dsh-tower 2.0.2 → 2.0.4

package/docs/zh/reference/config.md

@@ -22,7 +22,7 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 
 ```json
 {
-  "review": { "maxRoundsPerReviewer": 3 },
+  "review": { "requireReview": true, "maxRoundsPerReviewer": 3 },
   "merge": { "timeoutMs": 1800000 },
   "worktrees": { "root": "D:/tower-worktrees" },
   "spawn": { "reviewerPreset": "tower-reviewer", "maxDepth": 2 }
@@ -37,12 +37,12 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 | 键 | 默认值 | 含义 |
 |---|---|---|
 | `section` | `''` | 兼容别名：替换整段 Tower 模式提示文案。空值保留内置提醒。 |
-| `allowAgentControl` | `false`（随包 patch：`true`） | 兼容别名：注册 `tower_control`。 |
+| `allowAgentControl` | `true`（`mode.allowAgentControl` 的别名） | 兼容别名：注册 `tower_control`，允许模型切换模式。 |
 | `init.autoGitInit` | `false`（随包 patch：`true`） | 当 `repoRoot` 是绝对、已存在但不是仓库的目录时，`tower_init` 可以执行 `git init` 并创建一个空的初始提交。 |
 | `init.snapshotDirty` | `false` | `tower_init` 可以把未提交的**已跟踪**改动快照为游离提交作为 mission 基线（不含未跟踪文件；该提交通过 `refs/tower/snapshot/*` 保持存活）。 |
 | `mode.promptSection` | `''` | 替换用的提示文案（与 `section` 同时设置时优先）。 |
 | `mode.sectionAppend` | `''` | 追加在提醒之后的额外文本（团队约定）。 |
-| `mode.allowAgentControl` | `false` | 注册 `tower_control`；模型可带理由进入/退出。 |
+| `mode.allowAgentControl` | `true` | 注册 `tower_control`；模型可带理由进入/退出。设为 `false` 则仅人类可控制模式。 |
 | `mode.autoPauseGoal` | `true` | 进入模式时暂停活跃 goal；退出时不会自动恢复。 |
 | `mode.requireResumeAuthorization` | `false` | 恢复因 `pauseCause:user` 暂停的 mission 时，必须提供 `authorization` 引用。 |
 | `mode.workspaceLock` | `false`（随包 patch：`true`） | 每个仓库只允许一个 Tower 会话（`tower.lock`）；其他会话得到 `workspace-busy`。 |
@@ -53,9 +53,11 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 | `mode.denyTools` | goal/todo/team/workflow/subagent 工具（默认 12 个） | 模式激活期间被拒绝的工具。 |
 | `mode.storePath` | `$DSH_HOME/tower-mode` | `modes.json` 所在目录。 |
 | `mode.maxEntries` | `200` | 最多持久化的模式条目数（1–2000）。 |
+| `review.requireReview` | `false` | 合并前是否强制独立 clean 审查。默认 `false`（审查可选）；设为 `true` 则要求 `no-review`/`not-clean`/`review-hold`/`review-not-approved`/`tip-moved`/`review-mission-mismatch` 全部通过。`tower_review` 始终可用。 |
 | `review.maxRoundsPerReviewer` | `5` | 每个 reviewer 对每条分支的审查轮数上限。 |
 | `merge.timeoutMs` | `900000`（15 分钟） | `tower_merge` 默认超时，包含钩子；单次调用的 `timeoutMs` 优先。 |
 | `merge.maxBufferBytes` | `67108864`（64 MB） | 合并输出缓冲区。 |
+| `git.timeoutMs` | `15000` | 除 merge 外 Git 命令的默认超时；merge 使用 `merge.timeoutMs`。 |
 | `worktrees.root` | `''` | 默认 worktree 父目录；空值推导为 `<主检出父目录>/.dsh-tower-worktrees/<hash>`。 |
 | `spawn.workerPreset` | `tower-worker` | `role=worker` 使用的 preset。 |
 | `spawn.reviewerPreset` | `tower-reviewer` | `role=reviewer` 使用的 preset。 |
@@ -70,14 +72,14 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 | `send.maxPerMinute` | `120` | 每个仓库的 `tower_send` 每分钟速率限制（0 关闭）；超出返回 `rate-limited`。 |
 | `send.interruptDefault` | `false`（随包 patch：`true`） | `tower_send.interrupt` 的默认值（投递前先中断运行中的回合）。 |
 | `tests.enabled` | `true` | worktree 的 `package.json` 配置了测试发现时运行它。 |
-| `tests.admission` | `complete` | `spawn` 在启动 worker 前运行发现（fail-closed，不启动子代理）；`complete` 在 `tower_complete` 时运行；`off` 只在显式 `tower_test` 时运行。 |
+| `tests.admission` | `off` | `spawn` 在启动 worker 前运行发现（fail-closed，不启动子代理）；`complete` 在 `tower_complete` 时运行；`off` 只在显式 `tower_test` 时运行（默认；不会自动执行仓库代码）。 |
 | `tests.timeoutMs` | `60000` | 每条发现命令的超时。 |
 | `tests.maxBytes` | `16777216`（16 MiB） | 每条命令捕获的 stdout 上限。 |
 | `tests.autoChecks` | `true` | 向完成报告附加自动 `tests` 检查。 |
 | `tests.allowPackageDiscovery` | `true` | 允许仓库控制的 `tower.testDiscovery` 命令（会执行 worktree 代码；见安全页）。 |
 | `gates.requireChecks` | `false` | 合并前要求至少一条 `tower_complete.checks` 证据（`no-check-evidence`）。 |
-| `gates.requireTests` | `false` | 要求针对被审查 tip 的通过测试回执（`tests-missing`）。 |
-| `gates.allowReviewExemption` | `false` | 允许用 `reviewPolicy:"none"` + 理由跳过审查 blocker；默认故意关闭。 |
+| `gates.requireTests` | `false` | 要求针对当前 mission 分支 tip 的通过测试回执（`tests-missing`）；与审查门禁独立。 |
+| `gates.allowReviewExemption` | `false` | 在 `review.requireReview:true` 时，允许用 `reviewPolicy:"none"` + 非空理由跳过审查 blocker；默认故意关闭；全局审查关闭时无影响。 |
 | `docs.board` | `true` | 变更后写入 `MISSIONS.md`。 |
 | `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`；`repo` = `<repoRoot>/MISSIONS.md`。 |
 | `leases.ttlMs` | `900000` | 默认咨询式租约寿命；过期不会自动释放。 |

package/docs/zh/reference/errors.md

@@ -3,7 +3,7 @@
 [English](../../reference/errors.md) | **简体中文**
 
 工具失败是抛出的错误，不是 `{ok:false}` 结果（门禁结果是例外：见 [blockers.md](blockers.md)）。
-每个抛出的错误都以稳定 code 作为消息前缀：
+每个抛出的错误都以稳定 code 作为消息前缀。本版本定义 31 个工具错误码。
 
 ```
 [tower:mission-not-found] unknown mission "M9"
@@ -20,6 +20,7 @@
 | `mission-not-found` | 不存在该 id 的 mission。 | 过期或拼错的 `M9` |
 | `finding-not-found` | 不存在该 id 的 finding。 | `tower_findings({id:"F99"})` |
 | `invalid-transition` | 请求的状态转换不被允许。 | 尝试 blocked→merged；finding 状态图之外的流转；reviewer 修改 finding；在还有未完成任务、blocker、无提交或未读消息时完成 mission。 |
+| `worktree-dirty` | mission worktree 有未提交改动，不能完成。 | `tower_complete` 前遗留 staged/modified/untracked 文件 |
 | `state-locked` | 另一个 Tower 写入者持有 state 锁。 | 锁超时后的并发写 |
 | `state-corrupt` | Tower state 文件不可读或无效。 | 手工编辑过的 `state.json` |
 | `config-invalid` | Tower 配置无效。 | 格式错误的仓库 `config.json`、违反 schema 的值 |

package/docs/zh/reference/events.md

@@ -3,7 +3,7 @@
 [English](../../reference/events.md) | **简体中文**
 
 Tower 在工具成功调用（变更与只读）后发出进程内 Cordis 事件，其他插件因此可以观察仓库，而不必轮询。
-事件**不会**通过网络发送，也不包含遥测。
+本版本发出 29 个进程内事件。事件**不会**通过网络发送，也不包含遥测。
 
 ```js
 ctx.on('tower/merge', (payload) => {
@@ -33,14 +33,17 @@ ctx.on('tower/merge', (payload) => {
 | `tower/status` | `tower_status` 读取面板之后 |
 | `tower/preflight` | `tower_preflight` 评估门禁之后 |
 | `tower/doctor` | `tower_doctor` 完成只读检查之后 |
+| `tower/recover` | `tower_recover` 查看或清理 stale state 锁之后 |
 | `tower/test` | `tower_test` 运行测试发现之后 |
 | `tower/batch` | `tower_batch` 创建、查看或关闭 batch 之后 |
 | `tower/resource` | `tower_resource` 获取/释放/查看租约之后 |
 | `tower/import_legacy` | `tower_import_legacy` 保存旧版快照之后 |
 | `tower/legacy_map` | `tower_legacy_map` 映射或列出旧 id 之后 |
+| `tower/mode` | `tower_mode` 读取/变更会话模式之后（`value.mode`、`allowAgentControl`、`deniedWhileActive`） |
+| `tower/control` | `tower_control` 进入/退出模式之后（`value.mode`，操作者/理由在 `value` 中） |
+| `tower/reload` | `tower_reload` 返回重载调度/结果之后 |
 
-`tower_mode`、`tower_control` 与 `tower_reload` 不发出 Tower 事件。payload 是 JSON：
-`{tool, repoRoot, value}`。监听器抛错不会影响工具结果。
+payload 是 JSON：`{tool, repoRoot, value}`。监听器抛错不会影响工具结果。
 
 需要可持久审计的调用链时，请使用 `<git-common-dir>/dsh-tower/activity.jsonl` 与 `MISSIONS.md`；
 事件是进程内的，不会重放。

package/docs/zh/reference/testing.md

@@ -49,8 +49,9 @@ stdout/stderr 文件、SHA-256 哈希、退出码、计数、required 名称、w
 
 - `tower_test({repoRoot,missionId})` 按需运行发现并记录回执。
 - `tests.autoChecks` 开启时，`tower_complete` 会添加一条 `tests` 检查。
-- `gates.requireChecks` 要求任意完成检查；`gates.requireTests` 要求针对被审查 tip 的通过回执
-  （`tests-missing`）。
+- `gates.requireChecks` 要求任意完成检查；`gates.requireTests` 要求针对当前 mission 分支 tip 的
+  通过回执（`tests-missing`）。测试门禁与审查独立：即使 `review.requireReview:false`，测试门禁仍
+  检查分支 tip。
 
 ## 信任边界
 

package/docs/zh/reference/tools.md

@@ -3,9 +3,9 @@
 [English](../../reference/tools.md) | **简体中文**
 
 所有工具都接受 `repoRoot`（目标 Git 仓库内的绝对路径）并返回 JSON。
-本构建最多 28 个工具：下列 19 个核心仓库工具（含 `tower_interrupt`）、`tower_mode`、
-`mode.allowAgentControl` 开启时注册的 `tower_control`、`dev.hotReload` 开启时注册的
-`tower_reload`，以及 2.1 的验证/运维工具 `tower_doctor`、`tower_test`、`tower_batch`、
+本构建最多 29 个工具：下列 19 个核心仓库工具（含 `tower_interrupt`）、`tower_mode`、默认注册的
+`tower_control`（设 `mode.allowAgentControl:false` 可禁用）、`dev.hotReload` 开启时注册的
+`tower_reload`，以及 2.1 的验证/运维工具 `tower_doctor`、`tower_recover`、`tower_test`、`tower_batch`、
 `tower_resource`、`tower_import_legacy`、`tower_legacy_map`。
 
 `tower_mission` 使用 `id`（别名 `missionId`）；其他所有 mission 级工具使用 `missionId`
@@ -32,7 +32,7 @@ roster 角色由 `exec.agent` 与 roster 共同决定。mission 级工具（`tow
 | 工具 | 参数 | 用途 / 说明 |
 |---|---|---|
 | `tower_init` | `base?`、`autoGitInit?`、`snapshotDirty?`、`reanchor?` | 创建 `<git-common-dir>/dsh-tower/state.json`。`autoGitInit` 执行 `git init` 并创建空的初始提交；`snapshotDirty` 记录一个游离快照提交作为 mission 基线；`reanchor` 仅在没有非终态 mission 时修改基线。返回 `dirty`、`snapshotCommit`、`reanchored`。 |
-| `tower_plan` | `missions[]`（`title`、`scope[]`、`tasks[]?`、`deps[]?`、`kind?`、`context?`、`references[]?` ≤20、`reviewPolicy?`、`reviewExemptionReason?`） | 创建 mission `M1..`；重叠的 build scope 会自动加依赖；拒绝未知依赖与依赖循环。`reviewPolicy:"none"` 需要理由，并且要求 `gates.allowReviewExemption`。 |
+| `tower_plan` | `missions[]`（`title`、`scope[]`、`tasks[]?`、`deps[]?`、`kind?`、`context?`、`references[]?` ≤20、`reviewPolicy?`、`reviewExemptionReason?`） | 创建 mission `M1..`；重叠的 build scope 会自动加依赖；拒绝未知依赖与依赖循环。`reviewPolicy:"none"` 需要非空理由；审查门禁开启时，preflight 还要求 `gates.allowReviewExemption`。 |
 | `tower_mission` | `id`（别名 `missionId`）、`status?`、`task_done?`、`task_drop?`+`task_drop_reason?`、`blocker?`、`clear_blockers?`、`note?`、`scope?`、`pause_cause?`、`authorization?` | 更新单个 mission。worker 可安全使用的字段是 task/blocker/note；不能在这里设置 `merged`。暂停的 mission 记录 `pause_cause`（user/failure/resource/dependency）；恢复用户暂停的 mission 会遵循 `mode.requireResumeAuthorization`。 |
 | `tower_status` | `missionId?`、`offset?`、`limit?`、`includeGate?`、`format?` | 默认返回面板。`missionId` 返回完整详情（任务/备注/审查/finding/完成报告）。`offset`/`limit` 对 mission 分页（默认 20，最大 100），`includeGate` 附带门禁摘要，`format:"markdown"` 返回看板。 |
 | `tower_spawn` | `missionId`（别名 `id`）、`role`（`worker`/`reviewer`）、`name?`、`instructions?`、`worktreeRoot?`、`wait?`、`waitMs?`、`takeover?`、`includeDirtyBase?` | 准备或复用 worktree 并启动子代理。worker 使用 `tower-worker`；reviewer 要求 mission 为 `completed`，并使用只读的 `tower-reviewer`。`takeover:true` 替换已不再运行的 worker 条目（ownerGeneration 递增）。每个 mission 只能有一个活跃 worker；`spawn.maxLiveWorkers` 限制整个仓库。 |
@@ -41,7 +41,7 @@ roster 角色由 `exec.agent` 与 roster 共同决定。mission 级工具（`tow
 | `tower_diff` | `missionId`（别名 `id`）、`maxBytes?` | 只读 merge-base diff：文件、提交、有上限的 patch。供 reviewer 安全使用。 |
 | `tower_send` | `to`、`subject`、`body`、`scope?`、`interrupt?`、`consentRef?` | 向 roster 名称、`tower` 或 `all` 发送持久消息；对运行中的 agent 会即时投递。`interrupt:true` 先中断运行中的回合（Kimi 风格）再投递；`consentRef` 记录用于审计。受 `send.maxPerMinute` 限速。 |
 | `tower_inbox` | `limit?`、`include_read?` | 读取并确认发给调用者的消息；未读消息会阻止 `tower_complete`。 |
-| `tower_complete` | `missionId`（别名 `id`）、`report`、`checks?` | worker 报告完成（mission 变为 `completed`，等待审查）。要求当前 owner、无未完成任务/blocker、≥1 个提交、无未读消息。`checks` 记录 `{name, command?, exitCode?, evidence?}` 证据；`gates.requireChecks` 可以强制要求。配置了测试发现时还会自动运行并添加 `tests` 检查；失败会抛出 `[tower:tests-failed]`。 |
+| `tower_complete` | `missionId`（别名 `id`）、`report`、`checks?` | worker 报告完成（mission 变为 `completed`，可进入 preflight 与可选审查）。要求当前 owner、无未完成任务/blocker、≥1 个提交、无未读消息。`checks` 记录 `{name, command?, exitCode?, evidence?}` 证据；`gates.requireChecks` 可以强制要求。配置了测试发现时还会自动运行并添加 `tests` 检查；失败会抛出 `[tower:tests-failed]`。 |
 | `tower_interrupt` | `to?`（roster 名称）、`agentId?`、`reason?` | 通过 `subagents.interrupt` 中断一个运行中的 roster agent，并记录 `state:"interrupted"`。幂等（未运行 → `interrupted:false`）。 |
 | `tower_finding` | `type`、`title`、`summary`、`details`、`suggested_fix`、`severity?`、`missionId?`、`location?` | 记录 scope 之外的问题；reviewer 用它代替直接改文件。新 finding 初始为 `open`。 |
 | `tower_findings` | `id?`、`status?`、`note?`、过滤（`type?`、`severity?`、`missionId?`、`open?`、`limit?`） | 生命周期工具：列出/读取/流转。状态为 `open → triaged → fixed`/`wontfix`，允许重新打开。只有控制塔或 worker 能修改；reviewer 只能列出/读取。 |
@@ -51,9 +51,10 @@ roster 角色由 `exec.agent` 与 roster 共同决定。mission 级工具（`tow
 | `tower_rebase` | `missionId`（别名 `id`） | 在 worktree 内把分支 rebase 到基线。worker 运行中或 worktree 脏时拒绝。分支已包含在基线中时返回 `alreadyMerged` 且保持分支不动。 |
 | `tower_teardown` | `force?`、`exclude?`、`dry_run?`（别名 `dryRun`） | 移除符合条件的 merged/abandoned worktree 与分支；运行中的 agent 始终保留。 |
 | `tower_mode` | — | 报告模式、最近修改、被暂停的 goal、被拒绝的工具、store 路径、插件版本、HMR 可用性、workspace 锁持有者。 |
-| `tower_control` | `action`（`enter`/`exit`）、`reason` | 模型主动切换模式；仅当 `mode.allowAgentControl` 为 `true` 时可用；`reason` 必填。 |
+| `tower_control` | `action`（`enter`/`exit`）、`reason` | 模型主动切换模式；默认注册，设 `mode.allowAgentControl:false` 可禁用；`reason` 必填。 |
 | `tower_reload` | `repoRoot?` | 仅开发用：请求 DSH HMR 对账 profile 并从磁盘重载 Host 插件。`dev.hotReload` 开启时注册；在工具结果返回后调度（默认 50 ms）；没有 HMR 时以 `reload-unavailable` 失败。传入 `repoRoot` 时调用者必须是控制塔。 |
 | `tower_doctor` | —（需要 `repoRoot`） | 只读健康契约：git、state schema、config、preset/subagents/HMR、workspace 锁、roster、worktree realpath/归属、测试配置、leases。返回 `{ok, checks[{id,status,detail}], environmentContract}`。从不写状态。 |
+| `tower_recover` | `action`（`status`/`clear-stale-lock`）、`confirm?` | 恢复诊断与显式 stale state-lock 修复。`clear-stale-lock` 需要 `confirm:"CLEAR_STALE_LOCK"`，只把 PID 已死的锁移到备份文件；不会重置状态或 worktree。 |
 | `tower_test` | `missionId`（别名 `id`） | 运行 worktree 的 `package.json` 中 `tower.testDiscovery` 配置的发现命令并记录回执；失败时 `ok:false`。自动准入检查请用 `tower_complete`。 |
 | `tower_batch` | `action`（`create`/`status`/`close`/`abandon`）、`missionIds?`、`exclusions?`、`requiredChecks?`、`receiptPaths?`、`batchId?`、`checks?`、`treeTip?`、`receiptHashes?`、`reason?` | 有限证据批次。create 冻结成员/检查/回执；close 校验每条必需检查与回执哈希；`merged` 成员也可参与 close；abandon 可退掉过期的 open batch 且不删除 mission。成员关系不可变。 |
 | `tower_resource` | `action`（`acquire`/`release`/`status`）、`name?`、`holder?`、`token?`、`ttlMs?`、`force?` | 每个仓库的咨询式租约，位于 `<common>/dsh-tower/leases.json`。没有 OS CPU/内存硬上限；过期的租约需要显式 `force` 与正确 token。 |

package/index.js

@@ -1,11 +1,12 @@
 // dsh-tower — Host entry.
 //
-// Tower mode is a session-level stance. The human owns it through the
-// `/tower` command: bare `/tower`, `/tower on [message]`, `/tower off
-// [message]`, and `/tower <message>` all work, and any trailing text is
-// forwarded to the model as the next user message. With
-// config.allowAgentControl the model may also enter or leave the mode through
-// `tower_control` when the user intent or task state clearly calls for it.
+// Tower mode is a session-level stance. It is intentionally operable by both
+// sides: the `/tower` command (bare `/tower`, `/tower on [message]`, `/tower
+// off [message]`, and `/tower <message>`; trailing text is forwarded to the
+// model as the next user message) and, when config.allowAgentControl is true
+// (the default), the model through `tower_control`. Every change is recorded
+// with its actor and reason; set allowAgentControl:false for human-only mode
+// control.
 //
 // `/tower reload` asks DSH HMR to reconcile this profile and reload the Tower
 // plugin from disk when the HMR service is present (dev/linked installs).
@@ -31,6 +32,11 @@ export const Config = ConfigSchema
 
 let MODE = new Map()
 let denyTools = new Set(DEFAULT_DENY_TOOLS)
+
+function modeOn(key) {
+  const entry = key ? MODE.get(key) : undefined
+  return Boolean(entry && entry.on === true)
+}
 const READ_ONLY_TOOL_NAMES = new Set([
   'tower_status',
   'tower_roster',
@@ -44,11 +50,11 @@ const BASE_REMINDER = [
   'Tower mode is active for this session. You are the control tower: plan missions, spawn workers and reviewers, and integrate only through the Tower tools.',
   'Mission tracking lives in tower_plan / tower_mission / tower_status, not todo_write or the Team task board.',
   'Do not create or resume goals, do not spawn teammates, and never merge without a green tower_preflight.',
-  'Only the human can normally change this mode with /tower on|off.',
+  'Tower mode changes are explicit and recorded; the user can always use /tower on|off.',
 ].join(' ')
 
 const AGENT_CONTROL_NOTE =
-  'If tower_control is available you may also enter or leave Tower mode yourself when the user intent or task state clearly calls for it, and you must state a concrete reason.'
+  'You may also enter or leave Tower mode with tower_control when the user intent or task state clearly calls for it; always state a concrete reason.'
 
 function readPluginVersion() {
   if (pluginVersion !== null) return pluginVersion
@@ -187,12 +193,15 @@ function enterMode(ctx, key, agent, by, reason) {
 async function exitMode(key, by, reason) {
   const previous = MODE.get(key)
   if (!previous) return { wasOn: false, pausedGoal: null, goalNote: null }
-  MODE.delete(key)
+  const wasOn = previous.on === true
+  // Keep a timestamped off tombstone so a concurrent save from another
+  // session cannot resurrect this mode entry.
+  MODE.set(key, { on: false, at: Date.now() })
   persistModes()
   if (previous.lock) {
     await releaseWorkspaceLock(previous.lock.commonDir, { token: previous.lock.token }).catch(() => {})
   }
-  return { wasOn: true, pausedGoal: previous.pausedGoal ?? null, goalNote: null, by, reason: reason ?? null }
+  return { wasOn, pausedGoal: previous.pausedGoal ?? null, goalNote: null, by, reason: reason ?? null }
 }
 
 function forwardInstruction(agent, message, attachments) {
@@ -256,7 +265,7 @@ export function apply(ctx, rawConfig) {
       const key = agentKey(exec?.agent)
       if (!key) return
       const entry = MODE.get(key)
-      if (!entry) return
+      if (!entry || entry.on !== true) return
       const repo = await resolveRepo(repoRoot)
       const existing = entry.lock
       if (existing && existing.commonDir !== repo.commonDir) {
@@ -304,7 +313,7 @@ export function apply(ctx, rawConfig) {
     },
     basePreference(exec) {
       const key = agentKey(exec?.agent)
-      return key ? MODE.get(key)?.baseBranch ?? null : null
+      return key && modeOn(key) ? MODE.get(key)?.baseBranch ?? null : null
     },
   }
 
@@ -324,7 +333,7 @@ export function apply(ctx, rawConfig) {
   ctx.effect(() =>
     ctx.tools.guard((execution) => {
       const key = agentKey(execution.agent)
-      if (!key || !MODE.has(key)) return undefined
+      if (!key || !modeOn(key)) return undefined
       if (denyTools.has(execution.name)) {
         return `tower mode: ${execution.name} is disabled while Tower mode is active; use the Tower tools or /tower off`
       }
@@ -345,7 +354,7 @@ export function apply(ctx, rawConfig) {
     typeof ctx.on === 'function'
       ? ctx.on('agent/pre-step', (payload, next) => {
           const key = agentKey(payload?.agent)
-          if (key && MODE.has(key)) {
+          if (key && modeOn(key)) {
             // Once Tower is active, Tower wins regardless of entry policy: clear
             // any plan state so the two policies cannot coexist.
             const state = planModeState(ctx, payload.agent)
@@ -359,7 +368,7 @@ export function apply(ctx, rawConfig) {
   ctx.systemPrompt.section({
     name: 'tower:mode',
     order: 15000,
-    text: (context) => (context && MODE.has(agentKey(context.agent)) ? reminder : ''),
+    text: (context) => (context && modeOn(agentKey(context.agent)) ? reminder : ''),
   })
 
   // Workspace-lock heartbeat; only sessions holding a lock do I/O.
@@ -474,7 +483,7 @@ export function apply(ctx, rawConfig) {
           return {
             ok: true,
             action: args.action,
-            mode: MODE.has(key) ? 'on' : 'off',
+            mode: modeOn(key) ? 'on' : 'off',
             changed: args.action === 'enter' ? !outcome.wasOn : outcome.wasOn,
             changedBy: 'agent',
             reason,
@@ -497,7 +506,7 @@ export function apply(ctx, rawConfig) {
         const baseMatch = String(rawInput ?? '').trim().match(/^base\s+(\S+)\s*$/i)
         if (baseMatch) {
           const entry = MODE.get(key)
-          if (!entry) return { kind: 'error', text: 'Run /tower on first, then /tower base <branch>.' }
+          if (!entry || entry.on !== true) return { kind: 'error', text: 'Run /tower on first, then /tower base <branch>.' }
           entry.baseBranch = baseMatch[1]
           persistModes()
           return { kind: 'success', text: `Tower base preference set to "${entry.baseBranch}"; tower_init without an explicit base will use it.` }

package/lib/config.js

@@ -30,7 +30,50 @@ export const DEFAULT_DENY_TOOLS = [
 ]
 
 const LEGACY_KEYS = ['section', 'allowAgentControl']
-const GROUP_KEYS = ['init', 'mode', 'review', 'merge', 'worktrees', 'spawn', 'send', 'tests', 'gates', 'docs', 'leases', 'dev']
+const GROUP_KEYS = ['init', 'mode', 'review', 'merge', 'git', 'worktrees', 'spawn', 'send', 'tests', 'gates', 'docs', 'leases', 'dev']
+
+const SECTION_KEYS = {
+  init: ['autoGitInit', 'snapshotDirty'],
+  mode: [
+    'promptSection',
+    'sectionAppend',
+    'allowAgentControl',
+    'autoPauseGoal',
+    'requireResumeAuthorization',
+    'workspaceLock',
+    'workspaceLockScope',
+    'planModePolicy',
+    'workspaceStaleMs',
+    'heartbeatMs',
+    'denyTools',
+    'storePath',
+    'maxEntries',
+  ],
+  review: ['requireReview', 'maxRoundsPerReviewer'],
+  merge: ['timeoutMs', 'maxBufferBytes'],
+  git: ['timeoutMs'],
+  worktrees: ['root'],
+  spawn: [
+    'workerPreset',
+    'reviewerPreset',
+    'maxDepth',
+    'provider',
+    'workerModel',
+    'reviewerModel',
+    'maxLiveWorkers',
+    'staleMs',
+    'maxWaitMs',
+    'requireLease',
+  ],
+  send: ['maxPerMinute', 'interruptDefault'],
+  tests: ['enabled', 'admission', 'timeoutMs', 'maxBytes', 'autoChecks', 'allowPackageDiscovery'],
+  gates: ['requireChecks', 'requireTests', 'allowReviewExemption'],
+  docs: ['board', 'boardLocation'],
+  leases: ['ttlMs'],
+  dev: ['hotReload', 'reloadDelayMs', 'reloadRequiredIds'],
+}
+
+const MODEL_KEYS = ['provider', 'model', 'reasoningEffort', 'maxTokens']
 
 const ModelSchema = () =>
   Schema.object({
@@ -88,6 +131,9 @@ export const Config = Schema.object({
     .default({})
     .description('Tower-mode behavior and persistence.'),
   review: Schema.object({
+    requireReview: Schema.boolean()
+      .default(false)
+      .description('Require an independent clean review before merge. Default false: review is optional; set true to enforce the review gate globally.'),
     maxRoundsPerReviewer: Schema.natural().min(1).default(5).description('Review-round cap per reviewer per mission branch.'),
   })
     .default({})
@@ -98,6 +144,11 @@ export const Config = Schema.object({
   })
     .default({})
     .description('Merge execution policy.'),
+  git: Schema.object({
+    timeoutMs: Schema.natural().min(1000).default(15000).description('Default timeout for Git commands other than merge; merge uses merge.timeoutMs.'),
+  })
+    .default({})
+    .description('Git subprocess policy.'),
   worktrees: Schema.object({
     root: Schema.string().description('Default parent directory for mission worktrees; empty derives <main-checkout-parent>/.dsh-tower-worktrees/<hash>.'),
   })
@@ -142,8 +193,8 @@ export const Config = Schema.object({
   tests: Schema.object({
     enabled: Schema.boolean().default(true).description('Run declared test discovery when a mission configures it.'),
     admission: Schema.union(['spawn', 'complete', 'off'])
-      .default('complete')
-      .description('Run discovery before spawning a worker, when completing, or only on explicit tower_test.'),
+      .default('off')
+      .description('Run discovery before spawning a worker, when completing, or only on explicit tower_test (default off: repository code runs only on an explicit tower_test).'),
     timeoutMs: Schema.natural().min(1000).max(1800000).default(60000).description('Per discovery command timeout.'),
     maxBytes: Schema.natural().min(1024).max(16 * 1024 * 1024).default(16 * 1024 * 1024).description('Maximum captured stdout bytes per command.'),
     autoChecks: Schema.boolean().default(true).description('Attach a tests check to the completion report when discovery runs.'),
@@ -233,14 +284,39 @@ function normalizeLegacy(raw = {}) {
   return out
 }
 
+function assertModelKeys(value, label) {
+  const bad = Object.keys(value).filter((key) => !MODEL_KEYS.includes(key))
+  if (bad.length > 0) {
+    throw new TowerToolError('config-unknown-key', `${label} has unknown key(s) ${bad.join(', ')}`)
+  }
+}
+
 function assertKnownKeys(raw, label) {
   const unknown = Object.keys(raw).filter((key) => !LEGACY_KEYS.includes(key) && !GROUP_KEYS.includes(key))
   if (unknown.length > 0) {
     throw new TowerToolError(
       'config-unknown-key',
-      `${label} has unknown key(s) ${unknown.join(', ')} — config is { section?, allowAgentControl?, init?, mode?, review?, merge?, worktrees?, spawn?, send?, tests?, gates?, docs?, leases?, dev? }`,
+      `${label} has unknown key(s) ${unknown.join(', ')} — config is { section?, allowAgentControl?, init?, mode?, review?, merge?, git?, worktrees?, spawn?, send?, tests?, gates?, docs?, leases?, dev? }`,
     )
   }
+  for (const [group, allowed] of Object.entries(SECTION_KEYS)) {
+    const value = raw[group]
+    if (value === undefined) continue
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue
+    const bad = Object.keys(value).filter((key) => !allowed.includes(key))
+    if (bad.length > 0) {
+      throw new TowerToolError(
+        'config-unknown-key',
+        `${label} has unknown key(s) ${bad.map((key) => `${group}.${key}`).join(', ')}`,
+      )
+    }
+    if ((group === 'spawn') && value.workerModel && typeof value.workerModel === 'object') {
+      assertModelKeys(value.workerModel, `${label} spawn.workerModel`)
+    }
+    if ((group === 'spawn') && value.reviewerModel && typeof value.reviewerModel === 'object') {
+      assertModelKeys(value.reviewerModel, `${label} spawn.reviewerModel`)
+    }
+  }
 }
 
 const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
@@ -281,7 +357,7 @@ export function resolveTowerConfig(rawConfig) {
   // Apply the canonical default only after alias resolution: a validated
   // Cordis config may omit this key, and an explicit legacy top-level
   // `allowAgentControl:true` must not be shadowed by a schema default.
-  if (mode.allowAgentControl === undefined) mode.allowAgentControl = false
+  if (mode.allowAgentControl === undefined) mode.allowAgentControl = true
   if (!Array.isArray(mode.denyTools) || mode.denyTools.length === 0) mode.denyTools = [...DEFAULT_DENY_TOOLS]
   return {
     section: mode.promptSection ?? '',
@@ -289,6 +365,7 @@ export function resolveTowerConfig(rawConfig) {
     mode,
     review: clone(parsed.review ?? {}),
     merge: clone(parsed.merge ?? {}),
+    git: clone(parsed.git ?? {}),
     worktrees: clone(parsed.worktrees ?? {}),
     spawn: clone(parsed.spawn ?? {}),
     send: clone(parsed.send ?? {}),
@@ -370,7 +447,27 @@ export async function readRepoConfig(commonDir) {
 export async function resolveRepoConfig(repo) {
   const base = runtimeConfig()
   const layer = await readRepoConfig(repo.commonDir)
-  const merged = deepMerge(base, layer.config)
+  // The mode guard is a session/profile concern. A repository checkout may
+  // only tighten it, never weaken denyTools, workspaceLock, allowAgentControl,
+  // plan policy, or resume authorization.
+  const repoLayer = { ...layer.config }
+  delete repoLayer.mode
+  delete repoLayer.section
+  delete repoLayer.allowAgentControl
+  const merged = deepMerge(base, repoLayer)
+  const repoMode = layer.config.mode
+  if (repoMode && typeof repoMode === 'object' && !Array.isArray(repoMode)) {
+    merged.mode = { ...(merged.mode ?? {}) }
+    if (repoMode.requireResumeAuthorization === true) merged.mode.requireResumeAuthorization = true
+    if (repoMode.workspaceLock === true) merged.mode.workspaceLock = true
+    if (repoMode.autoPauseGoal === true) merged.mode.autoPauseGoal = true
+    if (repoMode.workspaceLockScope === 'all') merged.mode.workspaceLockScope = 'all'
+    if (repoMode.planModePolicy === 'refuse') merged.mode.planModePolicy = 'refuse'
+    if (repoMode.allowAgentControl === false) merged.mode.allowAgentControl = false
+    if (Array.isArray(repoMode.denyTools)) {
+      merged.mode.denyTools = [...new Set([...(base.mode?.denyTools ?? DEFAULT_DENY_TOOLS), ...repoMode.denyTools])]
+    }
+  }
   if (!Array.isArray(merged.mode?.denyTools) || merged.mode.denyTools.length === 0) {
     merged.mode = { ...(merged.mode ?? {}), denyTools: [...DEFAULT_DENY_TOOLS] }
   }

package/lib/doctor.js

@@ -4,6 +4,7 @@ import { promisify } from 'node:util'
 import path from 'node:path'
 import fsp from 'node:fs/promises'
 import { git } from './git.js'
+import { readStateLock } from './store.js'
 import { inspectWorkspaceLock } from './workspaceLock.js'
 
 const execFileAsync = promisify(execFile)
@@ -78,11 +79,13 @@ export async function runDoctor({ tower, ctx, agent }) {
   checks.push(hmr ? check('hmr', 'pass', 'service mounted') : check('hmr', 'warn', 'HMR is not mounted; /tower reload is unavailable'))
 
   if (state) {
-    const stateLock = path.join(tower.paths.dir, 'state.lock')
+    const lock = await readStateLock(tower.paths)
     checks.push(
-      (await exists(stateLock))
-        ? check('state-lock', 'warn', `${stateLock} exists (a writer may be active or a crash left it behind)`)
-        : check('state-lock', 'pass', 'no state lock file'),
+      !lock.record
+        ? check('state-lock', 'pass', 'no state lock file')
+        : lock.alive === false
+          ? check('state-lock', 'warn', `stale state lock (pid ${lock.record.pid ?? 'unknown'} is gone); the next mutation reclaims it atomically`)
+          : check('state-lock', 'warn', `state lock held by pid ${lock.record.pid ?? 'unknown'}; retry after it finishes`),
     )
     const lockDir = path.join(tower.commonDir, 'dsh-tower', 'tower.lock')
     try {
@@ -121,7 +124,7 @@ export async function runDoctor({ tower, ctx, agent }) {
     const removedNote = removedWorktrees > 0 ? ` (${removedWorktrees} removed by teardown)` : ''
     checks.push(
       missingWorktrees > 0
-        ? check('worktrees', 'fail', `${missingWorktrees} mission worktree(s) are missing or invalid${removedNote}`, 'run tower_preflight or tower_recover')
+        ? check('worktrees', 'fail', `${missingWorktrees} mission worktree(s) are missing or invalid${removedNote}`, 'inspect tower_status, restore the worktree/branch, then re-run tower_doctor')
         : dirtyWorktrees > 0
           ? check('worktrees', 'warn', `${dirtyWorktrees} worktree(s) have uncommitted changes${removedNote}`)
           : check('worktrees', 'pass', `all registered worktrees are valid${removedNote}`),
@@ -165,6 +168,9 @@ export async function runDoctor({ tower, ctx, agent }) {
       repoRoot: tower.root,
       commonDir: tower.commonDir,
       stateDir: tower.paths.dir,
+      gitTimeoutMs: Number(tower.config.git?.timeoutMs) || 15000,
+      mergeTimeoutMs: Number(tower.config.merge?.timeoutMs) || 900000,
+      testsAdmission: tower.config.tests?.admission ?? 'off',
     },
     mode: agent ? 'ready' : 'unknown',
   }

package/lib/errors.js

@@ -20,6 +20,7 @@ export const ERROR_CODES = {
   'config-unknown-key': 'Tower configuration has an unknown top-level key.',
   'git-failed': 'A git command failed.',
   'git-timeout': 'A git command timed out or exceeded its output buffer.',
+  'worktree-dirty': 'The mission worktree has uncommitted changes and cannot complete.',
   'spawn-unavailable': 'The subagents service is unavailable.',
   'provider-missing': 'No subagent provider is registered.',
   'preset-missing': 'The configured agent preset is not registered.',
@@ -45,6 +46,9 @@ export class TowerToolError extends Error {
     super(`[tower:${code}] ${message}`, options.cause ? { cause: options.cause } : undefined)
     this.name = 'TowerToolError'
     this.code = code
+    this.retryable = options.retryable === true
+    this.nextAction = options.nextAction ?? null
+    this.details = options.details ?? null
   }
 }
 
@@ -95,7 +99,12 @@ function originalMessage(error) {
 export function classifyError(error) {
   if (error instanceof TowerToolError) return error
   if (error && typeof error.code === 'string' && ERROR_CODES[error.code]) {
-    return new TowerToolError(error.code, originalMessage(error), { cause: error })
+    return new TowerToolError(error.code, originalMessage(error), {
+      cause: error,
+      retryable: error.retryable === true,
+      nextAction: error.nextAction ?? null,
+      details: error.details ?? null,
+    })
   }
   if (error instanceof GitError || error?.name === 'GitError') {
     const message = originalMessage(error)
@@ -104,8 +113,11 @@ export function classifyError(error) {
     return new TowerToolError(code, message, { cause: error })
   }
   const message = originalMessage(error)
+  const RETRYABLE = new Set(['state-locked', 'rate-limited', 'git-timeout', 'workspace-busy', 'merge-intent-pending'])
   for (const [code, pattern] of RULES) {
-    if (pattern.test(message)) return new TowerToolError(code, message, { cause: error })
+    if (pattern.test(message)) {
+      return new TowerToolError(code, message, { cause: error, retryable: RETRYABLE.has(code) })
+    }
   }
   return new TowerToolError('tool-internal', message, { cause: error })
 }

package/lib/git.js

@@ -4,6 +4,40 @@ import path from 'node:path'
 
 const GIT_TIMEOUT_MS = 15000
 const MAX_BUFFER = 16 * 1024 * 1024
+let configuredTimeoutMs = GIT_TIMEOUT_MS
+
+/** Override the default Git timeout from resolved Tower config. */
+export function setGitTimeout(ms) {
+  const value = Number(ms)
+  if (Number.isFinite(value) && value >= 1000) configuredTimeoutMs = value
+}
+
+const BLOCKED_GIT_ENV = new Set([
+  'GIT_DIR',
+  'GIT_WORK_TREE',
+  'GIT_INDEX_FILE',
+  'GIT_OBJECT_DIRECTORY',
+  'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+  'GIT_COMMON_DIR',
+  'GIT_NAMESPACE',
+  'GIT_PREFIX',
+  'GIT_CEILING_DIRECTORIES',
+  'GIT_CONFIG_GLOBAL',
+  'GIT_CONFIG_SYSTEM',
+  'GIT_CONFIG_NOSYSTEM',
+  'GIT_DISCOVERY_ACROSS_FILESYSTEM',
+  'GIT_QUARANTINE_PATH',
+])
+
+/** Git must not inherit a repository redirect from the DSH process environment. */
+export function gitEnv(source = process.env) {
+  const env = {}
+  for (const [key, value] of Object.entries(source)) {
+    if (BLOCKED_GIT_ENV.has(key)) continue
+    env[key] = value
+  }
+  return env
+}
 
 export class GitError extends Error {
   constructor(args, detail, code, meta = {}) {
@@ -23,10 +57,10 @@ export function git(cwd, args, options = {}) {
       args,
       {
         cwd,
-        timeout: options.timeoutMs ?? GIT_TIMEOUT_MS,
+        timeout: options.timeoutMs ?? configuredTimeoutMs,
         maxBuffer: options.maxBuffer ?? MAX_BUFFER,
         windowsHide: true,
-        env: process.env,
+        env: gitEnv(),
       },
       (error, stdout, stderr) => {
         if (error) {