{"version":"2.1.239","anchor":"trusted-device-enrollment-now-happens-on-demand-not-just-up-","canonical_anchor":"trusted-device-enrollment-now-happens-on-demand-not-just-up-","heading":"Trusted-device enrollment now happens on demand, not just up front","tier":"notice","area":"Device Trust","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239\/e\/trusted-device-enrollment-now-happens-on-demand-not-just-up-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239","markdown":"### Trusted-device enrollment now happens on demand, not just up front\n\nTrusted-device enrollment now happens when needed rather than only at startup, and records why it ran.\n\n**What**\n\nDevice enrollment records why it ran (`proactive`, `device_bind`, or after a server refusal) and whether the organisation required it. For consumer subscribers, and after a server refusal, it will enroll when the org merely allows the policy rather than enforcing it. A new path enrolls on demand just before binding a device session.\n\n**Details**\n\n- Gated on `tengu_violin_wood`, which falls back to off, plus related gates and organisation policy.\n- The existing opt-out environment variable is still honoured.\n\n**Evidence**\n\n`[trusted-device] Not enrolled, enrolling for a device-bound session`\n\n- Flag `tengu_violin_wood`: Off in both readings (read for one account on one subscription tier against v2.1.239; this account: off, anonymous baseline: off, compiled default: off)\n- Area: Device Trust\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 3\/5"}