dsh-tower 2.1.0-beta.1 → 2.3.0

package/adapters/store.js

@@ -0,0 +1,204 @@
+import { TowerToolError } from '../domain/errors.js'
+// Durable repo-scoped store: exclusive lock + atomic JSON + append-only activity.
+// The atomic/lock/JSON primitives are shared with the mode store (#56 P2b).
+import { fsp } from './store-fs.js'
+import {
+  PROCESS_STARTED_AT,
+  acquireLock,
+  lockRecord,
+  lockTiming,
+  readLock,
+} from './persistence.js'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+export {
+  readJson,
+  writeJsonAtomic,
+  writeJsonAtomicSync,
+  renameWithRetry,
+  appendJsonl,
+} from './persistence.js'
+
+export function pathsFor(commonDir) {
+  const dir = path.join(commonDir, 'dsh-tower')
+  return {
+    dir,
+    state: path.join(dir, 'state.json'),
+    lock: path.join(dir, 'state.lock'),
+    gitLock: path.join(dir, 'git.lock'),
+    activity: path.join(dir, 'activity.jsonl'),
+  }
+}
+
+export async function exists(file) {
+  try {
+    await fsp.access(file)
+    return true
+  } catch {
+    return false
+  }
+}
+
+export async function ensureDir(dir) {
+  await fsp.mkdir(dir, { recursive: true })
+}
+
+export function shortHash(text) {
+  return crypto.createHash('sha256').update(String(text)).digest('hex').slice(0, 12)
+}
+
+export async function readActivityTail(file, limit = 12) {
+  const text = await fsp.readFile(file, 'utf8').catch(() => '')
+  const lines = text.split('\n').filter(Boolean)
+  const tail = lines.slice(Math.max(0, lines.length - limit))
+  const out = []
+  for (const line of tail) {
+    try {
+      out.push(JSON.parse(line))
+    } catch {
+      // keep going: a truncated activity line must not hide the rest
+    }
+  }
+  return out
+}
+
+export async function readStateLock(paths, options = {}) {
+  return readLock(paths.lock, options)
+}
+
+/** Read the repo-scoped git mutex; a missing/free lock is not an error. */
+export async function readGitLock(paths, options = {}) {
+  return readLock(paths.gitLock, options)
+}
+
+// The git-mutex budget is pure policy over the resolved config (#93) and is
+// shared with the app layer, so it lives in the domain (#69). Re-exported here
+// for the store's callers and tests; the state lock keeps its short 5 s default.
+export { GIT_LOCK_MARGIN_MS, gitLockTimeoutMs } from '../domain/lockBudget.js'
+
+/**
+ * Read-only projection of the git mutex for tower_status/tower_doctor: the
+ * shape is `{ held: true, pid, phase, heldMs }` while a holder exists and
+ * `{ held: false }` when it is free.
+ */
+export function gitLockView(lock, options = {}) {
+  const record = lock?.record
+  if (!record) return { held: false }
+  return {
+    held: true,
+    pid: record.pid ?? null,
+    phase: record.phase ?? null,
+    heldMs: lockTiming(record, options).ageMs,
+  }
+}
+
+/**
+ * Paths objects whose state lock this process currently holds. A state
+ * migration may be persisted only inside `withLock`: the loader reads this to
+ * tell a locked mutation (which may write) from a read-only load (which must
+ * migrate in memory and leave the file alone).
+ */
+const HELD_STATE_LOCKS = new WeakSet()
+
+/** @param {object} [paths] @returns {boolean} */
+export function isStateLockHeld(paths) {
+  return Boolean(paths) && HELD_STATE_LOCKS.has(paths)
+}
+
+/**
+ * Hold the repo-wide tower lock for one mutation. A lock whose recorded PID is
+ * provably dead is reclaimed atomically; a live lock is reported, never
+ * stolen. While held the record heartbeats, so another process can tell a live
+ * writer from a recycled PID (#92). `heartbeatMs`/`heartbeatStaleMs`/`now` are
+ * injectable for tests; production callers use the defaults.
+ */
+export async function withLock(paths, fn, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 5000
+  const pollMs = options.pollMs ?? 25
+  const token = crypto.randomUUID()
+  const record = lockRecord(token, { startedAt: PROCESS_STARTED_AT }, options)
+  const held = await acquireLock(paths.lock, { ...options, token, record, timeoutMs, pollMs })
+  if (!held) {
+    const owner = await readStateLock(paths, options)
+    const ownerRecord = owner.record
+    const payload = owner.raw ?? (ownerRecord ? JSON.stringify(ownerRecord) : null)
+    throw new TowerToolError(
+      'state-locked',
+      `tower state is locked by another writer${payload ? ` (${payload})` : ''}; retry after it finishes`,
+    )
+  }
+  const startedAt = Date.now()
+  HELD_STATE_LOCKS.add(paths)
+  try {
+    return await fn(paths)
+  } finally {
+    HELD_STATE_LOCKS.delete(paths)
+    await held.release()
+    await fsp
+      .appendFile(path.join(paths.dir, 'lock-holds.jsonl'), `${JSON.stringify({ at: Date.now(), ms: Date.now() - startedAt, pid: process.pid })}\n`, 'utf8')
+      .catch(() => {})
+  }
+}
+
+function formatSeconds(ms) {
+  if (!Number.isFinite(ms)) return 'an unknown time'
+  return `${Math.max(0, Math.round(ms / 1000))} s`
+}
+
+/**
+ * Serialize git mutations without holding the state lock. The caller owns the
+ * wait budget: a merge passes its resolved `plan.timeoutMs`, and the other git
+ * mutations pass the same merge-derived budget (#93). While held the record
+ * carries `kind: 'git'` and the caller's `phase` (merge/rebase/init/teardown/
+ * provision), so a waiter and the read-only diagnostics can name the holder.
+ */
+export async function withGitLock(paths, fn, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 60000
+  const pollMs = options.pollMs ?? 25
+  const phase = options.phase ?? 'git'
+  const lock = paths.gitLock
+  const token = crypto.randomUUID()
+  const clock = typeof options.now === 'function' ? options.now : Date.now
+  const waitStartedAt = clock()
+  const startedAt = Date.now()
+  // The heartbeat matters here too: a legitimate pre-merge hook can hold this
+  // lock for minutes, and a stale-heartbeat reclaim must not mistake that for
+  // a crash (#92, #93).
+  const held = await acquireLock(lock, {
+    ...options,
+    token,
+    record: lockRecord(token, { kind: 'git', phase }, options),
+    timeoutMs,
+    pollMs,
+  })
+  if (!held) {
+    const owner = await readLock(lock, options)
+    const record = owner.record
+    const waitedMs = Math.max(0, clock() - waitStartedAt)
+    const heldMs = record ? lockTiming(record, options).ageMs : null
+    const holderPid = record?.pid ?? null
+    const holderPhase = record?.phase ?? null
+    const facts = record
+      ? `held by pid ${holderPid ?? 'unknown'}${holderPhase ? ` (${holderPhase})` : ''} for ${formatSeconds(heldMs)}; waited ${formatSeconds(waitedMs)}`
+      : `the lock was released before it could be inspected; waited ${formatSeconds(waitedMs)}`
+    throw new TowerToolError(
+      'state-locked',
+      `another git mutation is in progress for this repository: ${facts}; retry after it finishes`,
+      { details: { holderPid, holderPhase, heldMs, waitedMs } },
+    )
+  }
+  const waitedMs = Math.max(0, clock() - waitStartedAt)
+  try {
+    return await fn(paths)
+  } finally {
+    await held.release()
+    await fsp
+      .appendFile(
+        path.join(paths.dir, 'lock-holds.jsonl'),
+        `${JSON.stringify({ at: Date.now(), ms: Date.now() - startedAt, pid: process.pid, kind: 'git', phase, budgetMs: timeoutMs, waitedMs })}\n`,
+        'utf8',
+      )
+      .catch(() => {})
+  }
+}

package/{lib → adapters}/tests.js

@@ -19,10 +19,10 @@ import { TowerToolError } from '../domain/errors.js'
 //   minCount/required shortfall) returns `ok: false` in the receipt;
 // - an invalid discovery configuration (or invalid call arguments) throws a
 //   plain `Error`, which the tool layer wraps as `tower:invalid-argument`.
-import { spawn } from '../adapters/vcs-git.js'
-import { createWriteStream } from '../adapters/store-fs.js'
+import { spawn } from './vcs-git.js'
+import { createWriteStream } from './store-fs.js'
 import crypto from 'node:crypto'
-import { fsp } from '../adapters/store-fs.js'
+import { fsp } from './store-fs.js'
 import path from 'node:path'
 
 import { tryGit } from './git.js'
@@ -279,7 +279,9 @@ const TEST_ENV_ALLOW = new Set([
   'NODE_PATH',
 ])
 
+/** @returns {NodeJS.ProcessEnv} */
 export function testProcessEnv(source = process.env) {
+  /** @type {NodeJS.ProcessEnv} */
   const env = {}
   for (const [key, value] of Object.entries(source)) {
     if (!TEST_ENV_ALLOW.has(key)) continue
@@ -288,8 +290,12 @@ export function testProcessEnv(source = process.env) {
   return env
 }
 
-/** Platform shell for discovery commands (PowerShell 7 on Windows, bash on POSIX). */
-function shellSpec(platform = process.platform) {
+/**
+ * Platform shell for discovery commands (PowerShell 7 on Windows with a
+ * `powershell` fallback, bash on POSIX). Exported so both branches are asserted
+ * on every OS instead of only on the platform that happens to run CI (#86).
+ */
+export function shellSpec(platform = process.platform) {
   if (platform === 'win32') {
     const args = (command) => ['-NoProfile', '-NonInteractive', '-Command', command]
     return {
@@ -336,7 +342,8 @@ function closeStreams(streams) {
   return Promise.all(
     streams.map(
       (stream) =>
-        new Promise((resolve) => {
+        /** @type {Promise<void>} */
+        (new Promise((resolve) => {
           if (stream.closed || stream.destroyed) {
             resolve()
             return
@@ -344,7 +351,7 @@ function closeStreams(streams) {
           stream.once('close', resolve)
           stream.once('error', resolve)
           stream.end()
-        }),
+        })),
     ),
   )
 }
@@ -363,6 +370,7 @@ function spawnToFiles({ command, cwd, timeoutMs, maxBytes, stdoutPath, stderrPat
 
   return new Promise((resolve) => {
     let settled = false
+    /** @type {import('node:child_process').ChildProcess | null} */
     let child = null
     let timer = null
     let stdoutBytes = 0

package/adapters/vcs-git.js

@@ -1,4 +1,18 @@
-// The only lib/ module that imports node:child_process (#50).
+// The only module in the plugin that imports node:child_process (#50).
+//
+// Since #69 this is a real adapter, not a re-export shim: `createVcsPort()`
+// returns a runtime implementation of VcsPort (ports/vcs.js) that the
+// composition root injects into the app layer. The bounded-command
+// implementation lives next door in adapters/git.js (#70).
 import { execFile, spawn } from 'node:child_process'
+import * as git from './git.js'
 
 export { execFile, spawn }
+
+/**
+ * Build the Git vcs port (#69). The composition root assembles this once and
+ * injects it; a scripted or in-memory vcs can replace it wholesale.
+ */
+export function createVcsPort() {
+  return Object.freeze({ ...git })
+}

package/{lib → adapters}/workspaceLock.js

@@ -2,7 +2,7 @@
 // `mode.workspaceLock` is enabled. Same-user trusted model, like the rest of
 // the Tower store: it prevents accidental double control, not a malicious
 // writer.
-import { fsp } from '../adapters/store-fs.js'
+import { fsp } from './store-fs.js'
 import path from 'node:path'
 import crypto from 'node:crypto'
 

package/{lib → adapters}/worktreeOwnership.js

@@ -6,7 +6,7 @@
 // and must still be the Git worktree of the recorded branch in the recorded
 // repository. Every mismatch is rejected with an actionable message; nothing
 // is repaired or recreated here.
-import { fsp } from '../adapters/store-fs.js'
+import { fs, fsp } from './store-fs.js'
 import path from 'node:path'
 
 import { git } from './git.js'
@@ -22,18 +22,29 @@ function isNonEmptyString(value) {
   return typeof value === 'string' && value.trim().length > 0
 }
 
-function compareKey(target) {
-  const resolved = path.resolve(target)
-  return process.platform === 'win32' ? resolved.toLowerCase() : resolved
+// Path identity follows the injected platform's semantics so both branches are
+// testable on any OS (#86); on the real platform this is exactly `path`.
+export function compareKey(target, platform = process.platform) {
+  const pathImpl = platform === 'win32' ? path.win32 : path.posix
+  const resolved = pathImpl.resolve(target)
+  return platform === 'win32' ? resolved.toLowerCase() : resolved
+}
+
+function nativeRealpath(target) {
+  try {
+    return fs.realpathSync.native(target)
+  } catch {
+    return path.resolve(target)
+  }
 }
 
 function samePath(a, b) {
-  return compareKey(a) === compareKey(b)
+  return compareKey(nativeRealpath(a)) === compareKey(nativeRealpath(b))
 }
 
 async function realpathOrResolve(target) {
   try {
-    return await fsp.realpath(target)
+    return fs.realpathSync.native(target)
   } catch (error) {
     if (error?.code === 'ENOENT') return path.resolve(target)
     throw error
@@ -48,7 +59,7 @@ export async function canonicalPath(target) {
   if (!isNonEmptyString(target)) fail('invalid-argument', 'path is required')
   if (!path.isAbsolute(target)) fail('invalid-argument', `path must be an absolute path: ${target}`)
   try {
-    return await fsp.realpath(target)
+    return fs.realpathSync.native(target)
   } catch (error) {
     if (error?.code === 'ENOENT') fail('invalid-transition', `path does not exist: ${path.resolve(target)}`)
     throw error

package/app/archive.js

@@ -0,0 +1,188 @@
+// Terminal-mission archival use case (#73).
+//
+// The policy sweep runs inside an existing state lock, immediately before the
+// caller writes state.json: archive files are written first, then the state
+// document is compacted, so a crash between the two leaves the mission in state
+// and the archive entry is deduped by id on retry. Nothing is deleted: the full
+// mission, its linked reviews and its findings are moved to archive/<year>.json.
+import { hasLiveAgent } from '../domain/integration/liveness.js'
+import { missionSummary } from '../domain/summary.js'
+import {
+  archiveYearFor,
+  archivedEntry,
+  isClosedFinding,
+  linkedFindings,
+  linkedReviews,
+  selectForArchive,
+} from '../domain/state/archive.js'
+
+/** @typedef {import('../types/index.js').Mission} Mission */
+/** @typedef {import('../types/index.js').TowerState} TowerState */
+
+/**
+ * Read `archive/index.json` through the Tower's store. Never throws: the
+ * returned `ok:false` carries the diagnostic that status/doctor surface.
+ * @param {any} tower
+ * @returns {Promise<{ ok: boolean, file: string, missions: any[], error?: string, exists: boolean }>}
+ */
+export function archiveIndex(tower) {
+  return tower.deps.archive.readIndex(tower.deps.store, tower.paths)
+}
+
+/**
+ * Load one archived mission with its linked reviews and findings.
+ * @param {any} tower
+ * @param {string} missionId
+ */
+export function archivedMission(tower, missionId) {
+  return tower.deps.archive.readEntry(tower.deps.store, tower.paths, missionId)
+}
+
+/**
+ * A compact archived mission is rendered through the same summary projection as
+ * an active one, plus `archived: true`. The completion report and task bodies
+ * are intentionally absent: they live in the year file and are loaded only by
+ * `tower_status missionId`.
+ * @param {Record<string, any>} entry
+ * @returns {any}
+ */
+export function archivedSummary(entry) {
+  const mission = /** @type {any} */ ({
+    id: entry.id,
+    title: entry.title,
+    kind: entry.kind ?? 'build',
+    status: entry.status,
+    scope: Array.isArray(entry.scope) ? entry.scope : [],
+    deps: Array.isArray(entry.deps) ? entry.deps : [],
+    owner: entry.owner ?? null,
+    worktree: null,
+    blockers: [],
+    tasks: [],
+    reviewPolicy: 'required-clean',
+    mergedCommit: entry.mergedCommit ?? null,
+    mergedAt: entry.mergedAt ?? null,
+    updatedAt: entry.updatedAt ?? null,
+  })
+  return {
+    ...missionSummary(mission),
+    archived: true,
+    archivedAt: entry.archivedAt,
+    archivedYear: entry.archivedYear ?? null,
+    branch: entry.branch ?? null,
+  }
+}
+
+/**
+ * Status/board view of the archive index: a count plus a diagnostic, never a
+ * thrown error.
+ * @param {{ ok: boolean, file: string, missions: any[], error?: string, exists: boolean }} index
+ * @returns {Record<string, any>}
+ */
+export function archiveView(index) {
+  const years = index.ok
+    ? [...new Set(index.missions.map((entry) => entry.archivedYear).filter((year) => Number.isInteger(year)))].sort(
+        (left, right) => left - right,
+      )
+    : []
+  return {
+    count: index.ok ? index.missions.length : 0,
+    years,
+    file: index.file,
+    present: index.exists === true,
+    unreadable: index.ok ? false : true,
+    ...(index.ok ? {} : { message: index.error ?? 'tower archive is unreadable' }),
+  }
+}
+
+/**
+ * Move the eligible terminal missions out of `state` and into the archive.
+ * Mutates `state` in memory (missions, linked reviews and closed findings) and
+ * leaves the caller to validate/persist it under the lock it already holds.
+ *
+ * @param {any} tower
+ * @param {TowerState} state
+ * @param {{ now?: number, force?: boolean, activity?: Record<string, string | undefined> }} [options]
+ * @returns {Promise<{ archived: string[], written: boolean, files?: string[], error: string | null, year?: number }>}
+ */
+export async function sweepArchive(tower, state, options = {}) {
+  const policy = tower.config.archive ?? {}
+  if (policy.enabled === false) return { archived: [], written: false, error: null }
+  const now = options.now ?? Date.now()
+  const activity = options.activity ?? {}
+
+  // Open batches still need their members; a live agent's mission is never
+  // archived even if it is terminal (defence in depth; teardown keeps it too).
+  const protectedIds = new Set()
+  for (const batch of state.batches ?? []) {
+    const record = /** @type {Record<string, any>} */ (batch)
+    if (record.status !== 'open') continue
+    for (const missionId of Array.isArray(record.missionIds) ? record.missionIds : []) {
+      protectedIds.add(String(missionId))
+    }
+  }
+  for (const mission of state.missions) {
+    if (hasLiveAgent(state, mission.id, activity)) protectedIds.add(mission.id)
+  }
+
+  const selected = selectForArchive(state.missions, policy, {
+    now,
+    force: options.force === true,
+    protectedIds,
+  })
+  if (selected.length === 0) return { archived: [], written: false, error: null }
+
+  const archivedYear = archiveYearFor(now)
+  const entries = selected.map((mission) =>
+    archivedEntry(mission, {
+      archivedAt: now,
+      archivedYear,
+      reviews: linkedReviews(mission, state.reviews),
+      findings: linkedFindings(mission, state.findings),
+    }),
+  )
+
+  let written
+  try {
+    written = await tower.deps.archive.writeEntries(tower.deps.store, tower.paths, { entries, now })
+  } catch (error) {
+    return { archived: [], written: false, error: `archive write failed: ${String(error?.message ?? error)}` }
+  }
+  if (!written.ok) return { archived: [], written: false, error: written.error ?? 'archive write failed' }
+
+  // The archive now holds the full record: compact state.json in the same lock.
+  const ids = new Set(selected.map((mission) => mission.id))
+  const branches = new Set(
+    selected
+      .map((mission) => mission.worktree?.branch)
+      .filter((branch) => typeof branch === 'string'),
+  )
+  state.missions = state.missions.filter((mission) => !ids.has(mission.id))
+  if (Array.isArray(state.reviews)) {
+    state.reviews = state.reviews.filter((review) => !ids.has(review.missionId) && !branches.has(review.branch))
+  }
+  // Open findings stay actionable in state.json; the archive keeps a snapshot.
+  if (Array.isArray(state.findings)) {
+    state.findings = state.findings.filter(
+      (finding) => !(finding.missionId != null && ids.has(finding.missionId) && isClosedFinding(finding)),
+    )
+  }
+  state.revision += 1
+  state.updatedAt = now
+
+  for (const mission of selected) {
+    await tower.deps.store.appendJsonl(tower.paths.activity, {
+      at: now,
+      type: 'archive',
+      missionId: mission.id,
+      text: `archived to archive/${archivedYear}.json`,
+    }).catch(() => {})
+  }
+
+  return {
+    archived: [...ids],
+    written: true,
+    files: written.files,
+    error: null,
+    year: archivedYear,
+  }
+}

package/app/batch.js

@@ -1,6 +1,5 @@
 // Batch use cases.
 import { TowerToolError } from '../domain/errors.js'
-import { withLock, writeJsonAtomic, appendJsonl } from '../lib/store.js'
 import { validateState } from '../domain/state.js'
 import { validateCreate as validateBatchCreate, validateClose as validateBatchClose } from '../domain/batch.js'
 import {
@@ -17,7 +16,7 @@ function fail(message, code = 'batch-invalid') {
 }
 
 export async function createBatch(tower, input = {}, actor = 'tower') {
-    return withLock(tower.paths, async () => {
+    return tower.deps.store.withLock(tower.paths, async () => {
       const state = await tower.load()
       const normalized = validateBatchCreate(state, input)
       if (!Array.isArray(state.batches)) state.batches = []
@@ -26,8 +25,8 @@ export async function createBatch(tower, input = {}, actor = 'tower') {
       state.revision += 1
       state.updatedAt = batch.createdAt
       validateState(state, tower.paths.state)
-      await writeJsonAtomic(tower.paths.state, state)
-      await appendJsonl(tower.paths.activity, {
+      await tower.deps.store.writeJsonAtomic(tower.paths.state, state)
+      await tower.deps.store.appendJsonl(tower.paths.activity, {
         at: batch.createdAt,
         type: 'batch',
         text: `created ${batch.id}: ${batch.missionIds.join(', ')}`,
@@ -37,7 +36,7 @@ export async function createBatch(tower, input = {}, actor = 'tower') {
   }
 
   export async function closeBatch(tower, batchId, options = {}, actor = 'tower') {
-    return withLock(tower.paths, async () => {
+    return tower.deps.store.withLock(tower.paths, async () => {
       const state = await tower.load()
       const batch = (state.batches ?? []).find((entry) => entry.id === batchId)
       if (!batch) fail(`unknown batch "${batchId}"`)
@@ -48,15 +47,15 @@ export async function createBatch(tower, input = {}, actor = 'tower') {
       state.revision += 1
       state.updatedAt = batch.closedAt
       validateState(state, tower.paths.state)
-      await writeJsonAtomic(tower.paths.state, state)
-      await appendJsonl(tower.paths.activity, { at: batch.closedAt, type: 'batch', text: `closed ${batch.id}` })
+      await tower.deps.store.writeJsonAtomic(tower.paths.state, state)
+      await tower.deps.store.appendJsonl(tower.paths.activity, { at: batch.closedAt, type: 'batch', text: `closed ${batch.id}` })
       return { ok: true, batch, blockers: [], checks: result.checks ?? [] }
     })
   }
 
   /** @param {string} batchId @param {string} [actor] @param {string | null} [reason] */
   export async function abandonBatch(tower, batchId, actor = 'tower', reason = null) {
-    return withLock(tower.paths, async () => {
+    return tower.deps.store.withLock(tower.paths, async () => {
       const state = await tower.load()
       const batch = (state.batches ?? []).find((entry) => entry.id === batchId)
       if (!batch) fail(`unknown batch "${batchId}"`)
@@ -67,8 +66,8 @@ export async function createBatch(tower, input = {}, actor = 'tower') {
       state.revision += 1
       state.updatedAt = batch.abandonedAt
       validateState(state, tower.paths.state)
-      await writeJsonAtomic(tower.paths.state, state)
-      await appendJsonl(tower.paths.activity, { at: batch.abandonedAt, type: 'batch', text: `abandoned ${batch.id}` })
+      await tower.deps.store.writeJsonAtomic(tower.paths.state, state)
+      await tower.deps.store.appendJsonl(tower.paths.activity, { at: batch.abandonedAt, type: 'batch', text: `abandoned ${batch.id}` })
       return { ok: true, batch, alreadyAbandoned: false }
     })
   }

package/app/board.js

@@ -1,7 +1,6 @@
 // Mission board (MISSIONS.md) writing use cases.
 import path from 'node:path'
-import { fsp } from '../adapters/store-fs.js'
-import { renameWithRetry } from '../lib/store.js'
+import { archiveView } from './archive.js'
 
 export function boardFile(tower) {
   return tower.config.docs?.boardLocation === 'repo'
@@ -13,11 +12,12 @@ export async function writeBoard(tower) {
   if (tower.config.docs?.board === false) return null
   try {
     const state = await tower.load()
+    const index = await tower.archiveIndex()
     const file = boardFile(tower)
     await tower.ensureExcluded(file)
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`
-    await fsp.writeFile(tmp, tower.boardMarkdown(state), 'utf8')
-    await renameWithRetry(tmp, file)
+    await tower.deps.store.writeText(tmp, tower.boardMarkdown(state, archiveView(index)), 'utf8')
+    await tower.deps.store.renameWithRetry(tmp, file)
     return file
   } catch {
     return null