@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/search-index/index.js

@@ -1,20 +1,18 @@
 import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import { createRequire } from 'node:module';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { dump, load } from 'js-yaml';
 import { isQmdModelDownloadError } from '../../utils/qmd-model-download-error.js';
 import { isQmdModuleMissingError } from '../../utils/qmd-module-missing-error.js';
 import { isQmdNativeBindingError } from '../../utils/qmd-native-binding-error.js';
 import { isQmdQueryDocumentError } from '../../utils/qmd-query-document-error.js';
 import { isQmdStoreMissingError } from '../../utils/qmd-store-missing-error.js';
 import { isQmdStoreUnopenableError } from '../../utils/qmd-store-unopenable-error.js';
-import { markExpectedUserError } from '../../utils/expected-cli-error.js';
 import { redactErrorText } from '../../utils/redact-error-text.js';
 import { planCommandSpawn } from '../../utils/windows-spawn.js';
-import { resolveQmdConfigPath } from './max-doc-bytes.js';
-import { qmdCollectionPathRepairEnabled } from './collection-path-repair-flag.js';
+const require = createRequire(import.meta.url);
 /** The `path` implementation for a (possibly injected) platform. */
 function pathFor(platform) {
     return platform === 'win32' ? path.win32 : path.posix;
@@ -76,10 +74,6 @@ export class QmdExitError extends Error {
     stdout;
     stderr;
     name = 'QmdExitError';
-    /** Safe route labels for telemetry; raw qmd streams remain local to the error. */
-    entryPath;
-    /** Present only when the invoked executable is the bundled qmd. */
-    qmdVersion;
     constructor(message, args, status, stdout, stderr) {
         super(message);
         this.args = args;
@@ -434,16 +428,13 @@ export function lastQmdStoreEnsureOutcome() {
  * An upstream-contract test pins this rule to the INSTALLED qmd so a bump that
  * changes it turns CI red instead of silently restoring the noise.
  */
-export function resolveQmdHome(env = process.env) {
-    return env.HOME || env.USERPROFILE || os.homedir() || '/tmp';
-}
 export function resolveQmdStoreDir(env = process.env, cwd = process.cwd()) {
     const indexPath = env.INDEX_PATH;
     // path.resolve leaves an absolute INDEX_PATH untouched and anchors a relative
     // one to the child cwd, so the probed/stamped directory is the one qmd uses.
     if (indexPath)
         return path.dirname(path.resolve(cwd, indexPath));
-    const home = resolveQmdHome(env);
+    const home = env.HOME || env.USERPROFILE || os.homedir() || '/tmp';
     const cacheDir = env.XDG_CACHE_HOME || path.join(home, '.cache');
     return path.join(cacheDir, 'qmd');
 }
@@ -1011,22 +1002,6 @@ function describeQmdTermination(stdout, stderr) {
         return `qmd reported: ${summary.reason}`;
     return '';
 }
-/**
- * qmd caller-state failures that the top-level boundary may surface without a
- * crash report. The match is deliberately against qmd's raw stderr and a
- * closed subcommand set: a query containing these words must not change the
- * disposition of an unrelated qmd exit.
- */
-function isExpectedQmdCallerFailure(args, stderr) {
-    const subcommand = args[0];
-    if (subcommand === 'get') {
-        return /^Document not found:\s+[^\r\n]+$/m.test(stderr);
-    }
-    if (subcommand === 'collection') {
-        return /(?:^|\b)Failed to parse\s+[^\r\n]+:\s*.+$/m.test(stderr);
-    }
-    return false;
-}
 /** Normalise a spawn result and raise the typed qmd failures. */
 function finishRunQmd(result, bin, args, attribution) {
     const normalized = {
@@ -1237,26 +1212,7 @@ function finishRunQmd(result, bin, args, attribution) {
     if (alreadyExists) {
         throw new QmdCollectionExistsError(message, args, normalized.status, normalized.stdout, normalized.stderr, alreadyExists[1]);
     }
-    const exitError = new QmdExitError(message, args, normalized.status, normalized.stdout, normalized.stderr);
-    if (isExpectedQmdCallerFailure(args, normalized.stderr)) {
-        throw markExpectedUserError(exitError);
-    }
-    throw exitError;
-}
-function finishRunQmdWithDiagnostics(result, bin, args, options, attribution) {
-    try {
-        return finishRunQmd(result, bin, args, attribution);
-    }
-    catch (error) {
-        if (error instanceof QmdExitError) {
-            if (args[0] === 'update' && options.entryPath)
-                error.entryPath = options.entryPath;
-            const bundledBins = [packageLocalBin(), packageLocalNodeEntry()].filter((candidate) => Boolean(candidate));
-            if (bundledBins.includes(bin))
-                error.qmdVersion = resolveQmdVersion();
-        }
-        throw error;
-    }
+    throw new QmdExitError(message, args, normalized.status, normalized.stdout, normalized.stderr);
 }
 /** Run qmd with captured output and typed failures. */
 export function runQmd(args, options = {}) {
@@ -1265,7 +1221,7 @@ export function runQmd(args, options = {}) {
     if (options.runner) {
         const bin = options.bin ?? resolveQmdBin({ env: options.env });
         const result = options.runner(bin, args, { cwd: options.cwd, env: options.env });
-        return finishRunQmdWithDiagnostics(result, bin, args, options);
+        return finishRunQmd(result, bin, args);
     }
     // Default path: resolve the full invocation (shell-free Node launcher preferred)
     // and spawn it through the shared Windows-aware plan. An explicit string bin is
@@ -1298,7 +1254,7 @@ export function runQmd(args, options = {}) {
     // genuinely missing qmd — instead of blaming the launcher for all three
     // (HQ-CLI-1A). `command` is the process actually spawned; `launcher` is qmd's
     // file identity.
-    return finishRunQmdWithDiagnostics(result, launcher, args, options, {
+    return finishRunQmd(result, launcher, args, {
         command: invocation.command,
         launcher,
         cwd: options.cwd,
@@ -1372,90 +1328,9 @@ export function deriveCollections(hqRoot) {
     }
     return collections;
 }
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function qmdConfigPath(hqRoot) {
-    const env = {
-        ...process.env,
-        HOME: process.env.HOME ?? process.env.USERPROFILE ?? os.homedir(),
-    };
-    return resolveQmdConfigPath({ env, startDir: hqRoot });
-}
-/** Read qmd's configured collection metadata from the same config file its CLI uses. */
-function configuredCollections(hqRoot) {
-    const configPath = qmdConfigPath(hqRoot);
-    if (!configPath || !fs.existsSync(configPath))
-        return new Map();
-    const document = load(fs.readFileSync(configPath, 'utf8'));
-    if (!isRecord(document) || !isRecord(document.collections))
-        return new Map();
-    return new Map(Object.entries(document.collections).flatMap(([name, config]) => isRecord(config) && typeof config.path === 'string' ? [[name, config]] : []));
-}
-/** Restore existing collection options after qmd's add command rewrites the entry. */
-function restoreCollectionMetadata(hqRoot, collection, previousConfig) {
-    const configPath = qmdConfigPath(hqRoot);
-    if (!configPath || !fs.existsSync(configPath)) {
-        throw new Error(`QMD config disappeared while repairing collection '${collection.name}'`);
-    }
-    const document = load(fs.readFileSync(configPath, 'utf8'));
-    if (!isRecord(document) || !isRecord(document.collections)) {
-        throw new Error(`QMD config has no collections map while repairing '${collection.name}'`);
-    }
-    const currentConfig = document.collections[collection.name];
-    document.collections[collection.name] = {
-        ...(isRecord(currentConfig) ? currentConfig : {}),
-        ...previousConfig,
-        path: collection.path,
-    };
-    fs.writeFileSync(configPath, dump(document, { lineWidth: 0 }));
-}
-function resolvedPath(value) {
-    const absolutePath = path.resolve(value);
-    try {
-        return fs.realpathSync(absolutePath);
-    }
-    catch {
-        return absolutePath;
-    }
-}
-function comparablePath(value) {
-    return process.platform === 'win32' ? value.toLowerCase() : value;
-}
-/** Repair a known HQ-managed path, including the former company knowledge mirror layout. */
-function isPreviousHqManagedPath(hqRoot, collection, configuredPath) {
-    const root = resolvedPath(hqRoot);
-    const expectedPath = resolvedPath(collection.path);
-    const managedRelativePath = path.relative(root, expectedPath);
-    if (!managedRelativePath ||
-        path.isAbsolute(managedRelativePath) ||
-        managedRelativePath === '..' ||
-        managedRelativePath.startsWith(`..${path.sep}`)) {
-        return false;
-    }
-    const actualPath = resolvedPath(path.resolve(hqRoot, configuredPath));
-    const suffix = `${path.sep}${managedRelativePath}`;
-    const actualForComparison = comparablePath(actualPath);
-    const suffixForComparison = comparablePath(suffix);
-    const prefixLength = actualForComparison.length - suffixForComparison.length;
-    if (prefixLength > path.parse(actualPath).root.length && actualForComparison.endsWith(suffixForComparison)) {
-        return true;
-    }
-    const expectedParts = managedRelativePath.split(path.sep);
-    if (expectedParts.length !== 3 || expectedParts[0] !== 'companies' || expectedParts[2] !== 'knowledge') {
-        return false;
-    }
-    const slug = expectedParts[1];
-    if (!slug)
-        return false;
-    const formerMirrorPath = resolvedPath(path.join(root, 'repos', 'private', `knowledge-${slug}`));
-    return comparablePath(actualPath) === comparablePath(formerMirrorPath);
-}
 /**
  * Register expected collections that qmd does not yet know about, returning the
  * collections this call actually created (a `collection add` that exited 0).
- * When the default-off hq-flags rollout is enabled, it also replaces a registered
- * collection whose path matches a known prior HQ-managed layout.
  *
  * A same-name idempotent duplicate — qmd already owns the exact requested name
  * in its YAML config (`Collection '<name>' already exists.`), while the
@@ -1471,29 +1346,11 @@ function isPreviousHqManagedPath(hqRoot, collection, configuredPath) {
 export function reconcileCollections(hqRoot, options = {}) {
     const runOptions = { bin: options.bin, runner: options.runner, cwd: hqRoot };
     const registered = listRegisteredCollections(hqRoot, runOptions);
-    const expected = deriveCollections(hqRoot);
-    const repairPathDrift = options.repairPathDrift ?? qmdCollectionPathRepairEnabled();
-    const configured = repairPathDrift ? configuredCollections(hqRoot) : new Map();
-    const stale = repairPathDrift
-        ? expected.filter((collection) => {
-            const previousConfig = configured.get(collection.name);
-            return previousConfig !== undefined
-                && comparablePath(resolvedPath(path.resolve(hqRoot, previousConfig.path))) !== comparablePath(resolvedPath(collection.path))
-                && isPreviousHqManagedPath(hqRoot, collection, previousConfig.path);
-        })
-        : [];
-    for (const collection of stale) {
-        runQmd(['collection', 'remove', collection.name], runOptions);
-        registered.delete(collection.name);
-    }
-    const missing = expected.filter((collection) => !registered.has(collection.name));
+    const missing = deriveCollections(hqRoot).filter((collection) => !registered.has(collection.name));
     const created = [];
     for (const collection of missing) {
         try {
             runQmd(['collection', 'add', collection.path, '--name', collection.name, '--mask', collection.mask], runOptions);
-            const previousConfig = configured.get(collection.name);
-            if (previousConfig)
-                restoreCollectionMetadata(hqRoot, collection, previousConfig);
             created.push(collection);
         }
         catch (error) {
@@ -1502,9 +1359,6 @@ export function reconcileCollections(hqRoot, options = {}) {
             // different collection — stays fatal.
             if (!(error instanceof QmdCollectionExistsError) || error.collectionName !== collection.name)
                 throw error;
-            const previousConfig = configured.get(collection.name);
-            if (previousConfig)
-                restoreCollectionMetadata(hqRoot, collection, previousConfig);
         }
         runQmd(['context', 'add', `qmd://${collection.name}`, collection.context], runOptions);
     }

package/dist/lib/work-context/company.d.ts

@@ -3,9 +3,8 @@
  *
  * Order:
  *   1. trusted explicit (HQ_SPAWN_COMPANY env or observation.trustedContext/explicit)
- *   2. existing authoritative session scope — unless session meta.yaml
- *      names a different company (hq-session.sh rebind, US-047)
- *   3. session meta.yaml company_slug (/startwork / hq-session.sh)
+ *   2. existing authoritative session scope
+ *   3. session meta.yaml company_slug (/startwork)
  *   4. agent-box identity file (HQ_AGENT_IDENTITY_FILE → companyUid; source
  *      trusted_explicit — never "default company mode"; below HQ_SPAWN_COMPANY,
  *      above device default)
@@ -20,12 +19,14 @@
  */
 import type { TrustedExplicitContext } from "./contract.js";
 import { type SessionStateFile } from "./state.js";
-type CompanyResolutionSource = "trusted_explicit" | "existing_scope" | "session_meta" | "repo_map" | "device_default" | "deterministic_cwd" | "deterministic_remote";
+export type CompanyResolutionSource = "trusted_explicit" | "existing_scope" | "session_meta" | "repo_map" | "device_default" | "deterministic_cwd" | "deterministic_remote";
 export interface ResolvedCompany {
     slug?: string;
     uid?: string;
     source: CompanyResolutionSource;
 }
+/** Pointer to the US-017B correction client (never auto-switches). */
+export declare const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
 export declare function companyCorrectionPath(sessionId: string): string;
 export type CompanyResolution = {
     status: "resolved";
@@ -64,29 +65,17 @@ export interface CompanyResolveInput {
      * session-meta. Omitted (or unmapped) → the ladder falls through unchanged.
      */
     repoIdentityKey?: string | null;
-    /** Explicit historical repair may disable weak device-default evidence. */
-    allowDeviceDefault?: boolean;
 }
 /** Env naming the on-box identity.json (fleet agent boxes). */
 export declare const HQ_AGENT_IDENTITY_FILE_ENV = "HQ_AGENT_IDENTITY_FILE";
 export declare const DEFAULT_AGENT_IDENTITY_FILE = "/var/lib/hq-agent/identity.json";
-export declare function readAgentIdentityCompanyUid(env?: NodeJS.ProcessEnv): string | undefined;
-/**
- * Company named for a machine session.
- * Order: HQ_SPAWN_COMPANY, identity-file slug, identity-file uid.
- * Session meta is not included; callers place it between spawn and the file.
- * No company → undefined. Never invents NONE.
- */
-export declare function readMachineCompanyBinding(env?: NodeJS.ProcessEnv): {
-    slug?: string;
-    uid?: string;
-} | undefined;
 /**
- * Agent boxes must never infer a human device default. The file itself is the
- * machine marker; legacy identity files do not necessarily contain a company
- * UID, so parsing for that field is not an eligibility check.
+ * Read `companyUid` from the agent identity file when
+ * `HQ_AGENT_IDENTITY_FILE` is set, or the conventional fleet path otherwise.
+ * Missing/unreadable/malformed → undefined
+ * (never throws; never logs file contents).
  */
-export declare function hasAgentIdentityFile(env?: NodeJS.ProcessEnv): boolean;
+export declare function readAgentIdentityCompanyUid(env?: NodeJS.ProcessEnv): string | undefined;
 /**
  * Compare companies: UIDs when both sides have them; otherwise normalized
  * slugs when both have slugs. Never treat uid+slug vs slug-only as a
@@ -112,6 +101,15 @@ export declare function projectIdFromCwd(cwd: string | undefined, hqRoot?: strin
  * Read company_slug from workspace/sessions/<sid>/meta.yaml (best-effort, no yaml dep).
  */
 export declare function readMetaCompanySlug(sessionId: string, hqRoot: string | undefined): string | undefined;
+/**
+ * Deterministic mapping: exactly one of cwd companies/{slug} or remote owner.
+ * Multiple distinct signals that disagree → no deterministic mapping (needs_company
+ * unless a higher-precedence source exists). Matching signals collapse to one.
+ */
+export declare function resolveDeterministicCompany(input: {
+    cwd?: string;
+    hqRoot?: string;
+    remoteOwnerSlug?: string | null;
+}): ResolvedCompany | null;
 export declare function resolveCompany(input: CompanyResolveInput): CompanyResolution;
-export {};
 //# sourceMappingURL=company.d.ts.map

package/dist/lib/work-context/company.js

@@ -3,9 +3,8 @@
  *
  * Order:
  *   1. trusted explicit (HQ_SPAWN_COMPANY env or observation.trustedContext/explicit)
- *   2. existing authoritative session scope — unless session meta.yaml
- *      names a different company (hq-session.sh rebind, US-047)
- *   3. session meta.yaml company_slug (/startwork / hq-session.sh)
+ *   2. existing authoritative session scope
+ *   3. session meta.yaml company_slug (/startwork)
  *   4. agent-box identity file (HQ_AGENT_IDENTITY_FILE → companyUid; source
  *      trusted_explicit — never "default company mode"; below HQ_SPAWN_COMPANY,
  *      above device default)
@@ -23,7 +22,7 @@ import * as path from "node:path";
 import { getDefaultCompany, getRepoCompany } from "./config.js";
 import { authoritativeCompanyFromState, readSessionState, } from "./state.js";
 /** Pointer to the US-017B correction client (never auto-switches). */
-const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
+export const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
 export function companyCorrectionPath(sessionId) {
     return `${COMPANY_CORRECTION_PATH_PREFIX} ${sessionId}`;
 }
@@ -39,7 +38,13 @@ function normalizeSlug(value) {
         return undefined;
     return s;
 }
-function readAgentIdentityRecord(env) {
+/**
+ * Read `companyUid` from the agent identity file when
+ * `HQ_AGENT_IDENTITY_FILE` is set, or the conventional fleet path otherwise.
+ * Missing/unreadable/malformed → undefined
+ * (never throws; never logs file contents).
+ */
+export function readAgentIdentityCompanyUid(env = process.env) {
     // An explicit override (including empty/missing paths) never falls back to
     // another identity. This prevents accidental attribution to a different box.
     const file = (env[HQ_AGENT_IDENTITY_FILE_ENV] ?? DEFAULT_AGENT_IDENTITY_FILE).trim();
@@ -49,66 +54,15 @@ function readAgentIdentityRecord(env) {
         if (!fs.existsSync(file))
             return undefined;
         const raw = JSON.parse(fs.readFileSync(file, "utf8"));
-        if (!raw || typeof raw !== "object" || Array.isArray(raw))
-            return undefined;
-        return raw;
+        const uid = raw.companyUid;
+        return typeof uid === "string" && uid.trim().length > 0
+            ? uid.trim()
+            : undefined;
     }
     catch {
         return undefined;
     }
 }
-/** Company uid and slug from the fleet identity file. Missing file → undefined. */
-function readAgentIdentityCompany(env = process.env) {
-    const raw = readAgentIdentityRecord(env);
-    if (!raw)
-        return undefined;
-    const uid = typeof raw.companyUid === "string" ? raw.companyUid.trim() : "";
-    const slug = normalizeSlug(typeof raw.companySlug === "string" ? raw.companySlug : undefined);
-    if (!uid && !slug)
-        return undefined;
-    return {
-        ...(uid ? { uid } : {}),
-        ...(slug ? { slug } : {}),
-    };
-}
-export function readAgentIdentityCompanyUid(env = process.env) {
-    return readAgentIdentityCompany(env)?.uid;
-}
-/**
- * Company named for a machine session.
- * Order: HQ_SPAWN_COMPANY, identity-file slug, identity-file uid.
- * Session meta is not included; callers place it between spawn and the file.
- * No company → undefined. Never invents NONE.
- */
-export function readMachineCompanyBinding(env = process.env) {
-    const spawn = normalizeSlug(env.HQ_SPAWN_COMPANY);
-    const identity = readAgentIdentityCompany(env);
-    if (spawn)
-        return { slug: spawn, ...(identity?.uid ? { uid: identity.uid } : {}) };
-    if (!identity?.slug && !identity?.uid)
-        return undefined;
-    return {
-        ...(identity?.slug ? { slug: identity.slug } : {}),
-        ...(identity?.uid ? { uid: identity.uid } : {}),
-    };
-}
-/**
- * Agent boxes must never infer a human device default. The file itself is the
- * machine marker; legacy identity files do not necessarily contain a company
- * UID, so parsing for that field is not an eligibility check.
- */
-export function hasAgentIdentityFile(env = process.env) {
-    const configured = env[HQ_AGENT_IDENTITY_FILE_ENV];
-    const identityPath = configured === undefined ? DEFAULT_AGENT_IDENTITY_FILE : configured.trim();
-    if (!identityPath)
-        return false;
-    try {
-        return fs.existsSync(identityPath);
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Compare companies: UIDs when both sides have them; otherwise normalized
  * slugs when both have slugs. Never treat uid+slug vs slug-only as a
@@ -209,7 +163,7 @@ export function readMetaCompanySlug(sessionId, hqRoot) {
  * Multiple distinct signals that disagree → no deterministic mapping (needs_company
  * unless a higher-precedence source exists). Matching signals collapse to one.
  */
-function resolveDeterministicCompany(input) {
+export function resolveDeterministicCompany(input) {
     const fromCwd = companySlugFromCwd(input.cwd, input.hqRoot);
     const fromRemote = normalizeSlug(input.remoteOwnerSlug ?? undefined);
     if (fromCwd && fromRemote && fromCwd.toLowerCase() !== fromRemote.toLowerCase()) {
@@ -224,16 +178,6 @@ function resolveDeterministicCompany(input) {
     }
     return null;
 }
-function conflictingDeterministicEvidence(input) {
-    const cwd = companySlugFromCwd(input.cwd, input.hqRoot);
-    const remote = normalizeSlug(input.remoteOwnerSlug ?? undefined);
-    if (!cwd || !remote || cwd.toLowerCase() === remote.toLowerCase())
-        return null;
-    return {
-        cwd: { slug: cwd, source: "deterministic_cwd" },
-        remote: { slug: remote, source: "deterministic_remote" },
-    };
-}
 export function resolveCompany(input) {
     const env = input.env ?? process.env;
     // 1. Trusted explicit: HQ_SPAWN_COMPANY or observation trusted/explicit.
@@ -255,51 +199,41 @@ export function resolveCompany(input) {
         ? input.existingState
         : readSessionState(input.sessionId, input.root);
     const prior = authoritativeCompanyFromState(state);
-    // 3. session meta.yaml company_slug — read before existing_scope so an
-    // operator rebind via hq-session.sh can replace a stale Work Mesh company.
-    const metaSlug = input.metaCompanySlug !== undefined
-        ? normalizeSlug(input.metaCompanySlug)
-        : readMetaCompanySlug(input.sessionId, input.hqRoot);
     if (prior) {
         const scoped = {
             slug: prior.slug,
             uid: prior.uid,
             source: "existing_scope",
         };
-        if (metaSlug && !sameCompany(scoped, { slug: metaSlug })) {
-            return {
-                status: "resolved",
-                company: { slug: metaSlug, source: "session_meta" },
-            };
-        }
-        // Deterministic evidence from another company never silently replaces a
-        // scoped session, even before it has a project binding. Preserve the
-        // original scope and surface a conflict before tenant I/O.
+        // After a binding exists, a suspected other-company mismatch cannot
+        // auto-switch — return company_conflict with the US-017B correction path.
         const hadBinding = Boolean(state &&
             (state.contextStatus === "bound" ||
                 state.contextStatus === "needs_task" ||
                 state.contextStatus === "needs_project") &&
             (state.projectId || state.bindingEpisodeId));
-        const deterministic = resolveDeterministicCompany({
-            cwd: input.cwd,
-            hqRoot: input.hqRoot,
-            remoteOwnerSlug: input.remoteOwnerSlug,
-        });
-        if (deterministic && !sameCompany(scoped, deterministic)) {
-            return {
-                status: "company_conflict",
-                defaultCompany: scoped,
-                evidenceCompany: deterministic,
-                ...(hadBinding
-                    ? {
-                        afterBinding: true,
-                        correctionPath: companyCorrectionPath(input.sessionId),
-                    }
-                    : {}),
-            };
+        if (hadBinding) {
+            const deterministic = resolveDeterministicCompany({
+                cwd: input.cwd,
+                hqRoot: input.hqRoot,
+                remoteOwnerSlug: input.remoteOwnerSlug,
+            });
+            if (deterministic && !sameCompany(scoped, deterministic)) {
+                return {
+                    status: "company_conflict",
+                    defaultCompany: scoped,
+                    evidenceCompany: deterministic,
+                    afterBinding: true,
+                    correctionPath: companyCorrectionPath(input.sessionId),
+                };
+            }
         }
         return { status: "resolved", company: scoped };
     }
+    // 3. session meta.yaml company_slug
+    const metaSlug = input.metaCompanySlug !== undefined
+        ? normalizeSlug(input.metaCompanySlug)
+        : readMetaCompanySlug(input.sessionId, input.hqRoot);
     if (metaSlug) {
         return {
             status: "resolved",
@@ -309,15 +243,11 @@ export function resolveCompany(input) {
     // 4. Agent-box identity file (HQ_AGENT_IDENTITY_FILE). Prefer as the
     // device-default role with source trusted_explicit — never device_default /
     // "default company mode". Below HQ_SPAWN_COMPANY; above device default.
-    const identity = readAgentIdentityCompany(env);
-    if (identity?.uid || identity?.slug) {
+    const identityUid = readAgentIdentityCompanyUid(env);
+    if (identityUid) {
         return {
             status: "resolved",
-            company: {
-                ...(identity.slug ? { slug: identity.slug } : {}),
-                ...(identity.uid ? { uid: identity.uid } : {}),
-                source: "trusted_explicit",
-            },
+            company: { uid: identityUid, source: "trusted_explicit" },
         };
     }
     // 4b. Persisted per-repo company map (gap 4). A person answered once for this
@@ -334,26 +264,12 @@ export function resolveCompany(input) {
         }
     }
     // 5 + 6. Device default vs deterministic evidence.
-    const deviceDefault = input.allowDeviceDefault === false ? null : getDefaultCompany({ root: input.root });
+    const deviceDefault = getDefaultCompany({ root: input.root });
     const deterministic = resolveDeterministicCompany({
         cwd: input.cwd,
         hqRoot: input.hqRoot,
         remoteOwnerSlug: input.remoteOwnerSlug,
     });
-    const deterministicConflict = conflictingDeterministicEvidence({
-        cwd: input.cwd,
-        hqRoot: input.hqRoot,
-        remoteOwnerSlug: input.remoteOwnerSlug,
-    });
-    // Cwd and remote are both deterministic evidence. Their disagreement is
-    // never permission to fall through to a weaker device preference.
-    if (deterministicConflict) {
-        return {
-            status: "company_conflict",
-            defaultCompany: deterministicConflict.cwd,
-            evidenceCompany: deterministicConflict.remote,
-        };
-    }
     if (deviceDefault?.enabled && deviceDefault.slug) {
         const def = {
             slug: deviceDefault.slug,