@reticlehq/server 3.4.0 → 3.6.0

package/dist/memory/cloud/sync-cycle.d.ts

@@ -1,10 +1,10 @@
 /**
  * The derived records that ride along with runs, and the file each one lives in.
  *
- * A list rather than three hand-written blocks so adding a fourth is one line and cannot be
- * half-done — the bundle, the hashing and the reporting all walk this.
+ * One list, so adding a record is one line and cannot be half-done: the bundle, the hashing, the
+ * reporting and the disk source (`sync-disk.ts`) all read it.
  */
-declare const DERIVED_RECORDS: readonly [{
+export declare const DERIVED_RECORDS: readonly [{
     readonly kind: "impact";
     readonly file: "impact.json";
 }, {
@@ -19,6 +19,12 @@ declare const DERIVED_RECORDS: readonly [{
 }, {
     readonly kind: "assertion-tiers";
     readonly file: "assertion-tiers.json";
+}, {
+    readonly kind: "coverage";
+    readonly file: "coverage.json";
+}, {
+    readonly kind: "notes";
+    readonly file: "notes.json";
 }];
 type DerivedKind = (typeof DERIVED_RECORDS)[number]['kind'];
 /** What the machine reads from disk. Injected so a cycle is testable with no filesystem at all. */
@@ -75,6 +81,15 @@ export interface CloudSyncState {
      * fills the gap the server declared and never overrides the server on a question it answered.
      */
     sentRunIds?: string[];
+    /**
+     * The content hash of each run as the server last ACCEPTED it, for the runs still held locally.
+     *
+     * A run is not immutable: a session's live drive run is rewritten after every verdict under the
+     * same id. Sending by id alone delivered its first version and never the rest, so the server held
+     * a tab's first few verdicts and none after. The server upserts a run by id, so a changed run is
+     * simply sent again; this is how the machine tells a changed run from one it already delivered.
+     */
+    sentRunHashes?: Record<string, string>;
     /**
      * Runs the server refused, by run id: its reason, and the two things that could change the answer
      * (a hash of the run file, and of what the platform said it reads). A refused run is not offered
@@ -188,6 +203,9 @@ interface SyncDeps {
         text: string;
     }>;
 }
+/** The server's per-part answer: accepted count and rejection list, each read defensively. */
+/** A 200 that never confirmed the runs it was sent. Kept queued, and said, rather than dropped. */
+export declare const MSG_RUNS_UNCONFIRMED = "sync 200 without a runs result: the server did not confirm the runs it was sent, so they stay queued";
 /**
  * Run one cycle. Never throws: the local record is already safe on disk, and a sync that can take
  * down the thing it is backing up is worse than no sync.

package/dist/memory/cloud/sync-cycle.js

@@ -39,10 +39,10 @@ const SYNC_PULL_PATH = '/v1/sync/pull';
 /**
  * The derived records that ride along with runs, and the file each one lives in.
  *
- * A list rather than three hand-written blocks so adding a fourth is one line and cannot be
- * half-done — the bundle, the hashing and the reporting all walk this.
+ * One list, so adding a record is one line and cannot be half-done: the bundle, the hashing, the
+ * reporting and the disk source (`sync-disk.ts`) all read it.
  */
-const DERIVED_RECORDS = [
+export const DERIVED_RECORDS = [
     { kind: 'impact', file: ReticleDir.IMPACT_FILE },
     { kind: 'flake', file: ReticleDir.FLAKE_FILE },
     { kind: 'intent', file: ReticleDir.INTENT_FILE },
@@ -50,6 +50,10 @@ const DERIVED_RECORDS = [
     // cannot tell a server a page that drifted from one that always behaved that way.
     { kind: 'envelopes', file: ReticleDir.ENVELOPES_FILE },
     { kind: 'assertion-tiers', file: ReticleDir.TIERS_FILE },
+    // Reticle Coverage: what the platform's Overview shows as controls proved and routes reached.
+    { kind: 'coverage', file: ReticleDir.COVERAGE_FILE },
+    // The notes a human pinned in the HUD, pending and resolved: the review trail a team reads.
+    { kind: 'notes', file: ReticleDir.NOTES_FILE },
 ];
 const asJson = (text) => {
     try {
@@ -75,6 +79,8 @@ const flowName = (flow, index) => {
 const FLOW_VERSION_FIX = 'update the platform or remove `compare` from the flow';
 const RUN_VERSION_FIX = 'update the platform';
 /** The server's per-part answer: accepted count and rejection list, each read defensively. */
+/** A 200 that never confirmed the runs it was sent. Kept queued, and said, rather than dropped. */
+export const MSG_RUNS_UNCONFIRMED = 'sync 200 without a runs result: the server did not confirm the runs it was sent, so they stay queued';
 function partResult(body, part) {
     const raw = isRecord(body[part]) ? body[part] : {};
     const accepted = 'number' === typeof raw['accepted'] ? raw['accepted'] : 0;
@@ -92,6 +98,16 @@ function partResult(body, part) {
  * Split runs into requests bounded by count and by serialized size. A run bigger than the byte
  * bound on its own still goes, alone: it cannot be split, and holding it back would hide it.
  */
+/** The delivery record, kept only for the runs still on disk — the same bound as `sentRunIds`. */
+function heldHashes(runs, recorded) {
+    const out = {};
+    for (const { runId } of runs) {
+        const hash = recorded[runId];
+        if (hash !== undefined)
+            out[runId] = hash;
+    }
+    return out;
+}
 function batchRuns(runs) {
     const batches = [];
     let current = [];
@@ -194,8 +210,21 @@ export async function runSyncCycle(deps) {
         const priorRefusals = isRecord(deps.state.refusedRuns) ? deps.state.refusedRuns : {};
         const refusedRuns = {};
         const notRetried = [];
+        // Same rule as every record read from disk: only a string can equal a hash we computed.
+        const recorded = {};
+        if (isRecord(deps.state.sentRunHashes))
+            for (const [id, hash] of Object.entries(deps.state.sentRunHashes))
+                if ('string' === typeof hash)
+                    recorded[id] = hash;
+        /*
+         * Changed means no record, or a record that differs. No record has to count: a machine upgraded
+         * onto this can hold runs the server has only in an older version, and a tab that has closed
+         * never changes again to earn a re-send. So each such run is
+         * sent once and recorded, a one-time cost bounded by what retention keeps.
+         */
+        const delivered = (run) => known.has(run.runId) && recorded[run.runId] === hashPayload(run.payload);
         const unsent = allRuns.filter((run) => {
-            if (known.has(run.runId))
+            if (delivered(run))
                 return false;
             const prior = priorRefusals[run.runId];
             const unchanged = prior !== undefined &&
@@ -298,6 +327,13 @@ export async function runSyncCycle(deps) {
                 break;
             }
             const answer = isRecord(pushed.json) ? pushed.json : {};
+            // Runs were sent and the answer says nothing about them: a proxy's 200 page, an empty body.
+            // Delivered means the server said so. Recording them as sent here dropped them for good while
+            // the cycle reported ok; they stay queued, and the reason is the cycle's error.
+            if (batch.length > 0 && !isRecord(answer['runs'])) {
+                pushError = MSG_RUNS_UNCONFIRMED;
+                break;
+            }
             const runs = partResult(answer, 'runs');
             runsSent += runs.accepted;
             // Accepted means the server has it. A rejected run was refused by index, so it is exactly as
@@ -305,8 +341,10 @@ export async function runSyncCycle(deps) {
             const refusedHere = new Map(runs.rejected.map((r) => [r.index, r.reason]));
             batch.forEach((run, index) => {
                 const reason = refusedHere.get(index);
-                if (reason === undefined)
+                if (reason === undefined) {
                     known.add(run.runId);
+                    recorded[run.runId] = hashPayload(run.payload);
+                }
                 else
                     refusedRuns[run.runId] = { reason, payloadHash: hashPayload(run.payload), acceptsHash };
             });
@@ -369,6 +407,7 @@ export async function runSyncCycle(deps) {
         nextState.refusedSets = refusedSets;
         if (pushError !== undefined) {
             nextState.sentRunIds = allRuns.map((r) => r.runId).filter((id) => known.has(id));
+            nextState.sentRunHashes = heldHashes(allRuns, recorded);
             deps.sink.writeState({ ...nextState, lastError: pushError });
             return {
                 ...empty,
@@ -389,6 +428,7 @@ export async function runSyncCycle(deps) {
          * will never be attempted — so the record follows the artifacts and needs no number of its own.
          */
         nextState.sentRunIds = allRuns.map((r) => r.runId).filter((id) => known.has(id));
+        nextState.sentRunHashes = heldHashes(allRuns, recorded);
         // 3. COLLECT — always, even when there was nothing to send.
         const query = nextState.cursor === undefined ? '' : `?since=${encodeURIComponent(nextState.cursor)}`;
         const pull = await call(`${SYNC_PULL_PATH}${query}`);

package/dist/memory/cloud/sync-daemon.js

@@ -21,6 +21,7 @@
  * laptop on a train would otherwise fill the log with the same line four hundred times and teach
  * everyone to ignore it.
  */
+import { syncRequest } from './cloud-sync.js';
 import { log } from '../../log.js';
 import { emitSyncHook } from '../../hooks/hook-emit.js';
 import { describeSync, runSyncCycle } from './sync-cycle.js';
@@ -69,10 +70,7 @@ const movedAnything = (report) => report.runsSent > 0 ||
     report.capsulesSent > 0 ||
     report.derivedSent.length > 0 ||
     report.pulled > 0;
-const defaultRequest = async (url, init) => {
-    const res = await fetch(url, init);
-    return { status: res.status, text: await res.text() };
-};
+const defaultRequest = (url, init) => syncRequest(url, init);
 /**
  * Start the loop. Safe to call for an UNLINKED project: it resolves the link on every tick and does
  * nothing until one appears, which is what lets `reticle link` take effect without a restart.
@@ -147,7 +145,11 @@ export function startSyncDaemon(deps) {
                 continue;
             try {
                 const cloud = await cloudFor(root);
-                if (null === cloud.config)
+                // Linked HERE, by its own link file. An unlinked root resolves to the environment's key,
+                // which is the right answer for the root this daemon stands in and somebody else's project
+                // for every other one: a daemon started with RETICLE_API_KEY pushed every project this
+                // machine had seen into that one, a status and a pull per root on every cycle.
+                if (null === cloud.config || null === cloud.projectId)
                     continue;
                 const report = await pushRoot(root, cloud);
                 if (report === undefined)

package/dist/memory/cloud/sync-disk.d.ts

@@ -1,4 +1,4 @@
-import type { CloudSyncState, PulledIssues, SyncSink, SyncSource } from './sync-cycle.js';
+import { type CloudSyncState, type PulledIssues, type SyncSink, type SyncSource } from './sync-cycle.js';
 /** What the cycle reads, backed by a real `.reticle` directory. */
 export declare function diskSource(reticleRoot: string): SyncSource;
 /** What the cycle writes back into `.reticle/`. */

package/dist/memory/cloud/sync-disk.js

@@ -10,9 +10,11 @@
  * one unsynced record, not a crashed sync. There is no state here worth defending against a parse
  * error — the file will be rewritten on the next tool call anyway.
  */
+import { shareableRun } from '@reticlehq/core/artifacts';
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync, } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { IntentDir, ReticleDir } from '@reticlehq/core';
+import { DERIVED_RECORDS, } from './sync-cycle.js';
 import { subjectFor } from '../intent/intent-subject.js';
 const JSON_SUFFIX = '.json';
 /** Read + parse, or undefined for absent/unreadable/malformed. Never throws. */
@@ -79,13 +81,7 @@ function readFlows(root) {
         return [];
     }
 }
-const DERIVED_FILE = {
-    impact: ReticleDir.IMPACT_FILE,
-    flake: ReticleDir.FLAKE_FILE,
-    intent: ReticleDir.INTENT_FILE,
-    envelopes: ReticleDir.ENVELOPES_FILE,
-    'assertion-tiers': ReticleDir.TIERS_FILE,
-};
+const DERIVED_FILE = Object.fromEntries(DERIVED_RECORDS.map((record) => [record.kind, record.file]));
 /** The directory the sharded intent store writes into, beside the legacy flat file. */
 const INTENT_SUBDIR = ReticleDir.INTENT_SUBDIR;
 const INTENT_INDEX = IntentDir.INDEX_FILE;
@@ -170,7 +166,8 @@ export function diskSource(reticleRoot) {
         runs: () => readJsonDir(join(reticleRoot, ReticleDir.RUNS_SUBDIR))
             .map((payload) => {
             const id = payload?.runId;
-            return 'string' === typeof id ? { runId: id, payload } : undefined;
+            // The prompt context leaves the machine only when the project opted in.
+            return 'string' === typeof id ? { runId: id, payload: shareableRun(payload) } : undefined;
         })
             // A run artifact with no id cannot be diffed against the server's list, so sending it would
             // mean re-sending it every cycle forever. Dropped rather than uploaded repeatedly.

package/dist/memory/impact/account-watch.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Repaint the HUD when sign-in or a project link changes on disk.
+ *
+ * The impact snapshot already reads both files fresh, but it is only PUSHED when a tab attaches,
+ * a tool call lands, or the HUD's own Sign in completes. `reticle logout` and `reticle link` run in
+ * another process, so neither caused a push: a signed-out machine kept showing the old name, and a
+ * freshly linked project kept saying "Not linked", until somebody reloaded or drove something.
+ *
+ * ponytail: stat polling (`fs.watchFile`), not `fs.watch`. It works on a file that does not exist
+ * yet — the usual state of `cloud.json` before a link — and costs one stat per file per interval.
+ */
+/** How often each watched file is stat'ed. A second reads as live to somebody switching windows. */
+export declare const ACCOUNT_WATCH_INTERVAL_MS = 1000;
+export interface AccountFilesWatch {
+    /** Start watching one file. Watching the same path twice is a no-op. */
+    watch(path: string): void;
+    close(): void;
+}
+export declare function watchAccountFiles(onChange: () => void, intervalMs?: number): AccountFilesWatch;

package/dist/memory/impact/account-watch.js

@@ -0,0 +1,34 @@
+/**
+ * Repaint the HUD when sign-in or a project link changes on disk.
+ *
+ * The impact snapshot already reads both files fresh, but it is only PUSHED when a tab attaches,
+ * a tool call lands, or the HUD's own Sign in completes. `reticle logout` and `reticle link` run in
+ * another process, so neither caused a push: a signed-out machine kept showing the old name, and a
+ * freshly linked project kept saying "Not linked", until somebody reloaded or drove something.
+ *
+ * ponytail: stat polling (`fs.watchFile`), not `fs.watch`. It works on a file that does not exist
+ * yet — the usual state of `cloud.json` before a link — and costs one stat per file per interval.
+ */
+import { unwatchFile, watchFile } from 'node:fs';
+/** How often each watched file is stat'ed. A second reads as live to somebody switching windows. */
+export const ACCOUNT_WATCH_INTERVAL_MS = 1_000;
+export function watchAccountFiles(onChange, intervalMs = ACCOUNT_WATCH_INTERVAL_MS) {
+    const watched = new Set();
+    const listener = () => {
+        onChange();
+    };
+    return {
+        watch(path) {
+            if (watched.has(path))
+                return;
+            watched.add(path);
+            // Not persistent: a watcher must never be the reason a daemon cannot exit.
+            watchFile(path, { persistent: false, interval: intervalMs }, listener);
+        },
+        close() {
+            for (const path of watched)
+                unwatchFile(path, listener);
+            watched.clear();
+        },
+    };
+}

package/dist/memory/impact/impact-recorder.d.ts

@@ -16,9 +16,17 @@ export declare function initImpact(opts: {
      * directory may not reach for it. The daemon owns both sides.
      */
     config?: ConfigSource;
+    /** Resolve credentials per project when one daemon serves multiple linked apps. */
+    configForRoot?: (root: string) => ConfigSource;
+    /** Reticle Coverage for a project root, supplied by the daemon (the ledger is a feature's). */
+    coverageForRoot?: (root: string) => () => Record<string, number> | undefined;
     reticleRoot: string | undefined;
     projectName?: string;
     now?: () => number;
+    /** Where the machine-wide `~/.reticle` lives. Tests pass a temp dir so they never write the real one. */
+    globalRoot?: string;
+    /** This build's version, for HUD notices that need a newer SDK. */
+    sdkVersion?: string;
 }): ImpactStore | undefined;
 /** The live store for a root (default when omitted), if one has been initialised. */
 export declare function impactStore(root?: string): ImpactStore | undefined;

package/dist/memory/impact/impact-recorder.js

@@ -31,7 +31,13 @@ function storeFor(root) {
         return undefined;
     let found = stores.get(key);
     if (found === undefined) {
-        found = new ImpactStore({ ...storeOpts, reticleRoot: key });
+        const { configForRoot, coverageForRoot, ...opts } = storeOpts;
+        found = new ImpactStore({
+            ...opts,
+            ...(configForRoot === undefined ? {} : { config: configForRoot(key) }),
+            ...(coverageForRoot === undefined ? {} : { coverage: coverageForRoot(key) }),
+            reticleRoot: key,
+        });
         stores.set(key, found);
     }
     return found;
@@ -50,11 +56,15 @@ export function initImpact(opts) {
         return storeFor(undefined);
     if (defaultRoot === undefined) {
         defaultRoot = opts.reticleRoot;
-        const { projectName, now, config } = opts;
+        const { projectName, now, config, configForRoot, coverageForRoot, globalRoot, sdkVersion } = opts;
         storeOpts = {
             ...(projectName === undefined ? {} : { projectName }),
             ...(now === undefined ? {} : { now }),
+            ...(globalRoot === undefined ? {} : { globalRoot }),
+            ...(sdkVersion === undefined ? {} : { sdkVersion }),
             ...(config === undefined ? {} : { config }),
+            ...(configForRoot === undefined ? {} : { configForRoot }),
+            ...(coverageForRoot === undefined ? {} : { coverageForRoot }),
         };
     }
     return storeFor(opts.reticleRoot);

package/dist/memory/impact/impact-store.d.ts

@@ -1,5 +1,6 @@
 import { type OfferSource } from '../cloud/harness-offer.js';
 import type { ConfigSource } from '../cloud/harness-config.js';
+import { type NoticesSource } from '../cloud/hud-notices-source.js';
 import { type ImpactCounts, type ImpactDefect, type AccountState, type ImpactScope, type ImpactSnapshot } from '@reticlehq/core';
 /** Read a scope, tolerating absence and corruption: a broken file starts over rather than throwing. */
 export declare function readScope(path: string, now: number): ImpactScope;
@@ -23,6 +24,15 @@ export interface ImpactFoldMeta {
 }
 /** Fold one delta into a scope: totals, today's bucket, records and streak. Pure. */
 export declare function applyDelta(scope: ImpactScope, delta: Partial<ImpactCounts>, now: number, meta?: ImpactFoldMeta): ImpactScope;
+/**
+ * All time, never smaller than the project being looked at.
+ *
+ * The two scopes live in different files: the project's in its `.reticle`, the machine's in the
+ * home directory. A project whose history began before this machine's ledger (an upgrade, a new
+ * laptop, a moved checkout) showed more under "This project" than under "All time", which no reader
+ * can believe. The machine has done at least what any one of its projects has.
+ */
+export declare function atLeastProject(global: ImpactScope, project: ImpactScope): ImpactScope;
 /**
  * The live impact record for one project.
  *
@@ -42,6 +52,12 @@ export declare class ImpactStore {
         /** Where the workspace stands with the free harness offer. Injected so no test touches a network. */
         offer?: OfferSource;
         config?: ConfigSource;
+        /** The HUD rail's notices. Defaults to the daemon's cached copy of the published file. */
+        notices?: NoticesSource;
+        /** This build's version, for notices that need a newer SDK. Passed in: the store reads no package. */
+        sdkVersion?: string;
+        /** Reticle Coverage per level, as percentages. Injected: the ledger lives in `features/exhaust`. */
+        coverage?: () => Record<string, number> | undefined;
     });
     /** Notified after every fold, so the HUD can be pushed a fresh snapshot. */
     onChange(fn: () => void): void;

package/dist/memory/impact/impact-store.js

@@ -1,23 +1,25 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { describeSync, overallStatus, readSyncSummary } from '../project/sync-status.js';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { readAccountState } from '../cloud/account-state.js';
 import { harnessOfferSource } from '../cloud/harness-offer.js';
+import { hudNoticesSource } from '../cloud/hud-notices-source.js';
+import { selectNotices } from '@reticlehq/core/hud';
 import { ReticleDir, IMPACT_DAILY_BUCKETS, IMPACT_DEFECT_LIMIT, IMPACT_SCHEMA_VERSION, ImpactScopeSchema, addImpactCounts, emptyImpactCounts, emptyImpactRecords, estimateImpactSavings, } from '@reticlehq/core';
 /**
  * Where Reticle keeps the record of what it has done for you.
  *
- * Two scopes, two files, both local and never uploaded: the project's own `.reticle/impact.json`,
- * and a machine-wide `~/.reticle/impact.json` that answers "what has Reticle done for me overall"
- * across every app you have instrumented.
+ * Two scopes, two files: the project's own `.reticle/impact.json`, and a machine-wide
+ * `~/.reticle/impact.json` that answers "what has Reticle done for me overall" across every app you
+ * have instrumented.
  *
- * This is NOT telemetry. Telemetry answers our questions about the product and leaves the machine;
- * this answers the user's question about their own work and never does.
+ * This is NOT telemetry. Telemetry answers our questions about the product; this answers the user's
+ * question about their own work. A linked project's record syncs to that user's own dashboard (the
+ * sync cycle's `impact` kind); the machine-wide record never leaves the machine.
  */
 /** Writes are debounced: a verification loop is 50-200 calls, and each one is a counter bump. */
 const WRITE_DEBOUNCE_MS = 800;
-/** The project's cloud binding, written by `reticle link`. Absent for an unlinked project. */
-const CLOUD_LINK_FILE = 'cloud.json';
 /**
  * `reticleRoot` is the project's own `.reticle` directory (what every other store here is handed);
  * the global scope lives beside the daemon's own state in `~/.reticle`.
@@ -42,7 +44,7 @@ function impactPaths(reticleRoot, globalRoot) {
  */
 function readDashboardUrl(reticleRoot) {
     try {
-        const raw = JSON.parse(readFileSync(join(reticleRoot, CLOUD_LINK_FILE), 'utf8'));
+        const raw = JSON.parse(readFileSync(join(reticleRoot, ReticleDir.CLOUD_LINK_FILE), 'utf8'));
         if ('object' !== typeof raw || null === raw)
             return undefined;
         const value = raw['dashboardUrl'];
@@ -92,6 +94,12 @@ function writeScope(path, scope) {
         // memory and the next write attempt carries them.
     }
 }
+/** The daemon's cached copy of the HUD notices file, beside the machine-wide impact record. */
+const HUD_NOTICES_CACHE_FILE = 'hud-notices.json';
+/** How long a sync status is reused before it is read again. */
+const SYNC_STATUS_EVERY_MS = 10_000;
+/** When the caller did not say which build this is: matches only notices with no `minSdk`. */
+const UNKNOWN_SDK_VERSION = '0.0.0';
 /** YYYY-MM-DD in local time - the day boundary a person recognises, not UTC's. */
 export function isoDay(now) {
     const d = new Date(now);
@@ -105,33 +113,55 @@ function isNextDay(a, b) {
     const next = new Date(`${b}T00:00:00`);
     return 1 === Math.round((next.getTime() - prev.getTime()) / 86_400_000);
 }
+/**
+ * Consecutive days ending at the newest recorded day, read from the days themselves.
+ *
+ * It was a counter bumped when a fold opened a new day and compared only with the bucket before it,
+ * so one stray day in between (a late flush from another daemon, a writer with a frozen clock) reset
+ * it to 1. Counting back from the newest date means no out-of-order write can shorten it.
+ */
+function streakEndingAtLatest(sortedDates) {
+    let streak = 0;
+    let later;
+    for (let i = sortedDates.length - 1; i >= 0; i -= 1) {
+        const date = sortedDates[i];
+        if (date === undefined)
+            break;
+        if (later !== undefined && !isNextDay(date, later))
+            break;
+        streak += 1;
+        later = date;
+    }
+    return streak;
+}
 /** Fold one delta into a scope: totals, today's bucket, records and streak. Pure. */
 export function applyDelta(scope, delta, now, meta = {}) {
     const today = isoDay(now);
     const counts = addImpactCounts(scope.counts, delta);
-    const days = scope.days.slice();
-    const last = days[days.length - 1];
-    if (last !== undefined && last.date === today) {
-        days[days.length - 1] = { date: today, counts: addImpactCounts(last.counts, delta) };
-    }
-    else {
-        days.push({ date: today, counts: addImpactCounts(emptyImpactCounts(), delta) });
+    // One bucket per date, wherever the delta's date falls. The machine-wide record has many writers
+    // and a late flush carries an older date, so "the last bucket is today" is not something a fold
+    // may assume — appending on that assumption duplicated dates and put them out of order.
+    const byDate = new Map();
+    for (const day of scope.days) {
+        byDate.set(day.date, addImpactCounts(byDate.get(day.date) ?? emptyImpactCounts(), day.counts));
     }
+    const todayCounts = addImpactCounts(byDate.get(today) ?? emptyImpactCounts(), delta);
+    byDate.set(today, todayCounts);
+    const dates = [...byDate.keys()].sort();
+    const days = dates.map((date) => ({ date, counts: byDate.get(date) ?? emptyImpactCounts() }));
     while (days.length > IMPACT_DAILY_BUCKETS)
         days.shift();
-    const todayCounts = days[days.length - 1]?.counts ?? emptyImpactCounts();
-    const previousDay = days[days.length - 2];
     const records = { ...scope.records };
     records.bestVerdictDay = Math.max(records.bestVerdictDay, todayCounts.verdicts);
     records.bestDefectDay = Math.max(records.bestDefectDay, todayCounts.failed);
-    if (last === undefined || last.date !== today) {
-        // A new day joins the streak only if it follows yesterday; otherwise it starts a new one.
-        records.streakDays =
-            previousDay !== undefined && isNextDay(previousDay.date, today) ? records.streakDays + 1 : 1;
-    }
-    else if (0 === records.streakDays) {
-        records.streakDays = 1;
-    }
+    // The window keeps IMPACT_DAILY_BUCKETS days, so a streak longer than it cannot be read off the
+    // dates alone: when the whole window is one unbroken run, it continues the streak already held.
+    const inWindow = streakEndingAtLatest(dates);
+    const unbroken = inWindow === dates.length && scope.days.length >= IMPACT_DAILY_BUCKETS;
+    const newDay = !scope.days.some((day) => day.date === today);
+    records.streakDays = unbroken
+        ? Math.max(inWindow, scope.records.streakDays + (newDay ? 1 : 0))
+        : inWindow;
     records.bestStreakDays = Math.max(records.bestStreakDays, records.streakDays);
     records.longestRunMs = Math.max(records.longestRunMs, meta.runMs ?? 0);
     /*
@@ -150,6 +180,41 @@ export function applyDelta(scope, delta, now, meta = {}) {
         defects,
     };
 }
+/** The larger of two counters, key by key. */
+function maxEach(a, b) {
+    const out = { ...a };
+    for (const key of Object.keys(b))
+        out[key] = Math.max(a[key] ?? 0, b[key] ?? 0);
+    return out;
+}
+/**
+ * All time, never smaller than the project being looked at.
+ *
+ * The two scopes live in different files: the project's in its `.reticle`, the machine's in the
+ * home directory. A project whose history began before this machine's ledger (an upgrade, a new
+ * laptop, a moved checkout) showed more under "This project" than under "All time", which no reader
+ * can believe. The machine has done at least what any one of its projects has.
+ */
+export function atLeastProject(global, project) {
+    // The earlier of the two starts; zero is "never recorded", not the epoch.
+    const starts = [global.since, project.since].filter((t) => 0 < t);
+    return {
+        ...global,
+        counts: maxEach(global.counts, project.counts),
+        records: maxEach(global.records, project.records),
+        savings: {
+            tokens: {
+                ...global.savings.tokens,
+                value: Math.max(global.savings.tokens.value, project.savings.tokens.value),
+            },
+            minutes: {
+                ...global.savings.minutes,
+                value: Math.max(global.savings.minutes.value, project.savings.minutes.value),
+            },
+        },
+        since: 0 === starts.length ? 0 : Math.min(...starts),
+    };
+}
 /**
  * The live impact record for one project.
  *
@@ -158,6 +223,9 @@ export function applyDelta(scope, delta, now, meta = {}) {
  */
 export class ImpactStore {
     #paths;
+    #root;
+    /** The sync status, re-read at most every SYNC_STATUS_EVERY_MS: it reads every run file. */
+    #sync;
     #now;
     #projectName;
     #dashboardUrl;
@@ -178,7 +246,11 @@ export class ImpactStore {
     /** Where this workspace stands with the free harness offer. Cached; see harness-offer.ts. */
     #offer;
     #config;
+    #notices;
+    #sdkVersion;
+    #coverage;
     constructor(opts) {
+        this.#coverage = opts.coverage;
         this.#paths = impactPaths(opts.reticleRoot, opts.globalRoot ?? homedir());
         // Resolved per snapshot, not cached: a user who runs `reticle login` in another terminal must
         // see the HUD change without restarting the daemon that is watching their app.
@@ -186,9 +258,16 @@ export class ImpactStore {
         this.#now = opts.now ?? (() => Date.now());
         this.#projectName = opts.projectName;
         this.#dashboardUrl = readDashboardUrl(opts.reticleRoot);
+        this.#root = opts.reticleRoot;
         // The claim happens in the console, so the link this project was linked to IS the claim link —
         // built here rather than in the HUD, which has no way to know where this project points.
         this.#offer = opts.offer ?? harnessOfferSource(process.env, () => this.#dashboardUrl);
+        this.#notices =
+            opts.notices ??
+                hudNoticesSource({
+                    cacheFile: join(opts.globalRoot ?? homedir(), ReticleDir.ROOT, HUD_NOTICES_CACHE_FILE),
+                });
+        this.#sdkVersion = opts.sdkVersion ?? UNKNOWN_SDK_VERSION;
         // No default: the loader lives in `features/harness` and this file may not reach for it.
         // A store built without one simply reports no harness config, which the HUD renders as no row.
         this.#config = opts.config ?? { read: () => undefined };
@@ -196,6 +275,23 @@ export class ImpactStore {
         this.#project = readScope(this.#paths.project, now);
         this.#global = readScope(this.#paths.global, now);
     }
+    #syncStatus() {
+        const now = this.#now();
+        if (this.#sync !== undefined && now - this.#sync.at < SYNC_STATUS_EVERY_MS)
+            return this.#sync.value;
+        const summary = readSyncSummary(this.#root, true);
+        const value = {
+            status: overallStatus(summary),
+            runs: summary.runs,
+            onPlatform: summary.onPlatform,
+            pending: summary.pending,
+            refused: summary.refused.length + summary.refusedMore,
+            ...(summary.lastPushAt === undefined ? {} : { lastPushAt: summary.lastPushAt }),
+            said: describeSync(summary, now),
+        };
+        this.#sync = { at: now, value };
+        return value;
+    }
     /** Notified after every fold, so the HUD can be pushed a fresh snapshot. */
     onChange(fn) {
         this.#onChange = fn;
@@ -214,10 +310,13 @@ export class ImpactStore {
         const snap = {
             schemaVersion: IMPACT_SCHEMA_VERSION,
             project: this.#project,
-            global: this.#global,
+            global: atLeastProject(this.#global, this.#project),
         };
         if (this.#projectName !== undefined)
             snap.projectName = this.#projectName;
+        // Re-read, like the account: `reticle link` runs in another terminal while this store lives as
+        // long as the daemon, so a construction-time read said "Not linked" until a restart.
+        this.#dashboardUrl = readDashboardUrl(this.#root);
         if (this.#dashboardUrl !== undefined)
             snap.dashboardUrl = this.#dashboardUrl;
         snap.account = this.#account();
@@ -236,6 +335,23 @@ export class ImpactStore {
         const cfg = this.#config.read();
         if (cfg !== undefined)
             snap.harnessConfig = cfg;
+        // Chosen here, where the account and the entitlement are both known. Absent when nothing applies,
+        // so the HUD falls back to the slides bundled with the SDK.
+        const notices = selectNotices(this.#notices.read(), {
+            signedIn: snap.account?.signedIn,
+            entitled: cfg?.harnessEntitled,
+            sdkVersion: this.#sdkVersion,
+            now: this.#now(),
+        });
+        if (0 < notices.length)
+            snap.notices = notices;
+        const coverage = this.#coverage?.();
+        if (coverage !== undefined)
+            snap.coverage = coverage;
+        // Only for a linked project: an unlinked one has nothing on the platform, and the HUD already
+        // offers the way to link it.
+        if (this.#dashboardUrl !== undefined)
+            snap.sync = this.#syncStatus();
         return snap;
     }
     /** Write now (process exit, tests). */