@indigoai-us/hq-cloud 6.14.0 → 6.14.2

package/src/bin/sync-runner.test.ts

@@ -21,6 +21,7 @@ import {
   buildTargetedPushArgv,
   resolvePullScope,
   readPinnedPrefixes,
+  SESSIONS_SCOPE_PREFIX,
   defaultCollectTelemetry,
 } from "./sync-runner.js";
 import { PresignObjectIO, S3SdkObjectIO } from "../object-io.js";
@@ -36,6 +37,7 @@ import { PERSONAL_VAULT_JOURNAL_SLUG } from "../journal.js";
 import { HQ_CLOUD_VERSION } from "../version.js";
 import { lockPathFor, OPERATION_LOCKED_EXIT } from "../operation-lock.js";
 import { TRANSIENT_NETWORK_EXIT } from "../lib/net-errors.js";
+import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
 import { isCoveredByAny } from "../prefix-coalesce.js";
 import type { SyncResult, SyncOptions } from "../cli/sync.js";
 import type { ShareResult, ShareOptions } from "../cli/share.js";
@@ -43,6 +45,7 @@ import type {
   Membership,
   EntityInfo,
   PendingInviteByEmail,
+  TelemetryEventsBatch,
 } from "../vault-client.js";
 import { VaultAuthError } from "../vault-client.js";
 import type { PushEvent } from "../sync/push-event.js";
@@ -1601,6 +1604,60 @@ describe("all-complete aggregate", () => {
     expect(deps.stderr.raw()).toContain("runner.telemetry.timeout");
   });
 
+  it("emits action telemetry for completion and telemetry transport failure does not block completion", async () => {
+    const posts: TelemetryEventsBatch[] = [];
+    const client: VaultClientSurface = {
+      ...makeVaultStub({
+        memberships: [{ companyUid: "cmp_a" }],
+        entityGet: (uid: string) =>
+          Promise.resolve({ uid, slug: "acme" } as unknown as EntityInfo),
+      }),
+      postTelemetryEvents: vi.fn(async (batch) => {
+        posts.push(batch);
+        throw new Error("telemetry transport down");
+      }),
+    };
+    const deps = makeDeps({
+      createVaultClient: () => client,
+      collectTelemetry: vi.fn().mockResolvedValue(undefined),
+      sync: vi
+        .fn<(opts: SyncOptions) => Promise<SyncResult>>()
+        .mockResolvedValue(
+          defaultSyncResult({
+            filesDownloaded: 2,
+            bytesDownloaded: 300,
+          }),
+        ),
+    });
+
+    const code = await runRunner(["--companies"], deps);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(code).toBe(0);
+    expect(deps.stdout.events().some((e) => e.type === "all-complete")).toBe(
+      true,
+    );
+    const completed = posts
+      .flatMap((post) => post.events)
+      .find((event) => event.eventName === "sync_runner_completed");
+    expect(completed).toMatchObject({
+      app: "hq-cloud",
+      source: "sync-runner",
+      schemaVersion: 1,
+      properties: {
+        result: "completed",
+        attemptedCount: 1,
+        companyCount: 1,
+        errorCount: 0,
+        filesDownloaded: 2,
+        bytesDownloaded: 300,
+        filesUploaded: 0,
+        bytesUploaded: 0,
+      },
+    });
+    expect(deps.stderr.raw()).toContain("runner.telemetry_events.nonfatal");
+  });
+
   it("sums filesDownloaded and bytesDownloaded across all companies", async () => {
     const slugs: Record<string, string> = { cmp_a: "acme", cmp_b: "beta" };
     const deps = makeDeps({
@@ -2407,6 +2464,13 @@ describe("personal slot fanout", () => {
       const keys = Object.keys(args);
       expect(keys).not.toContain("personalMode");
       expect(keys).not.toContain("journalSlug");
+      // Positive assertion on the runner→sync() glue (sync-runner-company.ts:278):
+      // the push-only sessions exclusion IS threaded into the company pull leg.
+      // The ABSENT-key checks above would still pass if a regression dropped the
+      // `...(excludePrefixes.length > 0 ? { excludePrefixes } : {})` spread or
+      // flipped its guard — silently re-enabling full session pulls. Pin the
+      // exact leak against the exported constant, not a string literal.
+      expect(args.excludePrefixes).toEqual([SESSIONS_SCOPE_PREFIX]);
     }
   });
 
@@ -3504,9 +3568,9 @@ describe("runRunnerWithLoop — event-push wiring", () => {
     expect(clock.pendingTimerCount()).toBe(0);
   });
 
-  it("a non-zero poll pass exit returns immediately (hard error surfaces)", async () => {
+  it("a hard-error (exit 1) poll pass returns immediately", async () => {
     const watcher = makeWatcherStub();
-    const runPass = vi.fn().mockResolvedValue(2);
+    const runPass = vi.fn().mockResolvedValue(1);
 
     const code = await runRunnerWithLoop(
       ["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"],
@@ -3518,7 +3582,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         onShutdownSignal: () => () => {},
       },
     );
-    expect(code).toBe(2);
+    expect(code).toBe(1);
     expect(watcher.disposed).toBe(true);
   });
 
@@ -3533,7 +3597,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
       n++;
       // First pass: machine is offline (transient). Second pass: a real hard
       // error, used here only to end the otherwise-infinite loop deterministically.
-      return n === 1 ? TRANSIENT_NETWORK_EXIT : 2;
+      return n === 1 ? TRANSIENT_NETWORK_EXIT : 1;
     });
 
     const code = await runRunnerWithLoop(
@@ -3550,11 +3614,47 @@ describe("runRunnerWithLoop — event-push wiring", () => {
     // The transient pass did NOT end the loop — it ran again…
     expect(runPass).toHaveBeenCalledTimes(2);
     // …and the transient code was never surfaced as the watcher's exit code.
-    expect(code).toBe(2);
+    expect(code).toBe(1);
     expect(code).not.toBe(TRANSIENT_NETWORK_EXIT);
     expect(watcher.disposed).toBe(true);
   });
 
+  it("a PARTIAL_SYNC_EXIT poll pass does NOT surface as a crash — the loop retries", async () => {
+    // A partial pass (some per-file transfers threw: oversized object on an
+    // old runner, presign denial, expired token, corrupt vault key) must keep
+    // the watcher alive. Exiting on it got the watcher hot-respawned by the
+    // menubar supervisor and Sentry-captured on EVERY failing pass — the
+    // July 2026 "watcher exited unexpectedly (code=Some(2))" alert flood. The
+    // per-file errors still surface via ndjson `error` events; the loop logs
+    // and retries next tick. A one-shot `hq sync` still exits 2.
+    const watcher = makeWatcherStub();
+    let n = 0;
+    const runPass = vi.fn().mockImplementation(async () => {
+      n++;
+      // Two partial passes prove a DETERMINISTIC per-file failure doesn't kill
+      // the loop either. A hard error then ends the otherwise-infinite loop.
+      return n <= 2 ? PARTIAL_SYNC_EXIT : 1;
+    });
+
+    const code = await runRunnerWithLoop(
+      ["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"],
+      {
+        runPass,
+        clock: new FakeClock(),
+        createWatcher: () => watcher,
+        sleep: () => Promise.resolve(),
+        onShutdownSignal: () => () => {},
+      },
+    );
+
+    // Both partial passes stayed alive — the loop ran a third time…
+    expect(runPass).toHaveBeenCalledTimes(3);
+    // …and the partial code was never surfaced as the watcher's exit code.
+    expect(code).toBe(1);
+    expect(code).not.toBe(PARTIAL_SYNC_EXIT);
+    expect(watcher.disposed).toBe(true);
+  });
+
   it("without --event-push, no watcher is created (poll-only safety net)", async () => {
     let triggerShutdown = () => {};
     const createWatcher = vi.fn(() => makeWatcherStub());
@@ -4208,7 +4308,85 @@ describe("resolvePullScope", () => {
 
   it("returns all when the client has no getMembershipSyncConfig", async () => {
     const scope = await resolvePullScope(stubClient({}), "cmp_a", "acme");
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
+  });
+
+  // US-006 AC4: the sessions prefix is push-only, so `resolvePullScope` stamps
+  // `excludePrefixes: ["sessions/"]` on EVERY return — including `all`
+  // (full-bucket), owner→all, agent→all, shared, and custom. A single missed
+  // return site would silently regress to a full session pull; this test pins
+  // the invariant across every mode the resolver can return.
+  it("stamps the push-only sessions exclusion on EVERY resolved mode (AC4)", async () => {
+    expect(SESSIONS_SCOPE_PREFIX).toBe("sessions/");
+
+    const modes = [
+      // no-client early return → all
+      await resolvePullScope(stubClient({}), "cmp_a", "acme"),
+      // owner role-bypass → all
+      await resolvePullScope(
+        stubClient({
+          listMyMemberships: async () => [ownerMembership("cmp_a", "mk_owner")],
+        }),
+        "cmp_a",
+        "acme",
+      ),
+      // agent membership → all (short-circuit before the always-403 endpoint)
+      await resolvePullScope(
+        stubClient({
+          listMyMemberships: async () => [membership("cmp_a", "agt_9#cmp_a")],
+        }),
+        "cmp_a",
+        "acme",
+      ),
+      // config-all → all
+      await resolvePullScope(
+        stubClient({
+          listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+          getMembershipSyncConfig: async () => ({
+            membershipId: "mk_a",
+            syncMode: "all",
+            isDefault: true,
+          }),
+        }),
+        "cmp_a",
+        "acme",
+      ),
+      // shared
+      await resolvePullScope(
+        stubClient({
+          listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+          getMembershipSyncConfig: async () => ({
+            membershipId: "mk_a",
+            syncMode: "shared",
+            isDefault: false,
+          }),
+          listMyExplicitGrants: async () =>
+            [
+              { companyUid: "cmp_a", path: "knowledge/", permission: "read", source: "person" },
+            ] as never,
+        }),
+        "cmp_a",
+        "acme",
+      ),
+      // custom
+      await resolvePullScope(
+        stubClient({
+          listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+          getMembershipSyncConfig: async () => ({
+            membershipId: "mk_a",
+            syncMode: "custom",
+            customPaths: ["projects/x/"],
+            isDefault: false,
+          }),
+        }),
+        "cmp_a",
+        "acme",
+      ),
+    ];
+
+    for (const scope of modes) {
+      expect(scope.excludePrefixes).toEqual([SESSIONS_SCOPE_PREFIX]);
+    }
   });
 
   // OWNER role-bypass regression (feedback_67bdb8a4 / feedback_a46c3b37).
@@ -4238,7 +4416,7 @@ describe("resolvePullScope", () => {
       "cmp_a",
       "acme",
     );
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     // The short-circuit must fire BEFORE any grant resolution.
     expect(grantsCalled).toBe(false);
   });
@@ -4264,7 +4442,7 @@ describe("resolvePullScope", () => {
     // Even a `custom` row cannot scope an owner below their role on the sync
     // path (the server would 403 their own writes), so `all` wins and the
     // config fetch is never needed.
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
     expect(configCalled).toBe(false);
   });
 
@@ -4285,7 +4463,7 @@ describe("resolvePullScope", () => {
       "cmp_a",
       "acme",
     );
-    expect(scope).toEqual({ syncMode: "shared", prefixSet: ["knowledge/"] });
+    expect(scope).toEqual({ syncMode: "shared", prefixSet: ["knowledge/"], excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   it("returns all for an all-mode membership (no prefixSet)", async () => {
@@ -4301,7 +4479,7 @@ describe("resolvePullScope", () => {
       "cmp_a",
       "acme",
     );
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   it("returns all for an AGENT membership WITHOUT calling sync-config (HQ-1R: agents own no person entity → server 403s the person-gate)", async () => {
@@ -4325,7 +4503,7 @@ describe("resolvePullScope", () => {
       "acme",
     );
     expect(called).toBe(false); // never hit the always-403 endpoint for an agent
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   it("coalesces explicit grants for a shared-mode membership", async () => {
@@ -4445,7 +4623,7 @@ describe("resolvePullScope", () => {
     // A `*` grant = everything. Because coalescePrefixes drops the empty
     // prefix (which would otherwise collapse to "nothing" and prune the
     // tree), an everything-scope resolves to full-access `all`.
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   it("uses customPaths for a custom-mode membership", async () => {
@@ -4480,7 +4658,7 @@ describe("resolvePullScope", () => {
       "cmp_a",
       "acme",
     );
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   it("allows a genuinely-empty shared scope (grants method present, returns [])", async () => {
@@ -4497,7 +4675,7 @@ describe("resolvePullScope", () => {
       "cmp_a",
       "acme",
     );
-    expect(scope).toEqual({ syncMode: "shared", prefixSet: [] });
+    expect(scope).toEqual({ syncMode: "shared", prefixSet: [], excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   it("degrades to all when the membership is not found", async () => {
@@ -4511,7 +4689,7 @@ describe("resolvePullScope", () => {
       "cmp_a",
       "acme",
     );
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   it("degrades to all when sync-config resolution throws (never prune on error)", async () => {
@@ -4525,7 +4703,7 @@ describe("resolvePullScope", () => {
       "cmp_a",
       "acme",
     );
-    expect(scope).toEqual({ syncMode: "all" });
+    expect(scope).toEqual({ syncMode: "all", excludePrefixes: [SESSIONS_SCOPE_PREFIX] });
   });
 
   // ── pin union (Phase C: hq files get) ──────────────────────────────────────

package/src/bin/sync-runner.ts

@@ -59,6 +59,7 @@
 import * as os from "os";
 import * as path from "path";
 import * as fs from "fs";
+import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "url";
 import {
   getValidAccessToken,
@@ -78,6 +79,7 @@ import { pickCanonicalPersonEntity } from "../vault-client.js";
 import {
   resolvePullScope,
   readPinnedPrefixes,
+  SESSIONS_SCOPE_PREFIX,
   type PullScope,
 } from "../sync/pull-scope.js";
 import {
@@ -103,10 +105,15 @@ import {
 import { HQ_CLOUD_VERSION } from "../version.js";
 import { collectAndSendTelemetry } from "../telemetry.js";
 import { collectAndSendSkillTelemetry } from "../skill-telemetry.js";
+import { emitCloudTelemetry } from "../telemetry-events.js";
 import { reindexAfterSync } from "../qmd-reindex.js";
 import type { ReindexOptions as QmdReindexOptions } from "../qmd-reindex.js";
 import { reindex as defaultReindex } from "../cli/reindex.js";
 import type { ReindexOptions, ReindexResult } from "../cli/reindex.js";
+import type {
+  TelemetryEventsBatch,
+  TelemetryEventsIngestResult,
+} from "../vault-client.js";
 import { pruneConflictIndex } from "../lib/conflict-index.js";
 import { materializeCodexAgents } from "../agent-codex-instructions.js";
 import { getOrCreateMachineId } from "../lib/machine-id.js";
@@ -114,6 +121,7 @@ import {
   isTransientNetworkError,
   TRANSIENT_NETWORK_EXIT,
 } from "../lib/net-errors.js";
+import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
 import { describeError } from "../lib/describe-error.js";
 import type { Clock, TreeChangeBatch } from "../watcher.js";
 import type { PushReceiver, SyncEngineFn } from "../sync/push-receiver.js";
@@ -175,7 +183,7 @@ const DEFAULT_COGNITO: CognitoAuthConfig = {
 };
 
 const DEFAULT_VAULT_API_URL =
-  process.env.HQ_VAULT_API_URL ?? "https://hqapi.getindigo.ai";
+  process.env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
 
 const DEFAULT_HQ_ROOT = path.join(os.homedir(), "hq");
 const DEFAULT_TELEMETRY_TIMEOUT_MS = 120_000;
@@ -445,6 +453,10 @@ export interface VaultClientSurface {
   // interface; when absent, `resolvePullScope` degrades to `all`.
   getMembershipSyncConfig?: (membershipId: string) => Promise<MembershipSyncConfig>;
   listMyExplicitGrants?: (companyUid: string) => Promise<ExplicitGrant[]>;
+  postTelemetryEvents?: (
+    batch: TelemetryEventsBatch,
+    options?: { timeoutMs?: number },
+  ) => Promise<TelemetryEventsIngestResult>;
 }
 
 interface RunnerDiagnostic {
@@ -499,7 +511,7 @@ function createRunnerDiagnosticReporter(
 // (hq-cli) share ONE scope resolver — the drift between them was the root
 // cause of the all→shared scope-shrink wedge (DEV-1768). Re-exported here so
 // existing importers (and the runner test suite) keep their import path.
-export { resolvePullScope, readPinnedPrefixes };
+export { resolvePullScope, readPinnedPrefixes, SESSIONS_SCOPE_PREFIX };
 export type { PullScope };
 
 /**
@@ -1123,6 +1135,36 @@ export async function runRunner(
     claims?.sub && claims?.email
       ? { userSub: claims.sub, email: claims.email }
       : undefined;
+  const telemetrySessionId = `sync_${randomUUID()}`;
+  void emitCloudTelemetry(
+    client,
+    {
+      eventName: "sync_runner_session_started",
+      source: "sync-runner",
+      sessionId: telemetrySessionId,
+      properties: {
+        direction: parsed.direction,
+        targetMode: parsed.personal
+          ? "personal"
+          : parsed.company
+            ? "single_company"
+            : "companies",
+        watchState: parsed.watch ? "enabled" : "disabled",
+        eventPushState: parsed.eventPush ? "enabled" : "disabled",
+        scopePathCount: parsed.scopePaths?.length ?? 0,
+      },
+    },
+    {
+      claims,
+      log: (message) =>
+        reportDiagnostic({
+          component: "telemetry-events",
+          event: "runner.telemetry_events.nonfatal",
+          message,
+          context: { source: "sync-runner" },
+        }),
+    },
+  );
 
   // ---- transport selection (presigned-URL for cmp_, direct-S3/STS for prs_) -
   // Company vaults ALWAYS use the presigned-URL transport now (HQ-59): the
@@ -1204,6 +1246,31 @@ export async function runRunner(
   }
   const plan = targetPlan.plan;
 
+  void emitCloudTelemetry(
+    client,
+    {
+      eventName: "sync_runner_plan_built",
+      source: "sync-runner",
+      sessionId: telemetrySessionId,
+      properties: {
+        direction: parsed.direction,
+        targetCount: plan.length,
+        companyCount: plan.filter((target) => target.personalMode !== true).length,
+        personalCount: plan.filter((target) => target.personalMode === true).length,
+      },
+    },
+    {
+      claims,
+      log: (message) =>
+        reportDiagnostic({
+          component: "telemetry-events",
+          event: "runner.telemetry_events.nonfatal",
+          message,
+          context: { source: "sync-runner" },
+        }),
+    },
+  );
+
   emitFanoutPlan(emit, plan);
 
   // One-time seed of the reserved personal-vault journal from the legacy
@@ -1230,16 +1297,45 @@ export async function runRunner(
     resolveDeletePolicy,
     emit,
     scopePaths: parsed.scopePaths,
+    telemetryClient: client,
+    telemetryClaims: claims,
+    telemetrySessionId,
   });
   const { errors, allConflicts } = fanout;
   const rollup = rollupAllComplete(plan, fanout.stateByCompany);
 
   if (rollup.needsReindex) {
     try {
-      (deps.reindex ?? defaultReindex)({
+      const reindexOptions = {
         repoRoot: parsed.hqRoot,
         ...(deps.operationLockAlreadyHeld === true ? { skipLock: true } : {}),
-      });
+      };
+      const reindexResult = (deps.reindex ?? defaultReindex)(reindexOptions);
+      void emitCloudTelemetry(
+        client,
+        {
+          eventName: "reindex_run",
+          source: "sync-runner",
+          sessionId: telemetrySessionId,
+          properties: {
+            result: reindexResult.status === 0 ? "completed" : "failed",
+            statusCode: reindexResult.status,
+            changedCount: rollup.changedPaths.length,
+            lockResult:
+              deps.operationLockAlreadyHeld === true ? "skipped" : "attempted",
+          },
+        },
+        {
+          claims,
+          log: (message) =>
+            reportDiagnostic({
+              component: "telemetry-events",
+              event: "runner.telemetry_events.nonfatal",
+              message,
+              context: { source: "sync-runner" },
+            }),
+        },
+      );
     } catch (err) {
       reportDiagnostic({
         component: "native-reindex",
@@ -1248,6 +1344,30 @@ export async function runRunner(
         err,
         context: { hqRoot: parsed.hqRoot },
       });
+      void emitCloudTelemetry(
+        client,
+        {
+          eventName: "reindex_run",
+          source: "sync-runner",
+          sessionId: telemetrySessionId,
+          properties: {
+            result: "threw",
+            changedCount: rollup.changedPaths.length,
+            lockResult:
+              deps.operationLockAlreadyHeld === true ? "skipped" : "attempted",
+          },
+        },
+        {
+          claims,
+          log: (message) =>
+            reportDiagnostic({
+              component: "telemetry-events",
+              event: "runner.telemetry_events.nonfatal",
+              message,
+              context: { source: "sync-runner" },
+            }),
+        },
+      );
     }
   }
 
@@ -1294,6 +1414,34 @@ export async function runRunner(
     partial: rollup.partial,
     companies: rollup.companies,
   });
+  void emitCloudTelemetry(
+    client,
+    {
+      eventName: "sync_runner_completed",
+      source: "sync-runner",
+      sessionId: telemetrySessionId,
+      properties: {
+        result: rollup.partial ? "partial" : "completed",
+        attemptedCount: plan.length,
+        companyCount: rollup.companies.length,
+        errorCount: errors.length,
+        filesDownloaded: rollup.totalDownloaded,
+        bytesDownloaded: rollup.totalDownloadedBytes,
+        filesUploaded: rollup.totalUploaded,
+        bytesUploaded: rollup.totalUploadedBytes,
+      },
+    },
+    {
+      claims,
+      log: (message) =>
+        reportDiagnostic({
+          component: "telemetry-events",
+          event: "runner.telemetry_events.nonfatal",
+          message,
+          context: { source: "sync-runner" },
+        }),
+    },
+  );
 
   // Post-sync qmd reindex — runs AFTER `all-complete` is emitted so the
   // menubar/CLI already shows the sync as done; this is a best-effort tail
@@ -1304,7 +1452,7 @@ export async function runRunner(
   const qmdChangedPaths = rollup.changedPaths.filter(isKnowledgeMarkdownPath);
   if (qmdChangedPaths.length > 0 && process.env.HQ_QMD_REINDEX_ON_SYNC !== "0") {
     try {
-      (deps.qmdReindex ?? reindexAfterSync)(parsed.hqRoot, {
+      const qmdResult = (deps.qmdReindex ?? reindexAfterSync)(parsed.hqRoot, {
         changedPaths: qmdChangedPaths,
         forceCollectionRefresh: true,
         log: ({ event, message, err, context }) =>
@@ -1316,6 +1464,33 @@ export async function runRunner(
             context: { hqRoot: parsed.hqRoot, ...(context ?? {}) },
           }),
       });
+      void emitCloudTelemetry(
+        client,
+        {
+          eventName: "qmd_reindex_run",
+          source: "sync-runner",
+          sessionId: telemetrySessionId,
+          properties: {
+            result: "completed",
+            changedCount: qmdChangedPaths.length,
+            qmdState: qmdResult.qmdAvailable ? "available" : "unavailable",
+            collectionsAddedCount: qmdResult.collectionsAdded.length,
+            updateState: qmdResult.updated ? "updated" : "unchanged",
+            embedState: qmdResult.embedded ? "embedded" : "not_embedded",
+            dirtyState: qmdResult.pendingDirty ? "pending_dirty" : "clean",
+          },
+        },
+        {
+          claims,
+          log: (message) =>
+            reportDiagnostic({
+              component: "telemetry-events",
+              event: "runner.telemetry_events.nonfatal",
+              message,
+              context: { source: "sync-runner" },
+            }),
+        },
+      );
     } catch (err) {
       reportDiagnostic({
         component: "qmd-reindex",
@@ -1325,6 +1500,28 @@ export async function runRunner(
         context: { hqRoot: parsed.hqRoot },
       });
       // Defensive: reindexAfterSync already swallows internally.
+      void emitCloudTelemetry(
+        client,
+        {
+          eventName: "qmd_reindex_run",
+          source: "sync-runner",
+          sessionId: telemetrySessionId,
+          properties: {
+            result: "threw",
+            changedCount: qmdChangedPaths.length,
+          },
+        },
+        {
+          claims,
+          log: (message) =>
+            reportDiagnostic({
+              component: "telemetry-events",
+              event: "runner.telemetry_events.nonfatal",
+              message,
+              context: { source: "sync-runner" },
+            }),
+        },
+      );
     }
   }
 
@@ -1392,12 +1589,13 @@ export async function runRunner(
     }
   }
 
-  // Exit 2 only when something actually threw (`errors.length > 0`). A clean
-  // conflict-abort sets `partial: true` in the JSON but exits 0 — the Tauri
-  // menubar's non-zero-exit Sentry capture would otherwise fire for normal
-  // user-policy outcomes. Consumers that want to flag any non-clean outcome
-  // (clean-abort + thrown-error) read `partial` from the JSON.
-  return errors.length > 0 ? 2 : 0;
+  // Exit PARTIAL_SYNC_EXIT (2) only when something actually threw
+  // (`errors.length > 0`). A clean conflict-abort sets `partial: true` in the
+  // JSON but exits 0 — the Tauri menubar's non-zero-exit Sentry capture would
+  // otherwise fire for normal user-policy outcomes. Consumers that want to
+  // flag any non-clean outcome (clean-abort + thrown-error) read `partial`
+  // from the JSON. The watch loop stays alive on this code (see exit-codes.ts).
+  return errors.length > 0 ? PARTIAL_SYNC_EXIT : 0;
 }
 
 // ---------------------------------------------------------------------------