dsh-tower 2.1.0-beta.1 → 2.1.0

package/lib/doctor.js

@@ -5,6 +5,11 @@ import path from 'node:path'
 import { fsp } from '../adapters/store-fs.js'
 import { git } from './git.js'
 import { readStateLock } from './store.js'
+import { inspectArchive } from './archive.js'
+import { inspectStateVersion } from '../domain/state.js'
+import { SCHEMA_VERSION } from '../domain/mission.js'
+import { DEFAULT_MAX_REPORT_BYTES, completionReportBytes } from '../domain/missions/completion.js'
+import { comparisonMode } from '../domain/scope.js'
 import { assessHostVersion, detectHostVersion, readCompatibility } from './compatibility.js'
 import { profileConfig } from './config.js'
 import { inspectWorkspaceLock } from './workspaceLock.js'
@@ -33,9 +38,87 @@ function check(id, status, detail, action) {
   return { id, status, detail, ...(action ? { action } : {}) }
 }
 
+/** Read the on-disk state version without loading, migrating, or locking. */
+async function inspectStateSchema(paths) {
+  try {
+    const text = await fsp.readFile(paths.state, 'utf8')
+    return inspectStateVersion(JSON.parse(text), paths.state)
+  } catch (error) {
+    return {
+      status: 'invalid',
+      currentVersion: null,
+      supportedVersion: SCHEMA_VERSION,
+      migrations: [],
+      message: `tower state could not be inspected: ${String(error?.message ?? error)}`,
+    }
+  }
+}
+
+/**
+ * Report the on-disk schema version and the migration that a write would apply.
+ * Doctor never migrates: a read-only call must leave the file byte-identical.
+ */
+function stateSchemaReport(info) {
+  const stateSchema = {
+    currentVersion: info.currentVersion,
+    supportedVersion: info.supportedVersion,
+    migrations: info.migrations ?? [],
+    status: info.status,
+  }
+  if (info.status === 'current') {
+    return {
+      stateSchema,
+      check: check('state-schema', 'pass', `schemaVersion ${info.currentVersion} is current`),
+    }
+  }
+  if (info.status === 'migratable') {
+    return {
+      stateSchema,
+      check: check(
+        'state-schema',
+        'warn',
+        `schemaVersion ${info.currentVersion} is older than ${info.supportedVersion}; the next locked write migrates it and keeps state.json.v${info.currentVersion}.bak`,
+        'a write tool applies the migration; a read-only tool only migrates in memory',
+      ),
+    }
+  }
+  if (info.status === 'newer') {
+    return {
+      stateSchema,
+      check: check(
+        'state-schema',
+        'fail',
+        `schemaVersion ${info.currentVersion} is newer than this build supports (${info.supportedVersion}); state was written by a newer dsh-tower`,
+        'upgrade dsh-tower; this build refuses to downgrade state.json',
+      ),
+    }
+  }
+  if (info.status === 'unmigratable') {
+    return {
+      stateSchema,
+      check: check(
+        'state-schema',
+        'fail',
+        `schemaVersion ${info.currentVersion} has no migration to ${info.supportedVersion}`,
+        'restore a state.json written by a supported dsh-tower; this build will not guess at an unknown schema',
+      ),
+    }
+  }
+  return {
+    stateSchema,
+    check: check(
+      'state-schema',
+      'fail',
+      info.message ?? 'state schemaVersion is unreadable',
+      'restore a state.json this build can read, or run tower_init for a new repository',
+    ),
+  }
+}
+
 /** Run every read-only diagnostic; never writes state or takes the state lock. */
 export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityFile, loaderRows }) {
   const checks = []
+  let reportsReport = null
   const version = await gitVersion()
   checks.push(version ? check('git', 'pass', version) : check('git', 'fail', 'git is not available', 'install Git and retry'))
 
@@ -84,6 +167,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   }
 
   checks.push(check('repository', 'pass', `${tower.root} (common ${tower.commonDir})`))
+  const schemaInfo = await inspectStateSchema(tower.paths)
   let state = null
   try {
     state = await tower.load()
@@ -96,6 +180,29 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   } catch (error) {
     checks.push(check('state', 'fail', String(error?.message ?? error), 'run tower_init or restore the state file'))
   }
+  const schemaReport = stateSchemaReport(schemaInfo)
+  checks.push(schemaReport.check)
+
+  // Scope matching is only as good as the detected filesystem mode (#90).
+  // Doctor never probes: a read-only call must not create files. A legacy state
+  // that has not been re-initialized therefore reports the safe exact default.
+  const caseInsensitive =
+    state && (state.caseInsensitive === true || state.caseInsensitive === false) ? state.caseInsensitive : null
+  const comparison = comparisonMode(caseInsensitive)
+  checks.push(
+    caseInsensitive === null
+      ? check(
+          'case-mode',
+          'warn',
+          `caseInsensitive: not detected; scope matching uses ${comparison} comparison`,
+          'run tower_init on a writable checkout to probe and record the filesystem mode',
+        )
+      : check(
+          'case-mode',
+          'pass',
+          `caseInsensitive: ${caseInsensitive}; scope matching uses ${comparison} comparison`,
+        ),
+  )
 
   const config = tower.config ?? {}
   const profile = profileConfig()
@@ -208,6 +315,30 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
     )
     checks.push(check('legacy', 'pass', `${state.legacySnapshots?.length ?? 0} legacy snapshot(s)`))
     checks.push(check('batches', 'pass', `${state.batches?.length ?? 0} batch(es)`))
+
+    // Completion reports are the largest model-supplied strings in state.json;
+    // report the biggest one so growth is visible before it becomes a problem.
+    const reportSizes = (state.missions ?? [])
+      .map((mission) => ({ missionId: mission.id, bytes: completionReportBytes(mission.completionReport) }))
+      .filter((entry) => entry.bytes !== null)
+    const largestReport = reportSizes.reduce(
+      (best, entry) => (best === null || entry.bytes > best.bytes ? entry : best),
+      null,
+    )
+    const reportCap = Number(tower.config?.gates?.maxReportBytes) || DEFAULT_MAX_REPORT_BYTES
+    reportsReport = { count: reportSizes.length, largest: largestReport, capBytes: reportCap }
+    checks.push(
+      largestReport
+        ? check(
+            'reports',
+            largestReport.bytes > reportCap ? 'warn' : 'pass',
+            `${reportSizes.length} completion report(s); largest ${largestReport.bytes} B on ${largestReport.missionId} (cap ${reportCap} B)`,
+            largestReport.bytes > reportCap
+              ? 'existing reports predate the cap; reads are unchanged and no rewrite happens'
+              : undefined,
+          )
+        : check('reports', 'pass', `no completion reports (cap ${reportCap} B)`),
+    )
   }
 
   try {
@@ -248,16 +379,63 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
     checks.push(check('lock-holds', 'pass', 'no lock-hold samples yet'))
   }
 
+  // Archive inventory (#73): size, count and the configured trigger policy.
+  // A missing directory is a healthy empty archive; a corrupt file is a warn.
+  const archiveInventory = await inspectArchive(tower.paths)
+  const stateBytes = await fsp.stat(tower.paths.state).then((stat) => stat.size).catch(() => null)
+  const archivePolicy = config.archive ?? {}
+  const policyText = `afterDays=${archivePolicy.afterDays ?? 30} maxMissions=${archivePolicy.maxMissions ?? 100}${archivePolicy.enabled === false ? ' disabled' : ''}`
+  if (!archiveInventory.exists) {
+    checks.push(check('archive', 'pass', `no archived missions; ${policyText}`))
+  } else if (archiveInventory.unreadable.length > 0) {
+    checks.push(
+      check(
+        'archive',
+        'warn',
+        `${archiveInventory.missions} archived mission(s), ${archiveInventory.bytes} bytes; unreadable: ${archiveInventory.unreadable[0]}`,
+        'inspect <git-common-dir>/dsh-tower/archive/ and repair or move the corrupt file; archiving is paused until it is readable',
+      ),
+    )
+  } else {
+    checks.push(
+      check(
+        'archive',
+        'pass',
+        `${archiveInventory.missions} archived mission(s) in ${archiveInventory.years.length} year file(s), ${archiveInventory.bytes} bytes; ${policyText}`,
+      ),
+    )
+  }
+
   const failed = checks.filter((item) => item.status === 'fail').length
   return {
     ok: failed === 0,
     checks,
+    stateSchema: schemaReport.stateSchema,
+// reports (from #89) and archive (from #73) are both kept
+    reports: reportsReport,
+    archive: {
+      missions: state ? state.missions.length : null,
+      archivedMissions: archiveInventory.missions,
+      stateBytes,
+      archiveBytes: archiveInventory.bytes,
+      dir: archiveInventory.dir,
+      years: archiveInventory.years,
+      files: archiveInventory.files.length,
+      unreadable: archiveInventory.unreadable,
+      policy: {
+        enabled: archivePolicy.enabled !== false,
+        afterDays: archivePolicy.afterDays ?? 30,
+        maxMissions: archivePolicy.maxMissions ?? 100,
+      },
+    },
     environmentContract: {
       platform: process.platform,
       gitVersion: version,
       repoRoot: tower.root,
       commonDir: tower.commonDir,
       stateDir: tower.paths.dir,
+      caseInsensitive,
+      comparisonMode: comparison,
       gitTimeoutMs: Number(tower.config.git?.timeoutMs) || 15000,
       mergeTimeoutMs: Number(tower.config.merge?.timeoutMs) || 900000,
       testsAdmission: tower.config.tests?.admission ?? 'off',

package/lib/leases.js

@@ -27,6 +27,11 @@ const LOCK_STALE_MS = 10000
 const LOCK_POLL_MS = 20
 const NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/
 
+// Exported with the retry loop so a test can assert the budget and the exact
+// transient set instead of copying them (#86).
+export const UNLINK_ATTEMPTS = 12
+export const TRANSIENT_UNLINK_ERRORS = new Set(['EPERM', 'EBUSY', 'EACCES'])
+
 function fail(code, message) {
   /** @type {Error & {code?: string}} */
   const error = new Error(message)
@@ -57,17 +62,21 @@ export function leasesLockPath(commonDir) {
 /**
  * Windows can reject unlink while an indexer, antivirus, or a concurrent
  * reader still holds the file; retry briefly instead of failing the mutation.
+ *
+ * `options.unlink` and `options.sleep` inject the syscall and the backoff so
+ * both outcomes are testable on any OS (#86); production callers omit them.
  */
-async function unlinkWithRetry(file) {
+export async function unlinkWithRetry(file, options = {}) {
+  const unlink = options.unlink ?? fsp.unlink
+  const wait = options.sleep ?? sleep
   for (let attempt = 0; ; attempt += 1) {
     try {
-      await fsp.unlink(file)
+      await unlink(file)
       return true
     } catch (error) {
       if (error?.code === 'ENOENT') return false
-      const transient = error?.code === 'EPERM' || error?.code === 'EBUSY' || error?.code === 'EACCES'
-      if (!transient || attempt >= 12) throw error
-      await sleep(10 + attempt * 15)
+      if (!TRANSIENT_UNLINK_ERRORS.has(error?.code) || attempt >= UNLINK_ATTEMPTS) throw error
+      await wait(10 + attempt * 15)
     }
   }
 }

package/lib/legacy.js

@@ -41,13 +41,27 @@ function sha256(buffer) {
   return crypto.createHash('sha256').update(buffer).digest('hex')
 }
 
-function win32Lower(value) {
-  return process.platform === 'win32' ? value.toLowerCase() : value
+// Path semantics are selected from an injected platform so both branches are
+// testable on any OS (#86). On the real platform this is exactly `path`.
+function pathFor(platform) {
+  return platform === 'win32' ? path.win32 : path.posix
 }
 
-function isInside(parent, child) {
-  const relative = path.relative(win32Lower(path.resolve(parent)), win32Lower(path.resolve(child)))
-  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))
+export function win32Lower(value, platform = process.platform) {
+  return platform === 'win32' ? value.toLowerCase() : value
+}
+
+/**
+ * Is `child` inside `parent` (or the same path)? Windows reconciles case
+ * because NTFS is case-insensitive; the POSIX branch stays case-sensitive.
+ */
+export function isInside(parent, child, platform = process.platform) {
+  const pathImpl = pathFor(platform)
+  const relative = pathImpl.relative(
+    win32Lower(pathImpl.resolve(parent), platform),
+    win32Lower(pathImpl.resolve(child), platform),
+  )
+  return relative === '' || (!relative.startsWith('..') && !pathImpl.isAbsolute(relative))
 }
 
 async function realpathOrResolve(target) {

package/lib/persistence.js

@@ -20,8 +20,10 @@ import { TowerToolError } from '../domain/errors.js'
 export const DEFAULT_LOCK_TIMEOUT_MS = 5000
 export const DEFAULT_LOCK_POLL_MS = 25
 
-const RENAME_ATTEMPTS = 12
-const TRANSIENT_RENAME_ERRORS = new Set(['EPERM', 'EBUSY', 'EACCES'])
+// Exported with the retry loop so a test can assert the budget and the exact
+// transient set instead of copying them (#86).
+export const RENAME_ATTEMPTS = 12
+export const TRANSIENT_RENAME_ERRORS = new Set(['EPERM', 'EBUSY', 'EACCES'])
 const PROCESS_STARTED_AT = Date.now() - Math.round(process.uptime() * 1000)
 
 export function sleep(ms) {
@@ -74,18 +76,23 @@ export async function writeJsonAtomic(file, value) {
  * Windows can reject a rename while an indexer, antivirus, or a concurrent
  * reader still holds the destination; retry briefly instead of failing a
  * successful mutation. The temp file is removed when the rename never lands.
+ *
+ * `options.rename` and `options.sleep` inject the syscall and the backoff so
+ * both outcomes are testable on any OS (#86); production callers omit them.
  */
-export async function renameWithRetry(tmp, file) {
+export async function renameWithRetry(tmp, file, options = {}) {
+  const rename = options.rename ?? fsp.rename
+  const wait = options.sleep ?? sleep
   for (let attempt = 0; ; attempt += 1) {
     try {
-      await fsp.rename(tmp, file)
+      await rename(tmp, file)
       return
     } catch (error) {
       if (!TRANSIENT_RENAME_ERRORS.has(error?.code) || attempt >= RENAME_ATTEMPTS) {
         await fsp.unlink(tmp).catch(() => {})
         throw error
       }
-      await sleep(10 + attempt * 15)
+      await wait(10 + attempt * 15)
     }
   }
 }

package/lib/stateFile.js

@@ -0,0 +1,99 @@
+// State-file load path: schema-version inspection, migration, and the one
+// persisted migration result (#72).
+//
+// The domain stays pure: `prepareState` classifies, transforms and validates the
+// document. This module owns the disk effects, and it persists them only while
+// the caller holds the state lock, so a reader can never rewrite a document a
+// concurrent writer is about to change. A read-only load still migrates in
+// memory; the next locked write persists that migration once.
+//
+// Ordering mirrors the protocol contract:
+//   1. classify the version (a newer document is refused before any write);
+//   2. write the pre-migration backup;
+//   3. migrate in memory and validate the target schema;
+//   4. atomically replace state.json, bump `revision` once, append
+//      `state.migrated {from,to}` to the activity log.
+// A migration that throws therefore leaves state.json byte-identical.
+import { inspectStateVersion, prepareState } from '../domain/state.js'
+import { isStateLockHeld } from './store.js'
+
+/**
+ * @typedef {object} StateLoadResult
+ * @property {import('../types/index.js').TowerState} state
+ * @property {ReturnType<typeof inspectStateVersion>} version
+ * @property {null | {
+ *   from: number, to: number, steps: Array<{ from: number, to: number }>,
+ *   persisted: boolean, backupPath: string|null,
+ * }} migration
+ */
+
+/**
+ * Read `paths.state`, migrate it when it is older than this build, and (only
+ * while the state lock is held) persist that migration.
+ *
+ * @param {{
+ *   store: any,
+ *   paths: any,
+ *   now?: number,
+ *   persist?: boolean,
+ *   migrations?: readonly import('../domain/state/migrations.js').StateMigration[],
+ * }} input
+ * @returns {Promise<StateLoadResult>}
+ */
+export async function loadStateFile(input) {
+  const { store, paths, migrations } = input
+  const now = input.now ?? Date.now()
+  const raw = await store.readJson(paths.state)
+  const version = inspectStateVersion(raw, paths.state, migrations)
+  const persist = input.persist ?? isStateLockHeld(paths)
+  const backupPath = `${paths.state}.v${String(version.currentVersion ?? 'unknown')}.bak`
+
+  // Backup before the original can change. `prepareState` is pure, so a
+  // throwing migration cannot touch state.json whether or not this ran.
+  if (persist && version.status === 'migratable') {
+    await store.writeJsonAtomic(backupPath, raw)
+  }
+
+  const prepared = prepareState(raw, paths.state, { migrations })
+  if (!prepared.changed) {
+    return { state: prepared.state, version, migration: null }
+  }
+
+  if (!persist) {
+    return {
+      state: prepared.state,
+      version,
+      migration: {
+        from: prepared.from,
+        to: prepared.to,
+        steps: prepared.migrated,
+        persisted: false,
+        backupPath: null,
+      },
+    }
+  }
+
+  const baseRevision =
+    Number.isInteger(prepared.state.revision) && prepared.state.revision >= 0 ? prepared.state.revision : 0
+  const migrated = { ...prepared.state, revision: baseRevision + 1, updatedAt: now }
+  await store.writeJsonAtomic(paths.state, migrated)
+  await store.appendJsonl(paths.activity, {
+    at: now,
+    type: 'state.migrated',
+    from: prepared.from,
+    to: prepared.to,
+    revision: migrated.revision,
+    text: `schema v${prepared.from} -> v${prepared.to}`,
+  })
+  return {
+    state: migrated,
+    version,
+    migration: {
+      from: prepared.from,
+      to: prepared.to,
+      steps: prepared.migrated,
+      persisted: true,
+      backupPath,
+    },
+  }
+}

package/lib/store.js

@@ -66,6 +66,19 @@ export async function readStateLock(paths) {
   return readLock(paths.lock)
 }
 
+/**
+ * Paths objects whose state lock this process currently holds. A state
+ * migration may be persisted only inside `withLock`: the loader reads this to
+ * tell a locked mutation (which may write) from a read-only load (which must
+ * migrate in memory and leave the file alone).
+ */
+const HELD_STATE_LOCKS = new WeakSet()
+
+/** @param {object} [paths] @returns {boolean} */
+export function isStateLockHeld(paths) {
+  return Boolean(paths) && HELD_STATE_LOCKS.has(paths)
+}
+
 /**
  * Hold the repo-wide tower lock for one mutation. A lock whose recorded PID is
  * provably dead is reclaimed atomically; a live lock is reported, never stolen.
@@ -86,9 +99,11 @@ export async function withLock(paths, fn, options = {}) {
     )
   }
   const startedAt = Date.now()
+  HELD_STATE_LOCKS.add(paths)
   try {
     return await fn(paths)
   } finally {
+    HELD_STATE_LOCKS.delete(paths)
     await held.release()
     await fsp
       .appendFile(path.join(paths.dir, 'lock-holds.jsonl'), `${JSON.stringify({ at: Date.now(), ms: Date.now() - startedAt, pid: process.pid })}\n`, 'utf8')

package/lib/tests.js

@@ -288,8 +288,12 @@ export function testProcessEnv(source = process.env) {
   return env
 }
 
-/** Platform shell for discovery commands (PowerShell 7 on Windows, bash on POSIX). */
-function shellSpec(platform = process.platform) {
+/**
+ * Platform shell for discovery commands (PowerShell 7 on Windows with a
+ * `powershell` fallback, bash on POSIX). Exported so both branches are asserted
+ * on every OS instead of only on the platform that happens to run CI (#86).
+ */
+export function shellSpec(platform = process.platform) {
   if (platform === 'win32') {
     const args = (command) => ['-NoProfile', '-NonInteractive', '-Command', command]
     return {

package/lib/worktreeOwnership.js

@@ -6,7 +6,7 @@
 // and must still be the Git worktree of the recorded branch in the recorded
 // repository. Every mismatch is rejected with an actionable message; nothing
 // is repaired or recreated here.
-import { fsp } from '../adapters/store-fs.js'
+import { fs, fsp } from '../adapters/store-fs.js'
 import path from 'node:path'
 
 import { git } from './git.js'
@@ -22,18 +22,29 @@ function isNonEmptyString(value) {
   return typeof value === 'string' && value.trim().length > 0
 }
 
-function compareKey(target) {
-  const resolved = path.resolve(target)
-  return process.platform === 'win32' ? resolved.toLowerCase() : resolved
+// Path identity follows the injected platform's semantics so both branches are
+// testable on any OS (#86); on the real platform this is exactly `path`.
+export function compareKey(target, platform = process.platform) {
+  const pathImpl = platform === 'win32' ? path.win32 : path.posix
+  const resolved = pathImpl.resolve(target)
+  return platform === 'win32' ? resolved.toLowerCase() : resolved
+}
+
+function nativeRealpath(target) {
+  try {
+    return fs.realpathSync.native(target)
+  } catch {
+    return path.resolve(target)
+  }
 }
 
 function samePath(a, b) {
-  return compareKey(a) === compareKey(b)
+  return compareKey(nativeRealpath(a)) === compareKey(nativeRealpath(b))
 }
 
 async function realpathOrResolve(target) {
   try {
-    return await fsp.realpath(target)
+    return fs.realpathSync.native(target)
   } catch (error) {
     if (error?.code === 'ENOENT') return path.resolve(target)
     throw error
@@ -48,7 +59,7 @@ export async function canonicalPath(target) {
   if (!isNonEmptyString(target)) fail('invalid-argument', 'path is required')
   if (!path.isAbsolute(target)) fail('invalid-argument', `path must be an absolute path: ${target}`)
   try {
-    return await fsp.realpath(target)
+    return fs.realpathSync.native(target)
   } catch (error) {
     if (error?.code === 'ENOENT') fail('invalid-transition', `path does not exist: ${path.resolve(target)}`)
     throw error

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-tower",
-  "version": "2.1.0-beta.1",
+  "version": "2.1.0",
   "type": "module",
   "description": "DSH-native Tower: mission planning, worktree isolation, review-gated merges, and a human-owned Tower mode.",
   "license": "MIT",

package/scripts/pack-manifest.txt

@@ -8,6 +8,7 @@ SECURITY.md
 adapters/default.js
 adapters/store-fs.js
 adapters/vcs-git.js
+app/archive.js
 app/batch.js
 app/board.js
 app/checkCompletion.js
@@ -31,6 +32,9 @@ app/teardown.js
 app/tower.js
 cordis.patch.yml
 docs/README.md
+docs/agents/domain.md
+docs/agents/issue-tracker.md
+docs/agents/triage-labels.md
 docs/architecture/overview.md
 docs/board.md
 docs/examples/first-mission.md
@@ -106,13 +110,17 @@ domain/report.js
 domain/roster.js
 domain/scope.js
 domain/state.js
+domain/state/archive.js
+domain/state/migrations.js
 domain/state/schema.js
 domain/state/semantics.js
 domain/summary.js
 domain/vocabulary.js
 icon.svg
 index.js
+lib/archive.js
 lib/briefing.js
+lib/caseSensitivity.js
 lib/compatibility.js
 lib/config.js
 lib/doctor.js
@@ -126,6 +134,7 @@ lib/persistence.js
 lib/presets.js
 lib/spawn-prechecks.js
 lib/spawn-support.js
+lib/stateFile.js
 lib/store.js
 lib/tests.js
 lib/tool-registry.js

package/tools/complete.js

@@ -14,7 +14,7 @@ export function registerCompleteTool(ctx, deps) {
   define(ctx, {
     name: 'tower_complete',
     description:
-      'Worker-only: report mission completion. Enforced by the store: every task done or dropped, no blockers, the current owner, the mission branch has at least one commit since its spawn base, and no unread inbox messages. checks records verifiable evidence (name/command/exitCode/evidence); gates.requireChecks can require at least one before merge. Stores the full report; completion means ready for preflight and optional review, not merged.',
+      'Worker-only: report mission completion. Enforced by the store: every task done or dropped, no blockers, the current owner, the mission branch has at least one commit since its spawn base, and no unread inbox messages. checks records verifiable evidence (name/command/exitCode/evidence); gates.requireChecks can require at least one before merge. Stores the full report, capped at gates.maxReportBytes (default 32768 UTF-8 bytes); a larger report is rejected with invalid-argument and an actionable nextAction, never truncated. Persists reportBytes on the stored report. completion means ready for preflight and optional review, not merged.',
     parameters: CompleteInput,
     aliases: {"missionId":["id"]},
     requiresMissionId: true,

package/tools/doctor.js

@@ -15,7 +15,7 @@ export function registerDoctorTool(ctx, define) {
   define(ctx, {
     name: 'tower_doctor',
     description:
-      'Read-only environment and repository health check: git, state schema, config, presets/subagents/HMR, workspace lock, roster staleness, worktree ownership, test discovery, leases. Returns checks with pass/warn/fail and an environment contract. Never writes state.',
+'Read-only\ environment\ and\ repository\ health\ check:\ git,\ state\ schema,\ case-sensitivity\ detection\ \(caseInsensitive\ and\ the\ active\ scope\ comparison\ mode\),\ config,\ presets/subagents/HMR,\ workspace\ lock,\ roster\ staleness,\ worktree\ ownership,\ test\ discovery,\ leases,\ and\ the\ terminal-mission\ archive\ \(count,\ bytes,\ years,\ unreadable\ diagnostics\ and\ the\ configured\ afterDays/maxMissions\ policy\)\.\ Returns\ checks\ with\ pass/warn/fail\ and\ an\ environment\ contract\.\ Never\ writes\ state\ and\ never\ probes\ the\ filesystem\.',
     parameters: DoctorInput,
     output: output(SCHEMAS.doctor),
     async execute(args, exec) {

package/tools/init.js

@@ -16,7 +16,7 @@ export function registerInitTool(ctx, deps) {
   define(ctx, {
     name: 'tower_init',
     description:
-      'Initialize Tower mission state for a repository (absolute repoRoot). Creates <git-common-dir>/dsh-tower/state.json and an activity log; idempotent on an existing workspace. Options: autoGitInit (git init + empty initial commit when the directory is not a repository), snapshotDirty (snapshot uncommitted work into a dangling commit used as the mission baseline), reanchor (change base when every mission is merged/abandoned). Only the tower may initialize.',
+      'Initialize Tower mission state for a repository (absolute repoRoot). Creates <git-common-dir>/dsh-tower/state.json and an activity log; idempotent on an existing workspace. Probes whether the checkout filesystem folds case and records caseInsensitive once, so scope matching follows the real filesystem (a skipped probe records null and keeps the safe case-sensitive comparison). Options: autoGitInit (git init + empty initial commit when the directory is not a repository), snapshotDirty (snapshot uncommitted work into a dangling commit used as the mission baseline), reanchor (change base when every mission is merged/abandoned). Only the tower may initialize.',
     parameters: InitInput,
     aliases: { auto_git_init: ['autoGitInit'], snapshot_dirty: ['snapshotDirty'] },
     board: true,

package/tools/plan.js

@@ -24,7 +24,7 @@ export function registerPlanTool(ctx, deps) {
   define(ctx, {
     name: 'tower_plan',
     description:
-      'Plan one or more missions in an initialized repository. Each mission has a printable-ASCII title, relative scope globs, optional task checklist, optional mission-id dependencies, and kind build|survey. Assigns M1.. ids and auto-adds a dependency when build scopes overlap (serializes merges); rejects dependency cycles.',
+      'Plan one or more missions in an initialized repository. Each mission has a printable-Unicode title (NFC-normalized, at most 120 characters), relative scope globs, optional task checklist, optional mission-id dependencies, and kind build|survey. Assigns M1.. ids and auto-adds a dependency when build scopes overlap (serializes merges); rejects dependency cycles.',
     parameters: PlanInput,
     board: true,
     output: output(SCHEMAS.plan),

package/tools/preflight.js

@@ -38,6 +38,7 @@ export function registerPreflightTool(ctx, deps) {
               reviewedCommit: gate.review.reviewedCommit,
             }
           : null,
+        ...(gate.archived ? { archived: true } : {}),
       }
     },
   })