dsh-tower 2.1.0 → 2.4.0

package/skills.js

@@ -3,9 +3,12 @@
 // the short system-prompt sections stay authoritative for safety rules.
 import { readFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
+import { holdComponent } from './host/capability-registry.js'
 
 export const name = 'dsh-tower/skills'
-export const inject = ['skills']
+// #121: an optional capability row still depends on the host service, so a
+// composition with the host group off cannot leave an orphan skill provider.
+export const inject = ['skills', 'tower']
 
 const ASSETS = fileURLToPath(new URL('./skills/', import.meta.url))
 
@@ -59,5 +62,9 @@ const provider = {
 }
 
 export function apply(ctx) {
+  // #121: tower-skills is an optional component row. Registering here is what
+  // lets tower_status/tower_doctor report "disabled by component tower-skills"
+  // when the row is off instead of leaving the missing catalog unexplained.
+  holdComponent(ctx, 'tower-skills')
   ctx.skills.registerProvider(() => provider)
 }

package/tools/adopt.js

@@ -1,5 +1,4 @@
 // tower_adopt: reconcile the roster with the subagent catalog.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { AdoptInput } from '../domain/contracts/tool-inputs/index.js'
@@ -7,7 +6,7 @@ import { PARENT_STATUS_OK, ROSTER_ACTIVITY, ROSTER_STATE } from '../domain/vocab
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any }} deps
  */
 export function registerAdoptTool(ctx, deps) {
   const { define, actorFor, requireTowerActor } = deps
@@ -19,7 +18,7 @@ export function registerAdoptTool(ctx, deps) {
     aliases: { retire_missing: ['retireMissing'] },
     output: output(SCHEMAS.adopt),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'adopt the roster')
       const view = await tower.rosterView()

package/tools/batch.js

@@ -1,5 +1,4 @@
 // tower_batch: finite evidence batches.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { BatchInput } from '../domain/contracts/tool-inputs/index.js'
@@ -7,7 +6,7 @@ import { BATCH_ACTION } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any, summarizeBatch: any, verifyBatchReceiptFiles: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, summarizeBatch: any, verifyBatchReceiptFiles: any }} deps
  */
 export function registerBatchTool(ctx, deps) {
   const { define, actorFor, requireTowerActor, summarizeBatch, verifyBatchReceiptFiles } = deps
@@ -19,7 +18,7 @@ export function registerBatchTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.batch),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       if (args.action === BATCH_ACTION.status) {
         const state = await tower.load()

package/tools/complete.js

@@ -1,5 +1,4 @@
 // tower_complete: worker completion admission.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { CompleteInput } from '../domain/contracts/tool-inputs/index.js'
@@ -7,7 +6,7 @@ import { isCompleteAdmission } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, runMissionDiscovery: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, runMissionDiscovery: any }} deps
  */
 export function registerCompleteTool(ctx, deps) {
   const { define, runMissionDiscovery } = deps
@@ -21,7 +20,7 @@ export function registerCompleteTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.complete),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       // Validate authorization/state before executing repository-controlled
       // test code or writing a test receipt.
       await tower.checkCompletion({

package/tools/diff.js

@@ -13,15 +13,15 @@
 // The patch cap is enforced by the pure read projection.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_diff: read-only mission branch view.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { DiffInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any }} deps
  */
 export function registerDiffTool(ctx, deps) {
+  // openTower is injected by the composition root (#69).
   const { define } = deps
   define(ctx, {
     name: 'tower_diff',
@@ -32,7 +32,7 @@ export function registerDiffTool(ctx, deps) {
     requiresMissionId: true,
     output: output(SCHEMAS.diff),
     async execute(args) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       return tower.diff({ missionId: args.missionId, maxBytes: args.maxBytes })
     },
   })

package/tools/doctor.js

@@ -1,36 +1,33 @@
 // tower_doctor: read-only health check.
-import { Tower } from '../app/tower.js'
-import { resolveRepo } from '../lib/git.js'
-import { runtimeConfig } from '../lib/config.js'
-import { runDoctor } from '../lib/doctor.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { DoctorInput } from '../domain/contracts/tool-inputs/index.js'
 import { DOCTOR_STATUS } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {import('../types/index.js').DefineTool} define
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, createTower: any, resolveRepo: any, runtimeConfig: any, runDoctor: any, surface?: () => { tools?: number } }} deps
  */
-export function registerDoctorTool(ctx, define) {
+export function registerDoctorTool(ctx, deps) {
+  const { define, createTower, resolveRepo, runtimeConfig, runDoctor } = deps
   define(ctx, {
     name: 'tower_doctor',
     description:
-'Read-only\ environment\ and\ repository\ health\ check:\ git,\ state\ schema,\ case-sensitivity\ detection\ \(caseInsensitive\ and\ the\ active\ scope\ comparison\ mode\),\ config,\ presets/subagents/HMR,\ workspace\ lock,\ roster\ staleness,\ worktree\ ownership,\ test\ discovery,\ leases,\ and\ the\ terminal-mission\ archive\ \(count,\ bytes,\ years,\ unreadable\ diagnostics\ and\ the\ configured\ afterDays/maxMissions\ policy\)\.\ Returns\ checks\ with\ pass/warn/fail\ and\ an\ environment\ contract\.\ Never\ writes\ state\ and\ never\ probes\ the\ filesystem\.',
+'Read-only\ environment\ and\ repository\ health\ check:\ the\ concept-budget\ surface\ \(config\ keys/sections/tools\),\ git,\ state\ schema,\ case-sensitivity\ detection\ \(caseInsensitive\ and\ the\ active\ scope\ comparison\ mode\),\ config,\ presets/subagents/HMR,\ the\ state\ lock\ age/heartbeat\ freshness,\ the\ repo-scoped\ git\ lock\ holder\ \(gitLock:\ \{held,pid,phase,heldMs\}\),\ workspace\ lock,\ roster\ staleness,\ worktree\ ownership,\ test\ discovery,\ leases,\ and\ the\ terminal-mission\ archive\ \(count,\ bytes,\ years,\ unreadable\ diagnostics\ and\ the\ configured\ afterDays/maxMissions\ policy\)\.\ Returns\ checks\ with\ pass/warn/fail,\ state-lock\ and\ git-lock\ reports\ and\ an\ environment\ contract\.\ Never\ writes\ state\ and\ never\ probes\ the\ filesystem\.',
     parameters: DoctorInput,
     output: output(SCHEMAS.doctor),
     async execute(args, exec) {
       let tower
       let configError = null
       try {
-        tower = await Tower.open(args.repoRoot)
+        tower = await deps.openTower(args.repoRoot)
       } catch (error) {
         const message = String(error?.message ?? error)
         if (error?.code !== 'config-invalid' && error?.code !== 'config-unknown-key') throw error
         configError = message
         const repo = await resolveRepo(args.repoRoot)
-        tower = new Tower(repo, { ...runtimeConfig(), configPath: null, repoConfigPresent: true })
+        tower = deps.createTower(repo, { ...runtimeConfig(), configPath: null, repoConfigPresent: true })
       }
-      const report = await runDoctor(/** @type {any} */ ({ tower, ctx, agent: exec.agent }))
+      const report = await runDoctor(/** @type {any} */ ({ tower, ctx, agent: exec.agent, surface: deps.surface?.() }))
       if (!configError) return report
       return {
         ...report,

package/tools/finding.js

@@ -1,12 +1,11 @@
 // tower_finding: file one structured finding.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { FindingInput } from '../domain/contracts/tool-inputs/index.js'
 import { ROLE } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireKnownActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireKnownActor: any }} deps
  */
 export function registerFindingTool(ctx, deps) {
   const { define, actorFor, requireKnownActor } = deps
@@ -19,7 +18,7 @@ export function registerFindingTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.finding),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireKnownActor(actor, 'tower_finding')
       const view = await tower.rosterView()

package/tools/findings.js

@@ -1,14 +1,14 @@
 // tower_findings: list, read, or update findings.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { FindingsInput } from '../domain/contracts/tool-inputs/index.js'
 import { ROLE } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireKnownActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireKnownActor: any }} deps
  */
 export function registerFindingsTool(ctx, deps) {
+  // openTower is injected by the composition root (#69).
   const { define, actorFor, requireKnownActor } = deps
   define(ctx, {
     name: 'tower_findings',
@@ -18,7 +18,7 @@ export function registerFindingsTool(ctx, deps) {
     aliases: {"missionId":["mission_id"]},
     output: output(SCHEMAS.findings),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireKnownActor(actor, 'tower_findings')
       const view = await tower.rosterView()

package/tools/import-legacy.js

@@ -8,17 +8,15 @@
 // Pure legacy validation lives in domain and never runs fs.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_import_legacy: read-only legacy snapshot import.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
-import { importLegacySnapshot } from '../lib/legacy.js'
 import { ImportLegacyInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, importLegacySnapshot: any }} deps
  */
 export function registerImportLegacyTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor } = deps
+  const { define, actorFor, requireTowerActor, importLegacySnapshot } = deps
   define(ctx, {
     name: 'tower_import_legacy',
     description:
@@ -27,7 +25,7 @@ export function registerImportLegacyTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.importLegacy),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'import a legacy snapshot')
       const imported = await importLegacySnapshot({

package/tools/inbox.js

@@ -10,16 +10,16 @@
 // The unread calculation is a pure domain/collab projection.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_inbox: read and acknowledge inbound messages.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { InboxInput } from '../domain/contracts/tool-inputs/index.js'
 import { ROLE } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any }} deps
  */
 export function registerInboxTool(ctx, deps) {
+  // openTower is injected by the composition root (#69).
   const { define } = deps
   define(ctx, {
     name: 'tower_inbox',
@@ -29,7 +29,7 @@ export function registerInboxTool(ctx, deps) {
     aliases: {"include_read":["includeRead"]},
     output: output(SCHEMAS.inbox),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const view = await tower.rosterView()
       const self = view.roster.find((entry) => entry.agentId === String(exec.agent.id))
       const reader = self ? self.name : ROLE.tower

package/tools/index.js

@@ -4,14 +4,15 @@
 // - define(ctx, definition) accepts a TypeBox parameters schema;
 // - execute(args) is typed from that schema by Static<>;
 // - aliases and requiresMissionId are honored by the registry;
-// - operational switches decide whether a tool is registered;
+// - capability ownership decides whether a tool is registered; the component
+//   rows in cordis.patch.yml are the switches (#121);
 // - errors are classified to stable [tower:code] values;
 // - tools must not import node:fs or node:child_process directly.
 // 
 // Tests import this module for the public surface; they may also
-// import lib/tool-registry.js for low-level test hooks.
+// import host/tool-registry.js for low-level test hooks.
 // 
-// Packaging: package.json ships tools/*.js and lib/tool-registry.js.
+// Packaging: package.json ships tools/*.js and host/tool-registry.js.
 // The file intentionally stays tiny so handler modules remain the
 // only place where a tool is defined.
 // Keep this comment and the re-export list in sync when adding tools.
@@ -20,7 +21,7 @@
 // 
 // The registration aggregator, guards, rate limits, spawn backoff,
 // repository preparation, discovery helpers, and verb helpers live in
-// lib/tool-registry.js. This module only re-exports the public entry
+// host/tool-registry.js. This module only re-exports the public entry
 // points consumed by the Host plugin, tests, and docs generators.
 // 
 // Design rules:
@@ -30,10 +31,10 @@
 // - no business logic in this file;
 // - keep the surface stable for index.js and tests.
 // 
-// See docs/architecture/overview.md and lib/tool-registry.js.
+// See docs/architecture/overview.md and host/tool-registry.js.
 // Tower tool surface: thin public wiring (#56 P5).
-// Registration and shared machinery live in lib/tool-registry.js; one handler
+// Registration and shared machinery live in host/tool-registry.js; one handler
 // module per tool lives under tools/. This file only exposes the public entry
 // points consumed by the Host plugin, tests, and documentation generators.
-export { registerTowerTools, __testSpawnBackoff } from '../lib/tool-registry.js'
-export { workerBriefing, reviewerBriefing } from '../lib/briefing.js'
+export { registerTowerTools, __testSpawnBackoff } from '../host/tool-registry.js'
+export { workerBriefing, reviewerBriefing } from '../app/briefing.js'

package/tools/init.js

@@ -1,18 +1,15 @@
 // tower_init: repository initialization.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
-import { resolveRepo } from '../lib/git.js'
-import { runtimeConfig } from '../lib/config.js'
 import { InitInput } from '../domain/contracts/tool-inputs/index.js'
 import { isTowerRole, isUnknownRole } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any, workspaceHook: any, ensureRepository: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, workspaceHook: any, ensureRepository: any, resolveRepo: any, runtimeConfig: any }} deps
  */
 export function registerInitTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor, workspaceHook, ensureRepository } = deps
+  const { define, actorFor, requireTowerActor, workspaceHook, ensureRepository, resolveRepo, runtimeConfig } = deps
   define(ctx, {
     name: 'tower_init',
     description:
@@ -31,7 +28,7 @@ export function registerInitTool(ctx, deps) {
           args.autoGitInit === true || (args.autoGitInit === undefined && profileInit.autoGitInit === true)
         repo = await ensureRepository(args.repoRoot, autoGitInit)
       }
-      const tower = await Tower.open(repo.root)
+      const tower = await deps.openTower(repo.root)
       const initConfig = tower.config.init ?? {}
       const snapshotDirty =
         args.snapshotDirty === true || (args.snapshotDirty === undefined && initConfig.snapshotDirty === true)

package/tools/interrupt.js

@@ -8,14 +8,13 @@
 // Roster state policy is pure and lives in domain/collab.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_interrupt: interrupt one running roster agent.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { InterruptInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any, interruptRosterAgent: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, interruptRosterAgent: any }} deps
  */
 export function registerInterruptTool(ctx, deps) {
   const { define, actorFor, requireTowerActor, interruptRosterAgent } = deps
@@ -27,7 +26,7 @@ export function registerInterruptTool(ctx, deps) {
     aliases: { agentId: ['agent_id'] },
     output: output(SCHEMAS.interrupt),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'interrupt tower agents')
       if (!args.to && !args.agentId) throw new TowerToolError('invalid-argument', 'tower_interrupt requires to (roster name) or agentId')

package/tools/legacy-map.js

@@ -8,19 +8,17 @@
 // Pure mapping validation lives in the domain legacy layer.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_legacy_map: audit-only legacy snapshot mapping.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
-import { validateLegacyMap } from '../lib/legacy.js'
 import { LegacyMapInput } from '../domain/contracts/tool-inputs/index.js'
 import { LEGACY_MAP_ACTION } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, validateLegacyMap: any }} deps
  */
 export function registerLegacyMapTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor } = deps
+  const { define, actorFor, requireTowerActor, validateLegacyMap } = deps
   define(ctx, {
     name: 'tower_legacy_map',
     description:
@@ -28,7 +26,7 @@ export function registerLegacyMapTool(ctx, deps) {
     parameters: LegacyMapInput,
     output: output(SCHEMAS.legacyMap),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       const state = await tower.load()
       if (args.action === LEGACY_MAP_ACTION.status) {

package/tools/merge.js

@@ -9,15 +9,15 @@
 // The pure intent/shape decisions live in domain/integration.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_merge: merge a mission branch into the recorded base.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { MergeInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any, observeActivity: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, observeActivity: any }} deps
  */
 export function registerMergeTool(ctx, deps) {
+  // openTower is injected by the composition root (#69).
   const { define, actorFor, requireTowerActor, observeActivity } = deps
   define(ctx, {
     name: 'tower_merge',
@@ -29,7 +29,7 @@ export function registerMergeTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.merge),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'merge missions')
       const { activity, parentStatus } = await observeActivity(ctx, tower)

package/tools/mission.js

@@ -1,12 +1,11 @@
 // tower_mission: mission lifecycle updates.
-import { Tower } from '../app/tower.js'
 import { TowerToolError } from '../domain/errors.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { MissionInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireKnownActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireKnownActor: any }} deps
  */
 export function registerMissionTool(ctx, deps) {
   const { define, actorFor, requireKnownActor } = deps
@@ -19,7 +18,7 @@ export function registerMissionTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.mission),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireKnownActor(actor, 'tower_mission')
       return tower.mission({

package/tools/plan.js

@@ -10,17 +10,18 @@
 // Pure normalization and DAG policy live in domain/missions.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_plan: create missions.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
-import { assertPresetsAvailable } from '../lib/presets.js'
 import { PlanInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, assertPresetsAvailable: any }} deps
  */
 export function registerPlanTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor } = deps
+  // #70: preset validation is injected by the composition root, so this tool
+  // never imports host/ or adapters/ directly.
+  // openTower is injected by the composition root (#69).
+  const { define, actorFor, requireTowerActor, assertPresetsAvailable } = deps
   define(ctx, {
     name: 'tower_plan',
     description:
@@ -29,7 +30,7 @@ export function registerPlanTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.plan),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'plan missions')
       await assertPresetsAvailable(ctx, tower.config)

package/tools/preflight.js

@@ -1,12 +1,11 @@
 // tower_preflight: read-only merge gate digest.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { classifyError } from '../domain/errors.js'
 import { PreflightInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, observeActivity: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, observeActivity: any }} deps
  */
 export function registerPreflightTool(ctx, deps) {
   const { define, observeActivity } = deps
@@ -19,7 +18,7 @@ export function registerPreflightTool(ctx, deps) {
     requiresMissionId: true,
     output: output(SCHEMAS.preflight),
     async execute(args) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const { activity, parentStatus } = await observeActivity(ctx, tower)
       const gate = await tower.evaluateGate({ missionId: args.missionId, activity, parentStatus })
       return {

package/tools/rebase.js

@@ -9,15 +9,15 @@
 // Pure intent/waiver decisions live in domain/integration.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_rebase: rebase a mission branch inside its worktree.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { RebaseInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any, observeActivity: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, observeActivity: any }} deps
  */
 export function registerRebaseTool(ctx, deps) {
+  // openTower is injected by the composition root (#69).
   const { define, actorFor, requireTowerActor, observeActivity } = deps
   define(ctx, {
     name: 'tower_rebase',
@@ -29,7 +29,7 @@ export function registerRebaseTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.rebase),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'rebase missions')
       const { activity } = await observeActivity(ctx, tower)

package/tools/recover.js

@@ -1,31 +1,39 @@
 // tower_recover: explicit stale state-lock diagnostics/repair.
-import { Tower } from '../app/tower.js'
-import { readStateLock } from '../lib/store.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
-import { fsp } from '../adapters/store-fs.js'
 import { RecoverInput } from '../domain/contracts/tool-inputs/index.js'
 import { RECOVERY_ACTION, RECOVERY_CONFIRM, ROLE } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, readStateLock: any, lockTiming: any }} deps
  */
 export function registerRecoverTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor } = deps
+  const { define, actorFor, requireTowerActor, readStateLock, lockTiming } = deps
   define(ctx, {
     name: 'tower_recover',
     description:
-      'Read-only recovery diagnostics and an explicit stale-state-lock repair. status reports the state lock owner; clear-stale-lock requires confirm:"CLEAR_STALE_LOCK" and only moves a lock whose PID is provably dead to a backup file. It never resets Tower state or worktrees.',
+      'Read-only recovery diagnostics and an explicit stale-state-lock repair. status reports the state lock owner with its age, heartbeat age and staleness; clear-stale-lock requires confirm:"CLEAR_STALE_LOCK" and only moves a lock whose PID is provably dead to a backup file. force:true additionally clears a live-but-silent PID (a recycled PID) and still renames the record to a .recovered-<ts> backup. It never resets Tower state or worktrees.',
     parameters: RecoverInput,
     output: output(SCHEMAS.recover),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'recover Tower state')
-      const lock = await readStateLock(tower.paths)
+      const now = Date.now()
+      const lock = await readStateLock(tower.paths, { now })
+      const timing = lockTiming(lock.record, { now })
       const publicLock = lock.record
-        ? { pid: lock.record.pid ?? null, startedAt: lock.record.startedAt ?? null, at: lock.record.at ?? null, alive: lock.alive }
+        ? {
+            pid: lock.record.pid ?? null,
+            startedAt: lock.record.startedAt ?? null,
+            at: lock.record.at ?? null,
+            alive: lock.alive,
+            ageMs: timing.ageMs,
+            heartbeatAgeMs: timing.heartbeatAgeMs,
+            staleAfterMs: timing.staleAfterMs,
+            stale: timing.stale,
+          }
         : null
       if (args.action === RECOVERY_ACTION.status) {
         return { ok: true, action: RECOVERY_ACTION.status, stateLock: publicLock, cleared: false }
@@ -34,12 +42,29 @@ export function registerRecoverTool(ctx, deps) {
         throw new TowerToolError('invalid-argument', 'clear-stale-lock requires confirm:"CLEAR_STALE_LOCK"')
       }
       if (!lock.record) return { ok: true, action: RECOVERY_ACTION.clearStaleLock, stateLock: null, cleared: false }
-      if (lock.alive !== false) {
-        throw new TowerToolError('state-locked', `state lock pid ${lock.record.pid ?? ROLE.unknown} is still alive; refusing to clear it`)
+      const forced = args.force === true
+      if (lock.alive !== false && !forced) {
+        // A live PID is not proof of a live writer (#92): report the heartbeat
+        // and require the explicit force opt-in before moving the record.
+        throw new TowerToolError(
+          'state-locked',
+          `state lock pid ${lock.record.pid ?? ROLE.unknown} is still alive (last heartbeat ${timing.heartbeatAgeMs ?? 'unknown'}ms ago, stale after ${timing.staleAfterMs}ms); pass force:true with confirm:"CLEAR_STALE_LOCK" to move it to a backup after confirming no writer is active`,
+        )
       }
+      // Always rename, never unlink: the recovered bytes stay auditable. Use the
+      // plain port primitive, not `renameWithRetry`: the retrying helper has
+      // temp-file semantics and unlinks its source when the rename finally
+      // fails, which would destroy the record we are trying to preserve.
       const backup = `${tower.paths.lock}.recovered-${Date.now()}`
-      await fsp.rename(tower.paths.lock, backup)
-      return { ok: true, action: RECOVERY_ACTION.clearStaleLock, stateLock: publicLock, cleared: true, backup }
+      await tower.deps.store.rename(tower.paths.lock, backup)
+      return {
+        ok: true,
+        action: RECOVERY_ACTION.clearStaleLock,
+        stateLock: publicLock,
+        cleared: true,
+        backup,
+        forced,
+      }
     },
   })
 }