Make autosync visible

The background engine emitted nothing — no events, no fault reports — which made
it the least observable part of the app and the only part that runs with no user
present. Per-deployment counts existed but were manual-action counts only.

**The seam already existed.** Every outcome the engine produces already funnels
through `StatusReporter`, so telemetry is a decorating reporter rather than
`track()` calls threaded into the tick: one place to keep in step instead of two,
and the UI reporter keeps working untouched behind it. Emission is spawned, not
awaited — the trait is sync, telemetry is not, and the engine must not wait on a
network call to finish a tick.

Three events, under their own names:

- `autosync_published` — deliberately *not* `package_published`. Folding
  unattended work into a series already read as user actions would redefine it
  silently, which is the thing the name-continuity rule exists to prevent.
- `autosync_paused`, carrying the reason *category* only.
- `autosync_login_required` — the silent-failure signal: background sync stops
  and nothing asks the user anything.

Two methods report nothing, on purpose. `report_status` fires per package per
tick and carries a fingerprint precisely so consumers can discard repeats — a
progress signal, not a countable act. A subscriber error becomes a **fault**
rather than an event, because the vocabulary carries no error events and the
filesystem watcher concerns no deployment; that path is only assertable because
of the seam #823 added.

**The host is required, not optional** — the tightening the host change left open,
available here for free. The loop already declines to work on a package whose
lineage has no origin, so that guard is the proof: every outcome it reports
concerns a known deployment. `report_published` and `report_paused` now take
`&Host`, with one call site each, no degradation anywhere.

`PausedKind` maps the engine's reason to a category and drops its contents. The
engine's own type carries conflicting file names, a role name and a free-text
message for the UI banner; none of it crosses into the vocabulary. A test feeds
all three through and asserts nothing leaked.

Attribution is proven through the real tick, not just the type: `RecordingReporter`
now records hosts, and the publish test asserts the reported host is the package's
own origin.

just lint 0, cargo fmt --check 0, 310 quilt-sync tests, workspace green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: fiskus

quilt-sync/src-tauri/src/autopull/reporter.rs

@@ -1,13 +1,18 @@
 use std::fmt::Write;
+use std::sync::Arc;
 
 use serde::Serialize;
 
 use quilt_uri::Host;
 use quilt_uri::Namespace;
-use tauri::Emitter;
+use tauri::{Emitter, Manager};
 
 use crate::autopull::PausedReason;
 use crate::quilt;
+use crate::telemetry::Telemetry;
+use crate::telemetry::event::{
+    AutosyncAuthEvent, AutosyncEvent, AutosyncPausedEvent, MixpanelEvent, PausedKind,
+};
 use crate::telemetry::prelude::*;
 
 /// Event names. Kept in lockstep with the UI's `listen(...)` calls.
@@ -192,7 +197,10 @@ pub struct SubscriberErrorEvent {
 /// tests and a hypothetical headless daemon wire a logger.
 pub trait StatusReporter: Send + Sync + 'static {
     fn report_status(&self, namespace: &Namespace, event: PackageStatusEvent);
-    fn report_paused(&self, namespace: &Namespace, reason: PausedReason);
+    /// `host` is required rather than optional: the loop skips any package whose
+    /// lineage has no origin before doing work, so an outcome it reports always
+    /// concerns a known deployment.
+    fn report_paused(&self, namespace: &Namespace, host: &Host, reason: PausedReason);
     fn report_login_required(&self, host: Option<&Host>);
     fn report_subscriber_error(&self, event: SubscriberErrorEvent) {
         warn!(
@@ -202,8 +210,8 @@ pub trait StatusReporter: Send + Sync + 'static {
     }
     /// Surface a successful autosync publish. Default implementation
     /// logs only; `TauriEventReporter` also emits `PUBLISHED_EVENT`.
-    fn report_published(&self, namespace: &Namespace, message: &str) {
-        info!("autosync: published namespace={namespace} message={message}");
+    fn report_published(&self, namespace: &Namespace, host: &Host, message: &str) {
+        info!("autosync: published namespace={namespace} host={host} message={message}");
     }
 }
 
@@ -221,8 +229,8 @@ impl StatusReporter for LogReporter {
         );
     }
 
-    fn report_paused(&self, namespace: &Namespace, reason: PausedReason) {
-        info!("autosync: paused namespace={namespace} reason={reason:?}");
+    fn report_paused(&self, namespace: &Namespace, host: &Host, reason: PausedReason) {
+        info!("autosync: paused namespace={namespace} host={host} reason={reason:?}");
     }
 
     fn report_login_required(&self, host: Option<&Host>) {
@@ -236,6 +244,89 @@ impl StatusReporter for LogReporter {
 
 /// Production reporter: emits typed events on the Tauri event bus and
 /// also logs so file-tail-style debugging still works.
+/// Wraps another reporter and, in passing, tells telemetry what the engine just
+/// did.
+///
+/// A decorator rather than calls threaded into the tick: the engine already
+/// funnels every outcome through [`StatusReporter`], so that trait *is* the seam,
+/// and adding a second one inside the loop would mean two places to keep in step.
+/// The inner reporter still does its job — this only observes.
+///
+/// **Not every method reports.** `report_status` fires per package per tick and
+/// carries a fingerprint precisely so consumers can discard repeats; it is a
+/// progress signal, not a countable act, and sending it would swamp the
+/// vocabulary. A subscriber error is reported as a *fault* rather than an event,
+/// because the analytics vocabulary carries no error events by design.
+///
+/// Emission is spawned rather than awaited, because the trait is synchronous and
+/// telemetry is not. That is the right shape regardless: the engine must not wait
+/// on a network call to finish its tick.
+pub struct TelemetryReporter {
+    handle: tauri::AppHandle,
+    inner: Arc<dyn StatusReporter>,
+}
+
+impl TelemetryReporter {
+    pub fn wrapping(inner: Arc<dyn StatusReporter>, handle: tauri::AppHandle) -> Self {
+        Self { handle, inner }
+    }
+
+    /// Hand `event` to telemetry without blocking the caller.
+    ///
+    /// The `Telemetry` lives in Tauri state rather than being held here, so a
+    /// reporter constructed before it is managed still works — the same reason
+    /// [`TauriEventReporter`] holds a handle instead of a window.
+    fn emit(&self, event: MixpanelEvent) {
+        let handle = self.handle.clone();
+        tauri::async_runtime::spawn(async move {
+            handle.state::<Telemetry>().track(event).await;
+        });
+    }
+}
+
+impl StatusReporter for TelemetryReporter {
+    fn report_status(&self, namespace: &Namespace, event: PackageStatusEvent) {
+        // Deliberately not reported — see the type's note on volume.
+        self.inner.report_status(namespace, event);
+    }
+
+    fn report_paused(&self, namespace: &Namespace, host: &Host, reason: PausedReason) {
+        self.emit(MixpanelEvent::AutosyncPaused(AutosyncPausedEvent {
+            host: host.clone(),
+            reason: PausedKind::from(&reason),
+        }));
+        self.inner.report_paused(namespace, host, reason);
+    }
+
+    fn report_login_required(&self, host: Option<&Host>) {
+        self.emit(MixpanelEvent::AutosyncLoginRequired(AutosyncAuthEvent {
+            host: host.cloned(),
+        }));
+        self.inner.report_login_required(host);
+    }
+
+    fn report_subscriber_error(&self, event: SubscriberErrorEvent) {
+        // A fault, not an event: the vocabulary has no error events, and the
+        // filesystem watcher concerns no deployment, so there would be nothing to
+        // attribute one to. The message is a constant so the reporter groups it as
+        // one issue rather than one per path.
+        let handle = self.handle.clone();
+        tauri::async_runtime::spawn(async move {
+            handle
+                .state::<Telemetry>()
+                .report_anomaly("Autosync filesystem watcher reported an error");
+        });
+        self.inner.report_subscriber_error(event);
+    }
+
+    fn report_published(&self, namespace: &Namespace, host: &Host, message: &str) {
+        self.emit(MixpanelEvent::AutosyncPublished(AutosyncEvent {
+            host: host.clone(),
+        }));
+        self.inner.report_published(namespace, host, message);
+    }
+}
+
 pub struct TauriEventReporter {
     handle: tauri::AppHandle,
 }
@@ -257,8 +348,8 @@ impl StatusReporter for TauriEventReporter {
         }
     }
 
-    fn report_paused(&self, namespace: &Namespace, reason: PausedReason) {
-        info!("autosync: paused namespace={namespace} reason={reason:?}");
+    fn report_paused(&self, namespace: &Namespace, host: &Host, reason: PausedReason) {
+        info!("autosync: paused namespace={namespace} host={host} reason={reason:?}");
         let payload = PausedEvent::from_reason(namespace, &reason);
         if let Err(err) = self.handle.emit(PAUSED_EVENT, &payload) {
             warn!("autosync: failed to emit {PAUSED_EVENT}: {err}");
@@ -290,8 +381,8 @@ impl StatusReporter for TauriEventReporter {
         }
     }
 
-    fn report_published(&self, namespace: &Namespace, message: &str) {
-        info!("autosync: published namespace={namespace} message={message}");
+    fn report_published(&self, namespace: &Namespace, host: &Host, message: &str) {
+        info!("autosync: published namespace={namespace} host={host} message={message}");
         let payload = PublishedEvent {
             namespace: namespace.to_string(),
             message: message.to_string(),
@@ -522,6 +613,10 @@ pub(crate) mod test_support {
         pub logins: Mutex<Vec<Option<Host>>>,
         pub subscriber_errors: Mutex<Vec<SubscriberErrorEvent>>,
         pub published: Mutex<Vec<(Namespace, String)>>,
+        /// Hosts seen on the outcomes that carry one, so a test can assert the
+        /// engine attributed a report to the package's own deployment rather than
+        /// merely compiling against a `&Host`.
+        pub hosts: Mutex<Vec<Host>>,
     }
 
     impl StatusReporter for RecordingReporter {
@@ -532,7 +627,8 @@ pub(crate) mod test_support {
                 .push((namespace.clone(), event));
         }
 
-        fn report_paused(&self, namespace: &Namespace, reason: PausedReason) {
+        fn report_paused(&self, namespace: &Namespace, host: &Host, reason: PausedReason) {
+            self.hosts.lock().unwrap().push(host.clone());
             self.paused
                 .lock()
                 .unwrap()
@@ -547,7 +643,8 @@ pub(crate) mod test_support {
             self.subscriber_errors.lock().unwrap().push(event);
         }
 
-        fn report_published(&self, namespace: &Namespace, message: &str) {
+        fn report_published(&self, namespace: &Namespace, host: &Host, message: &str) {
+            self.hosts.lock().unwrap().push(host.clone());
             self.published
                 .lock()
                 .unwrap()

quilt-sync/src-tauri/src/autopull/tick.rs

@@ -464,7 +464,13 @@ pub(crate) async fn run_once(
         let Some(remote) = lineage.remote_uri.as_ref() else {
             continue;
         };
-        if remote.origin.is_none() || remote.bucket.is_empty() {
+        // The origin is what makes every outcome below attributable: the loop
+        // declines to work on a package without one, so `report_*` can require a
+        // host rather than accept an absent one.
+        let Some(origin) = remote.origin.as_ref() else {
+            continue;
+        };
+        if remote.bucket.is_empty() {
             continue;
         }
 
@@ -490,7 +496,7 @@ pub(crate) async fn run_once(
                 inner.backoff.write().await.remove(&namespace);
                 inner.login_blocked.write().await.remove(&namespace);
                 if let Some(message) = outcome.published.as_deref() {
-                    inner.reporter.report_published(&namespace, message);
+                    inner.reporter.report_published(&namespace, origin, message);
                 }
                 inner.reporter.report_status(
                     &namespace,
@@ -522,13 +528,15 @@ pub(crate) async fn run_once(
                 // the lookup is cached per host and the namespace is about
                 // to be paused, so a denied host costs at most one `/me`
                 // per role switch — not one per tick.
-                let reason = name_denied_role(model, roles, remote.origin.as_ref(), reason).await;
+                let reason = name_denied_role(model, roles, Some(origin), reason).await;
                 inner
                     .paused
                     .write()
                     .await
                     .insert(namespace.clone(), reason.clone());
-                inner.reporter.report_paused(&namespace, reason.clone());
+                inner
+                    .reporter
+                    .report_paused(&namespace, origin, reason.clone());
                 // Heuristic status from the refusal reason — flow::pull /
                 // flow::publish don't expose the post-attempt state
                 // directly. The string `"error"` is **reserved** for "we

quilt-sync/src-tauri/src/autopull/tick/tests/publish.rs

@@ -156,6 +156,14 @@ async fn run_once_publishes_on_changes() -> Result<(), Error> {
         // Default message_template is None → falls back to summary.
         assert_eq!(published[0].1, "Add file.txt");
     }
+    {
+        // Attribution, not just compilation: the host reported is the package's
+        // own origin, which is what makes a per-deployment autosync count mean
+        // anything.
+        let hosts = reporter.hosts.lock().unwrap();
+        assert_eq!(hosts.len(), 1);
+        assert_eq!(hosts[0].to_string(), "catalog.dev");
+    }
     {
         let statuses = reporter.statuses.lock().unwrap();
         assert_eq!(statuses.len(), 1);

quilt-sync/src-tauri/src/main.rs

@@ -131,8 +131,14 @@ fn main() {
             app.manage(oauth::OAuthState::default());
             // The watcher reads `Model` via `app_handle.state::<Model>()`
             // so it can spawn after `Model` is registered above.
+            // Telemetry wraps the UI reporter rather than replacing it: the
+            // engine's outcomes reach the window exactly as before, and telemetry
+            // observes them on the way past.
             let reporter: Arc<dyn StatusReporter> =
-                Arc::new(TauriEventReporter::new(app.handle().clone()));
+                Arc::new(autopull::reporter::TelemetryReporter::wrapping(
+                    Arc::new(TauriEventReporter::new(app.handle().clone())),
+                    app.handle().clone(),
+                ));
             let (watcher, status_rx) = Watcher::spawn(
                 app.handle().clone(),
                 autosync_settings.clone(),

quilt-sync/src-tauri/src/telemetry/event.rs

@@ -69,6 +69,75 @@ pub struct LoginEvent {
     pub flow: LoginFlow,
 }
 
+/// Something autosync did on its own, against a deployment it is **known** to
+/// have.
+///
+/// The host is required here where a manual package operation's is optional, and
+/// the loop is why: it skips any package whose lineage carries no origin before
+/// doing any work, so every outcome it reports is about a package with a remote.
+/// That is the proof a required host needs — the tightening the previous change
+/// left open for the manual paths, available here for free.
+#[derive(Debug, Clone, Serialize)]
+pub struct AutosyncEvent {
+    pub host: Host,
+}
+
+/// Autosync stopping on a package, and the kind of thing that stopped it.
+#[derive(Debug, Clone, Serialize)]
+pub struct AutosyncPausedEvent {
+    pub host: Host,
+    pub reason: PausedKind,
+}
+
+/// Autosync stopping because the session expired.
+///
+/// The one autosync payload whose host is optional, and not for the usual
+/// reason: the refusal itself carries the host only when the failing call knew
+/// which one it was talking to, so an absent host here means the engine could not
+/// name the deployment, not that there wasn't one.
+#[derive(Debug, Clone, Serialize)]
+pub struct AutosyncAuthEvent {
+    pub host: Option<Host>,
+}
+
+/// Why autosync paused, coarsely — the variant, never its contents.
+///
+/// The engine's own reason type carries a conflicting-file list, a role name and
+/// a free-text message for the UI banner. None of that crosses into telemetry:
+/// the vocabulary admits no free text, and a file name is exactly the kind of
+/// detail [the module's rule](self) exists to keep out. The category is what a
+/// report can act on anyway — "how often does a role denial stop background
+/// sync" does not need to know which file.
+#[derive(Debug, Clone, Copy, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PausedKind {
+    PendingChanges,
+    PendingCommit,
+    Diverged,
+    PullConflict,
+    RoleDenied,
+    /// The engine's own catch-all for non-transient errors it has not
+    /// enumerated. Coarse by inheritance rather than by choice: sharpening it
+    /// means sharpening `PausedReason` upstream first.
+    Other,
+}
+
+impl From<&crate::autopull::PausedReason> for PausedKind {
+    fn from(reason: &crate::autopull::PausedReason) -> Self {
+        use crate::autopull::PausedReason as R;
+        // Exhaustive rather than wildcarded, so a new pause reason cannot be
+        // added without deciding how a report should see it.
+        match reason {
+            R::PendingChanges => Self::PendingChanges,
+            R::PendingCommit => Self::PendingCommit,
+            R::Diverged => Self::Diverged,
+            R::PullConflict(_) => Self::PullConflict,
+            R::RoleDenied { .. } => Self::RoleDenied,
+            R::Other(_) => Self::Other,
+        }
+    }
+}
+
 impl RemotePackageEvent {
     pub fn for_uri(uri: Option<&S3PackageUri>) -> Self {
         Self {
@@ -149,6 +218,18 @@ pub enum MixpanelEvent {
     FileRevealed(PackageFileEvent),
     DefaultApplicationOpened(PackageFileEvent),
 
+    // ── autosync: the engine acting with no user present ──
+    /// A publish the loop completed on its own. Deliberately *not*
+    /// `package_published`: folding unattended work into a series read as
+    /// user actions would redefine it silently, which is the thing the
+    /// name-continuity rule exists to prevent.
+    AutosyncPublished(AutosyncEvent),
+    /// The loop stopped on a package, with the category that stopped it.
+    AutosyncPaused(AutosyncPausedEvent),
+    /// The loop stopped because the session expired — the silent-failure signal:
+    /// background sync ceases working and nothing asked the user anything.
+    AutosyncLoginRequired(AutosyncAuthEvent),
+
     // ── auth: always names the deployment it acts on ──
     UserLoggedIn(LoginEvent),
     RoleSwitched(AuthEvent),
@@ -181,6 +262,10 @@ impl MixpanelEvent {
             | Self::FileRevealed(e)
             | Self::DefaultApplicationOpened(e) => e.host.as_ref(),
 
+            Self::AutosyncPublished(e) => Some(&e.host),
+            Self::AutosyncPaused(e) => Some(&e.host),
+            Self::AutosyncLoginRequired(e) => e.host.as_ref(),
+
             Self::RoleSwitched(e) | Self::OAuthLoginInitiated(e) | Self::AuthErased(e) => {
                 Some(&e.host)
             }