dsh-tower 2.1.0-beta.1 → 2.1.0

package/docs/reference/tools.md

@@ -11,7 +11,8 @@ The build exposes up to 29 tools: 19 core repository tools below (including `tow
 `task_drop_reason`/`taskDropReason`, `clear_blockers`/`clearBlockers`,
 `include_read`/`includeRead`, `dry_run`/`dryRun`, `timeoutMs`/`timeout_ms`,
 `waitMs`/`wait_ms`, `mission_id`/`missionId` on findings, `agent_id`/`agentId` on interrupt,
-`include_gate`/`includeGate` on status, `retire_missing`/`retireMissing` on adopt. Outputs use
+`include_gate`/`includeGate`, `include_archived`/`includeArchived` on status,
+`retire_missing`/`retireMissing` on adopt. Outputs use
 canonical camelCase names.
 
 ## Roles
@@ -31,16 +32,16 @@ findings but not mutate them. Violations throw `[tower:not-authorized]` or
 | Tool | Parameters | Purpose / notes |
 |---|---|---|
 | `tower_init` | `base?`, `autoGitInit?`, `snapshotDirty?`, `reanchor?` | Create `<git-common-dir>/dsh-tower/state.json`. `autoGitInit` runs `git init` + empty initial commit; `snapshotDirty` records a dangling snapshot commit of uncommitted tracked changes used as the mission baseline; `reanchor` changes base only when no non-terminal mission exists. Returns `dirty`, `snapshotCommit`, `reanchored`. |
-| `tower_plan` | `missions[]` (`title`, `scope[]`, `tasks[]?`, `deps[]?`, `kind?`, `context?`, `references[]?` ≤20, `reviewPolicy?`, `reviewExemptionReason?`) | Create missions `M1..`; overlapping build scopes auto-add a dependency; rejects unknown deps and cycles. `reviewPolicy:"none"` requires a non-empty reason; when the review gate is on, preflight also requires `gates.allowReviewExemption`. |
+| `tower_plan` | `missions[]` (`title` — printable Unicode, NFC-normalized, ≤120 characters, `scope[]`, `tasks[]?`, `deps[]?`, `kind?`, `context?`, `references[]?` ≤20, `reviewPolicy?`, `reviewExemptionReason?`) | Create missions `M1..`; overlapping build scopes auto-add a dependency; rejects unknown deps and cycles. Mission ids stay ASCII (`M1`, `M2`); invisible characters and over-long titles are rejected with `invalid-argument`. `reviewPolicy:"none"` requires a non-empty reason; when the review gate is on, preflight also requires `gates.allowReviewExemption`. |
 | `tower_mission` | `id` (alias `missionId`), `status?`, `task_done?`, `task_drop?`+`task_drop_reason?`, `blocker?`, `clear_blockers?`, `note?`, `scope?`, `pause_cause?`, `authorization?` | Update one mission. Worker-safe fields are task/blocker/note; `merged` cannot be set here. Paused missions record `pause_cause` (user/failure/resource/dependency); resuming a user-paused mission honors `mode.requireResumeAuthorization`. |
-| `tower_status` | `missionId?`, `offset?`, `limit?`, `includeGate?`, `format?` | Dashboard by default. `missionId` returns full detail (tasks/notes/reviews/findings/completionReport). `offset`/`limit` page missions (default 20, max 100), `includeGate` adds gate digests, `format:"markdown"` returns the board. Includes `mode` with `lastChange` and recent `history` when the host mode hook is available. |
+\|\ `tower_status`\ \|\ `missionId\?`,\ `offset\?`,\ `limit\?`,\ `includeGate\?`,\ `includeArchived\?`,\ `format\?`\ \|\ Dashboard\ by\ default\.\ Paged\ missions\ carry\ `reportBytes`\ only;\ `missionId`\ returns\ full\ detail\ \(tasks/notes/reviews/findings/completionReport\ body\),\ and\ an\ archived\ mission\ is\ loaded\ from\ its\ year\ file\.\ `offset`/`limit`\ page\ active\ missions\ \(default\ 20,\ max\ 100\),\ `includeGate`\ adds\ gate\ digests,\ `includeArchived`\ appends\ compact\ archived\ summaries\ \(flagged\ `archived:true`,\ no\ report\ body\)\ after\ the\ active\ page,\ and\ `format:"markdown"`\ returns\ the\ board\ \(active\ rows\ plus\ an\ archived\ count\)\.\ Includes\ `mode`\ with\ `lastChange`\ and\ recent\ `history`\ when\ the\ host\ mode\ hook\ is\ available\.\ `archive`\ reports\ `\{count,\ years,\ unreadable,\ message}`;\ a\ corrupt\ archive\ degrades\ to\ `unreadable:true`\ instead\ of\ failing\ the\ dashboard\.\ \|
 | `tower_spawn` | `missionId` (alias `id`), `role` (`worker`/`reviewer`), `name?`, `instructions?`, `worktreeRoot?`, `wait?`, `waitMs?`, `takeover?`, `includeDirtyBase?` | Provision/reuse the worktree and start a subagent. Worker uses `tower-worker`; reviewer requires a `completed` mission and uses the read-only `tower-reviewer`. `takeover:true` replaces a live worker entry that is no longer running (increments ownerGeneration). Only one live worker per mission; `spawn.maxLiveWorkers` caps the repository. |
 | `tower_roster` | — | Roster with live activity (`running`/`inactive`/`missing`/`unknown`) and `stale` flags from the subagent catalog. Read-only. |
 | `tower_adopt` | `retireMissing?` | Reconcile roster entries with the durable subagent catalog. Provably gone agents are retired (default) or marked `missing` (`retireMissing:false`) so they can be inspected/taken over. |
 | `tower_diff` | `missionId` (alias `id`), `maxBytes?` | Read-only merge-base diff: files, commits, capped patch. Safe for reviewers. |
 | `tower_send` | `to`, `subject`, `body`, `scope?`, `interrupt?`, `consentRef?` | Durable message to a roster name, `tower`, or `all`; delivers live to a running agent. `interrupt:true` interrupts the running turn first (Kimi-style), then delivers; `consentRef` is recorded for audit. Rate-limited by `send.maxPerMinute`. |
 | `tower_inbox` | `limit?`, `include_read?` | Read/ack messages addressed to the caller; unread messages block `tower_complete`. |
-| `tower_complete` | `missionId` (alias `id`), `report`, `checks?` | Worker reports completion (mission becomes `completed`, ready for preflight and optional review). Requires current owner, no open tasks/blockers, ≥1 commit, no unread inbox. `checks` records `{name, command?, exitCode?, evidence?}` evidence; `gates.requireChecks` can demand it. When configured, test discovery runs automatically and adds a `tests` check; failure throws `[tower:tests-failed]`. |
+| `tower_complete` | `missionId` (alias `id`), `report`, `checks?` | Worker reports completion (mission becomes `completed`, ready for preflight and optional review). Requires current owner, no open tasks/blockers, ≥1 commit, no unread inbox. `report` is capped at `gates.maxReportBytes` (default 32768 UTF-8 bytes): a larger report is rejected with `invalid-argument` and a `nextAction` to file the full text in the mission worktree, never truncated; the stored report records `reportBytes`. `checks` records `{name, command?, exitCode?, evidence?}` evidence; `gates.requireChecks` can demand it. When configured, test discovery runs automatically and adds a `tests` check; failure throws `[tower:tests-failed]`. |
 | `tower_interrupt` | `to?` (roster name), `agentId?`, `reason?` | Interrupt one running roster agent via `subagents.interrupt`, record `state:"interrupted"`. Idempotent (not running → `interrupted:false`). |
 | `tower_finding` | `type`, `title`, `summary`, `details`, `suggested_fix`, `severity?`, `missionId?`, `location?` | Record an out-of-scope issue; reviewers use this instead of editing. Finds start as `open`. |
 | `tower_findings` | `id?`, `status?`, `note?`, filters (`type?`, `severity?`, `missionId?`, `open?`, `limit?`) | Lifecycle tool: list/read/transition. Statuses `open → triaged → fixed`/`wontfix`, reopen allowed. Only the tower or a worker may mutate; a reviewer can list/read. |
@@ -48,11 +49,11 @@ findings but not mutate them. Violations throw `[tower:not-authorized]` or
 | `tower_preflight` | `missionId` (alias `id`) | Read-only gate: returns `{ok, blockers[], branchTip, baseTip, changedFiles, review}`. |
 | `tower_merge` | `missionId` (alias `id`), `timeoutMs?` (alias `timeout_ms`) | Merge after a green gate. Records already-landed merges (`reconciled`), recovers a failed call whose commit exists (`recoveredFromFailure`), and separates `merge-hook-failed` from `merge-conflict`. |
 | `tower_rebase` | `missionId` (alias `id`) | Rebase the branch onto the base in its worktree. Refuses while the worker runs or the worktree is dirty. Already-contained branches return `alreadyMerged` untouched. |
-| `tower_teardown` | `force?`, `exclude?`, `dry_run?` (alias `dryRun`) | Remove eligible merged/abandoned worktrees and branches; running agents are always kept. |
+| `tower_teardown` | `force?`, `exclude?`, `dry_run?` (alias `dryRun`) | Remove eligible merged/abandoned worktrees and branches; running agents are always kept. The final pass applies the `archive` policy: terminal missions whose worktree is gone are moved to `<git-common-dir>/dsh-tower/archive/` once `archive.afterDays`/`archive.maxMissions` says so, and `archived` lists their ids. Nothing is deleted; `archive.afterDays:0` archives a just-torn-down mission immediately. |
 | `tower_mode` | — | Report mode, last change, paused goal, denied tools, store path, plugin version, HMR availability, workspace-lock holder. |
 | `tower_control` | `action` (`enter`/`exit`), `reason` | Model-initiated mode change; registered by default; disable with `mode.allowAgentControl:false`; reason is mandatory. |
 | `tower_reload` | `repoRoot?` | Dev-only: ask DSH HMR to reconcile the profile and reload the Host plugin from disk. Registered while `dev.hotReload` is on; scheduled after the result (default 50 ms); fails with `reload-unavailable` without HMR. When `repoRoot` is supplied the caller must be the tower. |
-| `tower_doctor` | — (takes `repoRoot`) | Read-only health contract: git, state schema, config, presets/subagents/HMR, workspace lock, roster, worktree realpath/ownership, test config, leases. Returns `{ok, checks[{id,status,detail}], environmentContract}`. Never writes. |
+| `tower_doctor` | — (takes `repoRoot`) | Read-only health contract: git, state schema, config, presets/subagents/HMR, workspace lock, roster, worktree realpath/ownership, test config, leases and the terminal-mission archive. Returns `{ok, checks[{id,status,detail}], stateSchema, archive, environmentContract}`; `archive` reports `{missions, archivedMissions, stateBytes, archiveBytes, years, files, unreadable, policy{enabled,afterDays,maxMissions}}`. A missing archive directory is healthy; a corrupt file is a `warn` with its diagnostic. Never writes. |
 | `tower_recover` | `action` (`status`/`clear-stale-lock`), `confirm?` | Recovery diagnostics plus an explicit stale state-lock repair. `clear-stale-lock` requires `confirm:"CLEAR_STALE_LOCK"` and only moves a lock whose PID is provably dead to a backup; it never resets state/worktrees. |
 | `tower_test` | `missionId` (alias `id`) | Run the worktree's `package.json` `tower.testDiscovery` and record a receipt; `ok:false` on failure. Use `tower_complete` for automatic admission checks. |
 | `tower_batch` | `action` (`create`/`status`/`close`/`abandon`), `missionIds?`, `exclusions?`, `requiredChecks?`, `receiptPaths?`, `batchId?`, `checks?`, `treeTip?`, `receiptHashes?`, `reason?` | Finite evidence batch. Create freezes members/checks/receipts; close verifies every required check and receipt hash; merged members are eligible; abandon retires a stale open batch without deleting missions. Membership is immutable. |

package/docs/zh/guide/install-upgrade-migration.md

@@ -31,7 +31,19 @@ Host 插件在 DSH 启动时加载：**安装或更新后需要重启 DSH**。
 
 ## 迁移说明
 
-- **2.0.4 → 2.1.0-beta.1**：不需要迁移 state/config。这是发布到 `next` dist-tag 的**预发布**，
+- **state schema v1 → v2（未发布）**：`state.json` 会自动迁移。升级后的第一次**写入**会保留
+  `state.json.v1.bak` 备份、`revision` 只 +1，并向 `activity.jsonl` 追加 `state.migrated {from,to}`；
+  只读工具仍可读取 v1 文件且不改写它。`tower_doctor` 报告磁盘上的版本与待执行的迁移。由更新插件
+  写入的文件会以 `[tower:state-version-unsupported]` 拒绝，绝不会被重写或降级；迁移抛错会报
+  `[tower:state-migration-failed]`，原文件保持字节不变。
+- **state schema v2 → v3（未发布，#90）**：scope 匹配跟随检出目录所在文件系统的行为。迁移把
+  `caseInsensitive` 回填为 `null`（“尚未探测”）；迁移不会读取文件系统，因此升级后的第一次
+  `tower_init` 会探测一次并记录 `true`/`false`。在此之前使用安全的 `case-sensitive` 比较，
+  `tower_doctor` 会把未知模式报告为 `warn`（`case-mode`）。在大小写不敏感的检出上，
+  `src/Api/**` 与 `src/api/**` 从此视为重叠，仅大小写不同的改动不再被 out-of-scope 门禁拒绝。
+  存储的 scope 文本永远不会被改写：看板仍显示操作者输入的原样。
+- **2.0.4 → 2.1.0-beta.1**：不需要迁移 config；state 会按上述说明自动迁移（v1/v2 → v3）。
+  这是发布到 `next` dist-tag 的**预发布**，
   `latest` 仍指向 2.0.4——请用 `dsh plugin --profile web add dsh-tower@next`（或精确版本号）安装。
   运行时行为未变；本版本承载的是交付闸门（CI 中的 mount smoke、`npm run release:check`、证据约定
   与追踪策略），而不是工具变化。本文档先于人工发布步骤合入：只有在[发布清单](release.md)执行

package/docs/zh/reference/blockers.md

@@ -17,7 +17,7 @@
 | `branch-missing` | 还没有 worktree/分支：先 spawn worker。 |
 | `stale-base` | 分支不包含基线 tip：执行 `tower_rebase`。 |
 | `read-only-survey` | survey mission 修改了文件；survey mission 必须只读。 |
-| `out-of-scope` | 改动文件超出 mission scope；有意为之就扩大 scope，否则回退。 |
+| `out-of-scope` | 改动文件超出 mission scope；有意为之就扩大 scope，否则回退。在大小写敏感的检出上，仅大小写不同的路径仍会被拒绝，detail 会指出折叠大小写后本可匹配的 scope 条目。 |
 | `base-dirty` | 主检出存在未提交改动，合并会覆盖它们。 |
 | `deps-unmerged` | 依赖 mission 尚未 merged/abandoned。 |
 | `no-review` | `review.requireReview:true` 且分支上没有审查：spawn reviewer（或关闭审查门禁）。 |

package/docs/zh/reference/config.md

@@ -82,8 +82,12 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 | `gates.requireChecks` | `false` | 合并前要求至少一条 `tower_complete.checks` 证据（`no-check-evidence`）。 |
 | `gates.requireTests` | `false` | 要求针对当前 mission 分支 tip 的通过测试回执（`tests-missing`）；与审查门禁独立。 |
 | `gates.allowReviewExemption` | `false` | 在 `review.requireReview:true` 时，允许用 `reviewPolicy:"none"` + 非空理由跳过审查 blocker；默认故意关闭；全局审查关闭时无影响。 |
+| `gates.maxReportBytes` | `32768`（32 KiB） | `tower_complete.report` 的 UTF-8 字节硬上限。超出时以 `invalid-argument` 拒绝并给出可执行的 `nextAction`（把全文写进 mission worktree 的文件并引用路径），绝不截断。已存在的超限报告仍可读取。 |
 | `docs.board` | `true` | 变更后写入 `MISSIONS.md`。 |
 | `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`；`repo` = `<repoRoot>/MISSIONS.md`。 |
+| `archive.enabled` | `true` | 在变更边界把 worktree 已移除的终态（`merged`/`abandoned`）任务移入 `<git-common-dir>/dsh-tower/archive/`。归档任务保留 tasks、reviews、findings 与完成报告；这是移动，不是删除。 |
+| `archive.afterDays` | `30` | 年龄触发：终态任务超过这么多天未更新，会在下次变更时归档（`0` 表示立即归档）。 |
+| `archive.maxMissions` | `100` | 数量触发：热状态中的终态任务超过此数时，从最旧的开始归档直到满足上限（`0` 表示归档所有符合条件的终态任务）。worktree 仍存在的任务永不归档。 |
 | `tools.exposeOperational` | `true` | 注册 batch/resource/import/legacy/recover/test/doctor 工具；`false` 可缩小固定工具 schema 上下文。 |
 | `leases.ttlMs` | `900000` | 默认咨询式租约寿命；过期不会自动释放。 |
 | `dev.hotReload` | `true` | 注册 `tower_reload`；关闭时 `/tower reload` 也被禁用。无 HMR 服务时调用返回 `reload-unavailable`。 |

package/docs/zh/reference/doctor.md

@@ -11,21 +11,54 @@
     { "id": "git", "status": "pass", "detail": "git version 2.55.0" },
     { "id": "state", "status": "pass", "detail": ".../state.json revision 7" }
   ],
+  "archive": {
+    "missions": 3,
+    "archivedMissions": 12,
+    "stateBytes": 48211,
+    "archiveBytes": 190244,
+    "years": [2026],
+    "files": 2,
+    "unreadable": [],
+    "policy": { "enabled": true, "afterDays": 30, "maxMissions": 100 }
+  },
   "environmentContract": {
     "platform": "win32",
     "gitVersion": "git version 2.55.0",
     "repoRoot": "D:/repo",
     "commonDir": "D:/repo/.git",
-    "stateDir": "D:/repo/.git/dsh-tower"
+    "stateDir": "D:/repo/.git/dsh-tower",
+    "caseInsensitive": true,
+    "comparisonMode": "case-insensitive"
   }
 }
 ```
 
+`archive` 报告终态任务归档：活跃 `missions`、`archivedMissions` 与 `stateBytes`，归档目录的
+`archiveBytes`/`years`/`files`，每条 `unreadable` 诊断，以及配置的 `policy`（`enabled`、`afterDays`、
+`maxMissions`）。归档目录不存在是健康的空归档（`archive` 检查为 `pass`）；截断的 index/year 文件是
+`warn` 并附带诊断，且归档会暂停而不是覆盖它——归档不可读期间没有数据会丢失，符合条件的 mission 仍留在
+`state.json`。
+
 检查覆盖：git 可用性、仓库身份、state schema/加载、仓库配置是否存在、worker/reviewer preset 名称、
 subagents 与 HMR 服务、workspace 锁持有者/是否过期、实时 roster、worktree 是否存在/归属/是否脏、
-test-discovery 策略、旧版快照、batch 与租约。被 `tower_teardown` 正常清理的 mission worktree 会被
+test-discovery 策略、完成报告大小、归档健康度、旧版快照、batch 与租约。被 `tower_teardown` 正常清理的 mission worktree 会被
 跳过（检查中会注明已移除数量），不会被误报为 missing。`warn` 是提示；`fail` 表示仓库在 spawn/merge 前需要
+
+`caseInsensitive` 是 `tower_init` 在检出目录所在文件系统上一次性探测的结果；`null` 表示“尚未探测”，
+此时 `case-mode` 检查为 `warn`。`comparisonMode` 是 scope 匹配实际使用的比较方式：
+`case-insensitive` 会折叠双方大小写，`case-sensitive` 则保持逐字节精确。doctor 从不执行探测（探测会
+创建临时文件，只读调用不能写入）；在没有可用写权限的检出上运行 `tower_init` 会记录该模式，在此之前
+使用安全的 `case-sensitive` 默认值。
+
+检查覆盖：git 可用性、仓库身份、state schema/加载、已探测的大小写模式、仓库配置是否存在、
+worker/reviewer preset 名称、subagents 与 HMR 服务、workspace 锁持有者/是否过期、实时 roster、
+worktree 是否存在/归属/是否脏、test-discovery 策略、旧版快照、batch 与租约。被 `tower_teardown`
+正常清理的 mission worktree 会被跳过（检查中会注明已移除数量），不会被误报为 missing。`warn` 是提示；`fail` 表示仓库在 spawn/merge 前需要
 处理。state 加载失败会作为失败的检查报告而不是抛出，因此 doctor 在损坏的仓库上仍然有用。
 
+`reports` 检查会指出仓库中最大的完成报告（`<bytes> B on <mission>`，对照 `gates.maxReportBytes` 上限），
+同样的数据也以 `reports: { count, largest: { missionId, bytes } | null, capBytes }` 返回。上限生效前写入的
+报告只会产生 `warn`，doctor 绝不会重写它们。
+
 环境契约仅供参考；它不是身份或授权证明。`tower_init` 仍要求控制塔角色，`tower_spawn` 仍会检查
 实时子代理目录。

package/docs/zh/reference/errors.md

@@ -3,7 +3,7 @@
 [English](../../reference/errors.md) | **简体中文**
 
 工具失败是抛出的错误，不是 `{ok:false}` 结果（门禁结果是例外：见 [blockers.md](blockers.md)）。
-每个抛出的错误都以稳定 code 作为消息前缀。本版本定义 33 个工具错误码。
+每个抛出的错误都以稳定 code 作为消息前缀。本版本定义 35 个工具错误码。
 
 ```
 [tower:mission-not-found] unknown mission "M9"
@@ -23,7 +23,9 @@
 | `stale-base` | 操作准备期间仓库状态已变化，需要重试。 | two-phase mutation 重校验 |
 | `worktree-dirty` | mission worktree 有未提交改动，不能完成。 | `tower_complete` 前遗留 staged/modified/untracked 文件 |
 | `state-locked` | 另一个 Tower 写入者持有 state 锁。 | 锁超时后的并发写 |
-| `state-corrupt` | Tower state 文件不可读或无效。 | 手工编辑过的 `state.json` |
+| `state-corrupt` | Tower state 文件不可读或无效。 | 手工编辑过的 `state.json`；非法 JSON；没有可用的 `schemaVersion` |
+| `state-version-unsupported` | state 文件的 schema 版本高于本构建支持的版本，或无法迁移。 | 打开由更新插件写入的仓库；未知的旧版本；本构建拒绝降级 |
+| `state-migration-failed` | state 迁移抛出异常；原文件未被修改。 | 迁移步骤中的 bug；查看迁移前的 `state.json.v<N>.bak` |
 | `config-invalid` | Tower 配置无效。 | 格式错误的仓库 `config.json`、违反 schema 的值 |
 | `config-unknown-key` | Tower 配置存在未知顶层键。 | 例如把键拼成 `allowAgentToggle` |
 | `git-failed` | git 命令因未归入其他分类的原因失败。 | 被拒绝的合并命令、非法 ref |

package/docs/zh/reference/tools.md

@@ -32,16 +32,16 @@ roster 角色由 `exec.agent` 与 roster 共同决定。mission 级工具（`tow
 | 工具 | 参数 | 用途 / 说明 |
 |---|---|---|
 | `tower_init` | `base?`、`autoGitInit?`、`snapshotDirty?`、`reanchor?` | 创建 `<git-common-dir>/dsh-tower/state.json`。`autoGitInit` 执行 `git init` 并创建空的初始提交；`snapshotDirty` 记录一个游离快照提交作为 mission 基线；`reanchor` 仅在没有非终态 mission 时修改基线。返回 `dirty`、`snapshotCommit`、`reanchored`。 |
-| `tower_plan` | `missions[]`（`title`、`scope[]`、`tasks[]?`、`deps[]?`、`kind?`、`context?`、`references[]?` ≤20、`reviewPolicy?`、`reviewExemptionReason?`） | 创建 mission `M1..`；重叠的 build scope 会自动加依赖；拒绝未知依赖与依赖循环。`reviewPolicy:"none"` 需要非空理由；审查门禁开启时，preflight 还要求 `gates.allowReviewExemption`。 |
+| `tower_plan` | `missions[]`（`title`——可打印 Unicode，NFC 规范化，≤120 字符、`scope[]`、`tasks[]?`、`deps[]?`、`kind?`、`context?`、`references[]?` ≤20、`reviewPolicy?`、`reviewExemptionReason?`） | 创建 mission `M1..`；重叠的 build scope 会自动加依赖；拒绝未知依赖与依赖循环。mission id 保持 ASCII（`M1`、`M2`）；不可见字符与超长标题会以 `invalid-argument` 拒绝。`reviewPolicy:"none"` 需要非空理由；审查门禁开启时，preflight 还要求 `gates.allowReviewExemption`。 |
 | `tower_mission` | `id`（别名 `missionId`）、`status?`、`task_done?`、`task_drop?`+`task_drop_reason?`、`blocker?`、`clear_blockers?`、`note?`、`scope?`、`pause_cause?`、`authorization?` | 更新单个 mission。worker 可安全使用的字段是 task/blocker/note；不能在这里设置 `merged`。暂停的 mission 记录 `pause_cause`（user/failure/resource/dependency）；恢复用户暂停的 mission 会遵循 `mode.requireResumeAuthorization`。 |
-| `tower_status` | `missionId?`、`offset?`、`limit?`、`includeGate?`、`format?` | 默认返回面板。`missionId` 返回完整详情（任务/备注/审查/finding/完成报告）。`offset`/`limit` 对 mission 分页（默认 20，最大 100），`includeGate` 附带门禁摘要，`format:"markdown"` 返回看板。host 提供 mode hook 时还会包含 `mode.lastChange` 与最近 `history`。 |
+| `tower_status` | `missionId?`、`offset?`、`limit?`、`includeGate?`、`format?` | 默认返回面板。分页 mission 只带 `reportBytes`；`missionId` 返回完整详情（任务/备注/审查/finding/完成报告正文）。`offset`/`limit` 对 mission 分页（默认 20，最大 100），`includeGate` 附带门禁摘要，`format:"markdown"` 返回看板。host 提供 mode hook 时还会包含 `mode.lastChange` 与最近 `history`。 |
 | `tower_spawn` | `missionId`（别名 `id`）、`role`（`worker`/`reviewer`）、`name?`、`instructions?`、`worktreeRoot?`、`wait?`、`waitMs?`、`takeover?`、`includeDirtyBase?` | 准备或复用 worktree 并启动子代理。worker 使用 `tower-worker`；reviewer 要求 mission 为 `completed`，并使用只读的 `tower-reviewer`。`takeover:true` 替换已不再运行的 worker 条目（ownerGeneration 递增）。每个 mission 只能有一个活跃 worker；`spawn.maxLiveWorkers` 限制整个仓库。 |
 | `tower_roster` | — | roster 及来自子代理目录的实时活动（`running`/`inactive`/`missing`/`unknown`）与 `stale` 标记。只读。 |
 | `tower_adopt` | `retireMissing?` | 把 roster 条目与持久子代理目录对账。可证明已消失的 agent 会被标记为 retired（默认），或标记为 `missing`（`retireMissing:false`）以便检查/接管。 |
 | `tower_diff` | `missionId`（别名 `id`）、`maxBytes?` | 只读 merge-base diff：文件、提交、有上限的 patch。供 reviewer 安全使用。 |
 | `tower_send` | `to`、`subject`、`body`、`scope?`、`interrupt?`、`consentRef?` | 向 roster 名称、`tower` 或 `all` 发送持久消息；对运行中的 agent 会即时投递。`interrupt:true` 先中断运行中的回合（Kimi 风格）再投递；`consentRef` 记录用于审计。受 `send.maxPerMinute` 限速。 |
 | `tower_inbox` | `limit?`、`include_read?` | 读取并确认发给调用者的消息；未读消息会阻止 `tower_complete`。 |
-| `tower_complete` | `missionId`（别名 `id`）、`report`、`checks?` | worker 报告完成（mission 变为 `completed`，可进入 preflight 与可选审查）。要求当前 owner、无未完成任务/blocker、≥1 个提交、无未读消息。`checks` 记录 `{name, command?, exitCode?, evidence?}` 证据；`gates.requireChecks` 可以强制要求。配置了测试发现时还会自动运行并添加 `tests` 检查；失败会抛出 `[tower:tests-failed]`。 |
+| `tower_complete` | `missionId`（别名 `id`）、`report`、`checks?` | worker 报告完成（mission 变为 `completed`，可进入 preflight 与可选审查）。要求当前 owner、无未完成任务/blocker、≥1 个提交、无未读消息。`report` 受 `gates.maxReportBytes`（默认 32768 UTF-8 字节）硬上限约束：超限会以 `invalid-argument` 拒绝并给出 `nextAction`（把全文写进 mission worktree 的文件），绝不截断；存储时会记录 `reportBytes`。`checks` 记录 `{name, command?, exitCode?, evidence?}` 证据；`gates.requireChecks` 可以强制要求。配置了测试发现时还会自动运行并添加 `tests` 检查；失败会抛出 `[tower:tests-failed]`。 |
 | `tower_interrupt` | `to?`（roster 名称）、`agentId?`、`reason?` | 通过 `subagents.interrupt` 中断一个运行中的 roster agent，并记录 `state:"interrupted"`。幂等（未运行 → `interrupted:false`）。 |
 | `tower_finding` | `type`、`title`、`summary`、`details`、`suggested_fix`、`severity?`、`missionId?`、`location?` | 记录 scope 之外的问题；reviewer 用它代替直接改文件。新 finding 初始为 `open`。 |
 | `tower_findings` | `id?`、`status?`、`note?`、过滤（`type?`、`severity?`、`missionId?`、`open?`、`limit?`） | 生命周期工具：列出/读取/流转。状态为 `open → triaged → fixed`/`wontfix`，允许重新打开。只有控制塔或 worker 能修改；reviewer 只能列出/读取。 |

package/domain/config/schema.js

@@ -15,6 +15,7 @@
 // `allowAgentControl: true` via the legacy top-level key.
 import Schema from '@deepseek-ai/schemastery'
 import { TowerToolError } from '../errors.js'
+import { DEFAULT_MAX_REPORT_BYTES } from '../missions/completion.js'
 
 export const DEFAULT_DENY_TOOLS = [
   'create_goal',
@@ -32,7 +33,7 @@ export const DEFAULT_DENY_TOOLS = [
 ]
 
 const LEGACY_KEYS = ['section', 'allowAgentControl']
-const GROUP_KEYS = ['init', 'mode', 'review', 'merge', 'git', 'worktrees', 'spawn', 'send', 'tests', 'gates', 'docs', 'leases', 'dev', 'tools']
+const GROUP_KEYS = ['init', 'mode', 'review', 'merge', 'git', 'worktrees', 'spawn', 'send', 'tests', 'gates', 'docs', 'archive', 'leases', 'dev', 'tools']
 
 const SECTION_KEYS = {
   init: ['autoGitInit', 'snapshotDirty', 'autoExclude'],
@@ -71,8 +72,9 @@ const SECTION_KEYS = {
   ],
   send: ['maxPerMinute', 'interruptDefault'],
   tests: ['enabled', 'admission', 'timeoutMs', 'maxBytes', 'autoChecks', 'allowPackageDiscovery'],
-  gates: ['requireChecks', 'requireTests', 'allowReviewExemption'],
+  gates: ['requireChecks', 'requireTests', 'allowReviewExemption', 'maxReportBytes'],
   docs: ['board', 'boardLocation'],
+  archive: ['enabled', 'afterDays', 'maxMissions'],
   tools: ['exposeOperational', 'exposeBatch', 'exposeImport', 'exposeLeases', 'exposeTests', 'exposeRecovery', 'exposeDoctor'],
   leases: ['ttlMs'],
   dev: ['hotReload', 'reloadDelayMs', 'reloadRequiredIds'],
@@ -226,6 +228,11 @@ export const Config = Schema.object({
     allowReviewExemption: Schema.boolean()
       .default(false)
       .description('Allow reviewPolicy:none missions with a non-empty reviewExemptionReason to skip review blockers.'),
+    maxReportBytes: Schema.natural()
+      .min(1024)
+      .max(16 * 1024 * 1024)
+      .default(DEFAULT_MAX_REPORT_BYTES)
+      .description('Hard cap, in UTF-8 bytes, for tower_complete.report; a larger report is rejected with an actionable nextAction, never truncated.'),
   })
     .default({})
     .description('Merge-gate strictness.'),
@@ -239,6 +246,21 @@ export const Config = Schema.object({
   })
     .default({})
     .description('Human-readable artifacts.'),
+  archive: Schema.object({
+    enabled: Schema.boolean()
+      .default(true)
+      .description('Move terminal (merged/abandoned) missions whose worktree is gone into <git-common-dir>/dsh-tower/archive/ at the next mutation, so state.json stops carrying their full history.'),
+    afterDays: Schema.natural()
+      .min(0)
+      .default(30)
+      .description('Terminal missions untouched for at least this many days are archived on the next mutation (0 archives them immediately).'),
+    maxMissions: Schema.natural()
+      .min(0)
+      .default(100)
+      .description('Maximum terminal missions kept hot; once exceeded, the oldest eligible terminal missions are archived until the cap holds (0 archives every eligible terminal mission).'),
+  })
+    .default({})
+    .description('Terminal-mission archival policy. Archived missions are moved, never deleted.'),
   tools: Schema.object({
     exposeOperational: Schema.boolean()
       .default(true)
@@ -316,7 +338,7 @@ export function assertKnownKeys(raw, label) {
   if (unknown.length > 0) {
     throw new TowerToolError(
       'config-unknown-key',
-      `${label} has unknown key(s) ${unknown.join(', ')} — config is { section?, allowAgentControl?, init?, mode?, review?, merge?, git?, worktrees?, spawn?, send?, tests?, gates?, docs?, leases?, dev? }`,
+      `${label} has unknown key(s) ${unknown.join(', ')} — config is { section?, allowAgentControl?, init?, mode?, review?, merge?, git?, worktrees?, spawn?, send?, tests?, gates?, docs?, archive?, leases?, dev?, tools? }`,
     )
   }
   for (const [group, allowed] of Object.entries(SECTION_KEYS)) {
@@ -397,6 +419,7 @@ export function resolveTowerConfig(rawConfig) {
     tests: clone(parsed.tests ?? {}),
     gates: clone(parsed.gates ?? {}),
     docs: clone(parsed.docs ?? {}),
+    archive: clone(parsed.archive ?? {}),
     tools: clone(parsed.tools ?? {}),
     leases: clone(parsed.leases ?? {}),
     dev: clone(parsed.dev ?? {}),

package/domain/contracts/outputs.js

@@ -54,6 +54,7 @@ const SCHEMAS = {
       base: S.str,
       revision: S.int,
       missions: S.int,
+      caseInsensitive: S.any,
     },
     ['created', 'repoRoot', 'commonDir', 'statePath', 'base', 'revision', 'missions'],
   ),
@@ -238,7 +239,32 @@ const SCHEMAS = {
     },
     ['ok', 'scheduled'],
   ),
-  doctor: S.obj({ ok: S.bool, checks: S.arr(S.obj()), environmentContract: S.obj() }, ['ok', 'checks']),
+  doctor: S.obj(
+    {
+      ok: S.bool,
+      checks: S.arr(S.obj()),
+      stateSchema: S.obj({
+        currentVersion: S.any,
+        supportedVersion: S.int,
+        migrations: S.arr(S.obj({ from: S.int, to: S.int })),
+        status: S.str,
+      }),
+      reports: S.any,
+      archive: S.obj({
+        missions: S.any,
+        archivedMissions: S.int,
+        stateBytes: S.any,
+        archiveBytes: S.int,
+        dir: S.str,
+        years: S.arr(S.int),
+        files: S.int,
+        unreadable: S.arr(S.str),
+        policy: S.obj(),
+      }),
+      environmentContract: S.obj(),
+    },
+    ['ok', 'checks'],
+  ),
   recover: S.obj(
     { ok: S.bool, action: S.str, stateLock: S.any, cleared: S.bool, backup: S.any, error: S.str },
     ['ok', 'action'],

package/domain/contracts/tool-inputs/missions.js

@@ -14,7 +14,7 @@ export const PlanInput = Type.Object({
   repoRoot: Type.String({ description: 'Absolute path inside the target Git repository.' }),
   missions: Type.Array(
     Type.Object({
-      title: Type.String({ description: 'Printable ASCII title; used as the mission label.' }),
+      title: Type.String({ description: 'Printable Unicode mission title, NFC-normalized, at most 120 characters; used as the mission label.' }),
       scope: Type.Optional(Type.Array(Type.String(), { description: 'Relative file globs this mission may touch; empty only for survey.' })),
       tasks: Type.Optional(Type.Array(Type.String(), { description: 'Verifiable task items the worker ticks off.' })),
       deps: Type.Optional(Type.Array(Type.String(), { description: 'Mission ids that must merge before this one.' })),
@@ -54,6 +54,7 @@ export const StatusInput = Type.Object({
   offset: Type.Optional(Type.Integer({ minimum: 0, description: 'Mission list offset (default 0).' })),
   limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 100, description: 'Mission list page size (default 20).' })),
   includeGate: Type.Optional(Type.Boolean({ description: 'Compute tower_preflight-style gate digests for missions on this page.' })),
+  includeArchived: Type.Optional(Type.Boolean({ description: 'Append archived terminal missions (compact summaries, marked archived:true) after the active page. The default dashboard and board list active missions only.' })),
   format: Type.Optional(enumOf(STATUS_FORMATS, { description: 'markdown returns the MISSIONS.md board text.' })),
 }, { additionalProperties: false })
 

package/domain/errors.js

@@ -28,6 +28,8 @@ export const ERROR_CODES = {
   'stale-base': 'The repository state changed while the operation was being prepared; retry.',
   'state-locked': 'Another Tower writer holds the state lock.',
   'state-corrupt': 'The Tower state file is unreadable or invalid.',
+  'state-version-unsupported': 'The Tower state file uses a schema version this build cannot read or downgrade.',
+  'state-migration-failed': 'A Tower state migration failed; the original state file was not modified.',
   'config-invalid': 'Tower configuration is invalid.',
   'config-unknown-key': 'Tower configuration has an unknown top-level key.',
   'git-failed': 'A git command failed.',

package/domain/integration/gate.js

@@ -2,7 +2,7 @@
 // facts the app already read (tips, changed files, checkout branch). The app
 // performs every read and owns the result assembly.
 // @ts-check
-import { fileInScope } from '../scope.js'
+import { caseInsensitiveScopeMatch, fileInScope } from '../scope.js'
 
 /** @typedef {import('../../types/index.js').Blocker} Blocker */
 /** @typedef {import('../../types/index.js').Mission} Mission */
@@ -76,16 +76,29 @@ export function surveyChangedFilesBlocker({ missionId, changedFiles }) {
  * @param {object} input
  * @param {Mission} input.mission
  * @param {string[]} input.changedFiles
+ * @param {boolean} [input.caseInsensitive] the checkout's detected comparison mode
  * @returns {Blocker | null}
  */
-export function outOfScopeBlocker({ mission, changedFiles }) {
-  const outOfScope = changedFiles.filter((file) => !fileInScope(mission.scope, file))
-  return outOfScope.length > 0
-    ? {
-        code: 'out-of-scope',
-        detail: `changed files outside scope (${mission.scope.join(', ')}): ${outOfScope.slice(0, 8).join(', ')}`,
-      }
-    : null
+export function outOfScopeBlocker({ mission, changedFiles, caseInsensitive = false }) {
+  const outOfScope = changedFiles.filter((file) => !fileInScope(mission.scope, file, { caseInsensitive }))
+  if (outOfScope.length === 0) return null
+  const parts = [`changed files outside scope (${mission.scope.join(', ')}): ${outOfScope.slice(0, 8).join(', ')}`]
+  // On a case-sensitive checkout a case-only mismatch is a human error worth
+  // naming, but it stays a rejection: folding here would make src/Api and
+  // src/api the same directory on a filesystem where they are not (#90).
+  if (!caseInsensitive) {
+    const hints = outOfScope
+      .map((file) => {
+        const pattern = caseInsensitiveScopeMatch(mission.scope, file)
+        return pattern
+          ? `${file} matches "${pattern}" only when case is folded; this checkout is case-sensitive`
+          : null
+      })
+      .filter(Boolean)
+      .slice(0, 3)
+    if (hints.length > 0) parts.push(`case mismatch: ${hints.join('; ')}`)
+  }
+  return { code: 'out-of-scope', detail: parts.join('. ') }
 }
 
 /**
@@ -114,13 +127,14 @@ export function baseDirtyBlocker(wouldOverwrite) {
  * @param {object} input
  * @param {string[]} input.deps
  * @param {TowerState} input.state
+ * @param {Map<string, { status: string }>} [input.archived] compact archived missions (#73)
  * @returns {Blocker[]}
  */
-export function dependencyBlockers({ deps = [], state }) {
+export function dependencyBlockers({ deps = [], state, archived = new Map() }) {
   /** @type {Blocker[]} */
   const blockers = []
   for (const depId of deps) {
-    const dep = state.missions.find((entry) => entry.id === depId)
+    const dep = state.missions.find((entry) => entry.id === depId) ?? archived.get(depId)
     if (!dep || !['merged', 'abandoned'].includes(dep.status)) {
       blockers.push({ code: 'deps-unmerged', detail: `${depId} is ${dep ? dep.status : 'missing'}` })
     }

package/domain/integration/init.js

@@ -116,6 +116,7 @@ export function existingInitResult({ state, statePath, dirty }) {
     reanchored: false,
     dirty,
     snapshotCommit: state.snapshotCommit ?? null,
+    caseInsensitive: state.caseInsensitive ?? null,
   }
 }
 
@@ -128,10 +129,21 @@ export function existingInitResult({ state, statePath, dirty }) {
  * @param {string | null} [input.towerAgentId]
  * @param {string | null} [input.snapshotCommit]
  * @param {string | null} [input.snapshotRef]
+ * @param {boolean | null} [input.caseInsensitive]
  * @param {number} input.now
  * @returns {TowerState}
  */
-export function initialState({ repoRoot, commonDir, base, dirty, towerAgentId = null, snapshotCommit = null, snapshotRef = null, now }) {
+export function initialState({
+  repoRoot,
+  commonDir,
+  base,
+  dirty,
+  towerAgentId = null,
+  snapshotCommit = null,
+  snapshotRef = null,
+  caseInsensitive = null,
+  now,
+}) {
   return {
     schemaVersion: SCHEMA_VERSION,
     repoRoot,
@@ -141,6 +153,7 @@ export function initialState({ repoRoot, commonDir, base, dirty, towerAgentId =
     createdAt: now,
     updatedAt: now,
     dirtyBase: dirty,
+    caseInsensitive,
     ...(towerAgentId ? { towerAgentId: String(towerAgentId) } : {}),
     ...(snapshotCommit ? { snapshotCommit, snapshotRef } : {}),
     missions: [],
@@ -156,9 +169,19 @@ export function initialState({ repoRoot, commonDir, base, dirty, towerAgentId =
  * @param {boolean} input.dirty
  * @param {string | null} input.snapshotCommit
  * @param {string | null} input.snapshotRef
+ * @param {boolean | null} [input.caseInsensitive]
  * @returns {object}
  */
-export function createdInitResult({ repoRoot, commonDir, statePath, base, dirty, snapshotCommit, snapshotRef }) {
+export function createdInitResult({
+  repoRoot,
+  commonDir,
+  statePath,
+  base,
+  dirty,
+  snapshotCommit,
+  snapshotRef,
+  caseInsensitive = null,
+}) {
   return {
     created: true,
     repoRoot,
@@ -171,6 +194,7 @@ export function createdInitResult({ repoRoot, commonDir, statePath, base, dirty,
     dirty,
     snapshotCommit,
     snapshotRef,
+    caseInsensitive,
   }
 }
 
@@ -194,6 +218,7 @@ export function existingInitWriteResult({ state, statePath, dirty, reanchored })
     reanchored,
     dirty,
     snapshotCommit: state.snapshotCommit ?? null,
+    caseInsensitive: state.caseInsensitive ?? null,
   }
 }
 
@@ -202,10 +227,21 @@ export function existingInitWriteResult({ state, statePath, dirty, reanchored })
  * @param {string} input.base
  * @param {string | null} [input.snapshotCommit]
  * @param {boolean} input.dirty
+ * @param {boolean | null} [input.caseInsensitive]
  * @returns {string}
  */
-export function initActivityText({ base, snapshotCommit = null, dirty }) {
-  return `base ${base}${snapshotCommit ? ` snapshot ${snapshotCommit.slice(0, 12)}` : ''}${dirty ? ' (dirty base)' : ''}`
+export function initActivityText({ base, snapshotCommit = null, dirty, caseInsensitive = null }) {
+  const mode = caseInsensitive === null ? '' : ` (${caseInsensitive ? 'case-insensitive' : 'case-sensitive'} filesystem)`
+  return `base ${base}${snapshotCommit ? ` snapshot ${snapshotCommit.slice(0, 12)}` : ''}${dirty ? ' (dirty base)' : ''}${mode}`
+}
+
+/**
+ * Activity line for a probe recorded on an existing state.
+ * @param {boolean} caseInsensitive
+ * @returns {string}
+ */
+export function caseProbeActivityText(caseInsensitive) {
+  return `case sensitivity detected: ${caseInsensitive ? 'case-insensitive' : 'case-sensitive'}`
 }
 
 /**

package/domain/mission.js

@@ -9,7 +9,7 @@
 
 /** @type {readonly MissionStatus[]} */
 export const MISSION_STATUSES = ['planned', 'active', 'completed', 'blocked', 'paused', 'merged', 'abandoned']
-export const SCHEMA_VERSION = 1
+export const SCHEMA_VERSION = 3
 /** @type {readonly MergeVerdict[]} */
 export const MERGE_VERDICTS = ['merge', 'fix-then-merge', 'hold']
 export const REVIEW_STATUS_RE = /^(clean|p1-\d+items|p2-\d+items)$/

package/domain/missions/completion.js

@@ -8,6 +8,57 @@ import { TowerToolError } from '../errors.js'
 /** @typedef {import('../../types/index.js').Mission} Mission */
 /** @typedef {import('../../types/index.js').RosterEntry} RosterEntry */
 
+/**
+ * Hard cap for `tower_complete.report`, in UTF-8 bytes (32 KiB). The value is
+ * the default of `gates.maxReportBytes`; a repository may lower or raise it.
+ */
+export const DEFAULT_MAX_REPORT_BYTES = 32 * 1024
+
+/**
+ * UTF-8 byte length, so multi-byte text is not silently favoured by a
+ * character-count bound.
+ * @param {string} value
+ * @returns {number}
+ */
+export function utf8ByteLength(value) {
+  return Buffer.byteLength(String(value), 'utf8')
+}
+
+/**
+ * Reject a report over the cap instead of truncating it: a silent cut loses
+ * evidence and cannot be recovered by the tower. The writer is told to keep the
+ * full text beside the branch and reference it.
+ * @param {string} report
+ * @param {number} [maxBytes]
+ * @returns {number} accepted UTF-8 byte length
+ */
+export function assertReportSize(report, maxBytes = DEFAULT_MAX_REPORT_BYTES) {
+  const bytes = utf8ByteLength(report)
+  if (bytes > maxBytes) {
+    throw new TowerToolError(
+      'invalid-argument',
+      `report is ${bytes} bytes (UTF-8), over the ${maxBytes}-byte cap; reports are rejected, not truncated — write the full text to a file in the mission worktree and reference the path in the report`,
+      {
+        nextAction: 'write the full text to a file in the mission worktree and reference the path in the report',
+      },
+    )
+  }
+  return bytes
+}
+
+/**
+ * Byte size of a stored completion report. Older documents have no
+ * `reportBytes`, so the body is measured on read; the field is never required.
+ * @param {any} completionReport
+ * @returns {number | null}
+ */
+export function completionReportBytes(completionReport) {
+  if (!isPlainObject(completionReport)) return null
+  const stored = completionReport.reportBytes
+  if (Number.isInteger(stored) && stored >= 0) return stored
+  return typeof completionReport.report === 'string' ? utf8ByteLength(completionReport.report) : null
+}
+
 /**
  * @param {string} message
  * @param {string} [code]
@@ -53,10 +104,10 @@ export function normalizeChecks(checks) {
 /**
  * Resolve and validate the reporting worker and the mission's completion
  * preconditions that need no repository access.
- * @param {{ mission: Mission, roster: RosterEntry[] | undefined, input: any }} params
+ * @param {{ mission: Mission, roster: RosterEntry[] | undefined, input: any, maxReportBytes?: number }} params
  * @returns {RosterEntry}
  */
-export function assertCompletionRequest({ mission, roster, input }) {
+export function assertCompletionRequest({ mission, roster, input, maxReportBytes }) {
   const worker = (roster ?? []).find((entry) => entry.agentId === input.agentId)
   if (!worker || worker.missionId !== mission.id) {
     fail(`agent ${input.agentId} is not assigned to mission ${mission.id}`)
@@ -75,6 +126,7 @@ export function assertCompletionRequest({ mission, roster, input }) {
   if (typeof input.report !== 'string' || input.report.trim().length === 0) {
     fail('tower_complete requires a non-empty report')
   }
+  assertReportSize(input.report.trim(), maxReportBytes)
   const openTasks = (mission.tasks ?? []).filter((task) => task.status === 'open')
   if (openTasks.length > 0) {
     fail(
@@ -106,9 +158,10 @@ export function assertCompletionInbox({ mission, worker, unread }) {
 
 /**
  * Project the completion report stored on the mission.
- * @param {{ report: string, worker: RosterEntry, checks: any[], now: number }} params
+ * @param {{ report: string, worker: RosterEntry, checks: any[], now: number, maxReportBytes?: number }} params
  * @returns {any}
  */
-export function completionReport({ report, worker, checks, now }) {
-  return { report: report.trim(), by: worker.name, at: now, checks }
+export function completionReport({ report, worker, checks, now, maxReportBytes }) {
+  const text = report.trim()
+  return { report: text, reportBytes: assertReportSize(text, maxReportBytes), by: worker.name, at: now, checks }
 }