What
The client that streams sessions now renews its trusted-device proof once per run, re-enrolling with the previous token rather than only reloading whatever was on disk. If renewal produces nothing, the stored token is cleared.
Details
- Renewal runs at most once, guarded by an internal flag, and falls back to a plain token load if re-enrolment fails.
- A failure is logged and the client simply sends no trusted-device header, so requests continue unauthenticated by device rather than erroring.
Evidence
[SessionsV2Client] device proof renewal failed:
Strings lifted out of the shipped bundle, so the claim above can be checked against them.