dsh-tower 2.1.0-beta.1 → 2.1.0

package/CHANGELOG.md

@@ -4,6 +4,57 @@
 
 ## 未发布（Unreleased）
 
+## 2.1.0（2026-10-23）
+
+### 新增
+
+- **#72 state 迁移**：`state.json` 的 `schemaVersion` 升到 3（v1→v2→v3 有序迁移链），并新增有序、纯函数式的迁移注册表
+  （`domain/state/migrations.js`）。旧 state 在持有 state 锁的加载中自动迁移：先写
+  `state.json.v<N>.bak` 备份，再原子替换、`revision` 只 +1、并向 activity 追加
+  `state.migrated {from,to}`；只读工具只在内存中迁移，不改写文件。由更新插件写入的 state 现在
+  以 `[tower:state-version-unsupported]` 拒绝（不再误报 `state-corrupt`），且绝不会被降级重写；
+  迁移抛错以 `[tower:state-migration-failed]` 报出，原文件保持字节不变。`tower_doctor` 新增
+  `stateSchema {currentVersion,supportedVersion,migrations,status}` 与 `state-schema` 检查。
+- **#73 终态任务归档**：`merged`/`abandoned` 且 worktree 已移除的 mission 在达到可配置策略
+  （`archive.enabled`/`archive.afterDays`/`archive.maxMissions`）后，于下一次变更边界移入
+  `<git-common-dir>/dsh-tower/archive/index.json` 与 `archive/<year>.json`（各自带 `archiveVersion`
+  头）。归档保留完整 mission、tasks、reviews、findings 与完成报告，state.json 只保留活跃任务，
+  因此每次 mutation 不再重写全部历史；归档按 id 幂等，进程崩溃后可重试。`tower_status` 默认只列
+  活跃任务，`includeArchived:true` 在活跃页后追加 `archived:true` 的压缩摘要（不含报告正文），
+  `missionId` 详情会从 year 文件加载；归档损坏时降级为 `archive.unreadable` 诊断而不是抛错。
+  `tower_doctor` 新增 `archive {missions,archivedMissions,stateBytes,archiveBytes,years,files,
+  unreadable,policy}` 与 `archive` 检查。`tower_preflight`/`tower_merge` 对已归档 mission 保持原行为，
+  新 mission 的编号也会避开归档 id。
+
+- **#88 Unicode mission 标题**：`validateTitle` 改为接受可打印 Unicode（NFC 归一化、120 码点上限），
+  显式拒绝 bidi override（U+202A–202E、U+2066–2069）与零宽字符（U+200B–200D、U+FEFF），控制/格式/
+  代理码点单独报错；mission id 仍为 ASCII。CJK/西里尔/日韩/emoji 标题可完整往返 `tower_plan` →
+  state → `tower_status` → `MISSIONS.md` → briefing，board 表格保持对齐。
+### 变更
+
+- **#89 completion report 上限**：`tower_complete.report` 新增 `gates.maxReportBytes`
+  （默认 32768，按 **UTF-8 字节**而非字符计）硬上限；超限以 `invalid-argument` 拒绝并给出
+  `nextAction`（把全文写进 mission worktree 的文件并引用路径），绝不截断。存储的完成报告新增
+  `reportBytes`；`tower_status` 的分页摘要只返回大小，完整正文只在 `missionId` 详情中返回；
+  `tower_doctor` 新增 `reports` 检查并报告仓库中最大的报告。旧 state 无需迁移：缺失
+  `reportBytes` 时在读取时按 UTF-8 字节推导。
+
+- **#90 scope 大小写**：`tower_init` 在检出目录上做一次性大小写探测并记录 `caseInsensitive`
+  （探测失败记录 `null`，比较继续使用安全的 case-sensitive 默认值）；`tower_doctor` 报告
+  `caseInsensitive` 与生效的 `comparisonMode`。在大小写不敏感的文件系统上，`fileInScope` 与
+  `scopesOverlap` 折叠双方，因此 `src/Api/**` 与 `src/api/**` 视为重叠（plan 自动串行、扩 scope
+  被拒绝），仅大小写不同的改动不再被 out-of-scope 门禁拒绝；在大小写敏感的检出上仍拒绝，但 blocker
+  detail 会指出折叠大小写后本可匹配的 scope 条目。存储的 scope 文本保持原样。state schema 升到 3，
+  v2 → v3 迁移回填 `caseInsensitive: null`。
+
+- **#86 平台矩阵 CI**：`test` job 改为显式 include 矩阵——ubuntu Node 22/24 与 Windows Node 22
+  （`test (22)`/`test (24)`/`test (22, windows)`），required context 名称不变；`win32Lower`/`isInside`、
+  `shellSpec`、`renameWithRetry`、`unlinkWithRetry`、worktree `compareKey` 均改为可注入 seam，并在任意
+  OS 上断言两条分支。Windows leg 已加入 `main` 的 required checks。
+
+- **#91 Windows 测试确定性**：新增 `tests/helpers/cleanup.mjs`（有界重试 + 隔离 rename + `os.tmpdir()`
+  守卫），37 个测试文件、106 处直接 `rmSync` 全部迁移；导入时把 Windows CI 的 8.3 短路径 TEMP
+  规范化，消除短/长路径比较失败；Windows 全量套件连续 5 次全绿。
 ## 2.1.0-beta.1（2026-10-22）
 
 **预发布**：本版本发布到 npm 的 `next` dist-tag，`latest` 继续保持 `2.0.4`，直到出现稳定版本。

package/COMPATIBILITY.md

@@ -5,6 +5,7 @@ is shipped in the npm package; doctor reads it locally and never contacts a regi
 
 | dsh version | tag / commit | verified on | what was run |
 |---|---|---|---|
+| 0.2.1-rc.2 | v2.1.0 | 2026-10-23 | mount smoke (29 tower tools, `/tower`, 3 skills, 2 presets, single bundle row), `npm test` (479), `npm run docs:check`, generated docs checks |
 | 0.2.1-rc.2 | v2.1.0-beta.1 | 2026-10-22 | mount smoke (29 tower tools, `/tower`, 3 skills, 2 presets, single bundle row), `npm test` (413), `npm run docs:check`, generated docs checks |
 | 0.2.1-rc.2 | 6ee19de | 2026-10-21 | `npm test` (229), `npm run docs:check`, offline `ui-bundle` tests |
 | 0.2.1-rc.2 | 5b0accd | 2026-10-18 | `npm test` (219), `npm run docs:check` |

package/CONTRIBUTING.md

@@ -20,6 +20,13 @@ and every PR stays unmergeable. The setting and its verification command are in
 [SECURITY.md](SECURITY.md#repository-protection-on-main). The `mount-fixtures` job runs the seeded
 smoke failures for evidence but is deliberately **not** a required context.
 
+The offline `test` matrix also has a `test (22, windows)` leg on `windows-latest` (Node 22). It runs the
+offline suite and the offline gates, not the release/coverage steps, so the platform branches are
+measured on a real Windows filesystem (see `tests/platform.test.mjs`). Its name is pinned through
+`matrix.name` so the two required contexts above stay byte-identical. The Windows leg is **not** a
+required context yet: #86 only asks that it exists and is green, and adding it to the protection setting
+is a separate human step.
+
 There are no mandatory approvals, no CODEOWNERS gate, and **merging your own PR is allowed**: there is
 one maintainer, and a mandatory self-approval would be theatre. What replaces the second reviewer is a
 written contract.
@@ -74,7 +81,7 @@ Requirements: Node.js 22+, Git. No package installation is needed for the offlin
 
 ## Pull request checklist
 
-1. `npm test` passes locally (416 tests today, including protocol end-to-end against a real temporary Git repository and mock spawn coverage) and `npm run docs:check` passes.
+1. `npm test` passes locally (479 tests today, including protocol end-to-end against a real temporary Git repository and mock spawn coverage) and `npm run docs:check` passes.
 2. New behavior has a test. Bug fixes should add a test that fails before the fix.
 3. No secrets, tokens, personal paths, session logs, or generated artifacts are added. `.gitignore` covers local acceptance output; do not force-add it.
 4. Keep the public API and state-file formats compatible; if a change is breaking, call it out in `CHANGELOG.md` and bump the version.

package/README.en.md

@@ -18,6 +18,7 @@ The repository root **is** the DSH bundle: `package.json` declares `dsh.bundle.p
 - **Missions with real isolation.** Every mission gets its own branch and Git worktree; workers never touch your checkout.
 - **Review-gated merges.** When `review.requireReview:true`, a reviewer bound to the current branch tip must submit a `clean` / `merge` verdict before merge; the merge gate re-checks scope, staleness, task completion, review history, and worktree ownership before a `--no-ff` merge. Independent review is optional by default (the gate is off); use `reviewPolicy:"none"` + reason plus `gates.allowReviewExemption:true` for a single mission when the global gate is on.
 - **Durable coordination.** Roster, inbox, findings, reviews, and mission state are persisted under `.git/dsh-tower/`, so a restart does not lose the plan.
+- **Bounded state growth.** Terminal missions whose worktree is gone move to `.git/dsh-tower/archive/` once `archive.afterDays`/`archive.maxMissions` says so, keeping their tasks, reviews, findings and completion report; mutations then rewrite only active work. `tower_status includeArchived` lists compact archived summaries, and `tower_doctor` reports archive size, count and policy.
 - **Safe by default.** While Tower mode is active, `create_goal`, `update_goal(resume)`, `todo_write`, the Team task board, and `spawn_teammate` are refused; a paused goal is never resumed automatically.
 - **Traceable finding lifecycle.** `tower_findings` lists, reads, and moves findings through `open → triaged → fixed` / `wontfix` (and can reopen); only the tower or a worker may change state, while reviewers can only read.
 - **Repository-level config.** Any repository can override review/merge/worktree/spawn policy in `<git-common-dir>/dsh-tower/config.json`; tool arguments override the repository layer, so no profile edit is needed per repository.
@@ -207,7 +208,7 @@ Workers use the bundled `tower-worker` preset (writable worktree surface); revie
 | `locale/`, `icon.svg` | localization and icon |
 | `tests/` | pure-function, protocol end-to-end, and plugin-level tests; optional isolated Web-runtime scripts |
 | `ui-bundle/` | optional Client widget (Tower tool cards, persistent Tower-mode chip, mode-aware denied rows, dock summary, transient overlay strip), not installed by default |
-| `.github/workflows/test.yml` | CI running the offline suite on Node 22/24, the release and coverage checks, and the Node 22 mount smoke and seeded fixtures |
+| `.github/workflows/test.yml` | CI running the offline suite on Node 22/24 (Ubuntu) and Node 22 (Windows), the release and coverage checks, and the Node 22 mount smoke and seeded fixtures |
 
 ## Development and testing
 
@@ -227,12 +228,17 @@ Every push and PR runs the same set of jobs; each job backs one checkable claim
 
 | Job | Claim | Evidence |
 |---|---|---|
-| `test` (Node 22/24) | the offline suite, documentation consistency, generated references, the published file list, architecture, types, and domain purity all hold | `npm test`, `npm run docs:check`, the three `docs:check:generated*` checks, `pack:check`, `architecture:check`, `types:check`, `domain:check` |
+| `test (22)`, `test (24)` (Ubuntu) | the offline suite, documentation consistency, generated references, the published file list, architecture, types, and domain purity all hold | `npm test`, `npm run docs:check`, the three `docs:check:generated*` checks, `pack:check`, `architecture:check`, `types:check`, `domain:check` |
+| `test (22, windows)` (`windows-latest`, not required) | the same offline suite and offline gates hold on a real Windows filesystem, so path casing, the `pwsh` shell, and the rename/unlink retries are measured instead of assumed | `npm test` plus the same offline gates as Ubuntu (no release/coverage) |
 | `test`'s `Coverage (Node 22)` step | coverage is actually measured in CI (reported only: no threshold, no badge) | `npm run test:coverage` |
 | `test`'s `Release check` step (Node 22) | a tag is a claim: the version moved past the previous version tag, a pushed tag is `v<version>`, and the changelog carries release content | `npm run release:check` |
 | `mount` (Node 22) | the packed tarball, added through the plugin CLI to a throwaway profile, mounts in the real loader and registers the surface the bundle claims | `npm run smoke:mount` |
 | `mount-fixtures` (Node 22, not required) | the mount smoke still goes red for the right seeded reasons (a renamed tool id, a removed skills section), with one cached host install shared by all runs | `npm run smoke:fixtures -- --host-dir <cached host>` |
 
+The `test` matrix pins each leg's context string through `matrix.name`: `test (22)`, `test (24)` and the new `test (22, windows)`. The first two are `main`'s required checks and keep their exact names; adding an `os` matrix key without an explicit name would rename them to `test (22, ubuntu-latest)`, and protected `main` would wait for a context that never reports. The Windows leg is Node 22 only and runs the offline suite and offline gates (no browser, no live suite, no release/coverage), in parallel with the existing jobs, so it does not extend the critical path. It is not a required context yet: making it green is the acceptance for #86, while adding it to the protection setting is a human step in #94.
+
+`tests/platform.test.mjs` injects `platform`/`rename`/`unlink` so both the win32 and POSIX branches are asserted on any OS; the only case that needs a real Windows filesystem (renaming over an open destination) is counted as `# SKIP` on Linux (`tests 11`, `skipped 1`), never silently absent. There is no macOS runner: macOS follows the same POSIX branch as Linux, which is a #86 non-goal.
+
 `mount` asserts the throwaway profile's **loaded surface**, never the text of `cordis.patch.yml`: 29 `tower_*` tools (27 `tools/*.js` modules plus `tower_mode` / `tower_control`), the 3 bundled skills, both the `tower-worker` and `tower-reviewer` presets, the `/tower` command, and exactly one top-level `tower-bundle` group row (the #66 invariant). It calls no model and opens no browser. Measured on the maintainer's Windows machine: about 100 seconds on a cold host (install included) and about 85 seconds with a cached host; the CI step allows 3 minutes (`timeout-minutes: 3`) inside the 5-minute `mount` job. A red run prints the resolved profile path, the host build, the loaded counts, and every unmet claim.
 
 The host build is pinned in exactly one place, `scripts/mount-smoke/host.json`; a unit test keeps the newest `COMPATIBILITY.md` row equal to it, so a release never retypes it. `npm run smoke:fixtures` proves the smoke still fails for the right seeded reasons (a renamed tool id, a removed skills section). CI runs it as the non-required `mount-fixtures` job, where the control and both seeds share one cached host install through `--host-dir` (about 2 minutes warm here).

package/README.md

@@ -18,6 +18,7 @@ Tower 模式与 mission/审查工作流的灵感来自 Moonshot AI 的 **Kimi Co
 - **任务级隔离。** 每个 mission 使用独立分支和 Git worktree，worker 不会碰到你的主检出。
 - **审查门禁合并。** 开启 `review.requireReview:true` 时，审查者针对当前分支 tip 给出 `clean` / `merge` 结论；合并门禁重新校验 scope、分支新鲜度、任务完成度、审查记录与 worktree 归属，通过后才执行 `--no-ff` 合并。独立审查默认可选（门禁关闭）；全局开启时，单个 mission 用 `reviewPolicy:"none"` + 理由并开启 `gates.allowReviewExemption:true` 做更窄豁免。
 - **可恢复的协作状态。** roster、inbox、findings、reviews 与 mission 状态持久化在 `.git/dsh-tower/` 下，重启不会丢计划。
+- **受控的状态增长。** worktree 已移除的终态任务在达到 `archive.afterDays`/`archive.maxMissions` 后移入 `.git/dsh-tower/archive/`，保留 tasks、reviews、findings 与完成报告；此后 mutation 只重写活跃工作。`tower_status includeArchived` 列出压缩后的归档摘要，`tower_doctor` 报告归档大小、数量与策略。
 - **默认安全。** Tower 模式开启期间拒绝 `create_goal`、`update_goal(resume)`、`todo_write`、Team 任务板与 `spawn_teammate`；被暂停的 goal 不会被自动恢复。
 - **可追溯的 finding 生命周期。** `tower_findings` 列表、读取并按 `open → triaged → fixed` / `wontfix` 流转，也可重新打开；只有 tower 或 worker 能改状态，reviewer 只能读。
 - **仓库级配置。** 每个仓库可用 `<git-common-dir>/dsh-tower/config.json` 覆盖 review/merge/worktree/spawn 策略，工具参数再覆盖仓库配置；无需为不同仓库改 profile。
@@ -203,7 +204,7 @@ worker 与 reviewer 是使用内置 `tower-worker` preset 的普通 DSH 子代
 | `locale/`、`icon.svg` | 本地化与图标 |
 | `tests/` | 纯函数、协议 e2e、插件级测试；可选的真实 Web 运行时脚本 |
 | `ui-bundle/` | 可选 Client 小挂件（Tower 工具卡片、Tower·on 状态 chip、模式感知的 disabled 行、dock 摘要、临时 overlay 状态条），默认不安装 |
-| `.github/workflows/test.yml` | CI：Node 22/24 离线套件、release 与覆盖率检查、Node 22 挂载 smoke 与种子失败 fixtures |
+| `.github/workflows/test.yml` | CI：Ubuntu 上 Node 22/24 与 Windows 上 Node 22 的离线套件、release 与覆盖率检查、Node 22 挂载 smoke 与种子失败 fixtures |
 
 ## 开发与测试
 
@@ -221,12 +222,17 @@ npm test        # node --test tests/*.test.mjs
 
 | Job | 声明 | 证据 |
 |---|---|---|
-| `test`（Node 22/24） | 离线套件、文档一致性、生成文档、发布文件清单、架构、类型与 domain 纯度全部成立 | `npm test`、`npm run docs:check`、三个 `docs:check:generated*`、`pack:check`、`architecture:check`、`types:check`、`domain:check` |
+| `test (22)`、`test (24)`（Ubuntu） | 离线套件、文档一致性、生成文档、发布文件清单、架构、类型与 domain 纯度全部成立 | `npm test`、`npm run docs:check`、三个 `docs:check:generated*`、`pack:check`、`architecture:check`、`types:check`、`domain:check` |
+| `test (22, windows)`（`windows-latest`，非必需检查） | 同一套离线套件与离线 gates 在真实 Windows 文件系统上成立；路径大小写、`pwsh` shell、rename/unlink 重试都不是只在 Linux 上被假设 | `npm test` + 与 Ubuntu 相同的离线 gates（不跑 release/coverage） |
 | `test` 的 `Coverage (Node 22)` 步骤 | 覆盖率在 CI 中真实测量（只报告，不设阈值、不加徽章） | `npm run test:coverage` |
 | `test` 的 `Release check`（Node 22）步骤 | tag 是一种声明：版本已越过上一个版本 tag、推送的 tag 是 `v<version>`、CHANGELOG 带有发布内容 | `npm run release:check` |
 | `mount`（Node 22） | 打出的 tarball 经 plugin CLI 装进一次性 profile 后，真实 loader 挂载并注册了 bundle 声称的表面 | `npm run smoke:mount` |
 | `mount-fixtures`（Node 22，非必需检查） | mount smoke 仍会因正确的种子失败而变红（改名一个工具 id、删除 skills 段），三次运行共用一次缓存的 host 安装 | `npm run smoke:fixtures -- --host-dir <缓存的 host>` |
 
+`test` 的三条 leg 在 job 内用 `matrix.name` 固定各自的 context 字符串：`test (22)`、`test (24)` 与新增的 `test (22, windows)`。前两条是 `main` 的必需检查，名字逐字节不变；把 `os` 直接塞进 matrix 会把它们改名成 `test (22, ubuntu-latest)`，保护规则将永远等不到该 context，所以矩阵用显式 `include` + `name`。Windows leg 只跑 Node 22 和离线套件/离线 gates（无浏览器、无 live suite、无 release/coverage），与现有 job 并行，不延长关键路径。它目前不是必需 context：让它变绿是本 issue 的验收，把它加入保护设置是 #94 的人工步骤。
+
+`tests/platform.test.mjs` 用注入的 `platform`/`rename`/`unlink` 在任意 OS 上同时断言 win32 与 POSIX 两条分支；唯一需要真实 Windows 的“rename 覆盖被打开的目标文件”用例在 Linux 上以 `# SKIP` 计入 TAP（`tests 11`、`skipped 1`），而不是静默消失。macOS 不单设 runner：它与 Linux 走同一条 POSIX 分支，这是 #86 的非目标。
+
 `mount` 断言一次性 profile 的**已加载表面**，而不是 `cordis.patch.yml` 的文本：29 个 `tower_*` 工具（27 个 `tools/*.js` 模块 + `tower_mode` / `tower_control`）、3 个内置 skill、`tower-worker` / `tower-reviewer` 两个 preset、`/tower` 命令，以及唯一一个顶层 `tower-bundle` group 行（#66）。它不调用模型、不打开浏览器。在维护者的 Windows 机器上实测：host 冷装（含安装）约 100 秒，host 已缓存约 85 秒；CI 中该步骤上限为 3 分钟（`timeout-minutes: 3`），`mount` job 上限 5 分钟。红叉会打印解析后的 profile 路径、host build、已加载计数与每一条未满足的声明。
 
 host build 只固定在一个地方：`scripts/mount-smoke/host.json`，`COMPATIBILITY.md` 最新一行由单元测试强制与它一致，发布时不再各写一遍。`npm run smoke:fixtures` 用两种种子失败（改名一个工具 id、删除 skills 段）证明 smoke 会以正确原因变红；CI 中它作为非必需的 `mount-fixtures` job 运行，control 与两个种子通过 `--host-dir` 共用一次缓存的 host 安装（本机热跑约 2 分钟）。

package/adapters/default.js

@@ -1,10 +1,12 @@
 // Default composition root for Tower dependencies (#50).
 import * as store from '../lib/store.js'
 import * as vcs from '../lib/git.js'
+import * as caseSensitivity from '../lib/caseSensitivity.js'
 
 export const defaultDeps = {
   store,
   vcs,
+  caseSensitivity,
   clock: { now: () => Date.now() },
   ids: { uuid: () => crypto.randomUUID() },
 }

package/app/archive.js

@@ -0,0 +1,190 @@
+// Terminal-mission archival use case (#73).
+//
+// The policy sweep runs inside an existing state lock, immediately before the
+// caller writes state.json: archive files are written first, then the state
+// document is compacted, so a crash between the two leaves the mission in state
+// and the archive entry is deduped by id on retry. Nothing is deleted: the full
+// mission, its linked reviews and its findings are moved to archive/<year>.json.
+import { appendJsonl } from '../lib/store.js'
+import { readArchiveIndex, readArchivedEntry, writeArchiveEntries } from '../lib/archive.js'
+import { hasLiveAgent } from '../domain/integration/liveness.js'
+import { missionSummary } from '../domain/summary.js'
+import {
+  archiveYearFor,
+  archivedEntry,
+  isClosedFinding,
+  linkedFindings,
+  linkedReviews,
+  selectForArchive,
+} from '../domain/state/archive.js'
+
+/** @typedef {import('../types/index.js').Mission} Mission */
+/** @typedef {import('../types/index.js').TowerState} TowerState */
+
+/**
+ * Read `archive/index.json` through the Tower's store. Never throws: the
+ * returned `ok:false` carries the diagnostic that status/doctor surface.
+ * @param {any} tower
+ * @returns {Promise<{ ok: boolean, file: string, missions: any[], error?: string, exists: boolean }>}
+ */
+export function archiveIndex(tower) {
+  return readArchiveIndex(tower.deps.store, tower.paths)
+}
+
+/**
+ * Load one archived mission with its linked reviews and findings.
+ * @param {any} tower
+ * @param {string} missionId
+ */
+export function archivedMission(tower, missionId) {
+  return readArchivedEntry(tower.deps.store, tower.paths, missionId)
+}
+
+/**
+ * A compact archived mission is rendered through the same summary projection as
+ * an active one, plus `archived: true`. The completion report and task bodies
+ * are intentionally absent: they live in the year file and are loaded only by
+ * `tower_status missionId`.
+ * @param {Record<string, any>} entry
+ * @returns {any}
+ */
+export function archivedSummary(entry) {
+  const mission = /** @type {any} */ ({
+    id: entry.id,
+    title: entry.title,
+    kind: entry.kind ?? 'build',
+    status: entry.status,
+    scope: Array.isArray(entry.scope) ? entry.scope : [],
+    deps: Array.isArray(entry.deps) ? entry.deps : [],
+    owner: entry.owner ?? null,
+    worktree: null,
+    blockers: [],
+    tasks: [],
+    reviewPolicy: 'required-clean',
+    mergedCommit: entry.mergedCommit ?? null,
+    mergedAt: entry.mergedAt ?? null,
+    updatedAt: entry.updatedAt ?? null,
+  })
+  return {
+    ...missionSummary(mission),
+    archived: true,
+    archivedAt: entry.archivedAt,
+    archivedYear: entry.archivedYear ?? null,
+    branch: entry.branch ?? null,
+  }
+}
+
+/**
+ * Status/board view of the archive index: a count plus a diagnostic, never a
+ * thrown error.
+ * @param {{ ok: boolean, file: string, missions: any[], error?: string, exists: boolean }} index
+ * @returns {Record<string, any>}
+ */
+export function archiveView(index) {
+  const years = index.ok
+    ? [...new Set(index.missions.map((entry) => entry.archivedYear).filter((year) => Number.isInteger(year)))].sort(
+        (left, right) => left - right,
+      )
+    : []
+  return {
+    count: index.ok ? index.missions.length : 0,
+    years,
+    file: index.file,
+    present: index.exists === true,
+    unreadable: index.ok ? false : true,
+    ...(index.ok ? {} : { message: index.error ?? 'tower archive is unreadable' }),
+  }
+}
+
+/**
+ * Move the eligible terminal missions out of `state` and into the archive.
+ * Mutates `state` in memory (missions, linked reviews and closed findings) and
+ * leaves the caller to validate/persist it under the lock it already holds.
+ *
+ * @param {any} tower
+ * @param {TowerState} state
+ * @param {{ now?: number, force?: boolean, activity?: Record<string, string | undefined> }} [options]
+ * @returns {Promise<{ archived: string[], written: boolean, files?: string[], error: string | null, year?: number }>}
+ */
+export async function sweepArchive(tower, state, options = {}) {
+  const policy = tower.config.archive ?? {}
+  if (policy.enabled === false) return { archived: [], written: false, error: null }
+  const now = options.now ?? Date.now()
+  const activity = options.activity ?? {}
+
+  // Open batches still need their members; a live agent's mission is never
+  // archived even if it is terminal (defence in depth; teardown keeps it too).
+  const protectedIds = new Set()
+  for (const batch of state.batches ?? []) {
+    const record = /** @type {Record<string, any>} */ (batch)
+    if (record.status !== 'open') continue
+    for (const missionId of Array.isArray(record.missionIds) ? record.missionIds : []) {
+      protectedIds.add(String(missionId))
+    }
+  }
+  for (const mission of state.missions) {
+    if (hasLiveAgent(state, mission.id, activity)) protectedIds.add(mission.id)
+  }
+
+  const selected = selectForArchive(state.missions, policy, {
+    now,
+    force: options.force === true,
+    protectedIds,
+  })
+  if (selected.length === 0) return { archived: [], written: false, error: null }
+
+  const archivedYear = archiveYearFor(now)
+  const entries = selected.map((mission) =>
+    archivedEntry(mission, {
+      archivedAt: now,
+      archivedYear,
+      reviews: linkedReviews(mission, state.reviews),
+      findings: linkedFindings(mission, state.findings),
+    }),
+  )
+
+  let written
+  try {
+    written = await writeArchiveEntries(tower.deps.store, tower.paths, { entries, now })
+  } catch (error) {
+    return { archived: [], written: false, error: `archive write failed: ${String(error?.message ?? error)}` }
+  }
+  if (!written.ok) return { archived: [], written: false, error: written.error ?? 'archive write failed' }
+
+  // The archive now holds the full record: compact state.json in the same lock.
+  const ids = new Set(selected.map((mission) => mission.id))
+  const branches = new Set(
+    selected
+      .map((mission) => mission.worktree?.branch)
+      .filter((branch) => typeof branch === 'string'),
+  )
+  state.missions = state.missions.filter((mission) => !ids.has(mission.id))
+  if (Array.isArray(state.reviews)) {
+    state.reviews = state.reviews.filter((review) => !ids.has(review.missionId) && !branches.has(review.branch))
+  }
+  // Open findings stay actionable in state.json; the archive keeps a snapshot.
+  if (Array.isArray(state.findings)) {
+    state.findings = state.findings.filter(
+      (finding) => !(finding.missionId != null && ids.has(finding.missionId) && isClosedFinding(finding)),
+    )
+  }
+  state.revision += 1
+  state.updatedAt = now
+
+  for (const mission of selected) {
+    await appendJsonl(tower.paths.activity, {
+      at: now,
+      type: 'archive',
+      missionId: mission.id,
+      text: `archived to archive/${archivedYear}.json`,
+    }).catch(() => {})
+  }
+
+  return {
+    archived: [...ids],
+    written: true,
+    files: written.files,
+    error: null,
+    year: archivedYear,
+  }
+}

package/app/board.js

@@ -2,6 +2,7 @@
 import path from 'node:path'
 import { fsp } from '../adapters/store-fs.js'
 import { renameWithRetry } from '../lib/store.js'
+import { archiveView } from './archive.js'
 
 export function boardFile(tower) {
   return tower.config.docs?.boardLocation === 'repo'
@@ -13,10 +14,11 @@ export async function writeBoard(tower) {
   if (tower.config.docs?.board === false) return null
   try {
     const state = await tower.load()
+    const index = await tower.archiveIndex()
     const file = boardFile(tower)
     await tower.ensureExcluded(file)
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`
-    await fsp.writeFile(tmp, tower.boardMarkdown(state), 'utf8')
+    await fsp.writeFile(tmp, tower.boardMarkdown(state, archiveView(index)), 'utf8')
     await renameWithRetry(tmp, file)
     return file
   } catch {

package/app/checkCompletion.js

@@ -10,6 +10,7 @@ import { fullMission } from '../domain/summary.js'
 import { validateState } from '../domain/state.js'
 import { countCommits, isClean } from '../lib/git.js'
 import { withLock, writeJsonAtomic, appendJsonl } from '../lib/store.js'
+import { sweepArchive } from './archive.js'
 
 export { normalizeChecks }
 
@@ -19,7 +20,12 @@ export async function checkCompletion(tower, input) {
   if (!mission) {
     throw new TowerToolError('invalid-argument', `unknown mission "${input.missionId}"`)
   }
-  const worker = assertCompletionRequest({ mission, roster: state.roster, input })
+  const worker = assertCompletionRequest({
+    mission,
+    roster: state.roster,
+    input,
+    maxReportBytes: tower.config.gates?.maxReportBytes,
+  })
   await tower.assertWorktree(mission.worktree)
   const commits = await countCommits(mission.worktree.path, mission.worktree.baseCommit)
   if (commits < 1) {
@@ -58,8 +64,15 @@ export async function complete(tower, input) {
     const checks = normalizeChecks(input.checks)
     const now = Date.now()
     mission.status = 'completed'
-    mission.completionReport = completionReport({ report: input.report, worker, checks, now })
+    mission.completionReport = completionReport({
+      report: input.report,
+      worker,
+      checks,
+      now,
+      maxReportBytes: tower.config.gates?.maxReportBytes,
+    })
     mission.updatedAt = now
+    await sweepArchive(tower, state, { now })
     state.revision += 1
     state.updatedAt = now
 

package/app/gate.js

@@ -20,8 +20,23 @@ import {
 
 export async function evaluateGate(tower, input) {
     const state = await tower.load()
-    const mission = state.missions.find((entry) => entry.id === input.missionId)
+    let mission = state.missions.find((entry) => entry.id === input.missionId)
+    let archivedEntry = null
+    if (!mission) {
+      // A completed mission may have been archived by policy; preflight and
+      // merge must behave the same for it as before the move (#73).
+      const archived = await tower.archivedMission(input.missionId)
+      if (archived.ok && archived.entry) {
+        archivedEntry = archived.entry
+        mission = archived.entry.mission
+      }
+    }
     if (!mission) return missingMissionGateResult(input.missionId)
+    const archiveIndex = await tower.archiveIndex()
+    const archivedMissions = new Map(
+      (archiveIndex.ok ? archiveIndex.missions : []).map((entry) => [entry.id, entry]),
+    )
+    const reviews = archivedEntry ? [...(state.reviews ?? []), ...(archivedEntry.reviews ?? [])] : state.reviews
     const activity = input.activity ?? {}
     const blockers = []
     const push = (code, detail) => blockers.push({ code, detail })
@@ -57,7 +72,7 @@ export async function evaluateGate(tower, input) {
           if (blocker) push(blocker.code, blocker.detail)
         }
         if (mission.kind !== 'survey') {
-          const blocker = outOfScopeBlocker({ mission, changedFiles })
+          const blocker = outOfScopeBlocker({ mission, changedFiles, caseInsensitive: state.caseInsensitive === true })
           if (blocker) push(blocker.code, blocker.detail)
         }
         const dirty = (await tower.git(tower.root, ['status', '--porcelain']))
@@ -71,12 +86,12 @@ export async function evaluateGate(tower, input) {
       }
     }
 
-    for (const blocker of dependencyBlockers({ deps: mission.deps ?? [], state })) {
+    for (const blocker of dependencyBlockers({ deps: mission.deps ?? [], state, archived: archivedMissions })) {
       push(blocker.code, blocker.detail)
     }
 
     const branch = worktree ? worktree.branch : null
-    const latest = latestReview(reviewsForBranch(state.reviews, branch))
+    const latest = latestReview(reviewsForBranch(reviews, branch))
     for (const blocker of mergeGateBlockers({
       mission,
       roster: state.roster ?? [],
@@ -94,15 +109,18 @@ export async function evaluateGate(tower, input) {
     const wrongBranch = baseWrongBranchBlocker({ checkoutBranch, base: state.base })
     if (wrongBranch) push(wrongBranch.code, wrongBranch.detail)
 
-    return gateResult({
-      mission: fullMission(mission),
-      worktree,
-      branchTip,
-      baseTip,
-      changedFiles,
-      review: latest,
-      blockers,
-    })
+    return {
+      ...gateResult({
+        mission: fullMission(mission),
+        worktree,
+        branchTip,
+        baseTip,
+        changedFiles,
+        review: latest,
+        blockers,
+      }),
+      ...(archivedEntry ? { archived: true } : {}),
+    }
   }
 
   /** Read-only mission diff for reviewers: branch changes against the merge base. */

package/app/init.js

@@ -7,10 +7,12 @@
 //   commit  — one short state lock writes/claims/reanchors, revalidating the
 //             state revision captured by prepare.
 import { withLock, withGitLock, exists, ensureDir, writeJsonAtomic, appendJsonl } from '../lib/store.js'
+import { detectCaseSensitivity } from '../lib/caseSensitivity.js'
 import { validateState } from '../domain/state.js'
 import { TowerToolError } from '../domain/errors.js'
 import {
   SNAPSHOT_REF_PREFIX,
+  caseProbeActivityText,
   claimCaller,
   createdInitResult,
   existingInitResult,
@@ -33,6 +35,19 @@ function fail(message, code = 'invalid-argument') {
   throw new TowerToolError(code, message)
 }
 
+/**
+ * Probe the checkout's own filesystem through the injected seam. The default
+ * composition uses the real probe; a composition that predates #90 keeps
+ * working through the fallback.
+ * @param {any} tower
+ * @returns {Promise<boolean | null>}
+ */
+async function detectCaseMode(tower) {
+  const detect = tower.deps?.caseSensitivity?.detect
+  if (typeof detect === 'function') return detect(tower.root)
+  return detectCaseSensitivity(tower.root)
+}
+
 /** Phase 1 of `Tower.init` (#51). A read-only init returns its result here. */
 async function prepareInit(tower, input) {
   const dirty = !(await tower.isClean(tower.root))
@@ -60,6 +75,10 @@ async function prepareInit(tower, input) {
     if (ownedByOther(owner, caller)) {
       fail(`tower state is owned by another agent; ${caller} is not the tower`, 'not-authorized')
     }
+    // "Detect once": a state that already carries a boolean is never re-probed,
+    // so a transient probe failure cannot silently flip the comparison mode.
+    const known = state.caseInsensitive === true || state.caseInsensitive === false
+    const caseInsensitive = known ? null : await detectCaseMode(tower)
     let reanchorBase = null
     if (input.reanchor === true) {
       const refusal = reanchorBlockedMessage(state.missions)
@@ -68,10 +87,10 @@ async function prepareInit(tower, input) {
     }
     const claim = claimCaller(owner, caller) !== null
     const reanchor = shouldReanchor({ reanchor: input.reanchor, reanchorBase, currentBase: state.base })
-    if (!claim && !reanchor) {
+    if (!claim && !reanchor && caseInsensitive === null) {
       return { early: existingInitResult({ state, statePath: tower.paths.state, dirty }) }
     }
-    return { stateRevision: state.revision, claim, reanchor, base: reanchorBase, dirty }
+    return { stateRevision: state.revision, claim, reanchor, base: reanchorBase, dirty, caseInsensitive }
   }
 
   return {
@@ -79,6 +98,7 @@ async function prepareInit(tower, input) {
     base: await resolveBase(),
     snapshot: shouldSnapshot({ snapshotDirty: input.snapshotDirty, dirty }),
     dirty,
+    caseInsensitive: await detectCaseMode(tower),
   }
 }
 
@@ -154,6 +174,7 @@ async function commitInitCreate(tower, prepared, acted, input) {
       towerAgentId: input.towerAgentId ? String(input.towerAgentId) : null,
       snapshotCommit: acted.snapshotCommit,
       snapshotRef: acted.snapshotRef,
+      caseInsensitive: prepared.caseInsensitive,
       now,
     })
     validateState(state, tower.paths.state)
@@ -161,7 +182,12 @@ async function commitInitCreate(tower, prepared, acted, input) {
     await appendJsonl(tower.paths.activity, {
       at: now,
       type: 'init',
-      text: initActivityText({ base: prepared.base, snapshotCommit: acted.snapshotCommit, dirty: prepared.dirty }),
+      text: initActivityText({
+        base: prepared.base,
+        snapshotCommit: acted.snapshotCommit,
+        dirty: prepared.dirty,
+        caseInsensitive: prepared.caseInsensitive,
+      }),
     })
     return createdInitResult({
       repoRoot: tower.root,
@@ -171,6 +197,7 @@ async function commitInitCreate(tower, prepared, acted, input) {
       dirty: prepared.dirty,
       snapshotCommit: acted.snapshotCommit,
       snapshotRef: acted.snapshotRef,
+      caseInsensitive: prepared.caseInsensitive,
     })
   })
 }
@@ -205,6 +232,21 @@ async function commitInitExisting(tower, prepared, input) {
       })
     }
     let reanchored = false
+    // Record the one-time case-sensitivity probe (#90). An unknown result is
+    // not persisted, so a later init can retry it without bumping the revision
+    // on every call.
+    if (prepared.caseInsensitive !== null && state.caseInsensitive !== prepared.caseInsensitive) {
+      state.caseInsensitive = prepared.caseInsensitive
+      state.revision += 1
+      state.updatedAt = now
+      validateState(state, tower.paths.state)
+      await writeJsonAtomic(tower.paths.state, state)
+      await appendJsonl(tower.paths.activity, {
+        at: now,
+        type: 'init',
+        text: caseProbeActivityText(prepared.caseInsensitive),
+      })
+    }
     if (prepared.reanchor && state.base !== prepared.base) {
       state.base = prepared.base
       state.baseChangedAt = now

package/app/merge.js

@@ -232,6 +232,12 @@ async function prepareFromState(tower, input, deps) {
   const { mergeTimeoutMs, MERGE_MAX_BUFFER } = deps
   let state = await tower.load()
   let mission = state.missions.find((entry) => entry.id === input.missionId)
+  if (!mission) {
+    // An archived terminal mission still answers `alreadyMerged` (or the same
+    // blockers) instead of turning into mission-missing after the move (#73).
+    const archived = await tower.archivedMission(input.missionId)
+    if (archived.ok && archived.entry) mission = archived.entry.mission
+  }
   if (!mission) return { result: missionMissingResult(input.missionId) }
 
   // Reconcile a stale merge intent: Git runs here, outside every state lock.