You'll notice
Session events refused with a 403 can now be re-signed by the device and resent instead of dropped
What
When Claude Code tries to send a session event (a record of activity in your session) to the server and gets back an HTTP 403 (permission refused) response, it can now, if a related setting is enabled, work out why: whether the device is unattested (not verified) or the session login has gone stale. In either case, it re-signs the event using a device signer and resends it, logging the message "Refused unsigned by a session bound to this machine; resending signed."
Why
This lets session activity get through even when a device-bound session initially rejects it for lacking a valid signature, instead of the event being silently lost.