@reticlehq/server 3.1.0 → 3.3.0

package/dist/memory/cloud/harness-offer.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Whether this workspace has taken the three months of free harness, read by the thing that would
+ * advertise it.
+ *
+ * The HUD can only advertise honestly if it knows, and only the platform knows. This is the read —
+ * filed beside the other reads of the linked account rather than with the harness itself, because
+ * nothing that DRIVES needs it; the thing that needs it is the snapshot the HUD paints from. Same
+ * shape as the harness's own `platform-config.ts` and for the same reasons: it is INFORMATION, not a
+ * credential, so every failure answers `undefined`, which every caller must treat as "say nothing"
+ * rather than as "not claimed". An offline laptop must not start advertising something the person
+ * already owns.
+ *
+ * It is also SYNCHRONOUS at the point of use. The impact snapshot is built inline, dozens of times a
+ * session, and the answer changes about once per workspace lifetime, so a cache that refreshes in
+ * the background is the whole design: readers get what we last heard, and a stale answer is only
+ * ever stale in the safe direction — the card the person is looking at is the one they can act on.
+ */
+import { type HarnessOffer } from '@reticlehq/core';
+/** A GET, narrowed to what this file uses, so a test can answer it without a network. */
+export type OfferFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+}>;
+/** Ask the platform where this workspace stands. `undefined` means "no answer", never "not claimed". */
+export declare function fetchHarnessOffer(env: Record<string, string | undefined>, claimUrl: string | undefined, doFetch?: OfferFetch, timeoutMs?: number): Promise<HarnessOffer | undefined>;
+/** What the impact snapshot reads: the last answer, with a refresh kicked off when it goes stale. */
+export interface OfferSource {
+    read(): HarnessOffer | undefined;
+}
+/**
+ * A self-refreshing cache over the read above.
+ *
+ * Deliberately NOT a timer. A daemon that lives for days would otherwise hold an interval whose only
+ * job is to re-ask a question nobody is asking, and it would have to be torn down in a place that
+ * already has nine teardowns. Refreshing on a stale READ means the work only happens while somebody
+ * is actually looking, and the first read of a process — which is always stale — starts the fetch
+ * that the second read answers from.
+ */
+export declare function harnessOfferSource(env: Record<string, string | undefined>, claimUrl: () => string | undefined, now?: () => number, load?: (claim: string | undefined) => Promise<HarnessOffer | undefined>): OfferSource;

package/dist/memory/cloud/harness-offer.js

@@ -0,0 +1,146 @@
+/**
+ * Whether this workspace has taken the three months of free harness, read by the thing that would
+ * advertise it.
+ *
+ * The HUD can only advertise honestly if it knows, and only the platform knows. This is the read —
+ * filed beside the other reads of the linked account rather than with the harness itself, because
+ * nothing that DRIVES needs it; the thing that needs it is the snapshot the HUD paints from. Same
+ * shape as the harness's own `platform-config.ts` and for the same reasons: it is INFORMATION, not a
+ * credential, so every failure answers `undefined`, which every caller must treat as "say nothing"
+ * rather than as "not claimed". An offline laptop must not start advertising something the person
+ * already owns.
+ *
+ * It is also SYNCHRONOUS at the point of use. The impact snapshot is built inline, dozens of times a
+ * session, and the answer changes about once per workspace lifetime, so a cache that refreshes in
+ * the background is the whole design: readers get what we last heard, and a stale answer is only
+ * ever stale in the safe direction — the card the person is looking at is the one they can act on.
+ */
+import { ReticleEnv, apiKeyFrom } from '@reticlehq/core';
+const OFFER_PATH = '/v1/harness/offer';
+/** Same budget as the model-config read: a drive must never wait on an advert. */
+const TIMEOUT_MS = 2_000;
+/**
+ * How long a cached answer is trusted.
+ *
+ * A claim happens once. The only transition worth catching quickly is the one the person just made
+ * in another tab, and ten minutes is well inside the time it takes them to come back and look.
+ */
+const FRESH_MS = 10 * 60 * 1_000;
+/**
+ * Parse the platform's answer.
+ *
+ * The platform reports `null` for "never claimed" on the fields it has no value for; the wire
+ * contract says ABSENT. They are the same fact and the translation belongs here, at the edge,
+ * rather than in a HUD that would then need to know about two spellings of nothing.
+ */
+function parse(body, claimUrl) {
+    try {
+        const parsed = JSON.parse(body);
+        if ('object' !== typeof parsed || null === parsed)
+            return undefined;
+        const record = parsed;
+        const claimed = record['claimed'];
+        if ('boolean' !== typeof claimed)
+            return undefined;
+        const offer = { claimed };
+        const expiresAt = record['expiresAt'];
+        if ('number' === typeof expiresAt)
+            offer.expiresAt = expiresAt;
+        const days = record['daysRemaining'];
+        if ('number' === typeof days)
+            offer.daysRemaining = days;
+        // The one field that cannot be inferred from the others: a LAPSED claim reports `claimed:false`
+        // and `daysRemaining:0`, which is indistinguishable from never having claimed unless the
+        // platform's own answer about offerability is carried through.
+        const eligible = record['eligible'];
+        if ('boolean' === typeof eligible)
+            offer.eligible = eligible;
+        if (claimUrl !== undefined && 0 < claimUrl.length)
+            offer.claimUrl = claimUrl;
+        return offer;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Ask the platform where this workspace stands. `undefined` means "no answer", never "not claimed". */
+export async function fetchHarnessOffer(env, claimUrl, doFetch = (url, init) => fetch(url, init), timeoutMs = TIMEOUT_MS) {
+    const key = apiKeyFrom(env);
+    const host = env[ReticleEnv.CLOUD_URL];
+    if (key === undefined || 0 === key.length)
+        return undefined;
+    if (host === undefined || 0 === host.length)
+        return undefined;
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+        controller.abort();
+    }, timeoutMs);
+    try {
+        const res = await doFetch(`${host.replace(/\/+$/, '')}${OFFER_PATH}`, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${key}` },
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return undefined;
+        return parse(await res.text(), claimUrl);
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * A self-refreshing cache over the read above.
+ *
+ * Deliberately NOT a timer. A daemon that lives for days would otherwise hold an interval whose only
+ * job is to re-ask a question nobody is asking, and it would have to be torn down in a place that
+ * already has nine teardowns. Refreshing on a stale READ means the work only happens while somebody
+ * is actually looking, and the first read of a process — which is always stale — starts the fetch
+ * that the second read answers from.
+ */
+export function harnessOfferSource(env, claimUrl, now = () => Date.now(), load = (claim) => fetchHarnessOffer(env, claim)) {
+    let cached;
+    // `undefined` rather than 0: "never asked" is a different state from "asked at the epoch", and
+    // conflating them made a source with an injected clock never take its first read.
+    let fetchedAt;
+    let inFlight = false;
+    const refresh = () => {
+        if (inFlight)
+            return;
+        inFlight = true;
+        void load(claimUrl())
+            .then((offer) => {
+            // A failed read keeps the LAST good answer rather than blanking the card mid-session: one
+            // dropped request is not evidence that the offer changed.
+            if (offer !== undefined)
+                cached = offer;
+            fetchedAt = now();
+        })
+            .catch(() => {
+            fetchedAt = now();
+        })
+            .finally(() => {
+            inFlight = false;
+        });
+    };
+    /*
+     * Asked once at construction, not first read.
+     *
+     * Measured in a browser: a daemon pushes the impact snapshot the INSTANT a session attaches, and
+     * on a page nobody drives that is the only push there will ever be. Refreshing on the first read
+     * meant that push always carried "we have not heard", the answer landed a moment later with
+     * nobody to tell, and the HUD showed nothing for the whole session. Starting the fetch when the
+     * daemon starts puts the answer in place before any page can connect.
+     */
+    refresh();
+    return {
+        read() {
+            if (fetchedAt === undefined || FRESH_MS <= now() - fetchedAt)
+                refresh();
+            return cached;
+        },
+    };
+}

package/dist/memory/cloud/harness-switch.d.ts

@@ -0,0 +1,11 @@
+export type SwitchFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+}>;
+/** `true` when the platform accepted it. Callers use this for logging, never to block a person. */
+export declare function writeHarnessSwitch(env: Record<string, string | undefined>, enabled: boolean, doFetch?: SwitchFetch, timeoutMs?: number): Promise<boolean>;

package/dist/memory/cloud/harness-switch.js

@@ -0,0 +1,53 @@
+/**
+ * Write the harness switch back to the platform.
+ *
+ * The panel does not keep this state — it emits an intent and this puts it where the dashboard can
+ * see it, so the two surfaces cannot disagree. Only the switch is sent: somebody who chose a
+ * provider in the console must not have it reset by a panel that never rendered one. The platform's
+ * PUT is what guarantees that, not the verb -- it merges the fields it is given and leaves the rest,
+ * which its own spec pins ("leaves the fields it was not sent alone").
+ *
+ * It says PUT because that is what the platform registers. It said PATCH for one release, against a
+ * route that has only ever served GET and PUT, so every write 404'd. Nothing reported it: the call
+ * is fire-and-forget and failure here is deliberately silent, so the switch simply sprang back on
+ * the next snapshot and looked like a UI that would not stick.
+ *
+ * Failure is SILENT by design, and that deserves saying plainly rather than being discovered. A
+ * dev-only overlay that threw a dialog because a settings write timed out would be worse than one
+ * that quietly did not save; the next snapshot re-reads the platform, so a lost write shows up as
+ * the switch springing back, which is a truthful thing for it to do.
+ */
+import { ReticleEnv, apiKeyFrom } from '@reticlehq/core';
+const CONFIG_PATH = '/v1/model/config';
+/** Same budget as the read beside it: a settings write must never hold anything up. */
+const TIMEOUT_MS = 2_000;
+/** `true` when the platform accepted it. Callers use this for logging, never to block a person. */
+export async function writeHarnessSwitch(env, enabled, doFetch = (url, init) => fetch(url, init), timeoutMs = TIMEOUT_MS) {
+    const key = apiKeyFrom(env);
+    const host = env[ReticleEnv.CLOUD_URL];
+    if (key === undefined || 0 === key.length)
+        return false;
+    if (host === undefined || 0 === host.length)
+        return false;
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+        controller.abort();
+    }, timeoutMs);
+    try {
+        // No projectId in the body: the key IS project-scoped, and the platform refuses to let a key
+        // name somebody else's project. Sending one would be asking for a privilege we do not have.
+        const res = await doFetch(`${host.replace(/\/+$/, '')}${CONFIG_PATH}`, {
+            method: 'PUT',
+            headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ harnessEnabled: enabled }),
+            signal: controller.signal,
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/memory/cloud/sync-cycle.d.ts

@@ -61,8 +61,20 @@ export interface CloudSyncState {
     lastPullAt?: number;
     /** The last failure, kept so `reticle sync` can say why it is behind instead of just "0 sent". */
     lastError?: string;
+    /**
+     * Run ids this machine has watched the server accept, kept only for the runs still held locally.
+     *
+     * Read ONLY when the server says its own `knownRunIds` was truncated. A complete list is a
+     * complete answer — a run missing from one is genuinely missing and must be re-sent — so this
+     * fills the gap the server declared and never overrides the server on a question it answered.
+     */
+    sentRunIds?: string[];
 }
 export interface SyncReport {
+    /**
+     * False if the cycle failed or any offered run was rejected. A completed HTTP exchange alone
+     * is not a successful push. Accepted counts and rejection reasons still describe partial success.
+     */
     ok: boolean;
     /** Runs the server accepted this cycle. */
     runsSent: number;

package/dist/memory/cloud/sync-cycle.js

@@ -99,9 +99,20 @@ export async function runSyncCycle(deps) {
          * something the server does not have. Silent data loss is the one failure this protocol must
          * not have, and an unreadable answer has to mean "it knows nothing", never "it knows this".
          */
-        const known = new Set(Array.isArray(held.knownRunIds)
-            ? held.knownRunIds.filter((id) => 'string' === typeof id)
-            : []);
+        const onlyStrings = (value) => Array.isArray(value) ? value.filter((id) => 'string' === typeof id) : [];
+        /*
+         * The server may answer "here are the ids I hold, and there are more than I listed". Read as the
+         * whole truth, that short list made every run past the server's page look unsent, so a project
+         * with enough runs to truncate it re-uploaded its history on every single cycle, forever. The
+         * field was declared on this response and read nowhere.
+         *
+         * Only then is the machine's own record consulted, and it is subject to the same rule as the
+         * server's: anything that is not a list of strings reads as "nothing is known".
+         */
+        const known = new Set([
+            ...onlyStrings(held.knownRunIds),
+            ...(true === held.truncated ? onlyStrings(deps.state.sentRunIds) : []),
+        ]);
         // Same rule for the hashes: only a string can equal a hash we computed, so anything else reads
         // as "unknown" and the record is sent once. Re-sending costs a request; skipping costs the data.
         const hashes = isRecord(held.stateHashes) ? held.stateHashes : {};
@@ -158,7 +169,20 @@ export async function runSyncCycle(deps) {
                 ? runs['rejected']
                 : [];
             nextState.lastPushAt = deps.now();
+            // Accepted means the server has it. A rejected run was refused by index, so it is exactly as
+            // unsent as it was before and must never be remembered as delivered.
+            const refused = new Set(runsRejected.map((r) => r.index));
+            unsent.forEach((run, index) => {
+                if (!refused.has(index))
+                    known.add(run.runId);
+            });
         }
+        /*
+         * Bounded by the runs still on disk rather than by a cap. Retention already decides how many
+         * runs a workspace keeps, and an id for a run nobody holds any more cannot stop an upload that
+         * will never be attempted — so the record follows the artifacts and needs no number of its own.
+         */
+        nextState.sentRunIds = allRuns.map((r) => r.runId).filter((id) => known.has(id));
         // 3. COLLECT — always, even when there was nothing to send.
         const query = nextState.cursor === undefined ? '' : `?since=${encodeURIComponent(nextState.cursor)}`;
         const pull = await call(`${SYNC_PULL_PATH}${query}`);
@@ -199,7 +223,8 @@ export async function runSyncCycle(deps) {
         delete nextState.lastError;
         deps.sink.writeState(nextState);
         return {
-            ok: true,
+            // Keep transport errors separate: rejection reasons already identify the failed artifacts.
+            ok: 0 === runsRejected.length,
             runsSent,
             runsRejected,
             flowsSent,

package/dist/memory/cloud/sync-daemon.d.ts

@@ -1,5 +1,6 @@
 import { type SyncReport } from './sync-cycle.js';
-import type { ProjectCloud } from './cloud-config.js';
+import { type ProjectCloud } from './cloud-config.js';
+import type { FileSystemPort } from '../project/fs/fs-port.js';
 interface SyncDaemonDeps {
     reticleRoot: string;
     /** Resolved per tick, not once: a repo linked while the daemon is alive starts syncing itself. */
@@ -29,7 +30,7 @@ interface SyncDaemonDeps {
         text: string;
     }>;
 }
-interface SyncDaemon {
+export interface SyncDaemon {
     /** Run one cycle now, whatever the timer is doing. Returns undefined when not linked. */
     syncNow: () => Promise<SyncReport | undefined>;
     /**
@@ -44,10 +45,42 @@ interface SyncDaemon {
      */
     nudge: () => void;
     stop: () => void;
+    /**
+     * Stop, but send what is still owed first.
+     *
+     * `stop()` cancels the pending timer, and the last thing a session writes is the run artifact the
+     * whole drive produced — so a daemon asked to close moments after a verdict dropped the one push
+     * anybody was waiting on. Measured against app.reticle.sh: a drive wrote its run, the daemon
+     * exited, and the dashboard's newest row stayed three weeks old.
+     *
+     * Bounded, because shutdown is not allowed to hang: an in-flight cycle is waited out only until
+     * the deadline, and a cycle that cannot finish in time is simply the interval's problem next
+     * time — the artifact is still on disk and the next daemon for this project sends it.
+     */
+    flush: () => Promise<void>;
 }
 /**
  * Start the loop. Safe to call for an UNLINKED project: it resolves the link on every tick and does
  * nothing until one appears, which is what lets `reticle link` take effect without a restart.
  */
 export declare function startSyncDaemon(deps: SyncDaemonDeps): SyncDaemon;
+/**
+ * Start cloud sync for a daemon and hand back the two hooks the daemon wires to it.
+ *
+ * The wiring lived in `index.ts`, which sits exactly on the thousand-line cap — so the next thing
+ * anyone needed there could not be added without a split, and this is the block that most obviously
+ * did not belong in a bootstrap file. Four calls that are all one concern: what to sync, where else
+ * to look, how a landed run wakes it, and what the panel's button does.
+ *
+ * Returns the daemon itself: the caller still owns when to nudge, when to sync now, and when to
+ * stop. Only the CONSTRUCTION moved, which is the part that was four interdependent arguments about
+ * resolving a credential — and the part a bootstrap file has no business spelling out.
+ */
+export declare function attachCloudSync(deps: {
+    fs: FileSystemPort;
+    reticleRoot: string;
+    homeDir: string;
+    env: NodeJS.ProcessEnv;
+    otherRoots: () => readonly string[];
+}): SyncDaemon;
 export {};

package/dist/memory/cloud/sync-daemon.js

@@ -25,6 +25,7 @@ import { log } from '../../log.js';
 import { emitSyncHook } from '../../hooks/hook-emit.js';
 import { describeSync, runSyncCycle } from './sync-cycle.js';
 import { diskSink, diskSource, readCloudState } from './sync-disk.js';
+import { resolveProjectCloud } from './cloud-config.js';
 /** How often the daemon cycles. See the note above on why this is a constant and not a curve. */
 const DAEMON_SYNC_INTERVAL_MS = 60_000;
 /**
@@ -53,6 +54,15 @@ const FIRST_CYCLE_DELAY_MS = 5_000;
  * written just after, so cycling on the very first byte would ship a bundle that is missing them.
  */
 const NUDGE_DELAY_MS = 1_500;
+/**
+ * How long a flush waits for a cycle already in flight before running its own.
+ *
+ * Shutdown budget, not a sync budget: every call inside a cycle already carries its own timeout, so
+ * this only bounds the WAIT. Generous enough for an ordinary cycle to finish, short enough that a
+ * stalled one cannot hold a daemon open.
+ */
+const FLUSH_WAIT_MS = 3_000;
+const FLUSH_POLL_MS = 25;
 const defaultRequest = async (url, init) => {
     const res = await fetch(url, init);
     return { status: res.status, text: await res.text() };
@@ -269,5 +279,40 @@ export function startSyncDaemon(deps) {
                 clearTimeout(timer);
             timer = undefined;
         },
+        flush: async () => {
+            stopped = true;
+            if (timer !== undefined)
+                clearTimeout(timer);
+            timer = undefined;
+            // A cycle already running may have started BEFORE the write being flushed, so its report says
+            // nothing about that artifact. Wait it out rather than skipping on the overlap guard.
+            const deadline = Date.now() + FLUSH_WAIT_MS;
+            while (running && Date.now() < deadline)
+                await new Promise((resolve) => setTimeout(resolve, FLUSH_POLL_MS));
+            await cycle();
+        },
     };
 }
+/**
+ * Start cloud sync for a daemon and hand back the two hooks the daemon wires to it.
+ *
+ * The wiring lived in `index.ts`, which sits exactly on the thousand-line cap — so the next thing
+ * anyone needed there could not be added without a split, and this is the block that most obviously
+ * did not belong in a bootstrap file. Four calls that are all one concern: what to sync, where else
+ * to look, how a landed run wakes it, and what the panel's button does.
+ *
+ * Returns the daemon itself: the caller still owns when to nudge, when to sync now, and when to
+ * stop. Only the CONSTRUCTION moved, which is the part that was four interdependent arguments about
+ * resolving a credential — and the part a bootstrap file has no business spelling out.
+ */
+export function attachCloudSync(deps) {
+    return startSyncDaemon({
+        reticleRoot: deps.reticleRoot,
+        cloud: () => resolveProjectCloud(deps.fs, deps.reticleRoot, deps.homeDir, deps.env),
+        // Every OTHER linked repo on this machine, not just the directory the daemon was started in.
+        // One daemon serves many projects, and pushing only its own root left the rest silently
+        // reporting nothing — indistinguishable, on the dashboard, from nobody having verified anything.
+        otherRoots: () => Promise.resolve(deps.otherRoots()),
+        cloudFor: (root) => resolveProjectCloud(deps.fs, root, deps.homeDir, deps.env),
+    });
+}

package/dist/memory/cloud/sync-disk.js

@@ -12,7 +12,7 @@
  */
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync, } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { ReticleDir } from '@reticlehq/core';
+import { IntentDir, ReticleDir } from '@reticlehq/core';
 import { subjectFor } from '../intent/intent-subject.js';
 const JSON_SUFFIX = '.json';
 /** Read + parse, or undefined for absent/unreadable/malformed. Never throws. */
@@ -73,8 +73,8 @@ const DERIVED_FILE = {
     intent: ReticleDir.INTENT_FILE,
 };
 /** The directory the sharded intent store writes into, beside the legacy flat file. */
-const INTENT_SUBDIR = 'intent';
-const INTENT_INDEX = 'index.json';
+const INTENT_SUBDIR = ReticleDir.INTENT_SUBDIR;
+const INTENT_INDEX = IntentDir.INDEX_FILE;
 /**
  * Every intent this project holds, flat file and shards merged.
  *
@@ -98,10 +98,15 @@ function readIntent(reticleRoot) {
         ...(legacy?.intents ?? {}),
     };
     let shards = 0;
-    for (const file of safeReaddir(join(reticleRoot, INTENT_SUBDIR))) {
-        if (!file.endsWith(JSON_SUFFIX) || INTENT_INDEX === file)
+    for (const entry of safeReaddir(join(reticleRoot, INTENT_SUBDIR))) {
+        if (INTENT_INDEX === entry)
             continue;
-        const shard = readJson(join(reticleRoot, INTENT_SUBDIR, file));
+        // `<subject>/intent.json` is the layout; a bare `<subject>.json` is an interim shard the store
+        // has not migrated yet, and is still this project's memory until it has.
+        const path = entry.endsWith(JSON_SUFFIX)
+            ? join(reticleRoot, INTENT_SUBDIR, entry)
+            : join(reticleRoot, INTENT_SUBDIR, entry, IntentDir.SHARD_FILE);
+        const shard = readJson(path);
         // A hand-edited or half-written shard costs one subject, never the whole sync.
         if (shard?.intents === undefined)
             continue;

package/dist/memory/impact/impact-recorder.d.ts

@@ -1,4 +1,5 @@
 import { type ImpactCounts, type ImpactDefect, type ImpactSnapshot } from '@reticlehq/core';
+import type { ConfigSource } from '../cloud/harness-config.js';
 import { ImpactStore, type ImpactFoldMeta } from './impact-store.js';
 /**
  * Wire the DEFAULT root — the daemon's own. Idempotent; the first one wins.
@@ -8,6 +9,13 @@ import { ImpactStore, type ImpactFoldMeta } from './impact-store.js';
  * project passes one, and this is the fallback for calls that do not.
  */
 export declare function initImpact(opts: {
+    /**
+     * The harness-config source, supplied by whoever wired the daemon.
+     *
+     * Passed in rather than built here: reading the platform lives in `features/harness`, and this
+     * directory may not reach for it. The daemon owns both sides.
+     */
+    config?: ConfigSource;
     reticleRoot: string | undefined;
     projectName?: string;
     now?: () => number;

package/dist/memory/impact/impact-recorder.js

@@ -50,10 +50,11 @@ export function initImpact(opts) {
         return storeFor(undefined);
     if (defaultRoot === undefined) {
         defaultRoot = opts.reticleRoot;
-        const { projectName, now } = opts;
+        const { projectName, now, config } = opts;
         storeOpts = {
             ...(projectName === undefined ? {} : { projectName }),
             ...(now === undefined ? {} : { now }),
+            ...(config === undefined ? {} : { config }),
         };
     }
     return storeFor(opts.reticleRoot);

package/dist/memory/impact/impact-store.d.ts

@@ -1,3 +1,5 @@
+import { type OfferSource } from '../cloud/harness-offer.js';
+import type { ConfigSource } from '../cloud/harness-config.js';
 import { type ImpactCounts, type ImpactDefect, type AccountState, type ImpactScope, type ImpactSnapshot } from '@reticlehq/core';
 /** Read a scope, tolerating absence and corruption: a broken file starts over rather than throwing. */
 export declare function readScope(path: string, now: number): ImpactScope;
@@ -37,6 +39,9 @@ export declare class ImpactStore {
         globalRoot?: string;
         /** Reads whether this machine is signed in. Injected so the store stays testable and pure-ish. */
         account?: () => AccountState;
+        /** Where the workspace stands with the free harness offer. Injected so no test touches a network. */
+        offer?: OfferSource;
+        config?: ConfigSource;
     });
     /** Notified after every fold, so the HUD can be pushed a fresh snapshot. */
     onChange(fn: () => void): void;

package/dist/memory/impact/impact-store.js

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { readAccountState } from '../cloud/account-state.js';
+import { harnessOfferSource } from '../cloud/harness-offer.js';
 import { ReticleDir, IMPACT_DAILY_BUCKETS, IMPACT_DEFECT_LIMIT, IMPACT_SCHEMA_VERSION, ImpactScopeSchema, addImpactCounts, emptyImpactCounts, emptyImpactRecords, estimateImpactSavings, } from '@reticlehq/core';
 /**
  * Where Reticle keeps the record of what it has done for you.
@@ -174,6 +175,9 @@ export class ImpactStore {
     #timer;
     #onChange;
     #account;
+    /** Where this workspace stands with the free harness offer. Cached; see harness-offer.ts. */
+    #offer;
+    #config;
     constructor(opts) {
         this.#paths = impactPaths(opts.reticleRoot, opts.globalRoot ?? homedir());
         // Resolved per snapshot, not cached: a user who runs `reticle login` in another terminal must
@@ -182,6 +186,12 @@ export class ImpactStore {
         this.#now = opts.now ?? (() => Date.now());
         this.#projectName = opts.projectName;
         this.#dashboardUrl = readDashboardUrl(opts.reticleRoot);
+        // The claim happens in the console, so the link this project was linked to IS the claim link —
+        // built here rather than in the HUD, which has no way to know where this project points.
+        this.#offer = opts.offer ?? harnessOfferSource(process.env, () => this.#dashboardUrl);
+        // No default: the loader lives in `features/harness` and this file may not reach for it.
+        // A store built without one simply reports no harness config, which the HUD renders as no row.
+        this.#config = opts.config ?? { read: () => undefined };
         const now = this.#now();
         this.#project = readScope(this.#paths.project, now);
         this.#global = readScope(this.#paths.global, now);
@@ -211,6 +221,21 @@ export class ImpactStore {
         if (this.#dashboardUrl !== undefined)
             snap.dashboardUrl = this.#dashboardUrl;
         snap.account = this.#account();
+        const cfgForOffer = this.#config.read();
+        const offer = this.#offer.read();
+        // Joined here because this is the one place that holds BOTH the offer and the platform config.
+        // The card reads the offer, so readiness has to travel on it rather than being re-derived in a
+        // presenter that has no business knowing what a provider key is.
+        if (offer !== undefined && cfgForOffer !== undefined)
+            offer.drivable = cfgForOffer.providerReady;
+        // Absent means "we have not heard", which the HUD renders as nothing at all. Never defaulted to
+        // `{claimed:false}`: that would advertise the offer to everyone who is offline.
+        if (offer !== undefined)
+            snap.harnessOffer = offer;
+        // Absent stays absent: the HUD reads that as "we have not heard" and renders no control.
+        const cfg = this.#config.read();
+        if (cfg !== undefined)
+            snap.harnessConfig = cfg;
         return snap;
     }
     /** Write now (process exit, tests). */

package/dist/memory/intent/inline-intent.js

@@ -9,7 +9,7 @@ import { sessionRoot } from '../project/session-root.js';
  * and it does. `reticle_act_and_wait` and `reticle_assert` are in every agent's tool list already,
  * so one optional argument there makes the declaration free and discoverable by construction.
  *
- * This is a shortcut into the EXISTING ledger, never a second one. It writes `.reticle/intent.json`
+ * This is a shortcut into the EXISTING ledger, never a second one. It writes `.reticle/intent/`
  * through `IntentStore` exactly as `reticle_intent { action: "declare" }` does, so a reviewer reads
  * one file in one vocabulary and cannot tell from the row which door the intent came in by. The
  * pattern is `flows/flow-intent.ts`, which does the same job for a saved flow.
@@ -146,8 +146,13 @@ binding) {
         // Declared WITHOUT a surface on purpose: see dischargeInlineIntent for why the route that
         // describes this record only exists after the action it is about.
         const declaredHere = existing === undefined;
-        if (declaredHere)
-            await store.declare([{ id, statement: intent }]);
+        if (declaredHere) {
+            // Nothing stored (a step label is refused) means nothing to link: no verdict may then claim
+            // to have proved an intent that was never written.
+            const stored = await store.declare([{ id, statement: intent }]);
+            if (0 === stored.length)
+                return undefined;
+        }
         /*
          * A binding may be INVENTED only for a row this call also declared.
          *