dsh-tower 2.3.0 → 2.4.0

package/domain/config/schema.js

@@ -33,7 +33,10 @@ export const DEFAULT_DENY_TOOLS = [
 ]
 
 const LEGACY_KEYS = ['section', 'allowAgentControl']
-const GROUP_KEYS = ['init', 'mode', 'review', 'merge', 'git', 'worktrees', 'spawn', 'send', 'tests', 'gates', 'docs', 'archive', 'leases', 'dev', 'tools']
+// #121: the `tools` group is gone. Every capability that used to be a
+// `tools.expose*` boolean is now a component row in `cordis.patch.yml`, and a
+// component row is the switch. What remains here is genuine tuning policy.
+const GROUP_KEYS = ['init', 'mode', 'review', 'merge', 'git', 'worktrees', 'spawn', 'send', 'tests', 'gates', 'docs', 'archive', 'leases', 'dev']
 
 const SECTION_KEYS = {
   init: ['autoGitInit', 'snapshotDirty', 'autoExclude'],
@@ -75,9 +78,8 @@ const SECTION_KEYS = {
   gates: ['requireChecks', 'requireTests', 'allowReviewExemption', 'maxReportBytes'],
   docs: ['board', 'boardLocation'],
   archive: ['enabled', 'afterDays', 'maxMissions'],
-  tools: ['exposeOperational', 'exposeBatch', 'exposeImport', 'exposeLeases', 'exposeTests', 'exposeRecovery', 'exposeDoctor'],
   leases: ['ttlMs'],
-  dev: ['hotReload', 'reloadDelayMs', 'reloadRequiredIds'],
+  dev: ['reloadDelayMs', 'reloadRequiredIds'],
 }
 
 const MODEL_KEYS = ['provider', 'model', 'reasoningEffort', 'maxTokens']
@@ -261,30 +263,16 @@ export const Config = Schema.object({
   })
     .default({})
     .description('Terminal-mission archival policy. Archived missions are moved, never deleted.'),
-  tools: Schema.object({
-    exposeOperational: Schema.boolean()
-      .default(true)
-      .description('Master switch for batch/resource/import/legacy/recover/test/doctor tools.'),
-    exposeBatch: Schema.boolean().default(true).description('Register tower_batch.'),
-    exposeImport: Schema.boolean().default(true).description('Register tower_import_legacy/tower_legacy_map.'),
-    exposeLeases: Schema.boolean().default(true).description('Register tower_resource advisory leases.'),
-    exposeTests: Schema.boolean().default(true).description('Register tower_test; gates.requireTests requires it.'),
-    exposeRecovery: Schema.boolean().default(true).description('Register tower_recover (stale state-lock escape).'),
-    exposeDoctor: Schema.boolean().default(true).description('Register tower_doctor (read-only health contract).'),
-  })
-    .default({})
-    .description('Tool-surface policy.'),
   leases: Schema.object({
     ttlMs: Schema.natural().min(1000).max(86400000).default(900000).description('Default advisory lease lifetime; expiry never auto-releases.'),
   })
     .default({})
     .description('Advisory resource leases.'),
   dev: Schema.object({
-    hotReload: Schema.boolean().default(true).description('Register tower_reload and /tower reload when the DSH HMR service is available.'),
     reloadDelayMs: Schema.natural().min(1).max(5000).default(50).description('Delay before a scheduled reload, so the tool result is delivered first.'),
     reloadRequiredIds: Schema.array(Schema.string())
-      .default(['tower-bundle', 'tower', 'tower-skills', 'preset-tower-worker', 'preset-tower-reviewer'])
-      .description('Loader entry ids passed to reconcileProfile as required.'),
+      .default(['tower', 'tower-host', 'preset-tower-worker'])
+      .description('Loader entry ids passed to reconcileProfile as required. Optional component rows are deliberately not required, so a row switched off is not a reload failure.'),
   })
     .default({})
     .description('Development and hot-reload behavior.'),
@@ -314,14 +302,23 @@ export function configSurface(config = Config) {
   return { keys, sections, count: keys.length }
 }
 
+/** @param {any} value */
 export function clone(value) {
   return value === undefined ? undefined : JSON.parse(JSON.stringify(value))
 }
 
+/**
+ * @param {any} value
+ * @returns {boolean}
+ */
 export function isPlainObject(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value)
 }
 
+/**
+ * @param {any} base
+ * @param {any} override
+ */
 export function deepMerge(base, override) {
   if (override === undefined) return clone(base) ?? {}
   if (!isPlainObject(base) || !isPlainObject(override)) return clone(override)
@@ -350,6 +347,10 @@ export function normalizeLegacy(raw = {}) {
   return out
 }
 
+/**
+ * @param {any} value
+ * @param {string} label
+ */
 function assertModelKeys(value, label) {
   const bad = Object.keys(value).filter((key) => !MODEL_KEYS.includes(key))
   if (bad.length > 0) {
@@ -357,12 +358,16 @@ function assertModelKeys(value, label) {
   }
 }
 
+/**
+ * @param {any} raw
+ * @param {string} label
+ */
 export function assertKnownKeys(raw, label) {
   const unknown = Object.keys(raw).filter((key) => !LEGACY_KEYS.includes(key) && !GROUP_KEYS.includes(key))
   if (unknown.length > 0) {
     throw new TowerToolError(
       'config-unknown-key',
-      `${label} has unknown key(s) ${unknown.join(', ')} — config is { section?, allowAgentControl?, init?, mode?, review?, merge?, git?, worktrees?, spawn?, send?, tests?, gates?, docs?, archive?, leases?, dev?, tools? }`,
+      `${label} has unknown key(s) ${unknown.join(', ')} — config is { section?, allowAgentControl?, init?, mode?, review?, merge?, git?, worktrees?, spawn?, send?, tests?, gates?, docs?, archive?, leases?, dev? }`,
     )
   }
   for (const [group, allowed] of Object.entries(SECTION_KEYS)) {
@@ -387,7 +392,11 @@ export function assertKnownKeys(raw, label) {
 
 const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
 
-/** Reject prototype-pollution style keys anywhere in a repository config. */
+/**
+ * Reject prototype-pollution style keys anywhere in a repository config.
+ * @param {any} value
+ * @param {string} label
+ */
 export function assertSafeKeys(value, label) {
   if (Array.isArray(value)) {
     for (const item of value) assertSafeKeys(item, label)
@@ -402,6 +411,7 @@ export function assertSafeKeys(value, label) {
   }
 }
 
+/** @param {any} [rawConfig] */
 export function resolveTowerConfig(rawConfig) {
   const raw = rawConfig ?? {}
   if (raw !== null && typeof raw !== 'object') throw new TowerToolError('config-invalid', 'Tower config must be an object')
@@ -413,11 +423,12 @@ export function resolveTowerConfig(rawConfig) {
     throw new TowerToolError('config-invalid', `Tower config is invalid: ${String(error?.message ?? error)}`)
   }
   const mode = clone(parsed.mode ?? {})
-  if (parsed.gates?.requireTests === true) {
-    const testsAvailable = parsed.tests?.enabled !== false && parsed.tools?.exposeOperational !== false && parsed.tools?.exposeTests !== false
-    if (!testsAvailable) {
-      throw new TowerToolError('config-invalid', 'Tower config is invalid: gates.requireTests is true but test discovery is disabled (tests.enabled/tools.exposeTests)')
-    }
+  if (parsed.gates?.requireTests === true && parsed.tests?.enabled === false) {
+    // #121: the tower-tests *component row* is the capability switch now; a
+    // repository that turns the row off cannot satisfy gates.requireTests. The
+    // component-level half of this invariant is enforced at plan/mode entry,
+    // where the mounted rows are known (host/presets.js).
+    throw new TowerToolError('config-invalid', 'Tower config is invalid: gates.requireTests is true but test discovery is disabled (tests.enabled:false)')
   }
   // Canonical keys win; the legacy top-level aliases only fill gaps.
   const rawMode = raw.mode ?? {}
@@ -444,7 +455,6 @@ export function resolveTowerConfig(rawConfig) {
     gates: clone(parsed.gates ?? {}),
     docs: clone(parsed.docs ?? {}),
     archive: clone(parsed.archive ?? {}),
-    tools: clone(parsed.tools ?? {}),
     leases: clone(parsed.leases ?? {}),
     dev: clone(parsed.dev ?? {}),
   }

package/domain/contracts/outputs.js

@@ -4,7 +4,12 @@ const S = {
   str: { type: 'string' },
   int: { type: 'integer' },
   bool: { type: 'boolean' },
+  /** @param {any} items */
   arr: (items) => ({ type: 'array', items }),
+  /**
+   * @param {Record<string, any>} [properties]
+   * @param {string[]} [required]
+   */
   obj: (properties = {}, required = []) => ({ type: 'object', properties, required, additionalProperties: true }),
   any: {},
 }
@@ -298,10 +303,15 @@ const SCHEMAS = {
   legacyMap: S.obj({ ok: S.bool, map: S.obj(), maps: S.arr(S.obj()) }, ['ok']),
 }
 
+/**
+ * @param {any} _args
+ * @param {any} value
+ */
 function renderValue(_args, value) {
   return [{ type: 'text', text: JSON.stringify(value, null, 2) }]
 }
 
+/** @param {any} schema */
 function output(schema) {
   return { schema, render: renderValue }
 }

package/domain/errors.js

@@ -24,6 +24,12 @@
 
 /** Neutral error type shared by the git adapter and the domain classifier. */
 export class GitError extends Error {
+  /**
+   * @param {string[]} args
+   * @param {string} detail
+   * @param {number | undefined} code the child-process errno, not a Tower code
+   * @param {{ timedOut?: boolean, bufferOverflow?: boolean, stdout?: string }} [meta]
+   */
   constructor(args, detail, code, meta = {}) {
     super(`git ${args.join(' ')} failed: ${detail}`)
     this.name = 'GitError'
@@ -327,11 +333,15 @@ export class TowerToolError extends Error {
   }
 }
 
+/** @param {any} error */
 function originalMessage(error) {
   return String(error?.message ?? error)
 }
 
-/** Wrap any thrown value into a TowerToolError with a stable code. */
+/**
+ * Wrap any thrown value into a TowerToolError with a stable code.
+ * @param {any} error
+ */
 export function classifyError(error) {
   if (error instanceof TowerToolError) return error
   if (error && typeof error.code === 'string' && ERROR_CODES[error.code]) {

package/domain/mission.js

@@ -12,7 +12,18 @@ export const MISSION_STATUSES = ['planned', 'active', 'completed', 'blocked', 'p
 export const SCHEMA_VERSION = 3
 /** @type {readonly MergeVerdict[]} */
 export const MERGE_VERDICTS = ['merge', 'fix-then-merge', 'hold']
-export const REVIEW_STATUS_RE = /^(clean|p1-\d+items|p2-\d+items)$/
+// #115: the review status vocabulary is one runtime source. The validator
+// accepts any positive item count (`p1-7items`), while the published
+// `ReviewStatus` type is generated from REVIEW_STATUS_ITEMS, which fixes the
+// documented 1..5 range so a consumer sees a closed union.
+export const REVIEW_STATUS_PRIORITIES = ['p1', 'p2']
+export const REVIEW_STATUS_ITEMS = [1, 2, 3, 4, 5]
+/** @type {readonly string[]} */
+export const REVIEW_STATUSES = [
+  'clean',
+  ...REVIEW_STATUS_PRIORITIES.flatMap((priority) => REVIEW_STATUS_ITEMS.map((count) => `${priority}-${count}items`)),
+]
+export const REVIEW_STATUS_RE = new RegExp(`^(?:clean|(?:${REVIEW_STATUS_PRIORITIES.join('|')})-\\d+items)$`)
 /** @type {ReadonlySet<string>} */
 export const TERMINAL_STATUSES = new Set(['merged', 'abandoned'])
 /** @type {readonly FindingType[]} */

package/domain/surface.js

@@ -9,9 +9,19 @@
 //
 // This module is pure: no fs, no git. `scripts/surface-baseline.mjs` supplies
 // the live counts and the file reads; `scripts/lib/surface.mjs` wraps them.
+//
+// Since #120 `components` is a fourth surface: the number of user-visible
+// component rows in `cordis.patch.yml`. That is what makes a contraction (the
+// 2.3.0 4 -> 1 group row) and the coming #121 growth require a written decision
+// instead of arriving quietly.
 export const SURFACE_BASELINE_FILE = 'scripts/surface-baseline.json'
 export const SURFACE_CLASSIFICATION_FILE = 'docs/reference/surface-budget.md'
-export const SURFACE_KEYS = ['configKeys', 'sections', 'tools']
+export const SURFACE_KEYS = ['configKeys', 'sections', 'tools', 'components']
+// A count in this list is two-way: a contraction needs a decision record just
+// like growth does. The component surface is where the failure actually
+// happened (4 top-level rows -> 1 group row), so "a reduction is cheap" is
+// exactly the policy hole #120 closes.
+export const SURFACE_TWO_WAY_KEYS = ['components']
 export const CONFIG_CLASSES = ['core', 'tuning', 'niche']
 export const TOOL_CLASSES = ['core', 'optional']
 export const SURFACE_SCHEMA_VERSION = 1
@@ -178,71 +188,160 @@ export function validateClassification(markdown, liveNames, options = {}) {
 }
 
 /**
- * Validate a committed baseline against the live counts and its own decision
- * chain. This is the brake: `current[surface] !== entry.value` fails, and every
- * decision that grows a count must name an existing ADR or deletions that are
- * provably absent from the live surface.
+ * Validate an explicit measurement-correction decision (#118).
  *
- * @param {ReturnType<typeof parseBaseline>} baseline
- * @param {{ configKeys: number, sections: number, tools: number, liveNames: { configKeys: string[], sections: string[], tools: string[] } }} current
+ * A correction says the live surface did not grow: the earlier measurement
+ * missed a registration path. It is deliberately narrower than an ADR — it only
+ * authorizes the written `from`/`to` step it carries, needs a reason and a date,
+ * and (when it names a `ref`) that reference must resolve. A later count change
+ * still needs its own decision, so the brake stays strict.
+ *
+ * @returns {boolean} true when the correction is valid evidence for the growth
+ */
+function correctionEvidence(decision, where, record, exists) {
+  if (decision.correction === undefined) return false
+  if (!isPlainObject(decision.correction)) {
+    record('correction-invalid', `${where}.correction must be an object with a reason and a date`)
+    return false
+  }
+  const correction = decision.correction
+  const reason = typeof correction.reason === 'string' ? correction.reason.trim() : ''
+  if (!reason) {
+    record('correction-invalid', `${where}.correction needs a non-empty reason explaining why the measurement changed`)
+  }
+  const date = correction.date ?? decision.date
+  const dateOk = typeof date === 'string' && ISO_DATE.test(date)
+  if (!dateOk) {
+    record('correction-invalid', `${where}.correction needs a date (YYYY-MM-DD)`)
+  } else if (typeof decision.date === 'string' && date !== decision.date) {
+    record('correction-invalid', `${where}.correction.date ${date} does not match the decision date ${decision.date}`)
+  }
+  let refOk = true
+  if (correction.ref !== undefined) {
+    const ref = typeof correction.ref === 'string' ? correction.ref.trim().replace(/\\/g, '/') : ''
+    if (!ref) {
+      record('correction-invalid', `${where}.correction.ref must be a repository path when present`)
+      refOk = false
+    } else if (!ref.startsWith('docs/') || !ref.endsWith('.md')) {
+      record('correction-invalid', `${where}.correction.ref must name a docs/*.md record, got ${ref}`)
+      refOk = false
+    } else if (!exists(ref)) {
+      record('correction-invalid', `${where}.correction.ref ${ref} does not exist`)
+      refOk = false
+    }
+  }
+  return reason.length > 0 && dateOk && refOk
+}
+
+/**
+ * Validate one surface entry against its live count and its decision chain. This
+ * is the brake: `live !== entry.value` fails, and every decision that grows a
+ * count must name an existing ADR, deletions that are provably absent from the
+ * live surface, or a valid measurement-correction record.
+ *
+ * A two-way surface (see SURFACE_TWO_WAY_KEYS) also refuses a contraction whose
+ * new count is not reached by a decision record; the other surfaces keep the
+ * "a reduction is cheap" rule from ADR 0004.
+ *
+ * Extracted from `validateBaseline` so a narrower gate (`docs:check:components`,
+ * #120) can validate just the component count without re-measuring the others.
+ *
+ * @param {string} key one of SURFACE_KEYS
+ * @param {{ seed: number, value: number, decisions: any[] }} entry
+ * @param {number} live
+ * @param {string[]} liveNames
  * @param {{ exists?: (relativePath: string) => boolean }} [options]
  * @returns {Array<{ code: string, level: string, message: string }>}
  */
-export function validateBaseline(baseline, current, options = {}) {
+export function validateSurfaceEntry(key, entry, live, liveNames, options = {}) {
   const exists = options.exists ?? (() => false)
   const findings = []
   const record = (code, message) => findings.push({ code, level: 'error', message })
-
-  for (const key of SURFACE_KEYS) {
-    const entry = baseline.surfaces[key]
-    const live = current[key]
-    if (!Number.isInteger(live)) {
-      record('surface-missing', `live ${key} count is unavailable`)
-      continue
+  if (!Number.isInteger(live)) {
+    record('surface-missing', `live ${key} count is unavailable`)
+    return findings
+  }
+  if (live !== entry.value) {
+    const direction = live > entry.value ? 'grew' : 'shrank'
+    record(
+      'stale-baseline',
+      `${key} ${direction} from the committed baseline ${entry.value} to ${live}; update ${SURFACE_BASELINE_FILE} with an ADR or a deletion record before landing`,
+    )
+  }
+  let running = entry.seed
+  entry.decisions.forEach((decision, index) => {
+    const where = `${key}.decisions[${index}]`
+    if (decision.from !== running) {
+      record('broken-chain', `${where}.from ${decision.from} does not continue from ${running}`)
     }
-    if (live !== entry.value) {
-      const direction = live > entry.value ? 'grew' : 'shrank'
-      record(
-        'stale-baseline',
-        `${key} ${direction} from the committed baseline ${entry.value} to ${live}; update ${SURFACE_BASELINE_FILE} with an ADR or a deletion record before landing`,
-      )
+    if (decision.date !== undefined && !ISO_DATE.test(String(decision.date))) {
+      record('broken-chain', `${where}.date is not YYYY-MM-DD`)
     }
-    let running = entry.seed
-    entry.decisions.forEach((decision, index) => {
-      const where = `${key}.decisions[${index}]`
-      if (decision.from !== running) {
-        record('broken-chain', `${where}.from ${decision.from} does not continue from ${running}`)
-      }
-      if (decision.date !== undefined && !ISO_DATE.test(String(decision.date))) {
-        record('broken-chain', `${where}.date is not YYYY-MM-DD`)
-      }
-      const growth = decision.to - decision.from
-      if (growth > 0) {
-        const deletions = Array.isArray(decision.deletions)
-          ? decision.deletions.filter((name) => typeof name === 'string' && name.trim()).map((name) => name.trim())
-          : []
-        const adr = typeof decision.adr === 'string' && decision.adr.trim() ? decision.adr.trim().replace(/\\/g, '/') : null
-        const adrExists = Boolean(adr) && adr.startsWith('docs/adr/') && adr.endsWith('.md') && exists(adr)
-        const liveNames = new Set(current.liveNames?.[key] ?? [])
-        const stillLive = deletions.filter((name) => liveNames.has(name))
-        const deletionEvidence = deletions.length >= growth && stillLive.length === 0
-        if (!adrExists && !deletionEvidence) {
-          const reasons = []
-          if (adr && !adrExists) reasons.push(`ADR ${adr} does not exist under docs/adr/`)
-          if (deletions.length === 0) reasons.push('no deletions recorded')
-          else if (stillLive.length > 0) reasons.push(`deleted name(s) are still in the live surface: ${stillLive.join(', ')}`)
-          else if (deletions.length < growth) reasons.push(`only ${deletions.length} deletion(s) for a growth of ${growth}`)
-          record('growth-without-evidence', `${where} grows ${key} by ${growth} without an ADR or a matching deletion (${reasons.join('; ')})`)
-        }
+    const growth = decision.to - decision.from
+    if (growth > 0) {
+      const deletions = Array.isArray(decision.deletions)
+        ? decision.deletions.filter((name) => typeof name === 'string' && name.trim()).map((name) => name.trim())
+        : []
+      const adr = typeof decision.adr === 'string' && decision.adr.trim() ? decision.adr.trim().replace(/\\/g, '/') : null
+      const adrExists = Boolean(adr) && adr.startsWith('docs/adr/') && adr.endsWith('.md') && exists(adr)
+      const liveSet = new Set(liveNames ?? [])
+      const stillLive = deletions.filter((name) => liveSet.has(name))
+      const deletionEvidence = deletions.length >= growth && stillLive.length === 0
+      const correction = correctionEvidence(decision, where, record, exists)
+      if (!adrExists && !deletionEvidence && !correction) {
+        const reasons = []
+        if (adr && !adrExists) reasons.push(`ADR ${adr} does not exist under docs/adr/`)
+        if (deletions.length === 0) reasons.push('no deletions recorded')
+        else if (stillLive.length > 0) reasons.push(`deleted name(s) are still in the live surface: ${stillLive.join(', ')}`)
+        else if (deletions.length < growth) reasons.push(`only ${deletions.length} deletion(s) for a growth of ${growth}`)
+        if (decision.correction !== undefined && !correction) reasons.push('the correction record is invalid')
+        record('growth-without-evidence', `${where} grows ${key} by ${growth} without an ADR, a matching deletion or a valid correction (${reasons.join('; ')})`)
       }
-      running = decision.to
-    })
-    if (running !== entry.value && !(entry.decisions.length === 0 && entry.value < running)) {
-      record(
-        'broken-chain',
-        `${key} value ${entry.value} does not match the last decision (${running}); every count change needs a decision record`,
-      )
     }
+    running = decision.to
+  })
+  const twoWay = SURFACE_TWO_WAY_KEYS.includes(key)
+  if (running !== entry.value && !(entry.decisions.length === 0 && entry.value < running && !twoWay)) {
+    record(
+      'broken-chain',
+      `${key} value ${entry.value} does not match the last decision (${running}); every count change needs a decision record`,
+    )
   }
   return findings
 }
+
+/**
+ * Validate the whole committed baseline. Every surface in SURFACE_KEYS is
+ * checked, so a missing `current` entry is a `surface-missing` finding.
+ *
+ * @param {ReturnType<typeof parseBaseline>} baseline
+ * @param {{ configKeys: number, sections: number, tools: number, components: number, liveNames: { configKeys: string[], sections: string[], tools: string[], components: string[] } }} current
+ * @param {{ exists?: (relativePath: string) => boolean }} [options]
+ * @returns {Array<{ code: string, level: string, message: string }>}
+ */
+export function validateBaseline(baseline, current, options = {}) {
+  const findings = []
+  for (const key of SURFACE_KEYS) {
+    findings.push(...validateSurfaceEntry(key, baseline.surfaces[key], current[key], current.liveNames?.[key], options))
+  }
+  return findings
+}
+
+/**
+ * Validate one surface entry of the committed baseline (the narrower form used
+ * by `docs:check:components`).
+ *
+ * @param {ReturnType<typeof parseBaseline>} baseline
+ * @param {string} key
+ * @param {Record<string, any>} current
+ * @param {{ exists?: (relativePath: string) => boolean }} [options]
+ * @returns {Array<{ code: string, level: string, message: string }>}
+ */
+export function validateSurfaceBaselineKey(baseline, key, current, options = {}) {
+  if (!SURFACE_KEYS.includes(key)) {
+    throw surfaceError(`surface ${key} is not one of ${SURFACE_KEYS.join('/')}`)
+  }
+  const entry = baseline.surfaces[key]
+  if (!entry) throw surfaceError(`surface baseline has no "${key}" entry`)
+  return validateSurfaceEntry(key, entry, current[key], current.liveNames?.[key], options)
+}

package/host/capability-batch.js

@@ -0,0 +1,15 @@
+// tower-batch component entry (#121): evidence batches only.
+//
+// Each optional capability is its own loader row, so switching this component
+// off removes exactly `tower_batch` and leaves the rest of Tower working. The
+// row is declared in cordis.patch.yml; the package export is `./batch`.
+import { holdComponent } from './capability-registry.js'
+import { registerBatchCapability } from './tool-registry.js'
+
+export const name = 'dsh-tower/batch'
+export const inject = ['tools', 'tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-batch')
+  registerBatchCapability(ctx)
+}

package/host/capability-hmr.js

@@ -0,0 +1,30 @@
+// tower-hmr component entry (#121): dev hot reload, shipped off.
+//
+// The row defaults to `disabled: true` in cordis.patch.yml, because a profile
+// without HMR is the normal case and the capability only makes sense for linked
+// development installs. Switching the row on registers `tower_reload` and the
+// `/tower reload` branch; switching it off leaves both absent while
+// `tower_status` reports "disabled by component tower-hmr".
+import { createHmrBridge } from './hmr.js'
+import { runtimeConfig } from './config.js'
+import { clearHmrBridge, holdComponent, setHmrBridge } from './capability-registry.js'
+import { registerHmrCapability } from './tool-registry.js'
+
+export const name = 'dsh-tower/hmr'
+export const inject = ['tools', 'tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-hmr')
+  const dev = runtimeConfig().dev ?? {}
+  const bridge = createHmrBridge(ctx, {
+    requiredIds: dev.reloadRequiredIds,
+    delayMs: dev.reloadDelayMs,
+    logger: ctx.logger ?? console,
+  })
+  setHmrBridge(bridge)
+  ctx.effect(() => () => {
+    clearHmrBridge(bridge)
+    bridge.dispose()
+  })
+  registerHmrCapability(ctx, { bridge })
+}

package/host/capability-import.js

@@ -0,0 +1,11 @@
+// tower-import component entry (#121): legacy import and its audit map only.
+import { holdComponent } from './capability-registry.js'
+import { registerImportCapability } from './tool-registry.js'
+
+export const name = 'dsh-tower/import'
+export const inject = ['tools', 'tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-import')
+  registerImportCapability(ctx)
+}

package/host/capability-leases.js

@@ -0,0 +1,11 @@
+// tower-leases component entry (#121): advisory resource leases only.
+import { holdComponent } from './capability-registry.js'
+import { registerLeasesCapability } from './tool-registry.js'
+
+export const name = 'dsh-tower/leases'
+export const inject = ['tools', 'tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-leases')
+  registerLeasesCapability(ctx)
+}