@indigoai-us/hq-cloud 6.14.28 → 6.14.30

package/src/qmd-reindex.ts

@@ -16,48 +16,29 @@
  *
  * What it does, best-effort and idempotent:
  *   1. Auto-registers any `companies/<slug>/knowledge` dir that isn't yet a
- *      qmd collection (kills the manual "map" step).
+ *      qmd collection (kills the manual "map" step). Detects path drift when
+ *      the name exists but points elsewhere; repairs only when
+ *      `HQ_QMD_REPAIR_PATH_DRIFT=1` (non-breaking default: detect-only).
  *   2. Runs an incremental lexical `qmd update` (fast — qmd skips unchanged
  *      files by mtime).
  *   3. Rebuilds embeddings only when `embed: true` (slow on a multi-GB
- *      index; meant for an idle pass, not every sync).
+ *      index; meant for an idle pass, not every sync). Never embeds in the
+ *      same cycle as a path-drift repair (repair drops that collection's
+ *      vectors).
  *
  * The index itself is never synced — it is large, binary, and embeds absolute
  * local paths. Only its *freshness* is automated here.
  *
- * ## Corruption safety (feedback_b9a369ff)
+ * ## Corruption safety (feedback_b9a369ff + feedback_332c7ccc)
  *
- * The qmd store (`.qmd/index.sqlite`, backed by a sqlite-vec virtual table) was
- * being corrupted on the vector side (`content_vectors` / `vectors_vec_rowids`)
- * because TWO uncoordinated writers raced on it: this post-sync reindex and an
- * interactive session's own qmd maintenance (e.g. a skill's `qmd embed`). Two
- * defects compounded:
- *   1. A hard 120s `spawnSync` timeout that KILLED a long `qmd update`/`embed`
- *      mid-write, tearing down the process between vector-table writes.
- *   2. No cross-process serialization, so an interactive `qmd embed` and a
- *      runner-spawned `qmd update` overlapped with near certainty.
- *
- * The mitigations here, all inside the runner so every teammate gets them on
- * their next sync:
- *   - The exec timeout is raised substantially so a legitimate long pass is no
- *     longer killed mid-write in the first place. A timed-out pass is treated as
- *     "not done" (left dirty, retried next cycle) and NEVER advances to embed.
- *     That not-done handling — together with the writer serialization below — is
- *     the real protection; the signal used for the (now rare) kill is secondary.
- *     When the bound does fire the child is sent SIGINT rather than the default
- *     SIGTERM, but qmd 2.5.3 traps both identically (each just restores the
- *     cursor and exits), so this is only the same clean exit path qmd takes on
- *     Ctrl-C — not a guarantee the in-flight SQLite write unwinds.
- *   - A shared advisory lock at `<hqRoot>/.qmd/.reindex.lock` serializes qmd
- *     writers. The runner takes it before touching qmd and SKIPS the cycle (and
- *     marks the tree dirty so the next sync retries) when another writer holds
- *     it. The lock path sits next to the DB so interactive HQ qmd maintenance
- *     can honor the same rendezvous.
- *   - Corruption is detected cheaply from qmd's own output (the SQLITE_CORRUPT
- *     signature). On detection the corrupt DB files are quarantined aside (moved
- *     to `index.sqlite.corrupt-<ts>`, never deleted) and the cycle stops writing
- *     so a clean rebuild happens on the next pass — instead of writing further
- *     onto an already-damaged store.
+ * The qmd store (sqlite-vec) was being corrupted on the vector side because
+ * TWO uncoordinated writers raced on it. Mitigations:
+ *   - Raised exec timeout so legitimate long passes are not killed mid-write.
+ *   - Dual advisory lock: legacy `<hqRoot>/.qmd/.reindex.lock` AND
+ *     `<resolvedIndexDir>/.reindex.lock` (deduped when equal). Default index
+ *     is often `~/.cache/qmd/index.sqlite`, not `<hqRoot>/.qmd`.
+ *   - Corruption quarantine targets the resolved index dir; reports success
+ *     only when files were actually moved.
  */
 
 import * as fs from "fs";
@@ -100,6 +81,53 @@ export function resolveExecTimeoutMs(env: NodeJS.ProcessEnv = process.env): numb
   return DEFAULT_QMD_EXEC_TIMEOUT_MS;
 }
 
+/** Opt-in destructive path-drift repair (remove + re-add). Default off. */
+export function repairPathDriftEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  const raw = (env.HQ_QMD_REPAIR_PATH_DRIFT ?? "").trim().toLowerCase();
+  return raw === "1" || raw === "true" || raw === "yes";
+}
+
+/**
+ * Parse the directory that holds `index.sqlite` from `qmd status` output.
+ * Returns null when the Index line is missing/unparseable.
+ */
+export function parseIndexDirFromStatus(stdout: string): string | null {
+  const m = stdout.match(/^\s*Index:\s*(.+?)\s*$/m);
+  if (!m) return null;
+  const indexFile = m[1].trim();
+  if (!indexFile) return null;
+  return path.dirname(indexFile);
+}
+
+/** Parse `Path:` from `qmd collection show` human output. */
+export function parseCollectionPathFromShow(stdout: string): string | null {
+  const m = stdout.match(/^\s*Path:\s*(.+?)\s*$/m);
+  if (!m) return null;
+  const p = m[1].trim();
+  return p || null;
+}
+
+/** Case-insensitive, trailing-separator-tolerant path equality after realpath. */
+export function pathsEquivalent(
+  a: string,
+  b: string,
+  realpathSync: (p: string) => string = safeRealpathSync,
+): boolean {
+  return normalizePathKey(realpathSync(a)) === normalizePathKey(realpathSync(b));
+}
+
+function normalizePathKey(p: string): string {
+  return path.resolve(p).replace(/[/\\]+$/, "").toLowerCase();
+}
+
+function safeRealpathSync(p: string): string {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
 const defaultExec: QmdExec = (args) => {
   const res = spawnSync("qmd", args, {
     encoding: "utf8",
@@ -268,9 +296,9 @@ const defaultAcquireReindexLock: AcquireReindexLock = (lockPath) => {
       };
     } catch (err) {
       if ((err as NodeJS.ErrnoException)?.code !== "EEXIST") {
-        // The `.qmd` dir isn't writable (unusual — it holds the DB). Fail OPEN
-        // rather than block the reindex on an infra problem: proceed without the
-        // advisory lock. The corruption guard below is the remaining backstop.
+        // The lock dir isn't writable. Fail OPEN rather than block the reindex
+        // on an infra problem: proceed without the advisory lock. The corruption
+        // guard below is the remaining backstop.
         return NOOP_LOCK;
       }
       // Held. Reclaim iff the holder is dead/stale, then retry once.
@@ -281,6 +309,35 @@ const defaultAcquireReindexLock: AcquireReindexLock = (lockPath) => {
   return null;
 };
 
+/**
+ * Acquire unique lock paths (legacy + resolved index). If any is busy, release
+ * what was acquired and return busy. Dedupes when both paths are the same so a
+ * process never O_EXCL-locks itself out.
+ */
+export function acquireDualReindexLocks(
+  acquireLock: AcquireReindexLock,
+  lockPaths: string[],
+): { locks: ReindexLockHandle[]; busy: boolean } {
+  const unique: string[] = [];
+  const seen = new Set<string>();
+  for (const p of lockPaths) {
+    const key = normalizePathKey(p);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(p);
+  }
+  const locks: ReindexLockHandle[] = [];
+  for (const p of unique) {
+    const handle = acquireLock(p);
+    if (!handle) {
+      for (const acquired of locks) acquired.release();
+      return { locks: [], busy: true };
+    }
+    locks.push(handle);
+  }
+  return { locks, busy: false };
+}
+
 /** Move corrupt DB files aside (never delete) so a clean rebuild can follow. */
 export type QuarantineCorruptIndex = (
   qmdDir: string,
@@ -298,6 +355,7 @@ const defaultQuarantineCorruptIndex: QuarantineCorruptIndex = (qmdDir, tsSuffix)
       const dest = `${src}.corrupt-${tsSuffix}`;
       fs.renameSync(src, dest);
       if (name === "index.sqlite") movedBase = dest;
+      else if (movedBase === null) movedBase = dest;
     } catch {
       // Best-effort: move what we can. A file we can't move is left in place;
       // the corruption guard still prevents further writes this cycle.
@@ -341,6 +399,10 @@ export interface ReindexOptions {
   acquireReindexLock?: AcquireReindexLock;
   /** Corrupt-index quarantine override for tests. */
   quarantineCorruptIndex?: QuarantineCorruptIndex;
+  /** realpath override for path-drift comparison in tests. */
+  realpathSync?: (p: string) => string;
+  /** Env override for tests (repair flag, etc.). */
+  env?: NodeJS.ProcessEnv;
   /** Optional diagnostic sink for unexpected swallowed failures. */
   log?: (diagnostic: {
     event: string;
@@ -353,6 +415,10 @@ export interface ReindexOptions {
 export interface ReindexResult {
   qmdAvailable: boolean;
   collectionsAdded: string[];
+  /** HQ-convention collections whose registered path differs from desired. */
+  pathDriftDetected: string[];
+  /** Collections successfully remove+re-added when repair was enabled. */
+  collectionsRepaired: string[];
   updated: boolean;
   embedded: boolean;
   pendingDirty: boolean;
@@ -360,8 +426,12 @@ export interface ReindexResult {
   lockBusy: boolean;
   /** True when a qmd command exceeded the exec timeout and was aborted. */
   timedOut: boolean;
-  /** True when a corrupt index was detected and quarantined this cycle. */
+  /** True when a corrupt index was detected and files were quarantined. */
   corruptionQuarantined: boolean;
+  /** True when corruption was detected but quarantine moved nothing. */
+  corruptionQuarantineFailed: boolean;
+  /** Directory used for quarantine / index-side lock (resolved or fallback). */
+  indexDir: string | null;
 }
 
 /**
@@ -378,15 +448,21 @@ export function reindexAfterSync(
   const existsSync = opts.existsSync ?? fs.existsSync;
   const acquireLock = opts.acquireReindexLock ?? defaultAcquireReindexLock;
   const quarantine = opts.quarantineCorruptIndex ?? defaultQuarantineCorruptIndex;
+  const realpathSync = opts.realpathSync ?? safeRealpathSync;
+  const env = opts.env ?? process.env;
   const result: ReindexResult = {
     qmdAvailable: false,
     collectionsAdded: [],
+    pathDriftDetected: [],
+    collectionsRepaired: [],
     updated: false,
     embedded: false,
     pendingDirty: false,
     lockBusy: false,
     timedOut: false,
     corruptionQuarantined: false,
+    corruptionQuarantineFailed: false,
+    indexDir: null,
   };
 
   try {
@@ -414,13 +490,20 @@ export function reindexAfterSync(
         ? state.pendingSinceMs
         : nowMs;
 
-    // Serialize qmd writers. If another writer (this runner from a prior cycle,
-    // or an interactive session's qmd maintenance) holds the lock, SKIP this
-    // cycle and mark the tree dirty so the next sync retries — never write onto
-    // the vector store concurrently (feedback_b9a369ff).
-    const lockPath = path.join(hqRoot, ".qmd", ".reindex.lock");
-    const lock = acquireLock(lockPath);
-    if (!lock) {
+    // Resolve the real index directory before locking. Default qmd layout is
+    // ~/.cache/qmd, not <hqRoot>/.qmd — status is read-only.
+    const legacyQmdDir = path.join(hqRoot, ".qmd");
+    const status = exec(["status"]);
+    const parsedIndexDir = parseIndexDirFromStatus(status.stdout ?? "");
+    const indexDir = parsedIndexDir ?? legacyQmdDir;
+    result.indexDir = indexDir;
+
+    // Serialize qmd writers across legacy + resolved layouts (feedback_332c7ccc).
+    const { locks, busy } = acquireDualReindexLocks(acquireLock, [
+      path.join(legacyQmdDir, ".reindex.lock"),
+      path.join(indexDir, ".reindex.lock"),
+    ]);
+    if (busy) {
       writeState(statePath, { ...state, pendingDirty: true, pendingSinceMs });
       result.lockBusy = true;
       result.pendingDirty = true;
@@ -428,35 +511,95 @@ export function reindexAfterSync(
     }
 
     try {
+      if (looksCorrupt(status)) {
+        handleCorruption(indexDir, statePath, state, pendingSinceMs, nowMs, quarantine, result);
+        return result;
+      }
+
       // Guard: qmd must be installed. `qmd collection list` doubles as the
       // availability probe AND the source for which collections already exist.
       const list = exec(["collection", "list"]);
       if (list.status !== 0) return result; // qmd absent or errored — no-op
       // An already-corrupt store can surface here even on the lexical side.
       if (looksCorrupt(list)) {
-        handleCorruption(hqRoot, statePath, state, pendingSinceMs, nowMs, quarantine, result);
+        handleCorruption(indexDir, statePath, state, pendingSinceMs, nowMs, quarantine, result);
         return result;
       }
       result.qmdAvailable = true;
       const existingCollections = list.stdout;
+      let repairedThisCycle = false;
 
-      // 1. Auto-register missing company knowledge collections.
+      // 1. Auto-register missing / reconcile drifted company knowledge collections.
       if (registrationMayBeStale) {
         const companiesDir = path.join(hqRoot, "companies");
         const slugs = (opts.readCompanies ?? defaultReadCompanies)(companiesDir);
+        const allowRepair = repairPathDriftEnabled(env);
         for (const slug of slugs) {
           const knowledgeDir = path.join(companiesDir, slug, "knowledge");
           if (!existsSync(knowledgeDir)) continue;
           const hasMd = (opts.hasIndexableMarkdown ?? defaultHasIndexableMarkdown)(knowledgeDir);
           if (!hasMd) continue;
-          // Already registered? qmd collection URIs look like `qmd://<slug>/`.
-          if (existingCollections.includes(`qmd://${slug}/`)) continue;
 
+          const namePresent = existingCollections.includes(`qmd://${slug}/`);
+          if (!namePresent) {
+            const add = exec(["collection", "add", knowledgeDir, "--name", slug, "--mask", "**/*.md"]);
+            if (add.status === 0) {
+              exec(["context", "add", `qmd://${slug}`, `Knowledge base for ${slug}.`]);
+              result.collectionsAdded.push(slug);
+            }
+            continue;
+          }
+
+          // Name exists — check path (feedback_f8e233c6). Paths only on `show`.
+          const show = exec(["collection", "show", slug]);
+          if (show.status !== 0) continue;
+          const registeredPath = parseCollectionPathFromShow(show.stdout ?? "");
+          if (!registeredPath) continue;
+          if (pathsEquivalent(registeredPath, knowledgeDir, realpathSync)) continue;
+
+          result.pathDriftDetected.push(slug);
+          opts.log?.({
+            event: "runner.qmd_reindex.path_drift",
+            message: `qmd collection ${slug} path drifted`,
+            err: null,
+            context: {
+              slug,
+              registeredPath,
+              desiredPath: knowledgeDir,
+              repairEnabled: allowRepair,
+            },
+          });
+
+          if (!allowRepair) continue;
+
+          // Guaranteed hasMd + exists above. Remove + re-add; never embed inline.
+          const removed = exec(["collection", "remove", slug]);
+          if (removed.status !== 0) {
+            writeState(statePath, { ...state, pendingDirty: true, pendingSinceMs });
+            result.pendingDirty = true;
+            opts.log?.({
+              event: "runner.qmd_reindex.path_drift_repair_failed",
+              message: `failed to remove drifted collection ${slug}`,
+              err: removed.stderr ?? removed.stdout,
+              context: { slug },
+            });
+            continue;
+          }
           const add = exec(["collection", "add", knowledgeDir, "--name", slug, "--mask", "**/*.md"]);
-          if (add.status === 0) {
-            exec(["context", "add", `qmd://${slug}`, `Knowledge base for ${slug}.`]);
-            result.collectionsAdded.push(slug);
+          if (add.status !== 0) {
+            writeState(statePath, { ...state, pendingDirty: true, pendingSinceMs });
+            result.pendingDirty = true;
+            opts.log?.({
+              event: "runner.qmd_reindex.path_drift_repair_failed",
+              message: `removed ${slug} but failed to re-add at desired path`,
+              err: add.stderr ?? add.stdout,
+              context: { slug, knowledgeDir },
+            });
+            continue;
           }
+          exec(["context", "add", `qmd://${slug}`, `Knowledge base for ${slug}.`]);
+          result.collectionsRepaired.push(slug);
+          repairedThisCycle = true;
         }
       }
 
@@ -474,7 +617,7 @@ export function reindexAfterSync(
 
         const update = exec(["update"]);
         if (looksCorrupt(update)) {
-          handleCorruption(hqRoot, statePath, state, pendingSinceMs, nowMs, quarantine, result);
+          handleCorruption(indexDir, statePath, state, pendingSinceMs, nowMs, quarantine, result);
           return result;
         }
         if (update.timedOut) {
@@ -494,11 +637,12 @@ export function reindexAfterSync(
         }
       }
 
-      // 3. Embeddings only on explicit request.
-      if (opts.embed) {
+      // 3. Embeddings only on explicit request — never after a path-drift repair
+      // in the same cycle (repair destroys that collection's vectors).
+      if (opts.embed && !repairedThisCycle) {
         const embed = exec(["embed"]);
         if (looksCorrupt(embed)) {
-          handleCorruption(hqRoot, statePath, state, pendingSinceMs, nowMs, quarantine, result);
+          handleCorruption(indexDir, statePath, state, pendingSinceMs, nowMs, quarantine, result);
           return result;
         }
         if (embed.timedOut) {
@@ -510,7 +654,7 @@ export function reindexAfterSync(
         result.embedded = embed.status === 0;
       }
     } finally {
-      lock.release();
+      for (const lock of locks) lock.release();
     }
   } catch (err) {
     try {
@@ -533,9 +677,10 @@ export function reindexAfterSync(
  * Quarantine the corrupt DB aside and mark the tree dirty so the NEXT cycle
  * rebuilds from scratch under the lock, instead of writing further onto an
  * already-damaged vector store. Mutates `result` in place.
+ * `corruptionQuarantined` is true only when files were actually moved.
  */
 function handleCorruption(
-  hqRoot: string,
+  indexDir: string,
   statePath: string,
   state: QmdReindexState,
   pendingSinceMs: number,
@@ -543,10 +688,13 @@ function handleCorruption(
   quarantine: QuarantineCorruptIndex,
   result: ReindexResult,
 ): void {
-  const qmdDir = path.join(hqRoot, ".qmd");
-  quarantine(qmdDir, quarantineSuffix(nowMs));
+  const moved = quarantine(indexDir, quarantineSuffix(nowMs));
   writeState(statePath, { ...state, pendingDirty: true, pendingSinceMs });
-  result.corruptionQuarantined = true;
+  if (moved != null) {
+    result.corruptionQuarantined = true;
+  } else {
+    result.corruptionQuarantineFailed = true;
+  }
   result.pendingDirty = true;
 }
 

package/src/telemetry.test.ts

@@ -81,6 +81,7 @@ function makeClient(opts: {
 interface TestEnv {
   root: string;
   claudeProjects: string;
+  codexRoot: string;
   cursorPath: string;
   menubarPath: string;
 }
@@ -88,11 +89,15 @@ interface TestEnv {
 function setupEnv(): TestEnv {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-telemetry-test-"));
   const claudeProjects = path.join(root, ".claude", "projects");
+  const codexRoot = path.join(root, ".codex");
   fs.mkdirSync(claudeProjects, { recursive: true });
+  fs.mkdirSync(path.join(codexRoot, "sessions"), { recursive: true });
+  fs.mkdirSync(path.join(codexRoot, "archived_sessions"), { recursive: true });
   fs.mkdirSync(path.join(root, ".hq"), { recursive: true });
   return {
     root,
     claudeProjects,
+    codexRoot,
     cursorPath: path.join(root, ".hq", "telemetry-cursor.json"),
     menubarPath: path.join(root, ".hq", "menubar.json"),
   };
@@ -120,6 +125,7 @@ function makeOpts(env: TestEnv, client: TelemetryClientSurface): CollectTelemetr
     machineId: "test-machine",
     installerVersion: "test-version",
     claudeProjectsRoot: env.claudeProjects,
+    codexRoot: env.codexRoot,
     cursorPath: env.cursorPath,
     menubarPath: env.menubarPath,
   };
@@ -634,6 +640,194 @@ describe("collectAndSendTelemetry", () => {
   });
 });
 
+// ── Codex rollout collection ────────────────────────────────────────────────
+
+function codexLine(value: Record<string, unknown>): string {
+  return JSON.stringify(value);
+}
+
+function writeCodexRollout(
+  env: TestEnv,
+  location: "sessions" | "archived_sessions",
+  name: string,
+  lines: Array<Record<string, unknown>>,
+): string {
+  const dir =
+    location === "sessions"
+      ? path.join(env.codexRoot, location, "2026", "07", "30")
+      : path.join(env.codexRoot, location);
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, name);
+  fs.writeFileSync(file, lines.map(codexLine).join("\n") + "\n", "utf-8");
+  return file;
+}
+
+function codexToken(
+  timestamp: string,
+  uuid: string,
+  input: number,
+  output: number,
+  reasoning = 0,
+  cached = 0,
+): Record<string, unknown> {
+  return {
+    timestamp,
+    uuid,
+    type: "event_msg",
+    payload: {
+      type: "token_count",
+      info: {
+        last_token_usage: {
+          input_tokens: input,
+          output_tokens: output,
+          reasoning_output_tokens: reasoning,
+          cached_input_tokens: cached,
+        },
+        total_token_usage: {
+          input_tokens: 999_999,
+          output_tokens: 999_999,
+        },
+      },
+      raw_content: "must never leave the machine",
+    },
+  };
+}
+
+describe("collectAndSendTelemetry — Codex rollouts", () => {
+  let env: TestEnv;
+  beforeEach(() => {
+    env = setupEnv();
+  });
+  afterEach(() => teardownEnv(env));
+
+  it("collects token deltas from live and archived Linux rollouts", async () => {
+    writeCodexRollout(env, "sessions", "rollout-live.jsonl", [
+      {
+        timestamp: "2026-07-30T10:00:00Z",
+        type: "session_meta",
+        payload: {
+          id: "codex-live",
+          cwd: "/home/yousuf/hq/repos/private/hq-cloud",
+          git: { branch: "feature/live" },
+          model: "session-model",
+          instructions: "private prompt",
+        },
+      },
+      {
+        timestamp: "2026-07-30T10:00:01Z",
+        type: "turn_context",
+        payload: { model: "codex-auto-review" },
+      },
+      codexToken("2026-07-30T10:00:02Z", "codex-event-live", 11, 7, 5, 3),
+    ]);
+    writeCodexRollout(env, "archived_sessions", "rollout-archived.jsonl", [
+      {
+        timestamp: "2026-07-29T10:00:00Z",
+        type: "session_meta",
+        payload: { id: "codex-archived", cwd: "/repo", model: "gpt-5-codex" },
+      },
+      codexToken("2026-07-29T10:00:01Z", "codex-event-archived", 2, 3, 1, 1),
+    ]);
+
+    const client = makeClient();
+    const result = await collectAndSendTelemetry(makeOpts(env, client));
+    const events = client.posts.flatMap((post) => post.events);
+
+    expect(result.filesScanned).toBe(2);
+    expect(result.eventsSent).toBe(2);
+    expect(events).toEqual(
+      expect.arrayContaining([
+        {
+          sessionId: "codex-live",
+          timestamp: "2026-07-30T10:00:02Z",
+          uuid: "codex-event-live",
+          cwd: "/home/yousuf/hq/repos/private/hq-cloud",
+          gitBranch: "feature/live",
+          model: "codex-auto-review",
+          inputTokens: 11,
+          outputTokens: 12,
+          cacheReadInputTokens: 3,
+        },
+        expect.objectContaining({
+          sessionId: "codex-archived",
+          model: "gpt-5-codex",
+          inputTokens: 2,
+          outputTokens: 4,
+          cacheReadInputTokens: 1,
+        }),
+      ]),
+    );
+    expect(JSON.stringify(events)).not.toContain("private prompt");
+    expect(JSON.stringify(events)).not.toContain("raw_content");
+    expect(JSON.stringify(events)).not.toContain("999999");
+
+    await collectAndSendTelemetry(makeOpts(env, client));
+    expect(client.posts.flatMap((post) => post.events)).toHaveLength(2);
+  });
+
+  it("persists model context for incremental rollouts and generates stable IDs", async () => {
+    const file = writeCodexRollout(env, "sessions", "rollout-incremental.jsonl", [
+      {
+        type: "session_meta",
+        payload: { id: "incremental", cwd: "/repo", model: "session-model" },
+      },
+      { type: "turn_context", payload: { model: "model-a" } },
+      codexToken("2026-07-30T13:00:00Z", "first-event", 1, 2),
+    ]);
+    fs.writeFileSync(
+      env.cursorPath,
+      JSON.stringify({ version: "1", files: {}, codex_next_rollout: file }),
+    );
+    const client = makeClient();
+
+    await collectAndSendTelemetry(makeOpts(env, client));
+    fs.appendFileSync(
+      file,
+      [
+        codexLine({ type: "turn_context", payload: { model: "model-b" } }),
+        codexLine({
+          ...codexToken("2026-07-30T13:01:00Z", "temporary", 3, 4),
+          uuid: undefined,
+        }),
+      ].join("\n") + "\n",
+    );
+    await collectAndSendTelemetry(makeOpts(env, client));
+
+    const events = client.posts.flatMap((post) => post.events);
+    expect(events).toHaveLength(2);
+    expect(events[1]).toMatchObject({
+      sessionId: "incremental",
+      cwd: "/repo",
+      model: "model-b",
+      inputTokens: 3,
+      outputTokens: 4,
+    });
+    expect(events[1].uuid).toMatch(/^codex-[a-f0-9]{64}$/);
+    const cursor = JSON.parse(fs.readFileSync(env.cursorPath, "utf-8"));
+    expect(cursor.files[file].context).toMatchObject({
+      session_id: "incremental",
+      cwd: "/repo",
+      session_model: "session-model",
+      turn_model: "model-b",
+    });
+    expect(cursor.codex_next_rollout).toBe(file);
+  });
+
+  it("does not advance a Codex rollout cursor when upload fails", async () => {
+    const file = writeCodexRollout(env, "sessions", "rollout-retry.jsonl", [
+      { type: "session_meta", payload: { id: "retry", model: "gpt-5-codex" } },
+      codexToken("2026-07-30T12:00:00Z", "retry-event", 1, 2),
+    ]);
+    const client = makeClient({ postResponse: new Error("server 500") });
+
+    const result = await collectAndSendTelemetry(makeOpts(env, client));
+
+    expect(result.eventsSent).toBe(0);
+    const cursor = readCursor(env);
+    expect(cursor.files[file]?.offset ?? 0).toBe(0);
+  });
+});
+
 // ── companyUid edge attribution (US-002) ────────────────────────────────────────
 
 describe("collectAndSendTelemetry — companyUid attribution", () => {