dsh-tower 2.6.0 → 2.7.0

package/docs/reference/shapes.md

@@ -0,0 +1,123 @@
+# Mission shapes (generated)
+
+> Generated by `npm run docs:generate:shapes` from `domain/shapes/index.js`. Do not edit by hand.
+
+A mission shape is the single place its kind's contract lives (#148/#149). Generic
+layers resolve `shapeFor(mission.kind)` and never branch on a kind literal; the
+shape audit (`npm run shape:audit`) refuses kind and role comparisons outside
+`domain/shapes/`, the global `TERMINAL_STATUSES`/`TRANSITIONS` vocabulary,
+one-argument `isTerminal`/`canTransition` calls, and the dimension regressions
+recorded in the inventory below (review tip, batch status, lease ledger, blocked
+writes, evidence reads, legacy vocabulary, path permission and role/shape
+conflation).
+
+## Kinds
+
+| Kind | Statuses | Has terminal | Provisioning | Can merge | Can rebase | Reach (owns / fence) | Component | Accepts result |
+|---|---|---|---|---|---|---|---|---|
+| `build` | `planned`, `active`, `completed`, `blocked`, `paused`, `merged`, `abandoned` | yes | `branch-worktree` | true | true | true / `scope` | — | false |
+| `survey` | `planned`, `active`, `completed`, `blocked`, `paused`, `abandoned` | yes | `shared` / `detached` | false | false | false / `read-only` | tower-survey | true |
+
+## Transitions
+
+### build
+
+| From | To |
+|---|---|
+| `planned` | `active`, `blocked`, `abandoned` |
+| `active` | `completed`, `blocked`, `paused`, `abandoned` |
+| `completed` | `active`, `blocked`, `abandoned` |
+| `blocked` | `active`, `abandoned` |
+| `paused` | `active`, `blocked`, `abandoned` |
+| `merged` | terminal |
+| `abandoned` | terminal |
+
+### survey
+
+| From | To |
+|---|---|
+| `planned` | `active`, `blocked`, `abandoned` |
+| `active` | `completed`, `blocked`, `paused`, `abandoned` |
+| `completed` | terminal |
+| `blocked` | `active`, `abandoned` |
+| `paused` | `active`, `blocked`, `abandoned` |
+| `abandoned` | terminal |
+
+## Survey placement (#148 W2)
+
+`survey.sandbox` is tuning, not a component: the `tower-survey` row stays the
+switch. The shape resolves both the placement and the preset, so generic layers
+never read the raw key or compare a kind.
+
+The decision is made once, at provisioning time. A mission with a recorded
+`mission.sandbox` keeps the detached placement and its completion invariants
+even if `survey.sandbox` later changes — a config flip can neither skip the
+sandbox HEAD/zero-commit checks nor strand the disposable checkout. A survey
+that never got a sandbox keeps the shared invariants for the same reason.
+
+| `survey.sandbox` | Provisioning | Preset | Completion invariants |
+|---|---|---|---|
+| `none` (default) | `shared`: no checkout, the agent reads the main checkout | `tower-survey` (strictly read-only: no write, edit, or shell tool) | HEAD equals `readCommit`, tracked-status fingerprint unchanged, zero commits |
+| `detached` | `detached`: `git worktree add --detach <worktreeRoot>/<id>-sandbox <readCommit>` (no branch, no `baseCommit`, never merged) | `tower-survey-sandbox` (read/write/edit/pwsh plus the mission tools; spawn/merge/rebase/review/diff still absent) | sandbox HEAD equals `readCommit`, zero commits; disposable write/shell side effects are ignored; sandbox removed on completion, abandon or teardown with a bounded retry |
+
+## Completion invariants
+
+| Kind | Invariants | Check |
+|---|---|---|
+| `build` | requiresWorktree=true, requiresCommits=true, requiresClean=true, requiresHeadMatch=false, requiresTrackedStatus=false | `checkCompletion` |
+| `survey` | requiresWorktree=false, requiresSandbox=false, requiresCommits=false, requiresClean=false, requiresHeadMatch=true, requiresTrackedStatus=true | `checkCompletion` |
+
+## Role
+
+| Contract | Owner |
+|---|---|
+| Status, transitions, terminality, merge/rebase, provisioning, reach, plan fields, completion, dependencies, briefing, summary | `domain/shapes/<kind>.js` |
+| Kind resolution and the action guard | `domain/shapes/index.js` |
+| Role vocabulary and the role contract (preset, model, placement, briefing, prerequisites) | `domain/roles.js` |
+| Generated reference and the audit | `scripts/generate-shapes-reference.mjs`, `scripts/shape-audit.mjs` |
+
+## Dimension inventory (#149)
+
+Every dimension the registry audit covers. A **shape-owned** verdict lives in
+`domain/shapes/<kind>.js`; a **correctly generic** verdict has one owner module
+outside the shapes; a **redesigned** verdict replaced an earlier ambiguous
+contract. The fitness rule is the mechanical check the audit (or the generated
+invariant) enforces.
+
+| Dimension | Verdict | Owner module | Fitness rule |
+|---|---|---|---|
+| Mission lifecycle | **Shape-owned.** Statuses, transitions and terminality are per kind. | `domain/shapes/<kind>.js` | `kind-literal`, `global-status-vocabulary`, `shape-entry-point` |
+| Role vocabulary | **Correctly generic.** Roles are actors, not mission kinds. | `domain/roles.js` | `role-literal` |
+| Provisioning | **Shape-owned.** A build gets a branch worktree; a survey is shared or a detached sandbox. | `domain/shapes/<kind>.js` | Generated invariant: only a build creates a branch/worktree; a recorded `mission.sandbox` decides a survey's placement. |
+| Read-only completion | **Shape-owned.** `resolveCompletion` derives invariants from the recorded placement. | `domain/shapes/survey.js` | Generated invariant: shared survey keeps HEAD and tracked status; detached survey keeps HEAD pinned; both make zero commits. |
+| Dependency | **Shape-owned.** `dependencySatisfied` names the terminal statuses that satisfy a dependent. | `domain/shapes/<kind>.js` | Generated invariant: a completed survey satisfies a dependent build; a merged build does too. |
+| Archive / reanchor / planning | **Shape-owned.** Terminality is the one archive/reanchor predicate. | `domain/shapes/<kind>.js` | Generated invariant: a terminal shape leaves open work and never blocks reanchor. |
+| Completion result | **Shape-owned.** Only a survey may record a completion result. | `domain/shapes/<kind>.js` | Generated invariant: `shape.acceptsResult`. |
+| Required component | **Shape-owned.** A survey needs the `tower-survey` row. | `domain/shapes/<kind>.js` | Generated invariant: planning refuses with an actionable code while the required component is off. |
+| Review | **Redesigned.** Commit-stamped evidence: a reviewer reads a disposable checkout at the recorded review commit; only a shape with a branch is reviewable. | `app/review.js`, `app/reviewCheckout.js`, `domain/missions/review.js` | `review-tip-read` — A review never reads a live worktree HEAD; verdicts are stamped with a recorded commit. |
+| Batch | **Correctly generic second lifecycle.** A batch is finite evidence over missions, not a mission kind; no shape knows about batches. | `domain/batch.js`, `domain/collab/batch.js`, `app/batch.js` | `batch-status-literal` — Batch status literals live in domain/batch.js; every other layer uses its constants. |
+| Leases | **Correctly generic.** One fail-closed admission point; expiry is recovered only by an explicit `force` release. | `adapters/leases.js`, `app/spawn-prechecks.js` | `lease-ledger` — Only adapters/leases.js reads or writes the lease ledger. |
+| Paused vs blocked | **Redesigned.** `blocked` is derived machine state; `paused` is a deliberate stop with a cause. | `domain/missions/lifecycle.js`, `domain/state/semantics.js` | `blocked-status-write` — blocked is derived from open blockers; only domain/missions/lifecycle.js writes it. |
+| Test receipts / evidence | **Redesigned — one reader.** Completion checks and discovery receipts are one normalized evidence contract in `domain/evidence.js`; the shape declares whether a receipt is tip-bound. `tower_complete` no longer copies a synthetic `tests` check into the report. | `domain/evidence.js`; `domain/shapes/<kind>.js` declares `evidence` | `evidence-single-read` — Completion checks and test receipts have one reader: domain/evidence.js. |
+| Legacy import | **Redesigned — strict adapter.** One payload is one declared format; status remaps, assumed kinds and non-carried fields are reported as `remapped`/`unresolved`/`dropped` instead of approximated. Import stays read-only and never resumes a paused mission. | `adapters/legacy.js`; `domain/batch.js` reads only the canonical `pausedMissionIds` | `legacy-vocabulary` — One live vocabulary: legacy formats/statuses are read only by adapters/legacy.js. |
+| Scope ownership | **Redesigned — shape.reach.** The shape owns path permission (`reach.ownsPaths`, `reach.fence`); the gate, planner, lifecycle and auto-deps derive from it through one fence. | `domain/scope.js` + `shape.reach` in `domain/shapes/<kind>.js` | `scope-reach` — Path permission derives from shape.reach through domain/scope.js; no module owns or re-implements it. |
+| Role vs kind | **Redesigned — orthogonal role contract.** Spawn, preset, model, placement, briefing, roster budget and gates resolve the role through `domain/roles.js`; the shape only supplies facts. | `domain/roles.js`; callers `tools/spawn.js`, `app/spawn-prechecks.js`, `app/spawn-support.js`, `domain/roster.js`, `host/presets.js` | `role-shape-conflation` — A role decision never combines with a shape decision; role facts live in domain/roles.js. |
+
+## Fitness rules
+
+Generated from `scripts/shape-audit.mjs` `RULES`; the audit is wired into `npm run check`.
+
+| Rule | Owner module | Contract |
+|---|---|---|
+| `kind-literal` | `domain/shapes/<kind>.js` | Generic layers never compare mission.kind with a literal. |
+| `role-literal` | `domain/roles.js` | Generic layers use the vocabulary role predicates, never a role literal. |
+| `global-status-vocabulary` | `domain/shapes/<kind>.js` | No module reaches for the global TERMINAL_STATUSES/TRANSITIONS tables. |
+| `shape-entry-point` | `domain/shapes/index.js` | isTerminal(kind, status) and canTransition(kind, from, to) are the only entry points. |
+| `review-tip-read` | `app/reviewCheckout.js` | A review never reads a live worktree HEAD; verdicts are stamped with a recorded commit. |
+| `batch-status-literal` | `domain/batch.js` | Batch status literals live in domain/batch.js; every other layer uses its constants. |
+| `lease-ledger` | `adapters/leases.js` | Only adapters/leases.js reads or writes the lease ledger. |
+| `blocked-status-write` | `domain/missions/lifecycle.js` | blocked is derived from open blockers; only domain/missions/lifecycle.js writes it. |
+| `evidence-single-read` | `domain/evidence.js` | Completion checks and test receipts have one reader: domain/evidence.js. |
+| `legacy-vocabulary` | `adapters/legacy.js` | One live vocabulary: legacy formats/statuses are read only by adapters/legacy.js. |
+| `scope-reach` | `domain/scope.js` | Path permission derives from shape.reach through domain/scope.js; no module owns or re-implements it. |
+| `role-shape-conflation` | `domain/roles.js` | A role decision never combines with a shape decision; role facts live in domain/roles.js. |

package/docs/reference/surface-budget.md

@@ -84,6 +84,36 @@ plugin-page form, not a row and not one row per mode; the review gate in
 non-disableable. The component and config-key counts do not move (11 visible
 components, 54 keys).
 
+#148/#149 grow the surface by exactly one key and one visible component,
+recorded in [ADR 0006](../adr/0006-mission-shapes.md): config keys 54 → 55,
+sections stay 14, components 11 → 12. A first cut of the shape work added three
+keys and a `survey` section, then contracted 57 → 55 before release in a second
+dated decision: a survey's preset is shape-owned
+(`SHAPES.survey.spawn.defaultPreset`), so a `spawn.surveyPreset` key could only
+disagree with the registry, and `survey.sandbox` advertised a placement W1 does
+not implement. What remains is `spawn.surveyModel`, the optional model route for
+survey workers (the survey row owns the capability, not the key name). The
+`tower-survey` row is the switch: off means surveys cannot be planned and no
+survey agent is dispatched; build missions are unaffected. No existing key
+changed class.
+
+#148 W2 implements the detached survey sandbox, so it restores exactly the
+placement key that W1 correctly withheld: `survey.sandbox` (`none`|`detached`,
+default `none`) returns as tuning, and `gates.requireFreshSurvey` (default
+`false`) joins it as merge-gate strictness; config keys 55 → 57 and sections
+14 → 15. It
+is not a capability: the `tower-survey` row stays the single switch and the
+sandbox preset is an internal child of it, so the visible component count does
+not move (12). `spawn.surveyPreset` stays removed: the shape resolves the preset
+from `survey.sandbox`, so the key could still only disagree with the registry.
+
+#149 W4 contracts the config surface by one: config keys 57 → 56. `tests.autoChecks`
+only chose whether a discovery projection was copied into the completion report,
+and that copy was the second evidence shape the W4 audit removed. The receipt in
+`mission.testRuns` is the one evidence record now, so the switch had no meaning
+left; it is deleted rather than kept as a dead tuning key. Sections and the
+visible component count do not move.
+
 ## Config keys
 
 | Key | Class | Note |
@@ -116,6 +146,8 @@ components, 54 keys).
 | `git.timeoutMs` | tuning | Default Git command timeout outside merge. |
 | `worktrees.root` | tuning | Default worktree placement. |
 | `spawn.workerPreset` | core | Chooses the tool surface a worker receives. |
+| `spawn.surveyModel` | tuning | Optional model route for survey agents. |
+| `survey.sandbox` | tuning | Placement only: shared read-only checkout (default) or a disposable detached sandbox. The tower-survey row is still the switch. |
 | `spawn.reviewerPreset` | core | Chooses the read-only reviewer surface. |
 | `spawn.maxDepth` | tuning | Subagent depth requested at spawn. |
 | `spawn.provider` | tuning | Provider route for spawned agents. |
@@ -130,11 +162,11 @@ components, 54 keys).
 | `tests.admission` | core | Chooses when repository code is executed. |
 | `tests.timeoutMs` | tuning | Per-command discovery timeout. |
 | `tests.maxBytes` | tuning | Captured discovery output cap. |
-| `tests.autoChecks` | tuning | Attaches a tests check to completion. |
 | `tests.allowPackageDiscovery` | core | Allows repository code to execute; a security contract. |
 | `gates.requireChecks` | core | Requires completion evidence before merge. |
 | `gates.requireTests` | core | Requires a test receipt before merge. |
 | `gates.allowReviewExemption` | core | Allows a review exemption and its reason. |
+| `gates.requireFreshSurvey` | core | Promotes the survey-stale dependency warning to a merge blocker; `false` keeps it advisory. |
 | `gates.maxReportBytes` | tuning | Report size cap; the refusal itself is not configurable. |
 | `docs.boardLocation` | tuning | Chooses where the board is written; whether it is written is the tower-board row. |
 | `archive.afterDays` | tuning | Archive age threshold; archival itself is the tower-archive row. |

package/docs/reference/testing.md

@@ -48,8 +48,10 @@ overall `ok`. `state.missions[].testRuns` keeps the most recent 50 receipts. The
 discovery fails.
 
 - `tower_test({repoRoot,missionId})` runs discovery on demand and records a receipt.
-- `tower_complete` adds a `tests` check when `tests.autoChecks` is on.
-- `gates.requireChecks` requires any completion check; `gates.requireTests` requires a passing receipt
+- The receipt in `testRuns` is the only evidence shape. `tower_complete` does not copy a `tests`
+  check into the completion report; completion checks, batch close and `gates.requireChecks` read the
+  same receipt.
+- `gates.requireChecks` requires any recorded check or receipt; `gates.requireTests` requires a passing receipt
   for the current mission branch tip (`tests-missing`). Review is independent of this gate: with
   `review.mode:optional` (the default) or `off`, the tests gate still checks the branch tip.
 

package/docs/reference/tools.generated.md

@@ -1,13 +1,13 @@
 # Tools overview (generated)
 
 > Generated by `npm run docs:generate:tools` from the registered tool definitions. Do not edit by hand.
-> Surface: config keys: 54 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
+> Surface: config keys: 56 · sections: 15 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
 
 | Tool | Description |
 |---|---|
 | `tower_adopt` | Reconcile the roster with the durable subagent catalog after a restart or new session. Agents that are provably gone are marked retired (records are kept) or missing (retireMissing:false, so the tower can inspect/take over); agents whose parent catalog cannot be read stay unknown and are never changed. Only the tower may adopt. |
 | `tower_batch` | Manage finite evidence batches: create freezes missionIds/requiredChecks/receiptPaths, status summarizes members, close verifies every required check and receipt hash, abandon retires a stale open batch. Membership and exclusions are immutable after create; close/abandon never remove missions. |
-| `tower_complete` | Worker-only: report mission completion. Enforced by the store: every task done or dropped, no blockers, the current owner, the mission branch has at least one commit since its spawn base, and no unread inbox messages. checks records verifiable evidence (name/command/exitCode/evidence); gates.requireChecks can require at least one before merge. Stores the full report, capped at gates.maxReportBytes (default 32768 UTF-8 bytes); a larger report is rejected with invalid-argument and an actionable nextAction, never truncated. Persists reportBytes on the stored report. completion means ready for preflight and optional review, not merged. |
+| `tower_complete` | Worker-only: report mission completion. Enforced by the store: every task done or dropped, no blockers, the current owner, the mission branch has at least one commit since its spawn base (zero commits plus HEAD pinned to readCommit for a survey; zero commits in its detached sandbox with HEAD pinned for a sandboxed survey), and no unread inbox messages. checks records verifiable evidence (name/command/exitCode/evidence); gates.requireChecks can require at least one before merge. result is survey-only evidence ({paths?,symbols?,plan?,notes?}); a build completion that carries one is refused. Stores the full report, capped at gates.maxReportBytes (default 32768 UTF-8 bytes); a larger report is rejected with invalid-argument and an actionable nextAction, never truncated. Persists reportBytes on the stored report. completion means ready for preflight and optional review, not merged. |
 | `tower_control` | Enter or leave Tower mode for the calling agent. Allowed only when the deployment enables allowAgentControl; use it when the user intent or task state clearly calls for Tower orchestration or a return to normal collaboration, and always state a concrete reason. |
 | `tower_diff` | Read-only view of a mission branch for review: merge base, changed files, commits, and a capped patch against the recorded base. Safe for reviewers; it never modifies the repository. |
 | `tower_doctor` | Read-only environment and repository health check: the concept-budget surface (config keys/sections/tools), git, state schema, case-sensitivity detection (caseInsensitive and the active scope comparison mode), config, presets/subagents/HMR, the state lock age/heartbeat freshness, the repo-scoped git lock holder (gitLock: {held,pid,phase,heldMs}), workspace lock, roster staleness, worktree ownership, test discovery, leases, and the terminal-mission archive (count, bytes, years, unreadable diagnostics and the configured afterDays/maxMissions policy). Returns checks with pass/warn/fail, state-lock and git-lock reports and an environment contract. Never writes state and never probes the filesystem. |
@@ -21,8 +21,8 @@
 | `tower_merge` | Merge a mission branch into the recorded base branch with --no-ff, after the hard gate passes. Verifies the two merge parents and records the mission as merged. If the merge commit already landed (manual merge, crashed or slow pre-merge hook), it detects the merge commit and records it as reconciled instead of merging again. A failed gate returns stable blocker codes without merging; a hook failure aborts cleanly and returns "merge-hook-failed" while a real content conflict returns "merge-conflict". |
 | `tower_mission` | Update one mission: lifecycle status, decision note, blocker, clear blockers, mark a task done, drop a task with a reason, or widen the scope (tower only). "merged" is never set here; only a future tower_merge records it. Merged and abandoned are terminal. |
 | `tower_mode` | Report whether Tower mode is active for the calling agent, who changed it last, whether the model may toggle it, any goal paused on entry, the workspace lock, HMR availability and the plugin version. |
-| `tower_plan` | Plan one or more missions in an initialized repository. Each mission has a printable-Unicode title (NFC-normalized, at most 120 characters), relative scope globs, optional task checklist, optional mission-id dependencies, and kind build|survey. Assigns M1.. ids and auto-adds a dependency when build scopes overlap (serializes merges); rejects dependency cycles. |
-| `tower_preflight` | Read-only merge gate for one mission: returns ok plus stable blocker codes (branch-missing, deps-unmerged, read-only-survey, stale-base, out-of-scope, base-dirty, branch-owned-by-closed-missions, and mission/worker guards). Review blockers (no-review, review-hold, not-clean, review-not-approved, tip-moved, review-mission-mismatch) apply only when review.mode is required; review.mode off and optional skip them. Never changes anything. |
+| `tower_plan` | Plan one or more missions in an initialized repository. Each mission has a printable-Unicode title (NFC-normalized, at most 120 characters), relative scope globs, optional task checklist, optional mission-id dependencies, and kind build|survey. Assigns M1.. ids and auto-adds a dependency when build scopes overlap (serializes merges); rejects dependency cycles. Returns survey-stale warnings for a build that depends on a survey whose recorded readCommit is not an ancestor of the base; those warnings are advisory and gates.requireFreshSurvey promotes them to merge blockers. |
+| `tower_preflight` | Read-only merge gate for one mission: returns ok plus stable blocker codes (branch-missing, deps-unmerged, stale-base, out-of-scope, base-dirty, branch-owned-by-closed-missions, and mission/worker guards) and warnings (survey-stale). Review blockers (no-review, review-hold, not-clean, review-not-approved, tip-moved, review-mission-mismatch) apply only when review.mode is required; review.mode off and optional skip them. survey-stale reports a build dependency on a survey whose readCommit is not an ancestor-or-equal of the build base; it is a warning by default and a blocker only when gates.requireFreshSurvey is true. A survey has no merge gate: it is refused with invalid-transition (tower_complete checks HEAD/readCommit and zero commits). Never changes anything. |
 | `tower_rebase` | Rebase a mission branch onto the current base tip inside its own worktree. Refuses while its worker is running or the worktree is dirty. A clean conflict-free rebase waives re-review for the old review; a conflict is aborted and the mission is marked blocked. If the branch is already contained in the base, it returns alreadyMerged and leaves the branch untouched so tower_merge can record the landed merge. |
 | `tower_recover` | Read-only recovery diagnostics and an explicit stale-state-lock repair. status reports the state lock owner with its age, heartbeat age and staleness; clear-stale-lock requires confirm:"CLEAR_STALE_LOCK" and only moves a lock whose PID is provably dead to a backup file. force:true additionally clears a live-but-silent PID (a recycled PID) and still renames the record to a .recovered-<ts> backup. It never resets Tower state or worktrees. |
 | `tower_reload` | Dev-only: ask DSH HMR to reconcile this profile and reload the Tower Host plugin from disk. Registered only while the tower-hmr component is on (the row is shipped off). The reload is scheduled a few milliseconds after this call returns (so the result reaches the model first). Use after editing the plugin source in a linked profile; plugin_manager install/update already triggers reconciliation by itself. Fails with reload-unavailable when the HMR service is absent. |
@@ -30,7 +30,7 @@
 | `tower_review` | Submit an independent review verdict bound to the current branch tip: a completed mission starts a review round, and while the mission is active a later route may still record a verdict for that same reviewed tip, appending to the same round without changing the status (a moved tip is rejected with an explanation). status is "clean", "p1-Nitems", or "p2-Nitems"; merge is "merge", "fix-then-merge", or "hold" (only clean + merge is later approval). Non-clean returns the mission to active. Reviewers are capped at 5 rounds per branch; a tower-submitted review is break-glass and requires breakGlassReason. The tool is not registered when review.mode is off. |
 | `tower_roster` | List tower roster agents with authoritative live activity from the subagent catalog (running/inactive/missing/unknown). Read-only; never resumes children. Use before completion or merge decisions. |
 | `tower_send` | Send a durable inbox message to a tower participant: a roster agent name, "tower", or "all" (broadcast). The message is persisted first; when the recipient is a currently running roster agent the tower also steers it into that child's current turn. Returns delivery results. |
-| `tower_spawn` | Spawn a worker or reviewer for a mission. Workers use the tower-worker preset; reviewers require a completed mission and use the read-only tower-reviewer preset, and the reviewer role is refused when review.mode is off. Provisions (or reuses) the mission git worktree and branch, generates a self-contained briefing, and starts a background subagent in that worktree. The child final report is delivered back to this session; tower_roster shows authoritative activity. Records the agent in the roster; reviewer spawns record the branch tip so a reviewer that modifies the branch cannot submit a review. Returns immediately unless wait=true. |
+| `tower_spawn` | Spawn a worker or reviewer for a mission. Workers use the mission shape's preset (tower-worker for a build, tower-survey for a read-only shared survey, tower-survey-sandbox for a detached survey with survey.sandbox=detached); reviewers require a completed build mission and use the read-only tower-reviewer preset, and the reviewer role is refused when review.mode is off. A build provisions (or reuses) the mission git worktree and branch; a shared survey runs in the shared checkout because it reads one commit; a detached survey provisions (or reuses) a disposable detached worktree at its readCommit with no branch. Generates a self-contained briefing (including dependency survey result evidence) and starts a background subagent. The child final report is delivered back to this session; tower_roster shows authoritative activity. Records the agent in the roster; reviewer spawns get a disposable detached checkout at the recorded branch tip, and the verdict is stamped with that commit (never a live worktree HEAD). Returns immediately unless wait=true. |
 | `tower_status` | Read the Tower dashboard for a repository: state path, base branch, revision, mission status counts, paged mission summaries (scope/deps/tasks/worktree/owner), roster size, findings, archive count, config path and the activity tail. Also reports the repo-scoped git lock holder (`gitLock: {held,pid,phase,heldMs}`) so a merge holding the mutex is visible, and the resolved review policy (`review: {mode, available, required, detail}`; mode off means review is intentionally unavailable). Pass missionId for one full mission (tasks, notes, reviews, findings, completion report; archived missions are loaded from their year file); offset/limit page the mission list (default 20, max 100); includeGate adds preflight gate digests for the page; includeArchived appends compact archived summaries after the active page; format:"markdown" returns the human-readable mission board (active missions plus an archived count). Read-only. |
 | `tower_teardown` | Tear down eligible mission worktrees after their missions are merged or abandoned. A worktree whose roster agent is running is always kept (force cannot override); dirty worktrees need force; exclude keeps named missions. dry_run previews the remove/keep decisions without changing anything. Terminal missions whose worktree is gone and whose configured archive policy is due (archive.afterDays / archive.maxMissions) are moved to <git-common-dir>/dsh-tower/archive/ so state.json stops rewriting them; nothing is deleted. |
 | `tower_test` | Run the mission worktree's declared tower.testDiscovery (package.json) and record the receipt. Returns ok:false with diagnostics when discovery fails; does not change mission status. Use tower_complete for automatic admission checks. |

package/docs/reference/tools.md

@@ -36,7 +36,7 @@ findings but not mutate them. Violations throw `[tower:not-authorized]` or
 |---|---|---|
 | `tower_init` | `base?`, `autoGitInit?`, `snapshotDirty?`, `reanchor?` | Create `<git-common-dir>/dsh-tower/state.json`. `autoGitInit` runs `git init` + empty initial commit; `snapshotDirty` records a dangling snapshot commit of uncommitted tracked changes used as the mission baseline; `reanchor` changes base only when no non-terminal mission exists. Returns `dirty`, `snapshotCommit`, `reanchored`. |
 | `tower_plan` | `missions[]` (`title` — printable Unicode, NFC-normalized, ≤120 characters, `scope[]`, `tasks[]?`, `deps[]?`, `kind?`, `context?`, `references[]?` ≤20, `reviewPolicy?`, `reviewExemptionReason?`) | Create missions `M1..`; overlapping build scopes auto-add a dependency; rejects unknown deps and cycles. Mission ids stay ASCII (`M1`, `M2`); invisible characters and over-long titles are rejected with `invalid-argument`. `reviewPolicy:"none"` requires a non-empty reason; when the review gate is on, preflight also requires `gates.allowReviewExemption`. |
-| `tower_mission` | `id` (alias `missionId`), `status?`, `task_done?`, `task_drop?`+`task_drop_reason?`, `blocker?`, `clear_blockers?`, `note?`, `scope?`, `pause_cause?`, `authorization?` | Update one mission. Worker-safe fields are task/blocker/note; `merged` cannot be set here. Paused missions record `pause_cause` (user/failure/resource/dependency); resuming a user-paused mission honors `mode.requireResumeAuthorization`. |
+| `tower_mission` | `id` (alias `missionId`), `status?`, `task_done?`, `task_drop?`+`task_drop_reason?`, `blocker?`, `clear_blockers?`, `note?`, `scope?`, `pause_cause?`, `authorization?` | Update one mission. Worker-safe fields are task/blocker/note; `merged` cannot be set here. `blocked` is derived from an open blocker (record `blocker`, never `status:"blocked"`); `clear_blockers` resumes it to `active`. Paused missions record `pause_cause` (user/failure/resource/dependency); resuming a user-paused mission honors `mode.requireResumeAuthorization`. |
 \|\ `tower_status`\ \|\ `missionId\?`,\ `offset\?`,\ `limit\?`,\ `includeGate\?`,\ `includeArchived\?`,\ `format\?`\ \|\ Dashboard\ by\ default\.\ Paged\ missions\ carry\ `reportBytes`\ only;\ `missionId`\ returns\ full\ detail\ \(tasks/notes/reviews/findings/completionReport\ body\),\ and\ an\ archived\ mission\ is\ loaded\ from\ its\ year\ file\.\ `offset`/`limit`\ page\ active\ missions\ \(default\ 20,\ max\ 100\),\ `includeGate`\ adds\ gate\ digests,\ `includeArchived`\ appends\ compact\ archived\ summaries\ \(flagged\ `archived:true`,\ no\ report\ body\)\ after\ the\ active\ page,\ and\ `format:"markdown"`\ returns\ the\ board\ \(active\ rows\ plus\ an\ archived\ count\)\.\ Includes\ `mode`\ with\ `lastChange`\ and\ recent\ `history`\ when\ the\ host\ mode\ hook\ is\ available\.\ `archive`\ reports\ `\{count,\ years,\ unreadable,\ message}`;\ a\ corrupt\ archive\ degrades\ to\ `unreadable:true`\ instead\ of\ failing\ the\ dashboard\.\ Also\ returns\ `gitLock`\ \(`\{held,\ pid,\ phase,\ heldMs}`\)\ for\ the\ repo-scoped\ git\ mutex,\ and\ `\{held:\ false}`\ when\ it\ is\ free\.\ \|
 | `tower_spawn` | `missionId` (alias `id`), `role` (`worker`/`reviewer`), `name?`, `instructions?`, `worktreeRoot?`, `wait?`, `waitMs?`, `takeover?`, `includeDirtyBase?` | Provision/reuse the worktree and start a subagent. Worker uses `tower-worker`; reviewer requires a `completed` mission and uses the read-only `tower-reviewer`; with `review.mode:off` the reviewer role is refused with `[tower:review-disabled]`. `takeover:true` replaces a live worker entry that is no longer running (increments ownerGeneration). Only one live worker per mission; `spawn.maxLiveWorkers` caps the repository. |
 | `tower_roster` | — | Roster with live activity (`running`/`inactive`/`missing`/`unknown`) and `stale` flags from the subagent catalog. Read-only. |
@@ -60,7 +60,7 @@ findings but not mutate them. Violations throw `[tower:not-authorized]` or
 | `tower_recover` | `action` (`status`/`clear-stale-lock`), `confirm?`, `force?` | Recovery diagnostics plus an explicit stale state-lock repair. `clear-stale-lock` requires `confirm:"CLEAR_STALE_LOCK"` and only moves a lock whose PID is provably dead to a `.recovered-<ts>` backup. `force:true` additionally clears a live-but-silent PID (a recycled PID): the output names `{pid, startedAt, ageMs, heartbeatAgeMs}` and the record is still renamed, never unlinked. It never resets state/worktrees. |
 | `tower_test` | `missionId` (alias `id`) | Run the worktree's `package.json` `tower.testDiscovery` and record a receipt; `ok:false` on failure. Use `tower_complete` for automatic admission checks. |
 | `tower_batch` | `action` (`create`/`status`/`close`/`abandon`), `missionIds?`, `exclusions?`, `requiredChecks?`, `receiptPaths?`, `batchId?`, `checks?`, `treeTip?`, `receiptHashes?`, `reason?` | Finite evidence batch. Create freezes members/checks/receipts; close verifies every required check and receipt hash; merged members are eligible; abandon retires a stale open batch without deleting missions. Membership is immutable. |
-| `tower_resource` | `action` (`acquire`/`release`/`status`), `name?`, `holder?`, `token?`, `ttlMs?`, `force?` | Advisory per-repository lease in `<common>/dsh-tower/leases.json`. No OS CPU/memory hard cap; expired leases require explicit `force` and the correct token. |
+| `tower_resource` | `action` (`acquire`/`release`/`status`), `name?`, `holder?`, `token?`, `ttlMs?`, `force?` | Advisory per-repository lease in `<common>/dsh-tower/leases.json`. No OS CPU/memory hard cap. A live lease is released only by its holder token; an **expired** lease is recovered by an explicit `force: true` release (never taken over automatically). |
 | `tower_import_legacy` | `sourcePath` | Read-only import of a Tower Codex `schemaVersion:1` or DSH legacy state. Full payload goes under `<common>/dsh-tower/legacy/<sha256>.json`; state stores a summary only. Never activates/adopts/resumes paused missions. |
 | `tower_legacy_map` | `action` (`map`/`status`), `sourceHash?`, `oldId?`, `newMissionId?` | Audit-only legacy-id mapping; mappings are append-only and never adopt a mission. |
 

package/docs/zh/reference/blockers.md

@@ -20,10 +20,10 @@
 | `no-check-evidence` | 启用了 `gates.requireChecks` 且完成报告没有 `checks`。把 completed mission 退回 `active`，带 checks 重新调用 `tower_complete`，然后重新审查。 |
 | `branch-missing` | 还没有 worktree/分支：先 spawn worker。 |
 | `stale-base` | 分支不包含基线 tip：执行 `tower_rebase`。 |
-| `read-only-survey` | survey mission 修改了文件；survey mission 必须只读。 |
 | `out-of-scope` | 改动文件超出 mission scope；有意为之就扩大 scope，否则回退。在大小写敏感的检出上，仅大小写不同的路径仍会被拒绝，detail 会指出折叠大小写后本可匹配的 scope 条目。 |
 | `base-dirty` | 主检出存在未提交改动，合并会覆盖它们。 |
 | `deps-unmerged` | 依赖 mission 尚未满足：build 依赖须 `merged`/`abandoned`；survey 依赖在 `completed` 即视为满足（含归档记录）。 |
+| `survey-stale` | build 依赖的 survey 的 `readCommit` 不是 build base 的祖先或同一提交。默认只是 `plan`/`preflight` 的 `warnings[]` 条目；`gates.requireFreshSurvey:true` 时同一 code 阻止合并。针对当前 base 重新规划 survey，或记录为何该读取仍然有效。 |
 | `no-review` | `review.mode:required` 且分支上没有审查：spawn reviewer（或关闭审查门禁）。 |
 | `review-mission-mismatch` | `review.mode:required` 且最新审查属于另一个 mission。 |
 | `not-clean` | `review.mode:required` 且最新审查是 `p1-Nitems`/`p2-Nitems`；需要再来一轮（同一轮的各 route 结论会追加记录，不会让状态反复翻转）。 |
@@ -63,4 +63,4 @@
 分支已包含在基线中时，`tower_rebase` 返回 `alreadyMerged: true`；此时调用 `tower_merge` 记录这次
 已落地的合并。
 
-稳定的 blocker code 共 32 个（26 个门禁 + 4 个合并失败 + 2 个 rebase 专属；`worker-busy` 与门禁共用）。
+稳定的 blocker code 共 31 个（25 个门禁 + 4 个合并失败 + 2 个 rebase 专属；`worker-busy` 与门禁共用）。

package/docs/zh/reference/config.md

@@ -99,9 +99,8 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 | `tests.admission` | `off` | `spawn` 在启动 worker 前运行发现（fail-closed，不启动子代理）；`complete` 在 `tower_complete` 时运行；`off` 只在显式 `tower_test` 时运行（默认；不会自动执行仓库代码）。 |
 | `tests.timeoutMs` | `60000` | 每条发现命令的超时。 |
 | `tests.maxBytes` | `16777216`（16 MiB） | 每条命令捕获的 stdout 上限。 |
-| `tests.autoChecks` | `true` | 向完成报告附加自动 `tests` 检查。 |
 | `tests.allowPackageDiscovery` | `true` | 允许仓库控制的 `tower.testDiscovery` 命令（会执行 worktree 代码；见安全页）。 |
-| `gates.requireChecks` | `false` | 合并前要求至少一条 `tower_complete.checks` 证据（`no-check-evidence`）。 |
+| `gates.requireChecks` | `false` | 合并前要求至少一条已记录检查（`tower_complete.checks`）或测试回执（`no-check-evidence`）。 |
 | `gates.requireTests` | `false` | 要求针对当前 mission 分支 tip 的通过测试回执（`tests-missing`）；与审查门禁独立。`tower-tests` 组件行关闭时，规划/进入模式会带解释拒绝该组合。 |
 | `gates.allowReviewExemption` | `false` | 在 `review.mode:required` 时，允许用 `reviewPolicy:"none"` + 非空理由跳过审查 blocker；默认故意关闭；`review.mode` 为 `off` 或 `optional` 时无影响（不会产生审查 blocker）。 |
 | `gates.maxReportBytes` | `32768`（32 KiB） | `tower_complete.report` 的 UTF-8 字节硬上限。超出时以 `invalid-argument` 拒绝并给出可执行的 `nextAction`（把全文写进 mission worktree 的文件并引用路径），绝不截断。已存在的超限报告仍可读取。 |

package/docs/zh/reference/testing.md

@@ -48,8 +48,9 @@ stdout/stderr 文件、SHA-256 哈希、退出码、计数、required 名称、w
 `tower_complete` 会抛出 `[tower:tests-failed]`。
 
 - `tower_test({repoRoot,missionId})` 按需运行发现并记录回执。
-- `tests.autoChecks` 开启时，`tower_complete` 会添加一条 `tests` 检查。
-- `gates.requireChecks` 要求任意完成检查；`gates.requireTests` 要求针对当前 mission 分支 tip 的
+- `testRuns` 中的回执是唯一的证据形态；`tower_complete` 不再向完成报告复制 `tests` 检查，完成检查、批次关闭
+  与 `gates.requireChecks` 读取同一份回执。
+- `gates.requireChecks` 要求任意已记录检查或回执；`gates.requireTests` 要求针对当前 mission 分支 tip 的
   通过回执（`tests-missing`）。测试门禁与审查独立：即使策略为 `review.mode:optional`（默认）或
   `off`，测试门禁仍检查分支 tip。
 

package/domain/batch.js

@@ -1,5 +1,11 @@
 // Batch admission packets (2.1): pure create/close/summarize validation.
 //
+// A batch is a second, generic lifecycle layered over missions (#149 W3): it is
+// not a mission shape and never gets a kind. Its whole lifecycle — statuses,
+// transition edges, terminality, legacy-status normalization and the status
+// vocabulary — lives in this module (see `BATCH_STATUS*`), so no other module
+// compares or writes `batch.status` to a string literal.
+//
 // This module performs no filesystem, git, or subprocess I/O. The tower tool
 // layer reads the worktree, receipt files, and test results, then passes what
 // it observed into `validateClose`. Receipt hashes may be supplied by the
@@ -11,7 +17,7 @@
 //   state.missions[]        -> { id, status, mergedCommit?, completionReport?, testRuns? }
 //   state.batches[]         -> { id, status: 'open'|'closed'|'abandoned', missionIds,
 //                                exclusions, requiredChecks, receiptPaths, receiptHashes? }
-//   state.legacySnapshots[] -> { hash, missions: [{ id, status }], pausedIds? }
+//   state.legacySnapshots[] -> { sourceHash, pausedMissionIds: string[] }
 // A batch record is the normalized validateCreate result plus `id`, `status`,
 // `createdAt`, and the optional `receiptHashes` expected-hash map.
 //
@@ -23,16 +29,64 @@
 // `input.treeTip` to bind recorded check `treeCommit` values to the current
 // HEAD.
 import path from 'node:path'
+import { findEvidence } from './evidence.js'
+import { shapeFor } from './shapes/index.js'
 
 const SHA256_PATTERN = /^[a-f0-9]{64}$/i
 const MAX_MISSIONS = 50
 const MAX_CHECKS = 50
 const MAX_RECEIPTS = 200
 const MAX_EXCLUSIONS = 50
-const PASS_STATUSES = new Set(['passed', 'pass', 'ok', 'success', 'succeeded', 'done', 'green'])
-const FAIL_STATUSES = new Set(['failed', 'fail', 'error', 'errored', 'timeout', 'timed-out', 'blocked'])
-const OPEN_BATCH_STATUSES = new Set(['open', 'created', 'active', 'pending'])
-const CLOSED_BATCH_STATUSES = new Set(['closed', 'abandoned'])
+
+// The batch lifecycle contract (#149 W3). A batch is opened by tower_batch
+// create and leaves `open` exactly once, to `closed` (every member verified) or
+// `abandoned` (retired without verification). There is no third stop state and
+// no per-shape variant.
+export const BATCH_STATUS = Object.freeze({ OPEN: 'open', CLOSED: 'closed', ABANDONED: 'abandoned' })
+/** @type {readonly string[]} */
+export const BATCH_STATUSES = Object.freeze([BATCH_STATUS.OPEN, BATCH_STATUS.CLOSED, BATCH_STATUS.ABANDONED])
+export const BATCH_TRANSITIONS = Object.freeze({
+  [BATCH_STATUS.OPEN]: Object.freeze([BATCH_STATUS.CLOSED, BATCH_STATUS.ABANDONED]),
+  [BATCH_STATUS.CLOSED]: Object.freeze([]),
+  [BATCH_STATUS.ABANDONED]: Object.freeze([]),
+})
+// Pre-v5 documents (and hand-written fixtures) used synonyms for `open`; v5
+// normalizes them once in the state migration and nothing else accepts them.
+/** @type {readonly string[]} */
+const LEGACY_OPEN_BATCH_STATUSES = Object.freeze(['created', 'active', 'pending'])
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isBatchTerminal(value) {
+  return value === BATCH_STATUS.CLOSED || value === BATCH_STATUS.ABANDONED
+}
+
+/**
+ * @param {unknown} from
+ * @param {unknown} to
+ * @returns {boolean}
+ */
+export function canTransitionBatch(from, to) {
+  return (BATCH_TRANSITIONS[/** @type {string} */ (from)] ?? []).includes(/** @type {string} */ (to))
+}
+
+/**
+ * Normalize a recorded batch status to the canonical vocabulary. An absent
+ * status means `open`; a legacy synonym means `open`; an unknown value is left
+ * as-is so validation can report it instead of silently rewriting it.
+ * @param {unknown} value
+ * @returns {string}
+ */
+export function normalizeBatchStatus(value) {
+  if (value === undefined || value === null || value === '') return BATCH_STATUS.OPEN
+  const status = String(value)
+  if (BATCH_STATUSES.includes(status)) return status
+  if (LEGACY_OPEN_BATCH_STATUSES.includes(status)) return BATCH_STATUS.OPEN
+  return status
+}
+
 
 /** Stable batch error; add `batch-invalid` to ERROR_CODES to map it directly. */
 export class BatchError extends Error {
@@ -123,28 +177,13 @@ function normalizeReceiptPathOrNull(value, where) {
 /** Legacy snapshots imported by adapters/legacy.js; only paused missions may be excluded. */
 function pausedLegacyIds(state) {
   const ids = new Set()
-  const collectMission = (mission) => {
-    if (isPlainObject(mission) && nonEmptyString(mission.id) && mission.status === 'paused') {
-      ids.add(mission.id.trim())
-    }
-  }
-  const collectList = (value) => {
-    if (Array.isArray(value)) value.forEach(collectMission)
-    else if (isPlainObject(value)) Object.values(value).forEach(collectMission)
-  }
   const snapshots = Array.isArray(state.legacySnapshots) ? state.legacySnapshots : []
   for (const snapshot of snapshots) {
     if (!isPlainObject(snapshot)) continue
-    collectList(snapshot.missions)
-    if (isPlainObject(snapshot.snapshot)) collectList(snapshot.snapshot.missions)
-    if (isPlainObject(snapshot.payload)) collectList(snapshot.payload.missions)
-    // adapters/legacy.js stores imported snapshots with `pausedMissionIds`; older,
-    // hand-written fixtures may use `pausedIds`.
-    for (const key of ['pausedIds', 'pausedMissionIds']) {
-      if (Array.isArray(snapshot[key])) {
-        for (const id of snapshot[key]) if (nonEmptyString(id)) ids.add(id.trim())
-      }
-    }
+    // #149 W4: `pausedMissionIds` is the one canonical field the legacy adapter
+    // writes. Reading any other shape here would be a second live vocabulary.
+    if (!Array.isArray(snapshot.pausedMissionIds)) continue
+    for (const id of snapshot.pausedMissionIds) if (nonEmptyString(id)) ids.add(id.trim())
   }
   return ids
 }
@@ -153,82 +192,13 @@ function missionInOpenBatch(state, missionId) {
   const batches = Array.isArray(state.batches) ? state.batches : []
   for (const batch of batches) {
     if (!isPlainObject(batch)) continue
-    const status = batch.status ?? 'open'
-    if (!OPEN_BATCH_STATUSES.has(status)) continue
+    const status = normalizeBatchStatus(batch.status ?? BATCH_STATUS.OPEN)
+    if (isBatchTerminal(status)) continue
     if (Array.isArray(batch.missionIds) && batch.missionIds.includes(missionId)) return batch
   }
   return null
 }
 
-function checkNames(entry) {
-  if (!isPlainObject(entry)) return []
-  for (const candidate of [entry.name, entry.id, entry.check]) {
-    if (nonEmptyString(candidate)) return [candidate.trim()]
-  }
-  // A nameless runDiscovery receipt stored in mission.testRuns is the built-in
-  // test tool evidence. It answers to `tests` (the tool-layer auto check name)
-  // and to `tower_test` (the synthetic name used by earlier integrations).
-  if (Array.isArray(entry.commands) && Array.isArray(entry.tests)) return ['tests', 'tower_test']
-  return []
-}
-
-function checkOutcome(entry) {
-  if (!isPlainObject(entry)) return null
-  if (typeof entry.status === 'string') {
-    const status = entry.status.trim().toLowerCase()
-    if (PASS_STATUSES.has(status)) return true
-    if (FAIL_STATUSES.has(status)) return false
-  }
-  if (typeof entry.ok === 'boolean') return entry.ok
-  if (typeof entry.pass === 'boolean') return entry.pass
-  if (typeof entry.success === 'boolean') return entry.success
-  if (entry.exitCode !== undefined && entry.exitCode !== null) {
-    const exitCode = typeof entry.exitCode === 'number' ? entry.exitCode : Number(entry.exitCode)
-    if (Number.isFinite(exitCode)) return exitCode === 0
-  }
-  if (entry.error !== undefined && entry.error !== null && entry.error !== '') return false
-  return null
-}
-
-/**
- * Find the most authoritative recorded outcome for `name` on one mission:
- * completion report first, then testRuns newest-first, then caller-supplied
- * `extraChecks` (optionally scoped by `missionId`).
- */
-function findCheck(mission, name, extraChecks, missionId) {
-  const sources = []
-  const reportChecks = Array.isArray(mission?.completionReport?.checks) ? mission.completionReport.checks : []
-  for (let index = reportChecks.length - 1; index >= 0; index -= 1) {
-    sources.push({ source: 'completionReport', entry: reportChecks[index] })
-  }
-  const testRuns = Array.isArray(mission?.testRuns) ? mission.testRuns : []
-  for (let index = testRuns.length - 1; index >= 0; index -= 1) {
-    const run = testRuns[index]
-    if (!isPlainObject(run)) continue
-    if (Array.isArray(run.checks) && run.checks.length > 0) {
-      for (let inner = run.checks.length - 1; inner >= 0; inner -= 1) {
-        sources.push({ source: 'testRuns', entry: run.checks[inner] })
-      }
-    } else {
-      sources.push({ source: 'testRuns', entry: run })
-    }
-  }
-  for (let index = extraChecks.length - 1; index >= 0; index -= 1) {
-    const entry = extraChecks[index]
-    if (!isPlainObject(entry)) continue
-    const scope = entry.missionId ?? entry.mission_id
-    if (scope !== undefined && scope !== null && String(scope) !== missionId) continue
-    sources.push({ source: 'input', entry })
-  }
-  for (const source of sources) {
-    if (!checkNames(source.entry).includes(name)) continue
-    const outcome = checkOutcome(source.entry)
-    if (outcome === null) continue
-    return { outcome, source: source.source, entry: source.entry }
-  }
-  return null
-}
-
 function blocker(message, code = 'batch-invalid') {
   return { code, message }
 }
@@ -414,9 +384,9 @@ export function validateClose(state, batch, input = {}) {
   const receiptPaths = receiptPathsRaw.map((value, index) => normalizeReceiptPath(value, `batch.receiptPaths[${index}]`))
 
   const blockers = []
-  const status = batch.status ?? 'open'
-  if (status === 'closed') blockers.push(blocker(`batch ${batch.id ?? ''} is already closed`.trim()))
-  else if (status === 'abandoned') blockers.push(blocker(`batch ${batch.id ?? ''} is abandoned`.trim()))
+  const status = normalizeBatchStatus(batch.status ?? BATCH_STATUS.OPEN)
+  if (status === BATCH_STATUS.CLOSED) blockers.push(blocker(`batch ${batch.id ?? ''} is already closed`.trim()))
+  else if (status === BATCH_STATUS.ABANDONED) blockers.push(blocker(`batch ${batch.id ?? ''} is abandoned`.trim()))
 
   const missions = Array.isArray(state.missions) ? state.missions : fail('state.missions must be an array')
   const byId = new Map()
@@ -447,13 +417,13 @@ export function validateClose(state, batch, input = {}) {
         results.push({ missionId, name, ok: true, outcome: 'skipped', source: 'abandoned' })
         continue
       }
-      const found = findCheck(mission, name, extraChecks, missionId)
+      const found = findEvidence(shapeFor(mission.kind).evidence, mission, name, { extraChecks, missionId })
       if (!found) {
         results.push({ missionId, name, ok: false, outcome: 'missing', source: null })
         blockers.push(blocker(`mission ${missionId} has no recorded check "${name}"`, 'tests-missing'))
         continue
       }
-      if (found.outcome !== true) {
+      if (found.ok !== true) {
         results.push({ missionId, name, ok: false, outcome: 'failed', source: found.source })
         blockers.push(blocker(`mission ${missionId} check "${name}" did not pass`, 'tests-failed'))
         continue
@@ -507,14 +477,14 @@ export function summarize(state, batch) {
   if (!Array.isArray(receiptPathsRaw)) fail('batch.receiptPaths must be an array')
   const receiptPaths = receiptPathsRaw.map((value, index) => normalizeReceiptPath(value, `batch.receiptPaths[${index}]`))
   const exclusions = Array.isArray(batch.exclusions) ? batch.exclusions : []
-  const status = batch.status ?? 'open'
+  const status = normalizeBatchStatus(batch.status ?? BATCH_STATUS.OPEN)
 
   const missions = Array.isArray(state.missions) ? state.missions : fail('state.missions must be an array')
   const byId = new Map()
   for (const mission of missions) if (isPlainObject(mission) && nonEmptyString(mission.id)) byId.set(mission.id, mission)
 
   const blockers = []
-  if (CLOSED_BATCH_STATUSES.has(status)) blockers.push(blocker(`batch ${batch.id ?? ''} is already ${status}`.trim()))
+  if (isBatchTerminal(status)) blockers.push(blocker(`batch ${batch.id ?? ''} is already ${status}`.trim()))
   const members = []
   const checks = []
   for (const missionId of missionIds) {
@@ -539,7 +509,7 @@ export function summarize(state, batch) {
         checks.push({ missionId, name, ok: true, outcome: 'skipped', source: 'abandoned' })
         continue
       }
-      const found = findCheck(mission, name, [], missionId)
+      const found = findEvidence(shapeFor(mission.kind).evidence, mission, name, { missionId })
       if (!found) {
         checks.push({ missionId, name, ok: false, outcome: 'missing', source: null })
         continue
@@ -547,8 +517,8 @@ export function summarize(state, batch) {
       checks.push({
         missionId,
         name,
-        ok: found.outcome === true,
-        outcome: found.outcome === true ? 'passed' : 'failed',
+        ok: found.ok === true,
+        outcome: found.ok === true ? 'passed' : 'failed',
         source: found.source,
       })
     }