@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/commands/mesh.js

@@ -5,57 +5,37 @@
  * require hq-pack-work-mesh on disk and does not start MQTT listen.
  * Distinct from `hq doctor` (hook guardrails).
  */
-import { resolve as resolvePath } from "node:path";
 import * as os from "node:os";
-import { readFileSync } from "node:fs";
-import { findHqRoot } from "../utils/manifest.js";
-import { CLI_VERSION } from "../cli-version.js";
 import chalk from "chalk";
-import { ensureCognitoToken, isExpiring, isMachineIdentity, loadCachedTokens, } from "../utils/cognito-session.js";
+import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
-import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
-import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard, boardStoryStatus, formatStoryStatusChanges, mergeProjectStories, prdSyncEventsThatChangeBoard, } from "../lib/mesh/project-board.js";
-import { mapSourceStoryStatus } from "../lib/mesh/story-status.js";
-import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.js";
+import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveMembershipCompanies, listActiveThreads, patchStoryStatus, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
-import { clearDefaultCompany, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, } from "../lib/work-context/config.js";
-import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
-import { DefaultCompanyUnavailableError, } from "../lib/work-context/errors.js";
+import { clearDefaultCompany, getDefaultCompany, readDeviceConfig, recordMigrationCapabilitySnapshot, setDefaultCompany, } from "../lib/work-context/config.js";
+import { DefaultCompanyLockedError, DefaultCompanyUnavailableError, } from "../lib/work-context/errors.js";
 import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
 import { CLI_KIND_TO_SCHEMA, resolveEnqueueSessionId, } from "../lib/mesh/live/index.js";
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
 import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
-const ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
-// Leave 500 ms of headroom inside SessionStart's 2 s process-group limit.
-const OFFLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS = 1_500;
-import { buildEmitEvidence, machineEmitDisposition } from "../lib/mesh/live/emit-evidence.js";
-import { appendHeldLine } from "../lib/mesh/live/spool.js";
+import { buildEmitEvidence } from "../lib/mesh/live/emit-evidence.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
-import { enrichSessionEndEvent } from "../lib/mesh/live/report-summary.js";
-import { emitEvents, formatEmitRejectionLines } from "../lib/mesh/live/emit.js";
+import { emitEvents } from "../lib/mesh/live/emit.js";
 import { readEmitRetry, writeEmitRetry } from "../lib/mesh/live/emit-retry.js";
 import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { readLegacyBacklog } from "../lib/mesh/live/emit-replay.js";
 import { resolveMeshEmitMode, writeMeshConfigMode, } from "../lib/mesh/live/daemon/mode.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
-import { buildInstallPaths, collectDaemonDoctor, daemonServiceIsLoaded, daemonServiceStatus, findAncestorHqRoot, resolveInstallHqRoot, detectPlatform, formatCliIdentityLines, formatDaemonDoctor, installDaemonIfStale, installDaemonService, readDaemonState, resolveAbsoluteNodeBinary, resolveRunningCliEntry, runMeshDaemon, uninstallDaemonService, } from "../lib/mesh/live/daemon/index.js";
-import { defaultRunCommand } from "../lib/service-manager/launchd.js";
+import { buildInstallPaths, collectDaemonDoctor, daemonServiceStatus, detectPlatform, formatDaemonDoctor, installDaemonService, readDaemonState, runMeshDaemon, uninstallDaemonService, daemonDir, } from "../lib/mesh/live/daemon/index.js";
 import { workContextRoot } from "../lib/work-context/paths.js";
 import { formatMigrateConfirmation, submitSessionMigration, } from "../lib/work-context/migrate.js";
 import { formatOrganizeList, prepareOrganizeDecision, settleOrganizeAskWithoutBind, submitOrganizeDecision, } from "../lib/work-context/organize.js";
-import { applyOperatorProjectBinding, readSessionState, updateSessionState, } from "../lib/work-context/state.js";
-import { findLocalPrd, listNeedsProjectSessions } from "../lib/work-context/bind-best.js";
-import { bindCallingSession, formatSessionBoundLine } from "../lib/work-context/bind-calling-session.js";
-import { rebindNeedsProjectOnPrompt } from "../lib/work-context/prompt-rebind.js";
-import { planPrdSync, rebindSessionToProject } from "../lib/work-context/prd-sync.js";
-import { reserveSessionSeq } from "../lib/mesh/live/session-seq.js";
+import { readSessionState } from "../lib/work-context/state.js";
 import { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "../lib/work-context/reconcile.js";
 import { resolveCompany } from "../lib/work-context/company.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../lib/work-context/repo-remote.js";
 import { promptRepoCompany, } from "../lib/work-context/repo-prompt.js";
 import { requeueQuarantinedOutbox } from "../lib/work-context/outbox.js";
-import { handOffInstallHere } from "../lib/daemon/handoff.js";
 export function formatCheckLines(threads, company, projectId) {
     if (threads.length === 0) {
         return ["Work mesh: no active project threads found."];
@@ -63,22 +43,14 @@ export function formatCheckLines(threads, company, projectId) {
     const scope = projectId
         ? `${company.companySlug || company.companyUid}/${projectId}`
         : company.companySlug || company.companyUid;
-    const lines = [`Work mesh: ${threads.length} thread(s) for ${scope}`];
+    const lines = [`Work mesh: ${threads.length} active thread(s) for ${scope}`];
     for (const thread of threads.slice(0, 8)) {
         const owner = thread.ownerUid ? ` owner=${thread.ownerUid}` : "";
         const summary = thread.progressSummary ||
             thread.sourceSignalSummary ||
             thread.blockedReason ||
             "";
-        const lane = thread.kind === "lane" ? thread.lane : undefined;
-        const laneDetails = lane
-            ? ` lane=${lane.laneId} laneStatus=${thread.laneStatus ?? "unknown"}` +
-                ` story=${lane.storyId ?? "unknown"} profile=${lane.workerProfile ?? "unknown"}` +
-                ` model=${lane.model ?? "unknown"} account=${lane.account ?? "unknown"}` +
-                `${lane.parentLaneId ? ` parent=${lane.parentLaneId}` : ""}`
-            : "";
-        const machine = thread.senderMachineUid ? ` machine=${thread.senderMachineUid}` : "";
-        lines.push(`- ${thread.threadStatus ?? "unknown"} ${thread.threadId ?? "?"}${owner}${machine}${laneDetails}${summary ? `: ${summary}` : ""}`);
+        lines.push(`- ${thread.threadStatus ?? "unknown"} ${thread.threadId ?? "?"}${owner}${summary ? `: ${summary}` : ""}`);
     }
     return lines;
 }
@@ -113,20 +85,12 @@ async function runCheck(opts) {
 async function runEvent(verb, opts) {
     const { token, company } = await withCompany(opts);
     const projectId = requireProject(opts);
-    const eventKind = verb === "start" ? "claim" : verb;
-    let claimant = "";
-    if (eventKind === "claim") {
-        const resolvedClaimant = await resolveMeshPrincipalUid(token, loadCachedTokens());
-        if (!resolvedClaimant) {
-            fail("Could not resolve the authenticated claimant. Sign in again and retry `hq mesh start`.");
-        }
-        claimant = resolvedClaimant;
-    }
     const ensured = await ensureProjectThread(token, company, projectId, {
         threadId: opts.threadId,
         summary: opts.summary,
     });
-    const event = await appendThreadEvent(token, company.companyUid, ensured.threadId, eventKind, eventPayload(eventKind, opts, claimant));
+    const eventKind = verb === "start" ? "claim" : verb;
+    const event = await appendThreadEvent(token, company.companyUid, ensured.threadId, eventKind, eventPayload(eventKind, opts, callerLabelFromToken(token)));
     if (opts.json) {
         console.log(JSON.stringify({
             ok: true,
@@ -145,705 +109,33 @@ async function runEvent(verb, opts) {
 async function runStory(opts) {
     const storyId = opts.story?.trim();
     const status = opts.status?.trim();
-    const assignee = opts.assignee?.trim();
-    if (!storyId) {
-        fail("story requires --story <id>");
-    }
-    if (!status && !assignee) {
-        fail("story requires --status queued|in_progress|review|done or --assignee <uid|me|none>");
-    }
-    if (status && !STORY_STATUSES.has(status)) {
-        fail("story --status must be queued|in_progress|review|done");
+    if (!storyId || !status || !STORY_STATUSES.has(status)) {
+        fail("story requires --story <id> and --status queued|in_progress|review|done");
     }
     const { token, company } = await withCompany(opts);
     const projectId = requireProject(opts);
-    let assigneeUid;
-    let clearAssignee = false;
-    if (assignee === "none") {
-        clearAssignee = true;
-    }
-    else if (assignee === "me") {
-        const resolved = await resolveMeshPrincipalUid(token, loadCachedTokens());
-        if (!resolved || resolved === "session") {
-            fail("`--assignee me` needs the signed-in person or agent. The synthetic session identity cannot be assigned. Sign in again and retry `hq mesh story`.");
-        }
-        assigneeUid = resolved;
-    }
-    else if (assignee) {
-        if (!/^(prs|agt)_/.test(assignee)) {
-            fail("`--assignee` must be a person or agent uid, `me`, or `none`.");
-        }
-        assigneeUid = assignee;
-    }
-    const patched = await patchStory(token, company.companyUid, projectId, storyId, {
-        ...(status ? { status } : {}),
-        ...(assigneeUid ? { assigneeUid } : {}),
-        ...(clearAssignee ? { clearAssignee: true } : {}),
-    });
+    const patched = await patchStoryStatus(token, company.companyUid, projectId, storyId, status);
     if (opts.json) {
         console.log(JSON.stringify({ ok: true, action: "story", company, ...patched, storyId }, null, 2));
         return;
     }
-    const assignment = assignee === "none"
-        ? "assignee cleared"
-        : assignee
-            ? `assignee ${patched.assigneeUid ?? assigneeUid}`
-            : "";
-    const statusPart = status ? `${storyId} → ${patched.status}` : storyId;
-    console.log(`Work mesh: story ${statusPart}${assignment ? ` ${assignment}` : ""} (v${patched.version ?? "?"})`);
-}
-function record(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : null;
-}
-function parseProjectRepoSpec(value, source) {
-    const raw = value.trim();
-    const separator = raw.lastIndexOf("@");
-    const path = (separator > 0 ? raw.slice(0, separator) : raw).trim();
-    const branch = (separator > 0 ? raw.slice(separator + 1) : "").trim();
-    if (!path)
-        fail(`${source} requires a non-empty repository path.`);
-    if (separator > 0 && !branch)
-        fail(`${source} has an empty branch after @.`);
-    return { path, branch };
-}
-function parseProjectRepos(value, source) {
-    if (!Array.isArray(value))
-        fail(`${source} must be a JSON repository array.`);
-    return value.map((raw, index) => {
-        if (typeof raw === "string")
-            return parseProjectRepoSpec(raw, `${source}[${index}]`);
-        const repo = record(raw);
-        const path = typeof repo?.path === "string"
-            ? repo.path.trim()
-            : typeof repo?.repoPath === "string"
-                ? repo.repoPath.trim()
-                : typeof repo?.repo === "string"
-                    ? repo.repo.trim()
-                    : "";
-        const branchValue = repo?.branch ?? repo?.branchName;
-        const branch = branchValue === undefined ? "" : typeof branchValue === "string" ? branchValue.trim() : null;
-        if (!repo || !path)
-            fail(`${source}[${index}].path requires a string.`);
-        if (branch === null)
-            fail(`${source}[${index}].branch requires a string.`);
-        return { path, branch };
-    });
-}
-function parseProjectReposJson(raw, source) {
-    try {
-        return parseProjectRepos(JSON.parse(raw), source);
-    }
-    catch (err) {
-        if (err instanceof SyntaxError)
-            fail(`${source} must contain valid JSON.`);
-        throw err;
-    }
-}
-function projectStoriesFromJson(value, source) {
-    const plan = Array.isArray(value) ? null : record(value);
-    const rawStories = Array.isArray(value)
-        ? value
-        : Array.isArray(plan?.userStories)
-            ? plan.userStories
-            : Array.isArray(plan?.stories)
-                ? plan.stories
-                : null;
-    if (!rawStories) {
-        fail(`${source} must be a JSON story array or an object with userStories.`);
-    }
-    const stories = rawStories.map((raw, index) => {
-        const story = record(raw);
-        const id = typeof story?.id === "string" ? story.id.trim() : "";
-        const title = typeof story?.title === "string" ? story.title.trim() : "";
-        if (!story || !id || !title) {
-            fail(`${source} userStories[${index}] requires string id and title.`);
-        }
-        const status = mapSourceStoryStatus(story, `${source} userStories[${index}]`);
-        const resolvedStatus = status || (story.passes === true ? "done" : undefined);
-        return {
-            id,
-            title,
-            ...(typeof story.description === "string" ? { description: story.description } : {}),
-            ...(Array.isArray(story.acceptanceCriteria)
-                ? {
-                    acceptanceCriteria: story.acceptanceCriteria.filter((item) => typeof item === "string"),
-                }
-                : {}),
-            ...(resolvedStatus ? { status: resolvedStatus } : {}),
-            // hq-pro makes passes mirror the Board status. A completed PRD story
-            // without an explicit status must therefore become done.
-            passes: resolvedStatus === "done",
-            ...(typeof story.priority === "number" && Number.isFinite(story.priority)
-                ? { priority: story.priority }
-                : {}),
-        };
-    });
-    const metadata = record(plan?.metadata);
-    const repos = metadata && Object.hasOwn(metadata, "repos")
-        ? parseProjectRepos(metadata.repos, `${source} metadata.repos`)
-        : undefined;
-    return {
-        ...(typeof plan?.name === "string" ? { name: plan.name } : {}),
-        ...(typeof plan?.description === "string" ? { description: plan.description } : {}),
-        stories,
-        ...(repos ? { repos } : {}),
-    };
-}
-function parseProjectPlan(raw, source) {
-    try {
-        return projectStoriesFromJson(JSON.parse(raw), source);
-    }
-    catch (err) {
-        if (err instanceof SyntaxError)
-            fail(`${source} must contain valid JSON.`);
-        throw err;
-    }
-}
-function httpStatus(err) {
-    if (err && typeof err === "object" && "status" in err && typeof err.status === "number") {
-        return err.status;
-    }
-    return undefined;
-}
-function mergeProjectRepos(current, planned) {
-    const plannedPaths = new Set(planned.map((repo) => repo.path));
-    return [...planned, ...current.filter((repo) => !plannedPaths.has(repo.path))];
-}
-async function runProjectSet(projectId, opts) {
-    if (opts.channel !== undefined && !opts.channel.trim()) {
-        fail("PROJECT_CHANNEL_INVALID: --channel must be a non-empty channel id.");
-    }
-    if (opts.storiesFile && opts.storiesJson) {
-        fail("Pass only one of --stories-file or --stories-json.");
-    }
-    if (opts.reposJson && opts.repo?.length) {
-        fail("Pass only one of --repos-json or --repo.");
-    }
-    const source = opts.storiesFile
-        ? parseProjectPlan(readFileSync(opts.storiesFile, "utf8"), opts.storiesFile)
-        : opts.storiesJson
-            ? parseProjectPlan(opts.storiesJson, "--stories-json")
-            : undefined;
-    const explicitRepos = opts.reposJson
-        ? parseProjectReposJson(opts.reposJson, "--repos-json")
-        : opts.repo?.length
-            ? opts.repo.map((repo, index) => parseProjectRepoSpec(repo, `--repo[${index}]`))
-            : undefined;
-    const { token, company } = await withCompany(opts);
-    let current;
-    try {
-        current = await getProjectView(token, company.companyUid, projectId);
-    }
-    catch (err) {
-        if (httpStatus(err) === 404 && opts.create) {
-            if (!source && !opts.name?.trim()) {
-                fail("`--create` needs --name or a stories file when the Board view does not exist.");
-            }
-            current = undefined;
-        }
-        else {
-            throw err;
-        }
-    }
-    if (!current && !opts.create) {
-        fail(`Work mesh project ${projectId} has no Board view. Re-run with --create to add one.`);
-    }
-    const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
-    const PROJECT_CHANGED = "The Board changed while you were editing. Re-run to pick up the latest.";
-    let view;
-    let registration;
-    if (!current) {
-        const ensured = await ensureProjectBoard({
-            token,
-            company,
-            projectId,
-            name: opts.name?.trim() || source?.name || projectId,
-            description: opts.description !== undefined ? opts.description : source?.description ?? "",
-            stories: source?.stories ?? [],
-            repos: explicitRepos ?? source?.repos ?? [],
-            channelId: opts.channel,
-        });
-        view = ensured.view;
-        registration = ensured.registration;
-    }
-    else if (opts.name !== undefined || opts.description !== undefined || source !== undefined || explicitRepos !== undefined) {
-        const stories = source
-            ? mergeProjectStories(current.stories, source.stories, { resetStatus: Boolean(opts.resetStatus) })
-            : current.stories;
-        const statusChangeLine = source ? formatStoryStatusChanges(current.stories, stories) : undefined;
-        try {
-            view = await putProjectView(token, company.companyUid, projectId, {
-                name: opts.name?.trim() || source?.name || current.name,
-                ...(opts.description !== undefined
-                    ? { description: opts.description }
-                    : source?.description !== undefined
-                        ? { description: source.description }
-                        : { description: current.description }),
-                stories,
-                repos: explicitRepos ?? source?.repos ?? current.repos,
-                ...(current.version !== undefined ? { expectedVersion: current.version } : {}),
-            });
-        }
-        catch (err) {
-            const conflict = err;
-            if (conflict.status === 409 && conflict.code === "VERSION_CONFLICT") {
-                if (opts.json) {
-                    console.log(JSON.stringify({ ok: false, code: "VERSION_CONFLICT", error: PROJECT_CHANGED }));
-                }
-                fail(PROJECT_CHANGED);
-            }
-            throw err;
-        }
-        if (statusChangeLine) {
-            if (opts.json)
-                console.error(statusChangeLine);
-            else
-                console.log(statusChangeLine);
-        }
-    }
-    else {
-        view = current;
-    }
-    if (current && opts.channel !== undefined) {
-        registration = await registerMeshProject(token, company.companyUid, projectId, opts.channel);
-    }
-    if (!current && opts.create) {
-        noteCallingSessionBound(view.projectId, company);
-    }
-    if (opts.json) {
-        console.log(JSON.stringify({
-            ok: true,
-            action: "project.set",
-            principalUid,
-            ...view,
-            ...(registration ? { registration } : {}),
-        }, null, 2));
-        return;
-    }
-    console.log(`Work mesh: project ${view.projectId} set (${view.name}; ${view.stories.length} stories)`);
-}
-async function runProjectRegister(projectId, opts) {
-    if (opts.channel !== undefined && !opts.channel.trim()) {
-        fail("PROJECT_CHANNEL_INVALID: --channel must be a non-empty channel id.");
-    }
-    const { token, company } = await withCompany(opts);
-    const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
-    const companyRef = company.companySlug || company.companyUid;
-    try {
-        const board = await getProjectView(token, company.companyUid, projectId);
-        if (board.companyUid !== company.companyUid || board.projectId !== projectId) {
-            fail(`Work mesh project ${projectId} has no Board view in company ${companyRef}. Create the Board before registering it.`);
-        }
-    }
-    catch (err) {
-        if (httpStatus(err) === 404) {
-            fail(`Work mesh project ${projectId} has no Board view in company ${companyRef}. Create the Board before registering it.`);
-        }
-        throw err;
-    }
-    let registration;
-    try {
-        registration = await registerMeshProject(token, company.companyUid, projectId, opts.channel);
-    }
-    catch (err) {
-        const failure = err;
-        if (failure.status === 403 && failure.code === "PROJECT_NOT_IN_COMPANY") {
-            fail(`Work mesh project ${projectId} could not be registered in company ${companyRef}: the Board or its genesis thread is missing. Run "hq mesh project ensure ${projectId} --company ${companyRef} --stories-file <prd.json>" to create or restore them.`);
-        }
-        throw err;
-    }
-    const boardState = "registered";
-    if (opts.json) {
-        console.log(JSON.stringify({ ok: true, action: "project.register", principalUid, boardState, ...registration }, null, 2));
-        return;
-    }
-    console.log(`Work mesh: project ${registration.projectId} registered (${boardState}; channel ${registration.channelId} ${registration.channelCreated ? "created" : "bound"})`);
-}
-async function runProjectEnsure(projectId, opts) {
-    if (!opts.storiesFile?.trim())
-        fail("`--stories-file <prd.json>` is required.");
-    const source = parseProjectPlan(readFileSync(opts.storiesFile, "utf8"), opts.storiesFile);
-    const { token, company } = await withCompany(opts);
-    let current;
-    try {
-        current = await getProjectView(token, company.companyUid, projectId);
-    }
-    catch (err) {
-        if (httpStatus(err) !== 404)
-            throw err;
-    }
-    if (opts.dryRun) {
-        if (current && (current.companyUid !== company.companyUid || current.projectId !== projectId)) {
-            fail("Work mesh project ensure dry-run: Board company or project id did not match the request.");
-        }
-        const stories = current ? mergeProjectStories(current.stories, source.stories) : source.stories;
-        const sourceStatuses = source.stories.map((story) => ({
-            id: story.id,
-            title: story.title,
-            status: boardStoryStatus(story),
-        }));
-        const boardStatuses = stories.map((story) => ({
-            id: story.id,
-            title: story.title,
-            status: boardStoryStatus(story),
-        }));
-        if (opts.json) {
-            console.log(JSON.stringify({
-                ok: true,
-                action: "project.ensure.dry-run",
-                projectId,
-                companyUid: company.companyUid,
-                sourceStatuses,
-                stories: boardStatuses,
-            }, null, 2));
-        }
-        else {
-            console.log(`Work mesh: project ${projectId} dry run (${sourceStatuses.length} source stories)`);
-            console.log("Source statuses:");
-            for (const story of sourceStatuses)
-                console.log(`${story.id}\t${story.status}`);
-            console.log("Merged Board statuses:");
-            for (const story of boardStatuses)
-                console.log(`${story.id}\t${story.status}`);
-        }
-        return;
-    }
-    // Genesis thread, then the view, then register. Register returns 403
-    // PROJECT_NOT_IN_COMPANY until both exist. A missing view uses that chain
-    // from ensureProjectBoard; an existing view is merged, then registered.
-    let registration;
-    let verified;
-    if (!current) {
-        const ensured = await ensureProjectBoard({
-            token,
-            company,
-            projectId,
-            name: source.name || projectId,
-            description: source.description ?? "",
-            stories: source.stories,
-            repos: source.repos ?? [],
-        });
-        registration = ensured.registration;
-        verified = ensured.view;
-    }
-    else {
-        const genesis = await ensureProjectThread(token, company, projectId, {
-            summary: source.name || projectId,
-        });
-        if (!genesis.threadId)
-            fail("Work mesh did not return a threadId.");
-        {
-            const stories = mergeProjectStories(current.stories, source.stories);
-            const repos = mergeProjectRepos(current.repos, source.repos ?? []);
-            const name = source.name || current.name;
-            const description = source.description !== undefined ? source.description : current.description;
-            const changed = name !== current.name ||
-                description !== current.description ||
-                JSON.stringify(stories) !== JSON.stringify(current.stories) ||
-                JSON.stringify(repos) !== JSON.stringify(current.repos);
-            if (changed) {
-                await putProjectView(token, company.companyUid, projectId, {
-                    name,
-                    description,
-                    stories,
-                    repos,
-                    ...(current.version !== undefined ? { expectedVersion: current.version } : {}),
-                });
-            }
-        }
-        registration = await registerMeshProject(token, company.companyUid, projectId);
-        await closeSupersededProjectThread({
-            token,
-            companyUid: company.companyUid,
-            openedThreadId: genesis.threadId,
-            canonicalThreadId: registration.threadId,
-            created: genesis.created,
-        });
-        if (!registration.threadId || !registration.channelId) {
-            fail("Work mesh registration did not return a threadId and channelId.");
-        }
-        verified = await getProjectView(token, company.companyUid, projectId);
-    }
-    if (verified.companyUid !== company.companyUid) {
-        fail(`Work mesh project ensure: company mismatch (expected ${company.companyUid}, got ${verified.companyUid}).`);
-    }
-    if (verified.projectId !== projectId) {
-        fail(`Work mesh project ensure: project id mismatch (expected ${projectId}, got ${verified.projectId}).`);
-    }
-    for (const story of source.stories) {
-        if (!verified.stories.some((row) => row.id === story.id)) {
-            fail(`Work mesh project ensure: missing story ${story.id}.`);
-        }
-    }
-    for (const repo of source.repos ?? []) {
-        if (!verified.repos.some((row) => row.path === repo.path)) {
-            fail(`Work mesh project ensure: missing repo ${repo.path}.`);
-        }
-    }
-    if (verified.version === undefined) {
-        fail("Work mesh project ensure: verified view has no version.");
-    }
-    const payload = {
-        projectId: verified.projectId,
-        threadId: registration.threadId,
-        channelId: registration.channelId,
-        version: verified.version,
-        stories: verified.stories,
-    };
-    noteCallingSessionBound(payload.projectId, company);
-    if (opts.json) {
-        console.log(JSON.stringify(payload));
-        return;
-    }
-    console.log(`Work mesh: project ${payload.projectId} ensured (thread ${payload.threadId}, channel ${payload.channelId}, ${payload.stories.length} stories)`);
-}
-async function runPrdSync(opts) {
-    const sessionId = opts.session.trim();
-    const file = opts.file.trim();
-    if (!sessionId || !file)
-        fail("Usage: hq mesh context prd-sync --session <sid> --file <prd.json>");
-    const root = workContextHomeRoot();
-    const plan = planPrdSync({ sessionId, file, root });
-    if (plan.rebindTo) {
-        rebindSessionToProject({ sessionId, root, projectId: plan.rebindTo });
-    }
-    if (!plan.changed) {
-        const payload = { ok: true, action: "context.prd-sync", changed: 0, ...(plan.skip ? { skip: plan.skip } : {}) };
-        if (opts.json)
-            console.log(JSON.stringify(payload));
-        else
-            console.log(plan.skip ? `Work mesh: prd-sync skipped (${plan.skip})` : "Work mesh: prd-sync unchanged");
-        return;
-    }
-    let token;
-    try {
-        token = await requireToken();
-    }
-    catch {
-        token = null;
-    }
-    if (!token) {
-        console.error("work-mesh: prd-sync has changes but no token; snapshot not advanced");
-        return;
-    }
-    // Attribution evidence: without company and project the server files these
-    // as unassigned and the Board never moves. After a same-company switch,
-    // this is the new project's id so ingest writes SESSION_STATE.projectId
-    // and bound-forward posts the channel line there.
-    const bound = readSessionState(sessionId, root);
-    const evidenceBase = {
-        ...(bound?.companySlug ? { companySlug: bound.companySlug } : {}),
-        ...(bound?.projectId ? { project: bound.projectId } : {}),
-        touchedPaths: [resolvePath(file)],
-    };
-    let toEmit = plan.events;
-    if (bound?.companyUid && bound.projectId) {
-        try {
-            const live = await getProjectView(token, bound.companyUid, bound.projectId);
-            toEmit = prdSyncEventsThatChangeBoard(plan.events, live.stories);
-        }
-        catch {
-            // Board unread — emit the snapshot diff; the server drops same-status.
-        }
-        if (toEmit.length === 0) {
-            plan.commit();
-            if (opts.json) {
-                console.log(JSON.stringify({ ok: true, action: "context.prd-sync", changed: 0 }));
-            }
-            else {
-                console.log("Work mesh: prd-sync unchanged");
-            }
-            return;
-        }
-        try {
-            const source = parseProjectPlan(readFileSync(file, "utf8"), file);
-            await ensureMissingBoardStories({
-                token,
-                company: {
-                    companyUid: bound.companyUid,
-                    companySlug: bound.companySlug || bound.companyUid,
-                },
-                projectId: bound.projectId,
-                name: source.name || bound.projectId,
-                description: source.description ?? "",
-                stories: source.stories,
-                repos: source.repos ?? [],
-                requiredIds: toEmit.map((event) => event.taskId),
-            });
-        }
-        catch (err) {
-            const reason = err instanceof Error ? err.message : String(err);
-            console.error(`work-mesh: prd-sync ensure failed; emitting anyway (${reason.slice(0, 160)})`);
-        }
-    }
-    const alreadyOnBoard = plan.events
-        .filter((event) => !toEmit.some((row) => row.taskId === event.taskId))
-        .map((event) => event.taskId);
-    const meshRoot = workMeshHomeRoot();
-    const seqFirst = reserveSessionSeq(sessionId, toEmit.length);
-    const events = toEmit.map((event, index) => buildMeshEmitEvent({
-        eventId: generateUlid(Date.now() + index),
-        kind: "task_status",
-        sessionId,
-        harness: "hq-sessions",
-        adapterVersion: "1.0.0",
-        at: new Date().toISOString(),
-        seq: seqFirst + index,
-        source: "hooks",
-        taskId: event.taskId,
-        status: event.status,
-        summary: event.status === "done"
-            ? `${event.taskId} passes`
-            : event.status === "in_progress"
-                ? `${event.taskId} in progress`
-                : `${event.taskId} in review`,
-        evidence: { ...evidenceBase, task: event.taskId },
-    }));
-    const poster = createEmitPoster({ token, baseUrl: resolveVaultApiBase(process.env) });
-    const emitted = await emitEvents({
-        workMeshRoot: meshRoot,
-        poster,
-        newEvents: events,
-    });
-    if (emitted.unassigned > 0 || emitted.rejected > 0) {
-        console.error(`work-mesh: prd-sync sent ${events.length}; unassigned=${emitted.unassigned} rejected=${emitted.rejected}`);
-        for (const line of formatEmitRejectionLines(emitted.rejections))
-            console.error(line);
-    }
-    const blocked = new Set(emitted.rejections.map((row) => row.eventId));
-    for (const pending of readEmitRetry(meshRoot)) {
-        const id = typeof pending.eventId === "string" ? pending.eventId : "";
-        if (id)
-            blocked.add(id);
-    }
-    const advanced = events.flatMap((event) => (event.eventId && event.taskId && !blocked.has(event.eventId) ? [event.taskId] : []));
-    plan.commit([...alreadyOnBoard, ...advanced]);
-    if (plan.taskId && advanced.includes(plan.taskId)) {
-        updateSessionState(sessionId, root, (current) => {
-            if (!current)
-                return null;
-            return {
-                ...current,
-                taskId: plan.taskId,
-                contextStatus: current.projectId ? "bound" : current.contextStatus,
-                updatedAt: new Date().toISOString(),
-            };
-        });
-    }
-    if (opts.json) {
-        console.log(JSON.stringify({ ok: true, action: "context.prd-sync", changed: toEmit.length, taskId: plan.taskId }));
-        return;
-    }
-    console.log(`Work mesh: prd-sync emitted ${toEmit.length} task_status`);
-}
-function noteCallingSessionBound(projectId, company) {
-    try {
-        const bound = bindCallingSession({
-            root: workContextHomeRoot(),
-            projectId,
-            company,
-        });
-        if (bound.bound)
-            console.error(formatSessionBoundLine(bound.sessionId, bound.projectId));
-    }
-    catch {
-        /* session bind is local and must not fail project ensure */
-    }
+    console.log(`Work mesh: story ${storyId} → ${patched.status} (v${patched.version ?? "?"})`);
 }
 async function runDoctor(opts) {
     if (opts.apply) {
         fail("`hq mesh doctor --apply` (paced Board PUTs from local prd.json) is not in the CLI yet.\n" +
             "Omit --apply to warm the conversation cache (directory, inbox, pair DMs).");
     }
-    const identity = collectDaemonDoctor();
-    const identityLines = formatCliIdentityLines(identity);
-    if (!opts.json) {
-        for (const line of identityLines)
-            console.log(line);
-    }
     const token = await requireToken();
     const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
-    if (!principalUid) {
-        fail("Could not resolve the authenticated principal. Sign in again and retry `hq mesh doctor`.");
-    }
     const warmed = await warmMeshConversationCache(token, principalUid);
-    const needsProject = listNeedsProjectSessions(workContextHomeRoot());
     if (opts.json) {
-        console.log(JSON.stringify({
-            ok: true,
-            action: "doctor",
-            ...warmed,
-            needsProject,
-            cliMismatchLine: identity.cliMismatchLine ?? null,
-            hqOnPath: identity.hqOnPath,
-            multipleHqOnPath: identity.multipleHqOnPath,
-        }, null, 2));
+        console.log(JSON.stringify({ ok: true, action: "doctor", ...warmed }, null, 2));
         return;
     }
     console.log(`Work mesh cache warmed at ${warmed.cacheRoot}` +
         ` (directory=${warmed.directory} inbox=${warmed.inbox}` +
         ` contacts=${warmed.contacts} pair-threads=${warmed.threads})`);
-    if (needsProject.length === 0) {
-        console.log("needs_project sessions: none");
-        return;
-    }
-    console.log(`needs_project sessions: ${needsProject.length}`);
-    for (const row of needsProject) {
-        const choices = row.candidates.map((candidate) => candidate.projectId).join(", ") || "(none)";
-        console.log(`- ${row.sessionId}: ${row.reason ?? "no reason recorded"}; candidates: ${choices}`);
-    }
-}
-async function runBindProject(target, opts) {
-    const sessionId = opts.session.trim();
-    const root = workContextHomeRoot();
-    const current = readSessionState(sessionId, root);
-    if (!current)
-        fail(`No work-context state for session ${sessionId}.`);
-    let projectId = target.trim();
-    if (projectId === "new") {
-        const slug = opts.slug?.trim();
-        if (!slug)
-            fail("Usage: hq mesh context bind-project new <slug> --session <sid>");
-        const hqRoot = process.env.HQ_ROOT?.trim() || findHqRoot();
-        const prdPath = findLocalPrd(hqRoot, current.companySlug, slug);
-        if (!prdPath) {
-            fail(`No PRD for ${slug}. Run /prd before binding a new project.`);
-        }
-        if (!current.companyUid)
-            fail(`Session ${sessionId} has no company. Bind a company first.`);
-        const { token, company } = await withCompany({ company: opts.company ?? current.companySlug });
-        const plan = parseProjectPlan(readFileSync(prdPath, "utf8"), prdPath);
-        await ensureProjectBoard({
-            token,
-            company: {
-                companyUid: current.companyUid,
-                companySlug: current.companySlug || company.companySlug,
-            },
-            projectId: slug,
-            name: plan.name || slug,
-            description: plan.description ?? "",
-            stories: plan.stories,
-            repos: plan.repos ?? [],
-        });
-        projectId = slug;
-    }
-    else if (/^[1-9][0-9]*$/.test(projectId)) {
-        const index = Number(projectId) - 1;
-        const chosen = current.projectCandidates?.[index];
-        if (!chosen)
-            fail(`No candidate ${projectId} on session ${sessionId}.`);
-        projectId = chosen.projectId;
-    }
-    const updated = updateSessionState(sessionId, root, (state) => state ? applyOperatorProjectBinding(state, projectId) : null);
-    if (!updated)
-        fail(`No work-context state for session ${sessionId}.`);
-    if (opts.json) {
-        console.log(JSON.stringify({ ok: true, action: "context.bind-project", sessionId, projectId, contextStatus: updated.contextStatus }));
-        return;
-    }
-    console.log(`Work mesh: session ${sessionId} bound to project ${projectId}`);
 }
 async function runContextReconcile(opts) {
     if (!opts.observationFile && !opts.observationJson) {
@@ -860,92 +152,25 @@ async function runContextReconcile(opts) {
     let fetchCandidates;
     let validateMembership;
     let offline = Boolean(opts.offline);
-    let token;
-    try {
-        if (offline) {
-            if (isMachineIdentity()) {
-                token = await ensureCognitoToken({ tokenSource: "machine", interactive: false });
-            }
-            else {
-                const cached = loadCachedTokens();
-                if (cached && !isExpiring(cached, 120)) {
-                    token = cached.accessToken;
-                }
-            }
-        }
-        else {
-            token = await requireToken();
-        }
-        if (token) {
-            const sessionToken = token;
-            const membershipValidationTimeoutMs = offline
-                ? OFFLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS
-                : ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS;
+    if (!offline) {
+        try {
+            const token = await requireToken();
+            deliver = createWorkSessionDeliverer({ token });
+            fetchCandidates = createCandidatesFetcher({ token });
             validateMembership = async (candidate) => {
-                const membership = await new Promise((resolve, reject) => {
-                    const timer = setTimeout(() => reject(new Error("membership validation timed out")), membershipValidationTimeoutMs);
-                    void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
-                        clearTimeout(timer);
-                        resolve(value);
-                    }, (error) => {
-                        clearTimeout(timer);
-                        reject(error);
-                    });
-                });
-                if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
+                const membership = await resolveActiveMembershipCompany(token, candidate);
+                if (!membership)
                     return false;
-                }
                 return { uid: membership.companyUid };
             };
-            if (!offline) {
-                deliver = createWorkSessionDeliverer({ token: sessionToken });
-                fetchCandidates = createCandidatesFetcher({ token: sessionToken });
-            }
         }
-    }
-    catch {
-        if (!offline) {
+        catch {
             offline = true;
             if (!opts.machine) {
                 console.error(chalk.yellow("No Cognito session; reconciling offline (outbox only)."));
             }
         }
     }
-    if (token) {
-        const activation = await ensureDefaultCompany({
-            root,
-            listMemberships: () => listActiveMembershipCompanies(token),
-            log: (message) => console.error(chalk.dim(message)),
-        });
-        if (activation.status === "needs_choice") {
-            const interactive = !offline &&
-                !opts.machine &&
-                Boolean(process.stdin.isTTY && process.stdout.isTTY) &&
-                !isMachineIdentity();
-            if (interactive) {
-                const choices = activation.memberships
-                    .map((membership, index) => `${index + 1}. ${membership.slug}`)
-                    .join("\n");
-                const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-                try {
-                    const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
-                    const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
-                    if (selected) {
-                        await setDefaultCompany(selected.slug, {
-                            root,
-                            validateMembership: (candidate) => candidate === selected.slug ? { uid: selected.uid } : false,
-                        });
-                    }
-                }
-                finally {
-                    rl.close();
-                }
-            }
-            else if (!offline && !opts.machine) {
-                console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
-            }
-        }
-    }
     const outcome = await reconcileObservation(obs, {
         root,
         env: process.env,
@@ -953,20 +178,6 @@ async function runContextReconcile(opts) {
         fetchCandidates,
         offline,
         validateMembership,
-        ensureProjectBoard: token
-            ? async ({ companyUid, projectId, prdPath }) => {
-                const plan = parseProjectPlan(readFileSync(prdPath, "utf8"), prdPath);
-                await ensureProjectBoard({
-                    token,
-                    company: { companyUid, companySlug: companyUid },
-                    projectId,
-                    name: plan.name || projectId,
-                    description: plan.description ?? "",
-                    stories: plan.stories,
-                    repos: plan.repos ?? [],
-                });
-            }
-            : undefined,
     });
     for (const line of outcome.diagnostics) {
         console.error(line);
@@ -1083,21 +294,19 @@ async function runContextBackfillHeld(opts) {
     const parsedLimit = opts.limit ? Number.parseInt(opts.limit, 10) : 0;
     const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 0;
     const companyHint = opts.company?.trim() || undefined;
-    const useDeviceDefault = opts.useDeviceDefault === true || readDeviceConfig({ root }).repairHeldWithDefault === true;
-    // Build the membership seam for both modes; dry-run is read-only but must
-    // validate a locally resolved slug just as live reconciliation does.
-    // The remaining seams are captured in the reconcile closure below.
+    // Build the reconcile network seam exactly like `hq mesh context reconcile`.
+    // Not needed in --dry-run (reconcile is never invoked then). Explicit types
+    // because these are captured in the reconcile closure below (no control-flow
+    // narrowing, unlike the inline reconcile handler).
     let deliver;
     let fetchCandidates;
     let validateMembership;
     let offline = Boolean(opts.offline);
-    if (!offline) {
+    if (!dryRun && !offline) {
         try {
             const token = await requireToken();
-            if (!dryRun) {
-                deliver = createWorkSessionDeliverer({ token });
-                fetchCandidates = createCandidatesFetcher({ token });
-            }
+            deliver = createWorkSessionDeliverer({ token });
+            fetchCandidates = createCandidatesFetcher({ token });
             validateMembership = async (candidate) => {
                 const membership = await resolveActiveMembershipCompany(token, candidate);
                 if (!membership)
@@ -1115,14 +324,11 @@ async function runContextBackfillHeld(opts) {
     const result = await backfillHeldSessions({
         workMeshRoot: meshRoot,
         workContextRoot: root,
-        hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot(),
         dryRun,
         limit,
         // Mirror the reconcile closure's non-forcing hint in the dry-run predictor
         // so `--dry-run` and the real run report the same counts.
         remoteOwnerHint: companyHint || undefined,
-        useDeviceDefault,
-        validateMembership,
         reconcile: (obs) => reconcileObservation(
         // Pass --company as a non-forcing hint (remoteOwnerSlug feeds
         // deterministic resolution BELOW the identity-file / device default,
@@ -1134,8 +340,6 @@ async function runContextBackfillHeld(opts) {
             fetchCandidates,
             offline,
             validateMembership,
-            allowDeviceDefault: useDeviceDefault,
-            deviceDefaultConfidence: useDeviceDefault,
         }),
     });
     if (opts.json) {
@@ -1150,9 +354,6 @@ async function runContextBackfillHeld(opts) {
         `${result.unresolved} unresolved, ` +
         `${result.errors} error(s).` +
         (dryRun ? " (dry-run: nothing written)" : ""));
-    for (const { sessionId, reason } of result.unresolvedReasons) {
-        console.log(`Unresolved ${sessionId}: ${reason}`);
-    }
     if (!dryRun && result.reconciled > 0) {
         console.log("Reconciled session state files were rewritten with a resolved company; " +
             "the mesh daemon's held retry will re-attribute and post those events.");
@@ -1161,38 +362,20 @@ async function runContextBackfillHeld(opts) {
 async function runContextDefaultGet(opts) {
     const root = workContextHomeRoot();
     const cfg = readDeviceConfig({ root });
-    const current = cfg.defaultCompany?.enabled && cfg.defaultCompany.slug
-        ? cfg.defaultCompany
-        : null;
-    const memberships = cfg.defaultCompanyMemberships?.memberships ?? [];
-    const disabled = isDefaultCompanyDisabled({ root });
-    const source = disabled ? "disabled" : current?.source ?? (current ? "chosen" : "unset");
+    const current = getDefaultCompany({ root });
     if (opts.json) {
-        console.log(JSON.stringify({
-            ok: true,
-            slug: current?.slug ?? null,
-            uid: current?.uid ?? null,
-            enabled: current?.enabled ?? false,
-            source,
-            needsChoice: !current && !disabled && memberships.length > 1,
-            memberships,
-            repairHeldWithDefault: cfg.repairHeldWithDefault === true,
-        }, null, 2));
-        return;
-    }
-    if (disabled) {
-        console.log("Default company disabled on this device.");
+        console.log(JSON.stringify({ ok: true, config: cfg, defaultCompany: current }, null, 2));
         return;
     }
     if (!current) {
         console.log("No device default company (default-company mode may be dark).");
         return;
     }
-    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled} source=${source}`);
+    console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled}`);
 }
 async function runContextDefaultSet(slug, opts) {
     const root = workContextHomeRoot();
-    void opts.company; // retained for CLI compatibility
+    void opts.company; // retained for CLI compatibility; unlock is memberships-wide
     let token;
     try {
         token = await requireToken();
@@ -1200,38 +383,42 @@ async function runContextDefaultSet(slug, opts) {
     catch {
         token = undefined;
     }
-    // Migration remains useful diagnostic context, but it must never prevent a
-    // verified member from choosing their own device-local preference.
+    // US-017B: unlock only when EVERY active membership advertises migration.
     let migrationCapability = false;
-    let migrationWarning;
     if (token) {
         const probe = await probeMigrationCapabilityForMemberships(token);
         recordMigrationCapabilitySnapshot(probe, { root });
         migrationCapability = probe.unlocked;
-        if (probe.offline) {
-            migrationWarning =
-                "Warning: migration capability could not be checked; membership for the selected company will still be verified.";
+        if (probe.offline && !opts.allowWithoutMigration) {
+            console.error(chalk.red("DEFAULT_COMPANY_LOCKED: cannot probe migration capability (offline or not logged in)"));
+            process.exitCode = 1;
+            return;
         }
-        else if (!probe.unlocked) {
+        if (!probe.unlocked && !opts.allowWithoutMigration) {
             const detail = probe.companies.length === 0
                 ? "no active memberships"
                 : probe.companies
                     .filter((c) => !c.migration)
                     .map((c) => c.companySlug || c.companyUid)
                     .join(", ");
-            migrationWarning =
-                `Warning: migration capability is mixed or unavailable for ${detail || "some memberships"}; ` +
-                    "the selected company can still be set because membership is verified directly.";
+            console.error(chalk.red(`DEFAULT_COMPANY_LOCKED: migration capability is not true for every company you belong to (${detail || "locked"})`));
+            process.exitCode = 1;
+            return;
         }
     }
-    else {
-        migrationWarning =
-            "Warning: migration capability could not be checked without a Cognito session; membership for the selected company must still be verified.";
+    else if (!opts.allowWithoutMigration) {
+        console.error(chalk.red("DEFAULT_COMPANY_LOCKED: cannot probe migration capability (no Cognito session)"));
+        process.exitCode = 1;
+        return;
+    }
+    if (!migrationCapability && opts.allowWithoutMigration) {
+        console.error(chalk.yellow("Warning: --allow-without-migration bypasses DEFAULT_COMPANY_LOCKED; a wrong default is hard to correct until migration is available for every company you belong to."));
     }
     try {
         const cfg = await setDefaultCompany(slug, {
             root,
             migrationCapability,
+            allowWithoutMigration: opts.allowWithoutMigration,
             validateMembership: async (candidate) => {
                 if (!token) {
                     throw new DefaultCompanyUnavailableError(`Cannot verify membership for company "${candidate}" (no Cognito session; offline or not logged in)`);
@@ -1249,20 +436,16 @@ async function runContextDefaultSet(slug, opts) {
                 return { uid: membership.companyUid };
             },
         });
-        const configured = opts.repairHeldWithDefault
-            ? setRepairHeldWithDefault(true, { root })
-            : cfg;
         if (opts.json) {
-            console.log(JSON.stringify({ ok: true, config: configured, migrationWarning }, null, 2));
+            console.log(JSON.stringify({ ok: true, config: cfg }, null, 2));
             return;
         }
-        const stored = configured.defaultCompany;
+        const stored = cfg.defaultCompany;
         console.log(`Default company set to ${stored?.slug ?? slug}${stored?.uid ? ` (${stored.uid})` : ""}`);
-        if (migrationWarning)
-            console.error(chalk.yellow(migrationWarning));
     }
     catch (err) {
-        if (err instanceof DefaultCompanyUnavailableError) {
+        if (err instanceof DefaultCompanyLockedError ||
+            err instanceof DefaultCompanyUnavailableError) {
             console.error(chalk.red(`${err.code}: ${err.message}`));
             process.exitCode = 1;
             return;
@@ -1532,16 +715,13 @@ async function runSessionStatus(opts) {
     }
     const { token, company } = await withCompany({ company: opts.company });
     const live = await fetchCompanyLive(token, company.companyUid);
-    const unattributedEvents = collectDaemonDoctor().unattributedEvents;
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, action: "session-status", company, live, unattributedEvents }, null, 2));
+        console.log(JSON.stringify({ ok: true, action: "session-status", company, live }, null, 2));
         return;
     }
     for (const line of formatCompanyLiveTable(live, company.companySlug || company.companyUid)) {
         console.log(line);
     }
-    console.log(`unattributed events: ${unattributedEvents.total} ` +
-        `(spool=${unattributedEvents.spool} held=${unattributedEvents.held} dead-letter=${unattributedEvents.deadLetter})`);
 }
 const HARNESSES = new Set([
     "claude-code",
@@ -1574,21 +754,6 @@ async function runSessionEnqueue(cliKind, opts) {
     const sessionId = resolveEnqueueSessionId(opts.sessionId, process.env);
     if (!sessionId)
         fail("sessionId required (--session-id or HQ_SESSION_ID)");
-    if (kind === "turn_start") {
-        try {
-            rebindNeedsProjectOnPrompt({
-                sessionId,
-                root: workContextHomeRoot(),
-                hqRoot: opts.hqRoot?.trim() || process.env.HQ_ROOT,
-                cwd: opts.cwd,
-                companySlug: opts.companySlug,
-                env: process.env,
-            });
-        }
-        catch {
-            /* prompt rebind is fail-soft */
-        }
-    }
     const evidence = buildEmitEvidence({
         sessionId: sessionId,
         hqRoot: opts.hqRoot,
@@ -1598,16 +763,7 @@ async function runSessionEnqueue(cliKind, opts) {
         companySlug: opts.companySlug,
         project: opts.project,
         task: opts.task,
-        env: process.env,
     });
-    const reportFields = kind === "session_end"
-        ? enrichSessionEndEvent({
-            kind,
-            sessionId: sessionId,
-            cwd: opts.cwd,
-            summary: opts.summary,
-        })
-        : {};
     const event = buildMeshEmitEvent({
         eventId: opts.eventId?.trim() || generateUlid(Date.now()),
         kind: kind,
@@ -1621,35 +777,10 @@ async function runSessionEnqueue(cliKind, opts) {
         taskId: opts.taskId,
         status: opts.status,
         reason: opts.reason,
-        summary: opts.summary ||
-            (typeof reportFields.summary === "string" ? reportFields.summary : undefined),
-        repo: typeof reportFields.repo === "string" ? reportFields.repo : undefined,
-        gitBranch: typeof reportFields.gitBranch === "string"
-            ? reportFields.gitBranch
-            : undefined,
-        prUrls: Array.isArray(reportFields.prUrls)
-            ? reportFields.prUrls
-            : undefined,
+        summary: opts.summary,
         evidence,
     });
     const meshRoot = workMeshHomeRoot();
-    // A machine credential with no company must not be posted. The server files
-    // that as company NONE. Hold it and say why.
-    if (machineEmitDisposition({ machine: isMachineIdentity(), companySlug: evidence.companySlug }) === "hold") {
-        appendHeldLine(JSON.stringify({
-            event,
-            heldReason: "NEEDS_COMPANY",
-            heldAt: new Date().toISOString(),
-            reason: "machine session has no company; event was not sent",
-        }), meshRoot);
-        const heldMessage = `work-mesh: held ${kind}; needs_company (machine session has no company; not sent)`;
-        if (opts.json) {
-            console.log(JSON.stringify({ ok: true, action: "emit", kind, held: true, reason: "needs_company" }, null, 2));
-            return;
-        }
-        console.error(heldMessage);
-        return;
-    }
     // Resolve a token non-interactively (same path as every CLI call). If the box
     // is not logged in, retain the event locally for the next invocation to drain.
     let token;
@@ -1685,9 +816,6 @@ async function runSessionEnqueue(cliKind, opts) {
     console.error(`work-mesh: emit ${kind} accepted=${summary.accepted}` +
         ` unassigned=${summary.unassigned} rejected=${summary.rejected}` +
         ` retryDepth=${summary.retryDepth}`);
-    for (const line of formatEmitRejectionLines(summary.rejections)) {
-        console.error(line);
-    }
 }
 async function runMeshMode(action, opts) {
     const meshRoot = workMeshHomeRoot();
@@ -1772,9 +900,6 @@ async function runMeshEmit(opts) {
         ` unassigned=${summary.unassigned} rejected=${summary.rejected}` +
         ` retryDepth=${summary.retryDepth}` +
         (opts.replayLegacy ? ` (legacy scanned=${scanned} skipped=${skipped})` : ""));
-    for (const line of formatEmitRejectionLines(summary.rejections)) {
-        console.log(line);
-    }
 }
 async function runSessionFlush(opts) {
     const token = await requireToken();
@@ -1873,43 +998,9 @@ export function registerMeshCommand(program) {
         .option("--summary <text>", "Note text")).action((opts) => wrap(() => runEvent("note", opts))());
     addSharedFlags(mesh
         .command("story")
-        .description("PATCH one Board story status and/or assignee")
+        .description("PATCH one Board story status")
         .requiredOption("--story <id>", "Story id, e.g. US-001")
-        .option("--status <status>", "queued|in_progress|review|done")
-        .option("--assignee <uid|me|none>", "Assign a person or agent uid, yourself, or clear")).action((opts) => wrap(() => runStory(opts))());
-    const project = mesh
-        .command("project")
-        .description("Set a project Board view or register its project channel");
-    project
-        .command("set <projectId>")
-        .description("PUT the project Board view from flags or a PRD JSON file")
-        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
-        .option("--name <name>", "Project name")
-        .option("--description <text>", "Project description")
-        .option("--stories-file <path>", "PRD JSON file with userStories")
-        .option("--stories-json <json>", "Story array or JSON object with userStories")
-        .option("--repos-json <json>", "Repository array, such as [{path,branch}]")
-        .option("--repo <path[@branch]>", "Repository binding (repeatable)", collectRepeatable)
-        .option("--channel <channelId>", "Bind the project to an existing company or project channel")
-        .option("--create", "Create the Board view when the GET is a 404")
-        .option("--reset-status", "Overwrite live story status from the PRD (prints a one-line summary of changes)")
-        .option("--json", "Print machine-readable JSON")
-        .action((projectId, opts) => wrap(() => runProjectSet(projectId, opts))());
-    project
-        .command("ensure <projectId>")
-        .description("Idempotently register a PRD on the Board and verify the view")
-        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
-        .requiredOption("--stories-file <path>", "PRD JSON file with userStories and metadata.repos")
-        .option("--dry-run", "Read the current Board and print computed story statuses without writing")
-        .option("--json", "Print {projectId, threadId, channelId, version, stories}")
-        .action((projectId, opts) => wrap(() => runProjectEnsure(projectId, opts))());
-    project
-        .command("register <projectId>")
-        .description("Register an existing Board and bind its project channel; use project ensure to create or repair a Board")
-        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
-        .option("--channel <channelId>", "Bind the project to an existing company or project channel")
-        .option("--json", "Print machine-readable JSON")
-        .action((projectId, opts) => wrap(() => runProjectRegister(projectId, opts))());
+        .requiredOption("--status <status>", "queued|in_progress|review|done")).action((opts) => wrap(() => runStory(opts))());
     mesh
         .command("doctor")
         .description("Warm ~/.hq/work-mesh/cache from hq-pro (directory, inbox, pair DMs). Not `hq doctor`.")
@@ -1939,29 +1030,12 @@ export function registerMeshCommand(program) {
     context
         .command("backfill-held")
         .description("Reconcile ENDED sessions whose held events lack a company so the daemon re-attributes the backlog (explicit, opt-in; no fleet fan-out)")
-        .option("--dry-run", "Report what would be reconciled; write nothing or deliver events")
+        .option("--dry-run", "Report what would be reconciled; write nothing, no network")
         .option("--offline", "Reconcile outbox-only (no candidates/register network)")
         .option("--limit <n>", "Cap sessions processed (default 0 = no cap)")
-        .option("--company <slug>", "Optional non-forcing company hint")
-        .option("--use-device-default", "Opt in to historical repair using the device default (lower-confidence attribution)")
+        .option("--company <slug>", "Optional non-forcing company hint (resolver default still wins)")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runContextBackfillHeld(opts))());
-    context
-        .command("bind-project")
-        .description("Bind this session to a project id, a numbered candidate, or new <slug>")
-        .argument("<target>", "Project id, candidate number, or new")
-        .argument("[slug]", "Project slug when target is new")
-        .requiredOption("--session <sid>", "Canonical session id")
-        .option("--company <slug|uid>", "Company override when creating a Board")
-        .option("--json", "Print machine-readable JSON")
-        .action((target, slug, opts) => wrap(() => runBindProject(target, { ...opts, slug }))());
-    context
-        .command("prd-sync")
-        .description("Emit task_status for PRD story passes/status changes on a bound session")
-        .requiredOption("--session <sid>", "Canonical session id")
-        .requiredOption("--file <path>", "prd.json written by the bound session")
-        .option("--json", "Print machine-readable JSON")
-        .action((opts) => wrap(() => runPrdSync(opts))());
     context
         .command("organize")
         .description("List or submit one-time project/task decisions (US-007B / US-005B)")
@@ -2011,11 +1085,10 @@ export function registerMeshCommand(program) {
         .action((opts) => wrap(() => runContextDefaultGet(opts))());
     def
         .command("set")
-        .description("Set the device default company slug after verifying membership")
+        .description("Set the device default company slug (unlocked when migration is true for every membership)")
         .argument("<slug>", "Company slug")
-        .option("--allow-without-migration", "Deprecated compatibility no-op; selected-company membership is always verified")
-        .option("--repair-held-with-default", "Persist opt-in for lower-confidence historical held-session repair")
-        .option("--company <slug|uid>", "Deprecated no-op; the selected company is verified directly")
+        .option("--allow-without-migration", "Bypass DEFAULT_COMPANY_LOCKED with a warning")
+        .option("--company <slug|uid>", "Deprecated no-op; unlock probes every active membership")
         .option("--json", "Print machine-readable JSON")
         .action((slug, opts) => wrap(() => runContextDefaultSet(slug, opts))());
     def
@@ -2029,19 +1102,6 @@ export function registerMeshCommand(program) {
         .argument("<sessionId>", "Canonical session id")
         .option("--machine", "Write exactly one ContextResult JSON line to stdout")
         .action((sessionId, opts) => wrap(() => runContextUntracked(sessionId, opts))());
-    const contract = mesh
-        .command("contract")
-        .description("Print versioned work-mesh contracts for other repositories");
-    contract
-        .command("preflight")
-        .description("Offline preflight ContextResult contract (contracts/preflight/v1)")
-        .option("--print-fixtures", "Write the fixture file JSON to stdout")
-        .action((opts) => wrap(async () => {
-        if (!opts.printFixtures) {
-            throw new Error("Pass --print-fixtures. The stable package path is contracts/preflight/v1/fixtures.json.");
-        }
-        process.stdout.write(`${JSON.stringify(buildPreflightFixtures(), null, 2)}\n`);
-    })());
     const session = mesh
         .command("session")
         .description("Local session-event spool: enqueue (printf-compatible), flush, and live status");
@@ -2088,14 +1148,11 @@ export function registerMeshCommand(program) {
     daemon
         .command("run")
         .description("Start the single-instance daemon (pid lock, spool watch, presence)")
-        .option("--hq-root <path>", "HQ tree root (else HQ_ROOT / persisted trusted roots); the Windows task passes this explicitly")
-        .action((opts) => wrap(() => runDaemonRun(opts))());
+        .action(() => wrap(() => runDaemonRun())());
     daemon
         .command("install")
-        .description("Install LaunchAgent (macOS), systemd user unit (Linux), or Scheduled Task (Windows)")
+        .description("Install LaunchAgent (macOS) or systemd user unit (Linux)")
         .option("--system-user <user>", "Write a root-owned unit template for agent boxes (e.g. ec2-user)")
-        .option("--hq-root <path>", "HQ root to record for the service (else HQ_ROOT, else the nearest HQ root above cwd)")
-        .option("--if-stale", "Reinstall and restart only when this CLI is newer than the daemon's recorded version")
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runDaemonInstall(opts))());
     daemon
@@ -2114,65 +1171,18 @@ export function registerMeshCommand(program) {
         .option("--json", "Print machine-readable JSON")
         .action((opts) => wrap(() => runDaemonDoctorCmd(opts))());
 }
-async function runDaemonRun(opts = {}) {
-    const hqRoot = opts.hqRoot?.trim() || undefined;
-    const handle = await runMeshDaemon({
-        ...(hqRoot ? { hqRoot } : {}),
-        enableWorkCache: true,
-    });
+async function runDaemonRun() {
+    const handle = await runMeshDaemon();
     // Stay alive until signal handlers call stop + exit.
     await new Promise(() => {
         void handle;
     });
 }
 async function runDaemonInstall(opts) {
-    // `hq daemon` runs mesh on this machine: installing a second unit would run it twice.
-    // An explicit --hq-root is verified the same way as below and saved for the daemon.
-    const explicitRoot = opts.hqRoot ? resolveInstallHqRoot({ explicit: opts.hqRoot }).root : undefined;
-    const handedOff = opts.systemUser
-        ? null
-        : handOffInstallHere(["mesh"], process.env, { hqRoot: explicitRoot, ifStale: opts.ifStale });
-    if (handedOff) {
-        console.log(opts.json ? JSON.stringify({ ok: true, action: "hq-daemon", reinstalled: false, message: handedOff }) : handedOff);
-        return;
-    }
-    // Verified root only: a repo's own .claude/ must never become the daemon's
-    // HQ root (that path is persisted as trusted and used for attribution).
-    const hqRoot = resolveInstallHqRoot({ explicit: opts.hqRoot });
-    const paths = buildInstallPaths({
-        systemUser: opts.systemUser,
-        hqRoot: hqRoot.root,
-        hqRootSource: hqRoot.source,
-        hqBinary: resolveRunningCliEntry(),
-        nodeBinary: resolveAbsoluteNodeBinary(),
-    });
-    if (opts.ifStale) {
-        const stale = installDaemonIfStale({
-            currentVersion: CLI_VERSION,
-            platform: detectPlatform(),
-            paths,
-            systemUser: opts.systemUser,
-        });
-        if (opts.json) {
-            console.log(JSON.stringify({
-                ok: true,
-                action: stale.reinstalled ? "install" : "unchanged",
-                reinstalled: stale.reinstalled,
-                message: stale.message,
-                hqBinary: paths.hqBinary,
-                nodeBinary: paths.nodeBinary,
-                hqRoot: hqRoot.root,
-            }, null, 2));
-            return;
-        }
-        console.log(stale.message);
-        return;
-    }
     const result = installDaemonService({
         platform: detectPlatform(),
-        paths,
+        paths: buildInstallPaths({ systemUser: opts.systemUser }),
         systemUser: opts.systemUser,
-        run: defaultRunCommand,
     });
     if (opts.json) {
         console.log(JSON.stringify({
@@ -2181,15 +1191,10 @@ async function runDaemonInstall(opts) {
             platform: result.platform,
             dest: result.dest,
             message: result.message,
-            hqRoot: hqRoot.root,
-            hqRootSource: hqRoot.source,
-            ...(result.notice ? { notice: result.notice } : {}),
         }, null, 2));
         return;
     }
     console.log(result.message);
-    if (result.notice)
-        console.log(result.notice);
 }
 async function runDaemonUninstall(opts) {
     const result = uninstallDaemonService({
@@ -2208,14 +1213,12 @@ async function runDaemonUninstall(opts) {
     }
     console.log(result.message);
 }
-export async function runDaemonStatus(opts, deps = {}) {
-    const paths = deps.paths ?? buildInstallPaths({});
+async function runDaemonStatus(opts) {
     const result = daemonServiceStatus({
-        platform: deps.platform ?? detectPlatform(),
-        paths,
-        isLoaded: daemonServiceIsLoaded(deps.run ?? defaultRunCommand, deps.uid),
+        platform: detectPlatform(),
+        paths: buildInstallPaths({}),
     });
-    const state = readDaemonState(paths.daemonDir);
+    const state = readDaemonState(daemonDir());
     const presenceRefusal = state?.presenceRefusal ?? null;
     if (opts.json) {
         console.log(JSON.stringify({
@@ -2225,21 +1228,12 @@ export async function runDaemonStatus(opts, deps = {}) {
             running: result.running ?? false,
             dest: result.dest,
             message: result.message,
-            ...(result.lastResult !== undefined ? { lastResult: result.lastResult } : {}),
-            ...(result.lastRunFailed !== undefined ? { lastRunFailed: result.lastRunFailed } : {}),
-            ...(result.recordedHqRoot !== undefined ? { hqRoot: result.recordedHqRoot } : {}),
-            ...(result.rootValid !== undefined ? { rootValid: result.rootValid } : {}),
-            ...(result.notice ? { notice: result.notice } : {}),
             mqttState: state?.mqttState,
             presenceRefusal,
         }, null, 2));
         return;
     }
     console.log(result.message);
-    if (result.recordedHqRoot)
-        console.log(`hq root: ${result.recordedHqRoot}`);
-    if (result.notice)
-        console.log(result.notice);
     if (presenceRefusal) {
         console.log(`presence refusal: ${presenceRefusal.code} (HTTP ${presenceRefusal.status}); next retry at ${presenceRefusal.nextRetryAt}`);
     }
@@ -2248,11 +1242,7 @@ export async function runDaemonStatus(opts, deps = {}) {
     }
 }
 async function runDaemonDoctorCmd(opts) {
-    // Same predicate as install: a repo's .claude/ is not an HQ root. Doctor
-    // only reads, so an unresolvable root is reported as absent, not fatal.
-    const report = collectDaemonDoctor({
-        hqRoot: process.env.HQ_ROOT?.trim() || findAncestorHqRoot(process.cwd()) || undefined,
-    });
+    const report = collectDaemonDoctor();
     if (opts.json) {
         console.log(JSON.stringify({ ok: !report.unhealthy, ...report }, null, 2));
         return;