@dzhechkov/harness-core 0.8.30 → 0.8.31

package/src/mutation-gate.ts

@@ -30,6 +30,8 @@ export interface MutationRegistryEntry {
   readonly file: string;
   /** exact text surgery: `find` must occur EXACTLY ONCE in the file (rule 1). */
   readonly mutation: { readonly find: string; readonly replace: string };
+  /** test files that discriminate this entry; a named registry self-check must remain runnable. */
+  readonly tests?: readonly string[];
   /** how many tests MUST go red under the mutation (default 1). */
   readonly minFailing?: number;
   /** how many actually did at the time of writing — makes a coverage DROP visible. */
@@ -42,6 +44,34 @@ export interface MutationRegistryEntry {
   readonly maxFailing?: number;
 }
 
+/** Registry integrity tests add the same unrelated failure to every ordinary mutant run. */
+export const REGISTRY_SELFCHECK_TESTS = [
+  'test/mutation-registry-freshness.test.ts',
+  'test/mutation-registry-anchors.test.ts',
+] as const;
+
+export interface MutationTestCommand {
+  readonly testCommand: string;
+  readonly excluded: readonly string[];
+}
+
+/** Build the mutant-only command; baseline commands remain unchanged in the executor. */
+export function buildMutationTestCommand(
+  testCommand: string,
+  entry: Pick<MutationRegistryEntry, 'tests'>,
+): MutationTestCommand {
+  const entryTests = new Set(entry.tests ?? []);
+  const commandTokens = testCommand.split(/\s+/);
+  const excluded = REGISTRY_SELFCHECK_TESTS.filter(
+    (testFile) => commandTokens.includes(testFile) && !entryTests.has(testFile),
+  );
+  const excludedSet = new Set<string>(excluded);
+  return {
+    testCommand: commandTokens.filter((token) => !excludedSet.has(token)).join(' '),
+    excluded,
+  };
+}
+
 export interface MutationRegistry {
   /** optional suite command override for the whole registry (default `npm test`). */
   readonly testCommand?: string;
@@ -112,6 +142,24 @@ export interface MutationObservation {
   readonly rebaselineFailureReason?: string;
   /** parsed failing files from a RED restored-tree run; absent when no red rebaseline ran. */
   readonly rebaselineAttribution?: BaselineAttribution;
+  /** bounded stdout+stderr tail supplied by the executor for a RED restored-tree run. */
+  readonly rebaselineOutputTail?: string;
+  /**
+   * path to the FULL stdout+stderr the executor saved for a RED baseline/rebaseline run (gate
+   * stability, 2026-09-12) — the bounded tail above is a diagnostic teaser; a multi-entry gate run
+   * that goes INCONCLUSIVE/OVER_FAILING needs the whole log to attribute the redness, and the tail
+   * alone was measured to hand back three lines of an unrelated neighbour's stderr. Absent when the
+   * run was green (nothing written) or the executor could not write the file.
+   */
+  readonly outputPath?: string;
+  /**
+   * set (to the caught error's message) when the executor tried and FAILED to save the full RED
+   * output — EACCES/ENOSPC/EROFS/ENOTDIR and the like (fix-round-1, HIGH/MEDIUM review findings,
+   * 2026-09-12). Mutually exclusive with `outputPath`: a red run either saved (path) or did not
+   * (error), never both, and a green run has neither. Absent/undefined = not attempted (green) or
+   * the save succeeded.
+   */
+  readonly outputError?: string;
   /** bounded log proving an internal runner failure received at most one retry. */
   readonly internalAttemptLog?: string;
 }
@@ -137,6 +185,12 @@ export interface MutationEntryResult {
    * of letting the reader assume it covers every entry.
    */
   readonly dropComparable: boolean;
+  /** full bounded restored-tree output tail for machine-readable reports. */
+  readonly rebaselineOutputTail?: string;
+  /** path to the full saved output for a RED baseline/rebaseline run; see MutationObservation. */
+  readonly outputPath?: string;
+  /** the save FAILED for a RED run; see MutationObservation.outputError. Mutually exclusive with `outputPath`. */
+  readonly outputError?: string;
   /** human sentence for the report line — names the undefended property on a green suite. */
   readonly detail: string;
 }
@@ -371,6 +425,9 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
       property: o['property'].trim(),
       file,
       mutation: { find: mut.find, replace: mut.replace },
+      ...(Array.isArray(o['tests']) && o['tests'].every((test) => typeof test === 'string')
+        ? { tests: o['tests'] as string[] }
+        : {}),
       minFailing,
       ...(observed !== undefined ? { observed } : {}),
       ...(maxFailing !== undefined ? { maxFailing } : {}),
@@ -717,6 +774,19 @@ export interface BaselineResult {
   readonly reason?: BaselineFailureReason;
 }
 
+/**
+ * `; full output: <path>` when the executor saved the full red-run output, `; full output NOT
+ * saved: <error>` when it tried and failed (fix-round-1 MEDIUM finding — an EACCES/ENOSPC/EROFS
+ * during the save must not vanish silently), else '' — byte-identical to the pre-gate-stability
+ * text when neither is known (NFR-1). `outputPath` takes precedence if somehow both are set (the
+ * callers never set both).
+ */
+function outputPathSuffix(outputPath?: string, outputError?: string): string {
+  if (outputPath !== undefined) return `; full output: ${outputPath}`;
+  if (outputError !== undefined) return `; full output NOT saved: ${outputError}`;
+  return '';
+}
+
 /**
  * A RED baseline in the scratch copy is a SETUP error, never a mutation result: every subsequent
  * "red under mutation" would be noise, and every "green" a lie about an unrunnable copy.
@@ -725,14 +795,17 @@ export function classifyBaseline(
   exitCode: number | null,
   runFailureReason?: string,
   attribution?: BaselineAttribution,
+  outputPath?: string,
+  outputError?: string,
 ): BaselineResult {
   if (exitCode === 0) return { ok: true, detail: 'baseline suite green in the scratch copy' };
+  const pathSuffix = outputPathSuffix(outputPath, outputError);
   if (exitCode === null) {
     const internal = runFailureReason?.startsWith('runner-internal-error:') === true;
     return {
       ok: false,
       reason: internal ? 'runner-internal-error' : 'runner-no-exit',
-      detail: `baseline INCONCLUSIVE — suite produced no exit code (${runFailureReason ?? 'unknown timeout/spawn failure'}) — the copy is not runnable; do not read this as a mutation result`,
+      detail: `baseline INCONCLUSIVE — suite produced no exit code (${runFailureReason ?? 'unknown timeout/spawn failure'}) — the copy is not runnable; do not read this as a mutation result${pathSuffix}`,
     };
   }
   const infrastructure = attribution?.infrastructureFailure;
@@ -740,14 +813,14 @@ export function classifyBaseline(
     return {
       ok: false,
       ...(infrastructure.reason !== undefined ? { reason: infrastructure.reason } : {}),
-      detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — runner infrastructure failure: ${infrastructure.reason} — ${infrastructure.evidence}; the broken copy cannot prove anything`,
+      detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — runner infrastructure failure: ${infrastructure.reason} — ${infrastructure.evidence}; the broken copy cannot prove anything${pathSuffix}`,
     };
   }
   if (attribution === undefined || attribution.parsedFrom === 'unparseable') {
     return {
       ok: false,
       reason: 'baseline-red-files-unparseable',
-      detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — failing files: unparseable from runner output — the broken copy cannot prove anything`,
+      detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — failing files: unparseable from runner output — the broken copy cannot prove anything${pathSuffix}`,
     };
   }
   const failing = `failing files: ${attribution.failingFiles.join(', ')}`;
@@ -755,13 +828,13 @@ export function classifyBaseline(
     return {
       ok: false,
       reason: 'extraneous-red-in-allowlist',
-      detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — ${failing} — extraneous red in the testCommand allowlist; the registry entries themselves are not disproven`,
+      detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — ${failing} — extraneous red in the testCommand allowlist; the registry entries themselves are not disproven${pathSuffix}`,
     };
   }
   return {
     ok: false,
     reason: 'baseline-red-covered-files',
-    detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — ${failing} — broken-copy baseline redness touches registry-covered files; fix the copy before evaluating mutations`,
+    detail: `baseline suite RED (exit ${exitCode}) in the UNMUTATED scratch copy — ${failing} — broken-copy baseline redness touches registry-covered files; fix the copy before evaluating mutations${pathSuffix}`,
   };
 }
 
@@ -814,6 +887,9 @@ function classifyMutationOutcomeWithoutAttemptLog(obs: MutationObservation): Mut
     failingCount: obs.failingCount,
     // an `observed` anchor is the ONLY thing that makes a drop detectable at all (round-7 honesty)
     dropComparable: e.observed !== undefined,
+    ...(obs.rebaselineOutputTail !== undefined ? { rebaselineOutputTail: obs.rebaselineOutputTail } : {}),
+    ...(obs.outputPath !== undefined ? { outputPath: obs.outputPath } : {}),
+    ...(obs.outputError !== undefined ? { outputError: obs.outputError } : {}),
   };
 
   if (obs.occurrences !== 1) {
@@ -864,7 +940,7 @@ function classifyMutationOutcomeWithoutAttemptLog(obs: MutationObservation): Mut
       applied: true,
       verdict: 'INCONCLUSIVE',
       drop: false,
-      detail: `suite produced NO exit code under the mutation (${obs.runFailureReason ?? 'unknown timeout / spawn failure'}) — inconclusive is a FAILURE, never a pass`,
+      detail: `suite produced NO exit code under the mutation (${obs.runFailureReason ?? 'unknown timeout / spawn failure'}) — inconclusive is a FAILURE, never a pass${outputPathSuffix(obs.outputPath, obs.outputError)}`,
     };
   }
 
@@ -898,7 +974,7 @@ function classifyMutationOutcomeWithoutAttemptLog(obs: MutationObservation): Mut
       applied: true,
       verdict: 'INCONCLUSIVE',
       drop: false,
-      detail: `suite red but the runner output is UNRECOGNISED (${obs.outputUnrecognised.slice(0, 220)}) — this tool has no classifier for the output shape, so file-load redness cannot be told from assertion redness; INCONCLUSIVE is a FAILURE, never a pass (run the gate with a node --test or vitest test command, or extend classifyRunFailure)`,
+      detail: `suite red but the runner output is UNRECOGNISED (${obs.outputUnrecognised.slice(0, 220)}) — this tool has no classifier for the output shape, so file-load redness cannot be told from assertion redness; INCONCLUSIVE is a FAILURE, never a pass (run the gate with a node --test or vitest test command, or extend classifyRunFailure)${outputPathSuffix(obs.outputPath, obs.outputError)}`,
     };
   }
 
@@ -912,12 +988,15 @@ function classifyMutationOutcomeWithoutAttemptLog(obs: MutationObservation): Mut
       : obs.rebaselineAttribution === undefined || obs.rebaselineAttribution.parsedFrom === 'unparseable'
       ? 'failing files: unparseable from runner output'
       : `failing files: ${obs.rebaselineAttribution.failingFiles.join(', ')}`;
+    const outputTailDetail = obs.rebaselineOutputTail === undefined
+      ? ''
+      : `; output tail (first 3 lines):\n${obs.rebaselineOutputTail.split(/\r?\n/).slice(0, 3).join('\n')}`;
     return {
       ...base,
       applied: true,
       verdict: 'INCONCLUSIVE',
       drop: false,
-      detail: `suite red under the mutation BUT the restored baseline did not reproduce green (${obs.rebaselineExitCode === null ? `no exit code: ${obs.rebaselineFailureReason ?? 'unknown timeout / spawn failure'}` : `exit ${obs.rebaselineExitCode}`}) — mutation did not revert / flaky restored-tree route; ${failing}; the redness is not attributable to the protection`,
+      detail: `suite red under the mutation BUT the restored baseline did not reproduce green (${obs.rebaselineExitCode === null ? `no exit code: ${obs.rebaselineFailureReason ?? 'unknown timeout / spawn failure'}` : `exit ${obs.rebaselineExitCode}`}) — mutation did not revert / flaky restored-tree route; ${failing}${outputTailDetail}; the redness is not attributable to the protection${outputPathSuffix(obs.outputPath, obs.outputError)}`,
     };
   }
 

package/src/operations.ts

@@ -1360,6 +1360,58 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
     }
   } catch { /* doctor never throws on a diagnostic */ }
 
+  // APPLY-LEG INSTALLED (feature `setup-installs-apply-leg`, ADR-001 Decision 3). Deliberately
+  // OUTSIDE the `existsSync(writerPath)` guard below, for the same reason the Codex apply-leg block
+  // above is: MEASURED 2026-09-12, `dz parity` printed a static "✓ automatic apply-leg" for
+  // `learning-apply` regardless of what the project actually had installed — a capability read off
+  // a table, not off the project. `applyLegStatus` is the ONE measurement; this check and
+  // `dz parity`'s `learning-apply` cell both read it, so they cannot disagree.
+  try {
+    const { applyLegStatus, applyLegReasonMessage } = await import('./apply-leg.js');
+    let configuredBackend: 'agentdb' | 'jsonl' | 'unknown' = 'unknown';
+    try {
+      const cfg = JSON.parse(readFileSync(join(root, '.dz', 'config.json'), 'utf-8')) as { memory?: { backend?: string } };
+      if (cfg.memory?.backend === 'agentdb') configuredBackend = 'agentdb';
+      else if (cfg.memory?.backend === 'jsonl') configuredBackend = 'jsonl';
+    } catch { /* no .dz/config.json yet — nothing to check */ }
+
+    if (configuredBackend === 'agentdb') {
+      // `applyLegStatus` is the ONE measurement, `installed` already folds in version + structural
+      // hook wiring (fix round 1, HIGH findings 1/2) — a stale-versioned or unreadable helper is
+      // `installed:false` with a `reason`, never a separate ad-hoc re-check of the same facts here.
+      const status = applyLegStatus(root);
+      if (!status.installed) {
+        if (status.reason === 'stale-version') {
+          // Distinct row name from "apply-leg installed", exactly as `AGENTDB_WRITER_VERSION`'s own
+          // staleness check does — `dz parity` reads the SAME `applyLegReasonMessage` for its
+          // `learning-apply` remedy note, so the two instruments cannot disagree about WHY.
+          checks.push({ name: 'apply-leg version', ok: false, detail: applyLegReasonMessage(status) });
+        } else if (status.reason === 'unreadable') {
+          // Q3 (fix round 1): an EXISTING-but-unreadable helper used to be swallowed by this whole
+          // block's outer catch (silence) — now a named, non-OK row, not folded into "not installed".
+          checks.push({ name: 'apply-leg unreadable', ok: false, detail: applyLegReasonMessage(status) });
+        } else {
+          checks.push({
+            name: 'apply-leg installed',
+            ok: false,
+            detail: 'NOT INSTALLED — run: dz setup --target claude-code --memory agentdb',
+          });
+        }
+      }
+      // Liveness (embed.sock) stays the existing check below, gated on the writer file — installed
+      // implies the recall hook + settings entries exist; whether the daemon is CURRENTLY alive is
+      // a separate, already-covered fact.
+    } else if (configuredBackend === 'jsonl') {
+      checks.push({
+        name: 'apply-leg',
+        ok: true,
+        detail: 'apply-leg unavailable on jsonl backend (needs --memory agentdb)',
+      });
+    }
+    // configuredBackend === 'unknown' (no .dz/config.json yet): nothing to check — a project that
+    // never ran `dz setup` gets no apply-leg opinion, same as every other doctor check here.
+  } catch { /* doctor never throws on a diagnostic */ }
+
   const writerPath = join(root, '.dz', 'agentdb-writer.mjs');
   if (existsSync(writerPath)) {
     const { writerVersionOf, AGENTDB_WRITER_VERSION } = await import('./setup.js');
@@ -1517,6 +1569,43 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
     }
   } catch { /* advisory only — the vector tier must never fail doctor */ }
 
+  // Mirror writer state (issue #10 defect 6, AM-9, feature setup-installs-apply-leg): the SAME
+  // reason `dz vector status` and `dz teach` both read (`mirrorWriterReason`) — one function, so a
+  // "legacy-shape" config (a top-level `backend` key instead of `memory.backend`) cannot be silent
+  // in doctor while `dz teach` is silent too. Informational only (`ok:true`): a mirror that is OFF
+  // by explicit config (`engine-off`) or simply unconfigured (`no-config`) is not a doctor FAILURE,
+  // it is a fact worth naming once per run rather than never.
+  try {
+    const { mirrorWriterReason: reasonFn, mirrorWriterExplanation: explainFn } = await import('./vector-tier.js');
+    const mirror = reasonFn(root);
+    // 'no-config' is the honest quiet baseline (a project that never ran `dz setup` at all) — every
+    // OTHER state means `.dz/config.json` exists and has an opinion worth naming, legacy-shape
+    // included, so THAT is the line this check exists to stop being silent about.
+    if (mirror.state !== 'no-config') {
+      checks.push({
+        name: 'mirror writer',
+        ok: true,
+        detail: `${mirror.enabled ? 'ON' : 'OFF'} (${explainFn(mirror.state)})`,
+      });
+    }
+  } catch { /* advisory only — the vector tier must never fail doctor */ }
+
+  // Quarantine labels have their own identity parity: equal aggregate counts can still describe
+  // disjoint dzIds. Informational only; the lexical store is authoritative and reindex projects it.
+  try {
+    const { countLearningStoreRowsReadonly } = await import('./store-counts.js');
+    const parity = countLearningStoreRowsReadonly(root).quarantineTierParity;
+    if (parity !== undefined) {
+      const drift = parity.lexicalOnly + parity.mirrorOnly;
+      checks.push({
+        name: 'quarantine tier parity',
+        ok: true,
+        detail: `quarantine tiers: both ${parity.both} · lexical-only ${parity.lexicalOnly} · mirror-only ${parity.mirrorOnly}` +
+          (drift > 0 ? ' — run dz vector reindex to project' : ''),
+      });
+    }
+  } catch { /* advisory only — unreadable identities leave the line absent */ }
+
   // 10. AQE store integrity (observability item 3/5). `.agentic-qe/integrity-log.jsonl` is the
   // best-attested log in this repo — a UserPromptSubmit hook runs a REAL `PRAGMA quick_check`,
   // stats the file and scans /proc for the process holding it, so unlike almost every other store

package/src/patterns.ts

@@ -32,6 +32,7 @@ import type { VectorEntry } from './vector-tier.js';
 import { rankLessonsByDelta, type LessonHistory } from './safla-delta.js';
 import { withStoreLock, withStoreLockSync, StoreLockTimeoutError, StoreLockCompromisedError } from './store-lock.js';
 import { describeNativeDep, exerciseSqliteOpen, probeNativeDep } from './native-dep-probe.js';
+import { classifySqliteReadFailure, warnOnce } from './sqlite-read-helpers.js';
 import {
   lessonPairIdOf,
   mergeLessonFormHits,
@@ -619,9 +620,18 @@ function loadStoreRecordsSync(projectRoot: string): MemoryRecord[] {
   // SQLite tier (only if the db file exists — avoid creating one on a pure read)
   if (sqliteBackend !== 'json' && existsSync(sqlitePath(projectRoot))) {
     try {
-      const db = SqliteBackend.open(sqlitePath(projectRoot));
+      const db = SqliteBackend.openReadOnly(sqlitePath(projectRoot));
       try { for (const r of db.allSync()) add(r); } finally { db.close(); }
-    } catch { /* native unavailable — fall through to JSON */ }
+    } catch (err) {
+      // FR-2 (readonly-residuals): native-unavailable stays a silent JSON fallback (unchanged
+      // behaviour); store-unreadable (a corrupt/broken store) warns once instead of silently
+      // looking like "fewer lessons".
+      if (classifySqliteReadFailure(err) === 'store-unreadable') {
+        const cause = err instanceof Error ? err.message : String(err);
+        const path = sqlitePath(projectRoot);
+        warnOnce(path, `dz: ${path} unreadable (${cause}) — falling back to the JSON store`);
+      }
+    }
   }
   // JSON store (the deterministic fallback; also the source during migration)
   try {
@@ -1266,7 +1276,7 @@ export function recallPatterns(
   const { sqliteBackend } = readLearningConfig(projectRoot);
   if (sqliteBackend !== 'json' && existsSync(sqlitePath(projectRoot))) {
     try {
-      const db = SqliteBackend.open(sqlitePath(projectRoot));
+      const db = SqliteBackend.openReadOnly(sqlitePath(projectRoot));
       try {
         if (!classFormIndexPresent(projectRoot)) {
           return sinkQuarantined(
@@ -1283,7 +1293,16 @@ export function recallPatterns(
       } finally {
         db.close();
       }
-    } catch { /* fall through to JSON */ }
+    } catch (err) {
+      // FR-2 (readonly-residuals): same classify-then-warn-once as loadStoreRecordsSync — a
+      // native-unavailable failure keeps the silent JSON fallback; a store-unreadable failure
+      // warns once instead of silently looking like "fewer lessons".
+      if (classifySqliteReadFailure(err) === 'store-unreadable') {
+        const cause = err instanceof Error ? err.message : String(err);
+        const path = sqlitePath(projectRoot);
+        warnOnce(path, `dz: ${path} unreadable (${cause}) — falling back to the JSON store`);
+      }
+    }
   }
   try {
     const backend = JsonFileBackend.openSync(storePath(projectRoot));

package/src/repository-origin.ts

@@ -1 +1,7 @@
-export const REPOSITORY_ORIGIN = 'git+https://github.com/djd1m/dz-harness-hub.git';
+// Points at the public mirror repo (git+https://github.com/djd1m/dz-harness.git), not the private
+// dz-harness-hub monorepo. Decision + rationale: docs/public-mirror-plan.md (2026-08-29) and
+// feature-adr npm-readme-install-first (2026-09-13, FR-5, owner approval "возвращать" 07:05 UTC).
+// A prior "hygiene" pass (278debac, 2026-09-10) flipped this to the private origin because the
+// decision lived only in prose; package-repository-field.test.ts now cites this same trail so a
+// future pass reads the reason before reverting it again (teach:a05c61bb).
+export const REPOSITORY_ORIGIN = 'git+https://github.com/djd1m/dz-harness.git';

package/src/round-exec.ts

@@ -0,0 +1,85 @@
+/** Pure parsing and classification for one `dz round exec` subprocess receipt. */
+
+export type RoundExecOutcome =
+  | 'done'
+  | 'timeout'
+  | 'session-limit'
+  | 'model-refused'
+  | 'failed'
+  | 'empty';
+
+export interface RoundExecLedgerRow {
+  readonly stage: 'round-exec';
+  readonly slug: string;
+  readonly round: number;
+  readonly coder: string;
+  readonly minutes: number;
+  readonly tokens: number | null;
+  readonly agents: 1;
+  readonly outcome: RoundExecOutcome;
+  readonly exitCode: number | null;
+  readonly bytes: number;
+  readonly startedAt: string;
+  readonly endedAt: string;
+  readonly log: string;
+  readonly brief: string;
+}
+
+export function parseCodexTokens(logText: string): number | null {
+  const matches = [...logText.matchAll(/^tokens used[ \t]*\r?\n([0-9][0-9, \t]*)[ \t]*$/gmi)];
+  const raw = matches.at(-1)?.[1];
+  if (raw === undefined) return null;
+  const parsed = Number(raw.replace(/[ ,\t]/g, ''));
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null;
+}
+
+export function classifyRoundExecOutcome(input: {
+  readonly exitCode: number | null;
+  readonly timedOut: boolean;
+  readonly bytes: number;
+  readonly tail: string;
+}): RoundExecOutcome {
+  if (input.timedOut) return 'timeout';
+  if (/rate limit|usage limit|limit reached/i.test(input.tail)) return 'session-limit';
+  if (/HTTP 400|not supported when using Codex/i.test(input.tail)) return 'model-refused';
+  if (input.exitCode === 0 && input.bytes > 0) {
+    const marker = input.tail.lastIndexOf('\ncodex\n');
+    const finalLine = marker < 0 ? '' : input.tail.slice(marker + '\ncodex\n'.length).split(/\r?\n/, 1)[0]?.trim() ?? '';
+    if (finalLine !== '') return 'done';
+  }
+  if (input.exitCode === 0 && input.bytes === 0) return 'empty';
+  return 'failed';
+}
+
+export function buildRoundExecRow(input: {
+  readonly slug: string;
+  readonly round: number;
+  readonly model: string;
+  readonly effort: string;
+  readonly minutes: number;
+  readonly tokens: number | null;
+  readonly outcome: RoundExecOutcome;
+  readonly exitCode: number | null;
+  readonly bytes: number;
+  readonly startedAt: string;
+  readonly endedAt: string;
+  readonly log: string;
+  readonly brief: string;
+}): RoundExecLedgerRow {
+  return {
+    stage: 'round-exec',
+    slug: input.slug,
+    round: input.round,
+    coder: `codex:${input.model}:${input.effort}`,
+    minutes: input.minutes,
+    tokens: input.tokens,
+    agents: 1,
+    outcome: input.outcome,
+    exitCode: input.exitCode,
+    bytes: input.bytes,
+    startedAt: input.startedAt,
+    endedAt: input.endedAt,
+    log: input.log,
+    brief: input.brief,
+  };
+}