@indigoai-us/hq-cli 5.125.0 → 5.127.0

package/dist/lib/mesh/live/daemon/run.js

@@ -19,7 +19,7 @@ import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { ensureDefaultCompany } from "../../../work-context/default-company.js";
 import { invalidateDefaultCompanyMemberships, readDeviceConfig, } from "../../../work-context/config.js";
-import { readSessionState, writeSessionState, } from "../../../work-context/state.js";
+import { readSessionState, mergeLocalSessionFields, updateSessionState, } from "../../../work-context/state.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../session-events-client.js";
 import { flushSessionEvents, HELD_RETRY_INTERVAL_MS, } from "../flush.js";
 import { backfillHeldSessions, } from "../backfill-held.js";
@@ -58,6 +58,30 @@ export function shouldFlushOnSpoolDirEvent(filename) {
         return true;
     return String(filename) === "spool.jsonl";
 }
+function sameCompanyValue(a, b) {
+    return Boolean(a && b && a.toLowerCase() === b.toLowerCase());
+}
+function stillMatchesDeniedCompany(current, input, slug) {
+    const deniedUid = input.companyUid ?? input.state?.companyUid;
+    const deniedSlug = input.companySlug ?? input.state?.companySlug ?? slug;
+    if (deniedUid && current.companyUid && deniedUid !== current.companyUid)
+        return false;
+    if (deniedSlug && current.companySlug && !sameCompanyValue(deniedSlug, current.companySlug))
+        return false;
+    return Boolean(current.companyUid || current.companySlug);
+}
+function stillMatchesDeniedDeviceDefaultBinding(current, original, input, slug) {
+    return stillMatchesDeniedCompany(current, input, slug) &&
+        current.companyUid === original.companyUid &&
+        current.companySlug === original.companySlug &&
+        current.contextStatus === original.contextStatus &&
+        current.projectId === original.projectId &&
+        current.taskId === original.taskId &&
+        current.bindingEpisodeId === original.bindingEpisodeId &&
+        current.source === original.source &&
+        current.version === original.version &&
+        current.updatedAt === original.updatedAt;
+}
 function alive(pid) {
     try {
         process.kill(pid, 0);
@@ -123,33 +147,54 @@ export async function runMeshDaemon(deps = {}) {
                 ? readSessionState(input.sessionId, ctxRoot)
                 : null);
             const slug = input.companySlug ?? state?.companySlug;
-            const membership = await (async () => {
+            let authorization;
+            if (!slug) {
+                authorization = { status: "denied" };
+            }
+            else {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS);
                 try {
-                    if (!slug)
-                        return null;
-                    const controller = new AbortController();
-                    const timeout = setTimeout(() => controller.abort(), DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS);
-                    try {
-                        return await Promise.race([
-                            resolveMembership(await getToken(), slug, controller.signal),
-                            new Promise((resolve) => controller.signal.addEventListener("abort", () => resolve(null), { once: true })),
-                        ]);
-                    }
-                    finally {
-                        clearTimeout(timeout);
-                    }
+                    authorization = await Promise.race([
+                        (async () => {
+                            const membership = await resolveMembership(await getToken(), slug, controller.signal);
+                            return membership
+                                ? { status: "authorized", uid: membership.companyUid }
+                                : { status: "denied" };
+                        })(),
+                        new Promise((resolve) => {
+                            controller.signal.addEventListener("abort", () => resolve({
+                                status: "unavailable",
+                                error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
+                            }), { once: true });
+                        }),
+                    ]);
                 }
-                catch {
-                    return null;
+                catch (err) {
+                    authorization = {
+                        status: "unavailable",
+                        error: err instanceof Error ? err.message : String(err),
+                    };
                 }
-            })();
-            const uid = membership?.companyUid;
+                finally {
+                    clearTimeout(timeout);
+                }
+            }
+            if (authorization.status === "unavailable") {
+                const prior = readDaemonState(dir)?.deviceDefaultMembershipLookupFailures ?? 0;
+                patchDaemonState(dir, {
+                    lastErrorCode: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED",
+                    deviceDefaultMembershipLookupFailures: prior + 1,
+                }, now);
+                log(dir, `device-default membership lookup unavailable${slug ? ` company=${slug}` : ""}: ${authorization.error.slice(0, 160)}`);
+                return authorization;
+            }
             if (!input.deviceDefault)
-                return uid ? { uid } : false;
-            if (uid &&
-                (!input.companyUid || input.companyUid === uid) &&
-                (!state?.companyUid || state.companyUid === uid)) {
-                return { uid };
+                return authorization;
+            if (authorization.status === "authorized" &&
+                (!input.companyUid || input.companyUid === authorization.uid) &&
+                (!state?.companyUid || state.companyUid === authorization.uid)) {
+                return authorization;
             }
             try {
                 invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
@@ -158,20 +203,39 @@ export async function runMeshDaemon(deps = {}) {
                 log(dir, `default membership cache invalidation failed: ${String(err).slice(0, 160)}`);
             }
             if (state) {
-                writeSessionState({
-                    ...state,
-                    companyUid: undefined,
-                    companySlug: undefined,
-                    contextStatus: "needs_company",
-                    updatedAt: now().toISOString(),
-                }, ctxRoot);
+                // Commit only if the device-default binding that started this lookup is
+                // still current. The shared session-state lock also makes a hook writer
+                // that arrives at this boundary commit after us rather than get lost.
+                deps.beforeDeviceDefaultRevocationCommit?.();
+                const revoked = updateSessionState(state.sessionId, ctxRoot, (current) => {
+                    if (!current || !stillMatchesDeniedDeviceDefaultBinding(current, state, input, slug)) {
+                        return null;
+                    }
+                    return mergeLocalSessionFields({
+                        ...current,
+                        companyUid: undefined,
+                        companySlug: undefined,
+                        contextStatus: "needs_company",
+                        updatedAt: now().toISOString(),
+                    }, current, { preserveCompanyBinding: false });
+                });
+                if (!revoked) {
+                    log(dir, `device-default membership denial left newer session binding intact session=${state.sessionId}`);
+                }
             }
             const prior = readDaemonState(dir)?.deviceDefaultAuthorizationDenials ?? 0;
             patchDaemonState(dir, { deviceDefaultAuthorizationDenials: prior + 1 }, now);
             log(dir, `device-default membership denied${slug ? ` company=${slug}` : ""}; work held`);
-            return false;
+            return { status: "denied" };
         },
     };
+    const validateDaemonMembership = async (slug, deviceDefault) => {
+        const authorization = await tenantGate.authorize({ companySlug: slug, deviceDefault });
+        if (authorization.status === "unavailable") {
+            throw new Error(`device-default membership lookup unavailable: ${authorization.error}`);
+        }
+        return authorization.status === "authorized" ? { uid: authorization.uid } : false;
+    };
     /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
     let lastHeldRetryAtMs = 0;
     const flushFn = deps.flush ??
@@ -191,12 +255,12 @@ export async function runMeshDaemon(deps = {}) {
                     lastHeldRetryAtMs = atMs;
                 },
                 log: (message) => log(dir, message),
-                authorizeDeviceDefaultTenant: async (state) => Boolean(await tenantGate.authorize({
+                authorizeDeviceDefaultTenant: async (state) => (await tenantGate.authorize({
                     state,
                     companySlug: state.companySlug,
                     companyUid: state.companyUid,
                     deviceDefault: true,
-                })),
+                })).status === "authorized",
             });
         });
     const replayFn = deps.replayOutbox ??
@@ -215,13 +279,16 @@ export async function runMeshDaemon(deps = {}) {
                     // only authority that may release them.
                     !op.companyConfidence;
                 if (requiresMembershipCheck) {
-                    const allowed = await tenantGate.authorize({
+                    const authorization = await tenantGate.authorize({
                         state: state ?? undefined,
                         companySlug: op.companySlug ?? state?.companySlug,
                         companyUid: op.companyUid ?? state?.companyUid,
                         deviceDefault: true,
                     });
-                    if (!allowed) {
+                    if (authorization.status === "unavailable") {
+                        return { ok: false, retryable: true, code: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED" };
+                    }
+                    if (authorization.status !== "authorized") {
                         return { ok: false, retryable: false, code: "DEVICE_DEFAULT_MEMBERSHIP_DENIED" };
                     }
                 }
@@ -260,13 +327,11 @@ export async function runMeshDaemon(deps = {}) {
                     root: ctxRoot,
                     env,
                     deliver,
-                    validateMembership: async (slug) => tenantGate.authorize({
-                        companySlug: slug,
-                        deviceDefault: useDeviceDefault,
-                    }),
+                    validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
                     allowDeviceDefault: useDeviceDefault,
                     deviceDefaultConfidence: useDeviceDefault,
                 }),
+                validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
             });
         });
     const boardLast = new Map();
@@ -282,12 +347,12 @@ export async function runMeshDaemon(deps = {}) {
                 lastRefresh: boardLast,
                 intervalMs: BOARD_REFRESH_INTERVAL_MS,
                 now: () => timers.now(),
-                authorizeDeviceDefaultTenant: async (_sessionId, state) => Boolean(await tenantGate.authorize({
+                authorizeDeviceDefaultTenant: async (_sessionId, state) => (await tenantGate.authorize({
                     state,
                     companySlug: state.companySlug,
                     companyUid: state.companyUid,
                     deviceDefault: true,
-                })),
+                })).status === "authorized",
             });
         });
     let presence = null;
@@ -387,18 +452,10 @@ export async function runMeshDaemon(deps = {}) {
             fs: deps.transcriptFs,
             now: () => now().getTime(),
             lastHookEventAt,
-            validateMembership: async (slug) => {
-                try {
-                    const token = await getToken();
-                    const membership = await resolveActiveMembershipCompany(token, slug);
-                    if (!membership)
-                        return false;
-                    return { uid: membership.companyUid };
-                }
-                catch {
-                    return false;
-                }
-            },
+            // Transcript watch has no direct state writer: reconcile owns its write
+            // and merges local fields. Surface transient lookup failures as throws so
+            // reconcile defers without turning them into an authoritative denial.
+            validateMembership: (slug) => validateDaemonMembership(slug, true),
             deliver: async (op) => {
                 try {
                     const token = await getToken();

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -29,6 +29,8 @@ export interface DaemonStateFile {
     emitMode?: "legacy" | "direct";
     /** Authoritative membership denials for device-default-derived tenant I/O. */
     deviceDefaultAuthorizationDenials?: number;
+    /** Transient device-default membership refresh failures; the next cycle retries. */
+    deviceDefaultMembershipLookupFailures?: number;
     updatedAt: string;
 }
 export declare function defaultDaemonState(pid: number, now?: () => Date): DaemonStateFile;

package/dist/lib/mesh/live/daemon/transcript-watch.d.ts

@@ -49,6 +49,9 @@ export declare const TRANSCRIPT_WATCH_REVALIDATE_MS: number;
 export declare const TRANSCRIPT_TURN_QUIET_MS = 5000;
 export declare const TRANSCRIPT_SESSION_END_MS: number;
 export declare const TRANSCRIPT_HOOK_COVER_MS = 60000;
+/** Retry unavailable transcript-start reconciliation without hot-looping. */
+export declare const TRANSCRIPT_START_RETRY_BASE_MS = 30000;
+export declare const TRANSCRIPT_START_RETRY_MAX_MS = 120000;
 /** Ignore cold transcripts whose mtime is older than this on first sight. */
 export declare const TRANSCRIPT_FRESH_MS: number;
 export declare const TRANSCRIPT_MARKER: "from transcript";

package/dist/lib/mesh/live/daemon/transcript-watch.js

@@ -54,6 +54,9 @@ export const TRANSCRIPT_WATCH_REVALIDATE_MS = 5 * 60_000;
 export const TRANSCRIPT_TURN_QUIET_MS = 5_000;
 export const TRANSCRIPT_SESSION_END_MS = 10 * 60_000;
 export const TRANSCRIPT_HOOK_COVER_MS = 60_000;
+/** Retry unavailable transcript-start reconciliation without hot-looping. */
+export const TRANSCRIPT_START_RETRY_BASE_MS = 30_000;
+export const TRANSCRIPT_START_RETRY_MAX_MS = 120_000;
 /** Ignore cold transcripts whose mtime is older than this on first sight. */
 export const TRANSCRIPT_FRESH_MS = TRANSCRIPT_SESSION_END_MS;
 export const TRANSCRIPT_MARKER = "from transcript";
@@ -652,6 +655,8 @@ export class TranscriptWatcher {
                         ended: false,
                         pendingTurn: false,
                         seq: 0,
+                        startRetryAttempts: 0,
+                        nextStartRetryAtMs: 0,
                     };
                     this.tracked.set(d.path, track);
                     const started = await this.emitStart(track, nowMs);
@@ -661,6 +666,14 @@ export class TranscriptWatcher {
                 }
                 if (track.ended)
                     continue;
+                if (!track.started) {
+                    if (nowMs < track.nextStartRetryAtMs)
+                        continue;
+                    const started = await this.emitStart(track, nowMs);
+                    if (started)
+                        result.started += 1;
+                    continue;
+                }
                 if (d.mtimeMs > track.lastMtimeMs) {
                     track.lastMtimeMs = d.mtimeMs;
                     track.lastChangeAtMs = nowMs;
@@ -737,14 +750,22 @@ export class TranscriptWatcher {
             hqRoot: this.deps.hqRoot,
             source: "transcript",
         };
-        await this.reconcileFn(observation, {
-            root: this.deps.workContextRoot,
-            env: this.deps.env,
-            now: () => new Date(nowMs),
-            validateMembership: this.deps.validateMembership,
-            deliver: this.deps.deliver,
-            offline: !this.deps.deliver,
-        });
+        try {
+            await this.reconcileFn(observation, {
+                root: this.deps.workContextRoot,
+                env: this.deps.env,
+                now: () => new Date(nowMs),
+                validateMembership: this.deps.validateMembership,
+                deliver: this.deps.deliver,
+                offline: !this.deps.deliver,
+            });
+        }
+        catch {
+            track.startRetryAttempts += 1;
+            const delayMs = Math.min(TRANSCRIPT_START_RETRY_BASE_MS * 2 ** (track.startRetryAttempts - 1), TRANSCRIPT_START_RETRY_MAX_MS);
+            track.nextStartRetryAtMs = nowMs + delayMs;
+            return false;
+        }
         // Re-check: a hook may have raced us during reconcile.
         const after = this.readState(track.sessionId, this.deps.workContextRoot);
         if (isHookWrittenSessionState(after)) {
@@ -753,6 +774,8 @@ export class TranscriptWatcher {
         }
         this.emitKind(track, "session_start", nowMs);
         track.started = true;
+        track.startRetryAttempts = 0;
+        track.nextStartRetryAtMs = 0;
         return true;
     }
     emitKind(track, kind, nowMs) {

package/dist/lib/scan-packages/index.d.ts

@@ -1,3 +1,4 @@
+import type { PackContributeKey } from '../../types.js';
 type Logger = (message: string) => void;
 export interface ScanPackagesOptions {
     quiet?: boolean;
@@ -7,6 +8,7 @@ export interface ScanPackagesOptions {
 export interface ScanPackagesResult {
     status: 0 | 1;
 }
+export declare function readContributes(manifest: string): Partial<Record<PackContributeKey, string[]>>;
 /** Wire installed pack contributions into their table-declared host locations. */
 export declare function scanPackages(hqRoot: string, options?: ScanPackagesOptions): ScanPackagesResult;
 export {};

package/dist/lib/scan-packages/index.js

@@ -18,7 +18,7 @@ catch {
     return false;
 } }
 function normalized(relative) { return relative.replaceAll(path.sep, '/'); }
-function readContributes(manifest) {
+export function readContributes(manifest) {
     // This deliberately mirrors the staging script's shallow awk grammar rather
     // than accepting YAML forms the legacy ABI never recognized (notably a
     // non-empty inline list). Mapping remains single-sourced in
@@ -163,34 +163,39 @@ function ensureSymlink(link, info, warn) {
         warn(`payload missing: ${link.src} (declared but not shipped)`);
         return;
     }
+    const relativeSrc = path.relative(path.dirname(link.dst), link.src);
     fs.mkdirSync(path.dirname(link.dst), { recursive: true });
     try {
         const stat = fs.lstatSync(link.dst);
         if (stat.isSymbolicLink()) {
             const existing = fs.readlinkSync(link.dst);
-            if (existing === link.src)
+            // Correct form is relative to the host directory so a tree can move
+            // between machines. An absolute match (this host, pre-relative installer)
+            // is ours and converges. A dangling leftover from another HQ root is
+            // not host content and is rewritten the same way.
+            if (existing === relativeSrc)
                 return;
-            // "Host content wins" protects content. A symlink that does not resolve
-            // is not content — and it is the shape every pack link takes when a tree
-            // moves between machines, because these links are absolute and the old
-            // HQ root does not exist on the new host. Skipping it would make that
-            // state permanent: stale on this run, and on every run after it.
-            //
+            if (existing === link.src) {
+                fs.rmSync(link.dst, { force: true });
+                fs.symlinkSync(relativeSrc, link.dst);
+                info(`relinked ${link.dst} -> ${relativeSrc} (was ${existing})`);
+                return;
+            }
             // Only a lookup that specifically says "not there" earns a relink.
             // fs.existsSync also answers false for EACCES, which would read content
             // this user merely cannot traverse as absent and delete the link to it.
             const lookup = targetLookup(link.dst);
             if (lookup === 'absent') {
                 fs.rmSync(link.dst, { force: true });
-                fs.symlinkSync(link.src, link.dst);
-                info(`relinked ${link.dst} -> ${link.src} (was ${existing}, which does not exist here)`);
+                fs.symlinkSync(relativeSrc, link.dst);
+                info(`relinked ${link.dst} -> ${relativeSrc} (was ${existing}, which does not exist here)`);
                 return;
             }
             if (lookup !== 'present') {
                 warn(`collision: ${link.dst} points at ${existing}, which could not be checked (${lookup}) — leaving it alone`);
                 return;
             }
-            warn(`collision: ${link.dst} already points at ${existing} (wanted ${link.src}) — skipping`);
+            warn(`collision: ${link.dst} already points at ${existing} (wanted ${relativeSrc}) — skipping`);
             return;
         }
         warn(`collision: ${link.dst} exists as regular file/dir — host content wins, skipping`);
@@ -200,8 +205,8 @@ function ensureSymlink(link, info, warn) {
         if (error.code !== 'ENOENT')
             throw error;
     }
-    fs.symlinkSync(link.src, link.dst);
-    info(`linked ${link.dst} -> ${link.src}`);
+    fs.symlinkSync(relativeSrc, link.dst);
+    info(`linked ${link.dst} -> ${relativeSrc}`);
 }
 /**
  * The link text, when `entry` is a symlink whose target is definitively not

package/dist/lib/work-context/config.d.ts

@@ -2,6 +2,8 @@
  * Device-local default company preference (~/.hq/work-context/config.json).
  * Preference only — never authority. activeCompany is never treated as default.
  */
+import * as fs from "node:fs";
+import { type WindowsAclCheckOptions } from "./windows-acl.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 export declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
 export interface DeviceDefaultCompany {
@@ -81,6 +83,24 @@ export declare function acquireDeviceConfigLock(root: string, options?: {
     timeoutMs?: number;
     staleMs?: number;
 }): () => void;
+/** Injection points for assertSafeConfigPath (tests only). */
+export interface SafeConfigPathIo {
+    platform?: NodeJS.Platform;
+    existsSync?: (p: string) => boolean;
+    lstatSync?: (p: string) => Pick<fs.Stats, "mode" | "isSymbolicLink">;
+    windowsAcl?: WindowsAclCheckOptions;
+}
+/**
+ * Refuse a config path that is a symlink (every platform) or writable by
+ * anyone other than the owner.
+ *
+ * - POSIX (darwin/linux/...): `mode & 0o022` must be clear. Unchanged.
+ * - win32: NTFS has no POSIX mode bits; Node reports 0666 for every regular
+ *   file, so the mode test would reject every config (US-018). We read the
+ *   real DACL instead (see windows-acl.ts). Unreadable DACL → documented
+ *   reduced-guarantee path: one diagnostic line, no throw.
+ */
+export declare function assertSafeConfigPath(configPath: string, io?: SafeConfigPathIo): void;
 export declare function readDeviceConfig(deps: Pick<DeviceConfigDeps, "root">): WorkContextDeviceConfig;
 export declare function getDefaultCompany(deps: Pick<DeviceConfigDeps, "root">): DeviceDefaultCompany | null;
 /** A clear is a durable opt-out, not an invitation for automatic reactivation. */

package/dist/lib/work-context/config.js

@@ -7,6 +7,7 @@ import * as path from "node:path";
 import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
 import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError, } from "./errors.js";
 import { workContextConfigPath, workContextRoot } from "./paths.js";
+import { assertWindowsOwnerOnlyAcl } from "./windows-acl.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 export const DEVICE_CONFIG_SCHEMA_VERSION = 1;
 const CONFIG_LOCK_TIMEOUT_MS = 5_000;
@@ -147,20 +148,40 @@ function sanitizeRepoCompanyMap(raw) {
     }
     return Object.keys(out).length > 0 ? out : null;
 }
-function assertSafeConfigPath(configPath) {
+/**
+ * Refuse a config path that is a symlink (every platform) or writable by
+ * anyone other than the owner.
+ *
+ * - POSIX (darwin/linux/...): `mode & 0o022` must be clear. Unchanged.
+ * - win32: NTFS has no POSIX mode bits; Node reports 0666 for every regular
+ *   file, so the mode test would reject every config (US-018). We read the
+ *   real DACL instead (see windows-acl.ts). Unreadable DACL → documented
+ *   reduced-guarantee path: one diagnostic line, no throw.
+ */
+export function assertSafeConfigPath(configPath, io = {}) {
+    const platform = io.platform ?? process.platform;
+    const existsSync = io.existsSync ?? fs.existsSync;
+    const lstatSync = io.lstatSync ?? fs.lstatSync;
     const dir = path.dirname(configPath);
     try {
-        if (fs.existsSync(dir)) {
-            const lst = fs.lstatSync(dir);
+        if (existsSync(dir)) {
+            const lst = lstatSync(dir);
             if (lst.isSymbolicLink()) {
                 throw new UnsafeConfigPathError(`Config directory is a symlink: ${dir}`);
             }
+            if (platform === "win32") {
+                assertWindowsOwnerOnlyAcl(dir, "directory", io.windowsAcl);
+            }
         }
-        if (fs.existsSync(configPath)) {
-            const lst = fs.lstatSync(configPath);
+        if (existsSync(configPath)) {
+            const lst = lstatSync(configPath);
             if (lst.isSymbolicLink()) {
                 throw new UnsafeConfigPathError(`Config file is a symlink: ${configPath}`);
             }
+            if (platform === "win32") {
+                assertWindowsOwnerOnlyAcl(configPath, "file", io.windowsAcl);
+                return;
+            }
             const mode = lst.mode & 0o777;
             // Warn-level only for world-writable; refuse group/other write bits on read for safety.
             if (mode & 0o022) {

package/dist/lib/work-context/reconcile.js

@@ -701,17 +701,37 @@ export async function reconcileObservation(obs, deps) {
     if (delivered.ok) {
         markOutboxAcked(outboxOp.operationId, deps.root, delivered.receiptId, nowFn);
         writeAckedRegisterState(outboxOp, deps.root, delivered.receiptId, nowFn);
-        // Persist binding episode on success for bound registrations.
-        if (registerClassification === "bound") {
+        // Company attribution write for EVERY acked register that resolved a
+        // company — not only bound sessions. A company-only ack (needs_project /
+        // needs_task / unresolved) must still project companyUid/companySlug and
+        // the true computed classification into durable session state; otherwise
+        // the emitter and mesh presence lose the tenant the server already
+        // acknowledged. projectId / taskId are written only when genuinely
+        // resolved, and a fresh bindingEpisodeId only when the session is bound —
+        // never fabricated on a partial path. (writeAckedRegisterState above may
+        // have already recorded a receipt-derived episode for a resolved partial
+        // binding; the default merge preserves that when the binding still matches.)
+        if (resolvedCompany.uid) {
+            const bound = registerClassification === "bound";
+            // A server ack of the company makes it authoritative: the durable status
+            // is at least needs_project (company known, no project), needs_task
+            // (project, no task), or bound (project + task) — mirroring
+            // acknowledgedStatus() in state.ts. Never downgrade an acked company to a
+            // pre-threshold "unresolved" projection; that is what dropped the tenant.
+            const ackedClassification = projectId && taskId
+                ? "bound"
+                : projectId
+                    ? "needs_task"
+                    : "needs_project";
             writeSessionState(mergeLocalSessionFields({
                 contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
                 sessionId,
                 companyUid: resolvedCompany.uid,
                 companySlug: resolvedCompany.slug,
-                contextStatus: "bound",
-                projectId,
-                taskId,
-                bindingEpisodeId: delivered.receiptId,
+                contextStatus: bound ? "bound" : ackedClassification,
+                ...(projectId ? { projectId } : {}),
+                ...(taskId ? { taskId } : {}),
+                ...(bound ? { bindingEpisodeId: delivered.receiptId } : {}),
                 updatedAt: nowFn().toISOString(),
                 startedAt,
                 ...(typeof toolWrites === "number" ? { toolWrites } : {}),
@@ -719,7 +739,8 @@ export async function reconcileObservation(obs, deps) {
                 ...transcriptFields,
             }, 
             // Merge against the just-written projection rather than the stale
-            // snapshot from before reconciliation (retains device confidence).
+            // pre-reconcile snapshot, so device confidence and any receipt
+            // attribution survive.
             readSessionState(sessionId, deps.root) ?? stateWrite), deps.root);
         }
         const kind = registerClassification === "bound"

package/dist/lib/work-context/state.d.ts

@@ -109,8 +109,19 @@ export interface AcknowledgedRegisterBinding {
 }
 /** Allowlisted keys that may appear in the durable state projection. */
 export declare const SESSION_STATE_ALLOWLIST: Set<string>;
+/**
+ * Serialize a session-state read/modify/write with every state writer. Atomic
+ * rename protects readers from torn files, but only this shared lock protects
+ * a writer that has to verify the current binding before changing it.
+ */
+export declare function withSessionStateLock<T>(sessionId: string, root: string, fn: () => T): T;
 export declare function readSessionState(sessionId: string, root: string): SessionStateFile | null;
 export declare function writeSessionState(state: SessionStateFile, root: string): string;
+/**
+ * Commit a state change only after inspecting the latest value under the same
+ * lock used by ordinary session writers. Returning null declines the write.
+ */
+export declare function updateSessionState(sessionId: string, root: string, update: (current: SessionStateFile | null) => SessionStateFile | null): SessionStateFile | null;
 /** Strip any non-allowlisted fields before durable write. */
 export declare function projectSessionState(state: SessionStateFile): SessionStateFile;
 /**
@@ -119,6 +130,7 @@ export declare function projectSessionState(state: SessionStateFile): SessionSta
  */
 export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null, options?: {
     preserveBindingEpisode?: boolean;
+    preserveCompanyBinding?: boolean;
 }): SessionStateFile;
 /**
  * Upgrade the local projection after the server acknowledges a register.