the reconcile network seam exactly like `hq mesh context reconcile`.
     // Not needed in --dry-run (reconcile is never invoked then). Explicit types
     // because these are captured in the reconcile closure below (no control-flow
@@ -331,6 +382,7 @@ async function runContextBackfillHeld(opts) {
         // Mirror the reconcile closure's non-forcing hint in the dry-run predictor
         // so `--dry-run` and the real run report the same counts.
         remoteOwnerHint: companyHint || undefined,
+        useDeviceDefault,
         reconcile: (obs) => reconcileObservation(
         // Pass --company as a non-forcing hint (remoteOwnerSlug feeds
         // deterministic resolution BELOW the identity-file / device default,
@@ -342,6 +394,8 @@ async function runContextBackfillHeld(opts) {
             fetchCandidates,
             offline,
             validateMembership,
+            allowDeviceDefault: useDeviceDefault,
+            deviceDefaultConfidence: useDeviceDefault,
         }),
     });
     if (opts.json) {
@@ -364,16 +418,34 @@ async function runContextBackfillHeld(opts) {
 async function runContextDefaultGet(opts) {
     const root = workContextHomeRoot();
     const cfg = readDeviceConfig({ root });
-    const current = getDefaultCompany({ root });
+    const current = cfg.defaultCompany?.enabled && cfg.defaultCompany.slug
+        ? cfg.defaultCompany
+        : null;
+    const memberships = cfg.defaultCompanyMemberships?.memberships ?? [];
+    const disabled = isDefaultCompanyDisabled({ root });
+    const source = disabled ? "disabled" : current?.source ?? (current ? "chosen" : "unset");
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, config: cfg, defaultCompany: current }, null, 2));
+        console.log(JSON.stringify({
+            ok: true,
+            slug: current?.slug ?? null,
+            uid: current?.uid ?? null,
+            enabled: current?.enabled ?? false,
+            source,
+            needsChoice: !current && !disabled && memberships.length > 1,
+            memberships,
+            repairHeldWithDefault: cfg.repairHeldWithDefault === true,
+        }, null, 2));
+        return;
+    }
+    if (disabled) {
+        console.log("Default company disabled on this device.");
         return;
     }
     if (!current) {
         console.log("No device default company (default-company mode may be dark).");
         return;
     }
-    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled}`);
+    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled} source=${source}`);
 }
 async function runContextDefaultSet(slug, opts) {
     const root = workContextHomeRoot();
@@ -434,11 +506,14 @@ async function runContextDefaultSet(slug, opts) {
                 return { uid: membership.companyUid };
             },
         });
+        const configured = opts.repairHeldWithDefault
+            ? setRepairHeldWithDefault(true, { root })
+            : cfg;
         if (opts.json) {
-            console.log(JSON.stringify({ ok: true, config: cfg, migrationWarning }, null, 2));
+            console.log(JSON.stringify({ ok: true, config: configured, migrationWarning }, null, 2));
             return;
         }
-        const stored = cfg.defaultCompany;
+        const stored = configured.defaultCompany;
         console.log(`Default company set to ${stored?.slug ?? slug}${stored?.uid ? ` (${stored.uid})` : ""}`);
         if (migrationWarning)
             console.error(chalk.yellow(migrationWarning));
@@ -1035,7 +1110,8 @@ export function registerMeshCommand(program) {
         .option("--dry-run", "Report what would be reconciled; write nothing, no network")
         .option("--offline", "Reconcile outbox-only (no candidates/register network)")
         .option("--limit <n>", "Cap sessions processed (default 0 = no cap)")
-        .option("--company <slug>", "Optional non-forcing company hint (resolver default still wins)")
+        .option("--company <slug>", "Optional non-forcing company hint")
+        .option("--use-device-default", "Opt in to historical repair using the device default (lower-confidence attribution)")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runContextBackfillHeld(opts))());
     context
@@ -1090,6 +1166,7 @@ export function registerMeshCommand(program) {
         .description("Set the device default company slug after verifying membership")
         .argument("<slug>", "Company slug")
         .option("--allow-without-migration", "Deprecated compatibility no-op; selected-company membership is always verified")
+        .option("--repair-held-with-default", "Persist opt-in for lower-confidence historical held-session repair")
         .option("--company <slug|uid>", "Deprecated no-op; the selected company is verified directly")
         .option("--json", "Print machine-readable JSON")
         .action((slug, opts) => wrap(() => runContextDefaultSet(slug, opts))());

package/dist/lib/doctor/checks/work-context.js

@@ -6,7 +6,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { readDeviceConfig, getDefaultCompany, } from "../../work-context/config.js";
+import { readDeviceConfig, } from "../../work-context/config.js";
 import { outboxStats, listOutboxOperations } from "../../work-context/outbox.js";
 import { workContextRoot, workContextSessionsDir } from "../../work-context/paths.js";
 import { countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
@@ -96,7 +96,9 @@ function runChecks(deps) {
     // Default-company mode + migration capability (US-017B)
     try {
         const cfg = readDeviceConfig({ root });
-        const def = getDefaultCompany({ root });
+        const def = cfg.defaultCompany?.enabled && cfg.defaultCompany.slug
+            ? cfg.defaultCompany
+            : null;
         const mode = def?.enabled
             ? `enabled slug=${def.slug}`
             : "disabled (dark / unset)";

package/dist/lib/mesh/live/backfill-held.d.ts

@@ -111,6 +111,8 @@ export interface BackfillHeldDeps {
      * meta) in BOTH the dry-run predictor and the write path, so the two agree.
      */
     remoteOwnerHint?: string;
+    /** Historical device-default repair is opt-in; false keeps no-evidence sessions held. */
+    useDeviceDefault?: boolean;
     /** Env passed to the dry-run resolver (tests). Default process.env. */
     env?: NodeJS.ProcessEnv;
     /**

package/dist/lib/mesh/live/backfill-held.js

@@ -231,7 +231,7 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
  * the write run can still under-count; the gross all-or-nothing mismatch is
  * gone because both paths key off this same resolver + evidence.
  */
-function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env) {
+function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env, useDeviceDefault) {
     // This predictor is called only with a ref already rebuilt from trusted local
     // evidence. Do not let raw held-event cwd/hqRoot values re-enter resolution.
     const remoteOwnerSlug = remoteOwnerHint?.trim();
@@ -241,6 +241,7 @@ function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env) {
         env,
         trusted: ref.companySlug ? { companySlug: ref.companySlug } : undefined,
         remoteOwnerSlug,
+        allowDeviceDefault: useDeviceDefault,
     });
     return resolution.status === "resolved";
 }
@@ -385,7 +386,7 @@ export async function backfillHeldSessions(deps) {
     const env = deps.env ?? process.env;
     const newOperationId = deps.newOperationId ?? (() => globalThis.crypto.randomUUID());
     const predictCompany = deps.predictCompany ??
-        ((ref) => defaultPredictCompany(ref, deps.workContextRoot, deps.remoteOwnerHint, env));
+        ((ref) => defaultPredictCompany(ref, deps.workContextRoot, deps.remoteOwnerHint, env, deps.useDeviceDefault === true));
     const sessions = readHeldSessions(deps.workMeshRoot);
     // An acked register is authoritative local evidence. Older clients could
     // lose its state projection on a later hook write; recover that projection
@@ -434,7 +435,10 @@ export async function backfillHeldSessions(deps) {
                 continue;
             }
         }
-        if (!evidence.candidate?.slug) {
+        // Historical repair may use the explicitly opted-in device default only
+        // when there is no durable local company evidence. Never manufacture a
+        // slug from the held event itself.
+        if (!evidence.candidate?.slug && deps.useDeviceDefault !== true) {
             result.unresolved += 1;
             deps.log?.(`would stay unresolved ${sessionId} (${hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence"})`);
             continue;
@@ -442,7 +446,7 @@ export async function backfillHeldSessions(deps) {
         const evidenceRef = {
             sessionId,
             harness,
-            companySlug: evidence.candidate.slug,
+            companySlug: evidence.candidate?.slug,
             // Held-event fields are transport input, not trusted context. Preserve
             // project/task only when the durable session state already owns them.
             project: state?.projectId,

package/dist/lib/mesh/live/daemon/board-refresh.d.ts

@@ -6,6 +6,7 @@
  * authoritative in ProjectView because `hq mesh story` writes there.
  * Metadata-only snapshot — never prompts or tokens.
  */
+import type { SessionStateFile } from "../../../work-context/state.js";
 export declare const BOARD_REFRESH_INTERVAL_MS = 60000;
 export interface BoardStorySnapshot {
     id: string;
@@ -26,6 +27,8 @@ export interface BoardRefreshDeps {
     /** Per-session last refresh timestamps (ms). */
     lastRefresh?: Map<string, number>;
     intervalMs?: number;
+    /** Authorizes a device-default-derived session before its tenant read. */
+    authorizeDeviceDefaultTenant?: (sessionId: string, state: SessionStateFile) => Promise<boolean>;
 }
 export declare function formatBoardMarkdown(input: {
     sessionId: string;

package/dist/lib/mesh/live/daemon/board-refresh.js

@@ -92,6 +92,12 @@ export async function refreshBoundSessionBoards(deps) {
             skipped += 1;
             continue;
         }
+        if (state.companyConfidence === "device_default" &&
+            deps.authorizeDeviceDefaultTenant &&
+            !(await deps.authorizeDeviceDefaultTenant(sessionId, state))) {
+            skipped += 1;
+            continue;
+        }
         try {
             const board = await deps.readBoard(state.companyUid, state.projectId);
             if (!board) {

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -19,6 +19,7 @@ export interface DaemonDoctorReport {
     heldCount: number;
     /** Distinct held sessions with neither bound state nor local company evidence. */
     heldWithNoLocalEvidence: number;
+    attributedByDeviceDefault: number;
     deadLetterCount: number;
     /** Events in any local queue still marked no-company / NEEDS_COMPANY / NONE. */
     unattributedEvents: UnattributedEventCounts;
@@ -47,6 +48,8 @@ export interface DaemonDoctorReport {
         rejected?: number;
         error?: string;
     };
+    /** Work held or quarantined after default-derived membership was denied. */
+    deviceDefaultAuthorizationDenials: number;
 }
 export interface DaemonDoctorDeps {
     home?: string;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -4,6 +4,7 @@
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
+import * as path from "node:path";
 import { describeCognitoTokenSource, } from "../../../../utils/cognito-session.js";
 import { listOutboxOperations, outboxStats, } from "../../../work-context/outbox.js";
 import { readSessionState } from "../../../work-context/state.js";
@@ -52,6 +53,21 @@ function oldestJsonlAgeMs(filePath, nowMs) {
         return undefined;
     }
 }
+function countDeviceDefaultAttribution(root) {
+    try {
+        return fs.readdirSync(path.join(root, "sessions")).filter((entry) => {
+            if (!entry.endsWith(".json"))
+                return false;
+            const state = readSessionState(entry.slice(0, -5), root);
+            return state?.companyConfidence === "device_default" &&
+                Boolean(state.companyUid) &&
+                state.contextStatus !== "needs_company";
+        }).length;
+    }
+    catch {
+        return 0;
+    }
+}
 export function collectDaemonDoctor(deps = {}) {
     const home = deps.home ?? os.homedir();
     const env = deps.env ?? process.env;
@@ -88,6 +104,7 @@ export function collectDaemonDoctor(deps = {}) {
             !hasCurrentAcknowledgedRegistration(ref, state, outboxOperations, deps.hqRoot ?? env.HQ_ROOT?.trim(), trustedRoots) &&
             !refWithLocalCompanyEvidence(ref, deps.hqRoot ?? env.HQ_ROOT?.trim(), trustedRoots, state));
     }).length;
+    const attributedByDeviceDefault = countDeviceDefaultAttribution(ctxRoot);
     const deadLetterCount = countJsonlLines(deadPath);
     const unattributedEvents = countUnattributedEvents(meshRoot);
     const outbox = outboxStats(ctxRoot);
@@ -95,6 +112,7 @@ export function collectDaemonDoctor(deps = {}) {
     const companiesOnline = state?.companiesOnline ?? [];
     const emitMode = state?.emitMode ?? "legacy";
     const subscribed = mqttState === "connected";
+    const deviceDefaultAuthorizationDenials = state?.deviceDefaultAuthorizationDenials ?? 0;
     const oldestSpoolAgeMs = oldestJsonlAgeMs(spoolPath, now());
     const unhealthyReasons = [];
     const online = mqttState === "connected" && companiesOnline.length > 0;
@@ -140,6 +158,7 @@ export function collectDaemonDoctor(deps = {}) {
         spoolDepth,
         heldCount,
         heldWithNoLocalEvidence,
+        attributedByDeviceDefault,
         deadLetterCount,
         unattributedEvents,
         outboxDepth: outbox.depth,
@@ -164,6 +183,7 @@ export function collectDaemonDoctor(deps = {}) {
                 error: emitState.lastError,
             }
             : undefined,
+        deviceDefaultAuthorizationDenials,
     };
 }
 export function formatDaemonDoctor(report) {
@@ -179,7 +199,7 @@ export function formatDaemonDoctor(report) {
         // receive-only (direct) mode.
         lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
     }
-    lines.push(`dead-letter: ${report.deadLetterCount}`, `unattributed events: ${report.unattributedEvents.total} ` +
+    lines.push(`attributed by device default: ${report.attributedByDeviceDefault}`, `device-default authorization denials: ${report.deviceDefaultAuthorizationDenials}`, `dead-letter: ${report.deadLetterCount}`, `unattributed events: ${report.unattributedEvents.total} ` +
         `(spool=${report.unattributedEvents.spool} held=${report.unattributedEvents.held} dead-letter=${report.unattributedEvents.deadLetter})`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`);
     if (report.emitMode === "legacy") {
         lines.push(`last flush: ${report.lastFlushAt ?? "(never)"}${report.lastFlushResult

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -8,8 +8,11 @@
  * - MQTT presence (contract-3)
  * - SIGTERM/SIGINT: flush once more, MQTT DISCONNECT (server derives offline), exit
  */
+import { type DeliverFn } from "../../../work-context/outbox.js";
+import { type SessionEventsPoster } from "../session-events-client.js";
 import { type FlushSummary } from "../flush.js";
 import { type BackfillHeldResult } from "../backfill-held.js";
+import { type BoardReader } from "./board-refresh.js";
 import { type CredentialsFetcher, type TimerHost } from "./credentials.js";
 import { type PidLockDeps } from "./pid-lock.js";
 import { PresenceClient, type MqttConnectFn } from "./presence.js";
@@ -19,6 +22,7 @@ export declare const SPOOL_DEBOUNCE_MS = 2000;
 export declare const FLUSH_INTERVAL_MS = 10000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export declare const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+export declare const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2000;
 /** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
 export declare const DAEMON_VERSION_DRIFT_EXIT_CODE = 75;
 /**
@@ -79,6 +83,13 @@ export interface DaemonRunDeps {
     exit?: (code: number) => void;
     /** Token provider (tests). */
     getToken?: () => Promise<string>;
+    /** Low-level tenant I/O seams used by authorization regression tests. */
+    poster?: SessionEventsPoster;
+    deliver?: DeliverFn;
+    readBoard?: BoardReader;
+    resolveMembership?: (token: string, slug: string, signal?: AbortSignal) => Promise<{
+        companyUid: string;
+    } | null>;
     log?: (dir: string, line: string) => void;
     /** Stop after this many ms (tests). */
     runForMs?: number;