dsh-tower 2.3.0 → 2.4.1

package/host/capability-registry.js

@@ -0,0 +1,149 @@
+// Runtime view of the optional component rows (#121).
+//
+// The component rows in `cordis.patch.yml` are separate loader entries. A
+// capability row that is off simply never runs `apply()`, so the host cannot
+// ask a disabled plugin to report itself. This module is the small shared
+// registry the capability entry points write into and the read-only reporters
+// (`tower_status`, `tower_doctor`) read back. An absent entry is a disabled
+// component, reported with the exact "disabled by component <id>" wording the
+// acceptance contract asks for, never a silent absence.
+//
+// The registry is process-local and reference-counted: a capability entry point
+// registers on apply and unregisters through its `ctx.effect` disposer, so an
+// HMR reload cannot leave a stale "enabled" claim behind. It is coordination,
+// not state: no file is written and no tool result depends on it except the
+// capability report itself.
+
+/** The visible optional component rows, in `cordis.patch.yml` order. */
+export const TOWER_COMPONENT_IDS = Object.freeze([
+  'tower-skills',
+  'tower-batch',
+  'tower-import',
+  'tower-leases',
+  'tower-tests',
+  'tower-hmr',
+  'preset-tower-reviewer',
+])
+
+/** Tool ids each code component owns; the preset row owns no tool. */
+export const COMPONENT_TOOLS = Object.freeze({
+  'tower-skills': Object.freeze([]),
+  'tower-batch': Object.freeze(['tower_batch']),
+  'tower-import': Object.freeze(['tower_import_legacy', 'tower_legacy_map']),
+  'tower-leases': Object.freeze(['tower_resource']),
+  'tower-tests': Object.freeze(['tower_test']),
+  'tower-hmr': Object.freeze(['tower_reload']),
+  'preset-tower-reviewer': Object.freeze([]),
+})
+
+/** id -> number of live registrations (redelivery/HMR can overlap briefly). */
+const active = new Map()
+
+/**
+ * Mark one component as mounted. IDEMPOTENT per call site: the reference count
+ * lets a brief double-mount during HMR stay "enabled" until the last disposer
+ * runs.
+ * @param {string} id
+ */
+export function registerComponent(id) {
+  if (!TOWER_COMPONENT_IDS.includes(id)) throw new TypeError(`unknown Tower component: ${id}`)
+  active.set(id, (active.get(id) ?? 0) + 1)
+}
+
+/** Drop one registration; a component is disabled when its count reaches 0. */
+export function unregisterComponent(id) {
+  const count = active.get(id) ?? 0
+  if (count <= 1) active.delete(id)
+  else active.set(id, count - 1)
+}
+
+/** True when a code component entry point is currently mounted. */
+export function componentEnabled(id) {
+  return (active.get(id) ?? 0) > 0
+}
+
+/** Register/unregister a component around one plugin's lifetime. */
+export function holdComponent(ctx, id) {
+  registerComponent(id)
+  if (typeof ctx?.effect === 'function') {
+    ctx.effect(() => () => unregisterComponent(id))
+  }
+  return () => unregisterComponent(id)
+}
+
+/** Test hook: process-local registry state must be reset per fixture. */
+export function __testResetComponentRegistry() {
+  active.clear()
+  sharedHmrBridge = null
+}
+
+/** The exact wording the acceptance contract uses for a missing capability. */
+export function disabledReason(id) {
+  return `disabled by component ${id}`
+}
+
+/** Reviewer-preset availability from the optional agent-presets service. */
+async function reviewerPresetAvailable(ctx) {
+  const service = ctx?.get?.('agentPresets')
+  if (!service || typeof service.list !== 'function') return null
+  try {
+    const presets = await service.list()
+    return Array.isArray(presets) && presets.some((entry) => String(entry?.id) === 'tower-reviewer')
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Report every optional component as enabled or disabled. The reviewer preset
+ * is not a code entry point: its row mounts an agent preset, so availability is
+ * read from `agentPresets` and reported as unknown (omitted) when that service
+ * is absent, exactly as the doctor's preset check does.
+ *
+ * @param {any} ctx
+ * @returns {Promise<{ enabled: string[], disabled: Array<{ id: string, reason: string }> }>}
+ */
+export async function componentReport(ctx) {
+  const enabled = []
+  const disabled = []
+  for (const id of TOWER_COMPONENT_IDS) {
+    if (id === 'preset-tower-reviewer') {
+      const available = await reviewerPresetAvailable(ctx)
+      if (available === false) disabled.push({ id, reason: disabledReason(id) })
+      else if (available === true) enabled.push(id)
+      continue
+    }
+    if (componentEnabled(id)) enabled.push(id)
+    else disabled.push({ id, reason: disabledReason(id) })
+  }
+  return { enabled, disabled }
+}
+
+// A capability plugin's `ctx.provide()` is visible to its descendants, not to
+// the parent host context that owns `/tower` and `tower_mode`. The hot-reload
+// bridge is a process singleton, so it is shared here rather than through a
+// service lookup the host could not see.
+let sharedHmrBridge = null
+
+/** Publish the mounted tower-hmr bridge for the host entry to read. */
+export function setHmrBridge(bridge) {
+  sharedHmrBridge = bridge
+}
+
+/** Clear the publication when the component unloads; never clear another bridge. */
+export function clearHmrBridge(bridge) {
+  if (sharedHmrBridge === bridge) sharedHmrBridge = null
+}
+
+/** The mounted tower-hmr bridge, or null when the component row is off. */
+export function currentHmrBridge() {
+  return sharedHmrBridge
+}
+
+/** One-line form used by `tower_status` and the doctor's `components` check. */
+export function componentSummary(report) {
+  if (!report || report.disabled.length === 0) {
+    return `${report?.enabled?.length ?? 0} optional component(s) enabled`
+  }
+  return report.disabled.map((entry) => entry.reason).join('; ')
+}

package/host/capability-tests.js

@@ -0,0 +1,16 @@
+// tower-tests component entry (#121): declared test discovery only.
+//
+// With this row off there is no `tower_test` tool and no receipt to satisfy
+// `gates.requireTests`; planning/mode entry refuse that combination with an
+// explanatory error (host/presets.js), and the merge gate still reports
+// `tests-missing` because no receipt can exist.
+import { holdComponent } from './capability-registry.js'
+import { registerTestsCapability } from './tool-registry.js'
+
+export const name = 'dsh-tower/tests'
+export const inject = ['tools', 'tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-tests')
+  registerTestsCapability(ctx)
+}

package/host/doctor.js

@@ -17,6 +17,7 @@ import { parseBaseline, surfaceLine, SURFACE_BASELINE_FILE } from '../domain/sur
 import { assessHostVersion, detectHostVersion, readCompatibility } from './compatibility.js'
 import { profileConfig } from './config.js'
 import { inspectWorkspaceLock } from '../adapters/workspaceLock.js'
+import { componentReport, componentSummary } from './capability-registry.js'
 
 const execFileAsync = promisify(execFile)
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
@@ -287,16 +288,32 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
         ),
   )
   const presets = ctx.get?.('agentPresets')
+  const reviewerRequired = config.review?.requireReview === true
   if (presets && typeof presets.list === 'function') {
     try {
       const available = (await presets.list()).map((entry) => String(entry.id))
-      const missing = [config.spawn?.workerPreset ?? 'tower-worker', config.spawn?.reviewerPreset ?? 'tower-reviewer']
-        .filter((id) => !available.includes(id))
-      checks.push(
-        missing.length === 0
-          ? check('presets', 'pass', `worker=${config.spawn?.workerPreset ?? 'tower-worker'} reviewer=${config.spawn?.reviewerPreset ?? 'tower-reviewer'}`)
-          : check('presets', 'fail', `missing preset(s): ${missing.join(', ')}`, 'enable the Tower preset bundle and retry'),
-      )
+      const worker = config.spawn?.workerPreset ?? 'tower-worker'
+      const reviewer = config.spawn?.reviewerPreset ?? 'tower-reviewer'
+      const required = reviewerRequired ? [worker, reviewer] : [worker]
+      const missing = required.filter((id) => !available.includes(id))
+      // #121: `preset-tower-reviewer` is a conditional component. Its off state
+      // is supported while review.requireReview is false; with the gate on it is
+      // a fail, because no independent review can be dispatched.
+      if (missing.length === 0) {
+        const reviewerNote = available.includes(reviewer)
+          ? `reviewer=${reviewer}`
+          : `reviewer=${reviewer} (disabled by component preset-tower-reviewer)`
+        checks.push(check('presets', 'pass', `worker=${worker} ${reviewerNote}`))
+      } else {
+        checks.push(
+          check(
+            'presets',
+            'fail',
+            `missing preset(s): ${missing.join(', ')}${reviewerRequired && missing.includes(reviewer) ? ' (review.requireReview is true, so preset-tower-reviewer may not be off)' : ''}`,
+            'enable the Tower preset component and retry',
+          ),
+        )
+      }
     } catch (error) {
       checks.push(check('presets', 'warn', `preset registry unavailable: ${String(error?.message ?? error)}`))
     }
@@ -304,6 +321,16 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
     checks.push(check('presets', 'warn', 'agentPresets service is unavailable'))
   }
 
+  // #121: the optional component rows are a diagnostic fact. A disabled row is
+  // reported with the exact "disabled by component <id>" reason rather than
+  // disappearing silently from the tool surface.
+  const components = await componentReport(ctx)
+  checks.push(
+    components.disabled.length > 0
+      ? check('components', 'warn', componentSummary(components), 'enable the reported row in the plugin page and restart DSH')
+      : check('components', 'pass', componentSummary(components)),
+  )
+
   const subagents = ctx.get?.('subagents')
   checks.push(subagents ? check('subagents', 'pass', 'service mounted') : check('subagents', 'fail', 'subagents service is unavailable', 'enable the subagent bundle'))
   const hmr = ctx.get?.('hmr')
@@ -399,11 +426,15 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
     )
 
     const testConfigured = state.missions?.some((mission) => mission.testRuns !== undefined)
+    const testsDisabled =
+      config.tests?.enabled === false || components.disabled.some((entry) => entry.id === 'tower-tests')
     checks.push(
       check(
         'tests',
-        config.tests?.enabled === false ? 'warn' : 'pass',
-        config.tests?.enabled === false ? 'test discovery disabled' : `admission=${config.tests?.admission ?? 'complete'} timeoutMs=${config.tests?.timeoutMs ?? 60000}${testConfigured ? '; receipts present' : ''}`,
+        testsDisabled ? 'warn' : 'pass',
+        testsDisabled
+          ? `test discovery disabled${config.tests?.enabled === false ? ' (tests.enabled:false)' : ' (disabled by component tower-tests)'}`
+          : `admission=${config.tests?.admission ?? 'complete'} timeoutMs=${config.tests?.timeoutMs ?? 60000}${testConfigured ? '; receipts present' : ''}`,
       ),
     )
     checks.push(check('legacy', 'pass', `${state.legacySnapshots?.length ?? 0} legacy snapshot(s)`))
@@ -520,6 +551,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
 // reports (from #89) and archive (from #73) are both kept
     reports: reportsReport,
     surface: surfaceReport,
+    components,
     archive: {
       missions: state ? state.missions.length : null,
       archivedMissions: archiveInventory.missions,

package/host/hmr.js

@@ -20,13 +20,11 @@
 //   one, so a tool-triggered reload is safe.
 import { TowerToolError } from '../domain/errors.js'
 
-/** Entry ids Tower expects to be active after a reconciliation. */
+/** Entry ids Tower expects to be active after a reconciliation (#121 rows). */
 export const DEFAULT_REQUIRED_IDS = Object.freeze([
-  'tower-bundle',
   'tower',
-  'tower-skills',
+  'tower-host',
   'preset-tower-worker',
-  'preset-tower-reviewer',
 ])
 
 /** Debounce window for the dev hot-reload hook (milliseconds). */

package/host/presets.js

@@ -1,5 +1,20 @@
-// Cross-field preset validation (#64): fail before work starts, not at spawn.
+// Cross-field preset and component validation (#64, #121): fail before work
+// starts, not at spawn.
+//
+// Two invariants travel with the optional rows:
+//
+//   1. `preset-tower-worker` is a mandatory dependency: planning, mode entry and
+//      spawn must refuse when the worker preset is absent.
+//   2. `preset-tower-reviewer` is a *conditional* component. It may be off while
+//      `review.requireReview` is false (merge is unaffected); with the review
+//      gate on it must be locked with an explanatory error, never silently
+//      allowed.
+//
+// `tower-tests` adds a third: with the component row off there is no
+// `tower_test` tool and no receipt, so `gates.requireTests: true` is refused
+// here rather than left to fail at merge time with a misleading blocker.
 import { TowerToolError } from '../domain/errors.js'
+import { componentEnabled, disabledReason } from './capability-registry.js'
 
 export function presetIds(config = {}) {
   return {
@@ -13,23 +28,50 @@ function rowId(preset) {
 }
 
 /**
- * Resolve both presets against the profile's agentPresets service. Fail closed
- * with preset-missing before mode entry/planning when a required preset is not
+ * Resolve the presets against the profile's agentPresets service. Fail closed
+ * with preset-missing before mode entry/planning when a *required* preset is not
  * registered. If the service is unavailable, doctor reports that separately and
  * this check cannot make a claim either way.
+ *
+ * The reviewer preset is required only when `review.requireReview` is true; the
+ * off state is otherwise supported by the component contract.
  */
 export async function assertPresetsAvailable(ctx, config = {}) {
   const service = ctx?.get?.('agentPresets')
   if (!service || typeof service.list !== 'function') return { checked: false, missing: [] }
   const presets = presetIds(config)
+  const required = [presets.worker]
+  if (config.review?.requireReview === true) required.push(presets.reviewer)
   const available = new Set((await service.list()).map((entry) => String(entry.id)))
-  const missing = [presets.worker, presets.reviewer].filter((id) => !available.has(id))
-  if (missing.length > 0) {
-    const rows = [...new Set(missing.map(rowId))]
+  const missing = required.filter((id) => !available.has(id))
+  if (missing.length === 0) return { checked: true, missing: [] }
+  const rows = [...new Set(missing.map(rowId))]
+  const reviewLock =
+    config.review?.requireReview === true && missing.includes(presets.reviewer)
+      ? ` review.requireReview is true, so the reviewer row may not be off; ${disabledReason(rowId(presets.reviewer))} is rejected`
+      : ''
+  throw new TowerToolError(
+    'preset-missing',
+    `required Tower agent preset(s) missing: ${missing.join(', ')}; re-enable ${rows.join(', ')} in the plugin page, then restart DSH.${reviewLock}`,
+  )
+}
+
+/**
+ * Every runtime invariant that depends on which component rows are mounted.
+ * Called before planning and before entering Tower mode, so a configuration
+ * that a component switch has invalidated is rejected with an explanation
+ * instead of failing later at merge time.
+ *
+ * @param {any} ctx
+ * @param {Record<string, any>} config
+ */
+export async function assertRuntimePreconditions(ctx, config = {}) {
+  const presets = await assertPresetsAvailable(ctx, config)
+  if (config.gates?.requireTests === true && !componentEnabled('tower-tests')) {
     throw new TowerToolError(
-      'preset-missing',
-      `required Tower agent preset(s) missing: ${missing.join(', ')}; re-enable ${rows.join(', ')} in the plugin page, then restart DSH`,
+      'config-invalid',
+      `gates.requireTests is true but ${disabledReason('tower-tests')}; re-enable the tower-tests component or set gates.requireTests:false`,
     )
   }
-  return { checked: true, missing: [] }
+  return presets
 }

package/host/tool-registry.js

@@ -18,7 +18,7 @@ import { git, resolveRepo, hasAnyCommit } from '../adapters/git.js'
 import { runtimeConfig } from './config.js'
 import { runDoctor } from './doctor.js'
 import { createHmrBridge } from './hmr.js'
-import { assertPresetsAvailable } from './presets.js'
+import { assertRuntimePreconditions } from './presets.js'
 import { readStateLock } from '../adapters/store.js'
 import { lockTiming } from '../adapters/persistence.js'
 import { acquireLease, releaseLease, inspectLeases } from '../adapters/leases.js'
@@ -53,6 +53,7 @@ import { registerFindingsTool } from '../tools/findings.js'
 import { readDiscoveryConfig, normalizeDiscovery, runDiscovery } from '../adapters/tests.js'
 import { summarize as summarizeBatch } from '../domain/batch.js'
 import { assertPorts } from '../ports/index.js'
+import { COMPONENT_TOOLS, componentEnabled, componentReport, holdComponent, disabledReason } from './capability-registry.js'
 import path from 'node:path'
 import { fsp } from '../adapters/store-fs.js'
 import { createDefaultDeps } from '../adapters/default.js'
@@ -60,6 +61,17 @@ import crypto from 'node:crypto'
 
 // Mutable composition state is grouped in one const object: the registration
 // aggregator is the composition root, not an ambient module-level binding.
+/**
+ * The workspace-lock hook the Host entry injects (`index.js`). Optional
+ * members are only present when the entry supplies them, so the registry and
+ * the tools that receive it declare the same shape.
+ * @typedef {object} WorkspaceHook
+ * @property {(repoRoot: string, exec: any, toolName: string) => Promise<void>} ensure
+ * @property {(exec: any) => string | null} [basePreference]
+ * @property {(exec: any) => Record<string, any> | null} [modeInfo]
+ * @property {(entry: any, key: string) => Promise<Record<string, any>>} [status]
+ */
+/** @type {{ workspaceHook: WorkspaceHook | null, hmrBridge: ReturnType<typeof createHmrBridge> | null, deps: Record<string, any> | null, definedTools: Set<string> }} */
 const runtimeState = {
   workspaceHook: null,
   hmrBridge: null,
@@ -67,23 +79,54 @@ const runtimeState = {
   // fallback is for tests/embedders that call registerTowerTools() directly;
   // it is still built once per process.
   deps: null,
-  // #84: the defined tool names are recorded before the exposure switches run,
-  // so the concept budget measures the full surface rather than one profile's
-  // subset. The number is reported by tower_doctor and compared with the
-  // committed scripts/surface-baseline.json.
+  // #84/#118/#121: registered tool names are recorded before any component row
+  // decides whether its capability mounts, so the concept budget measures the
+  // full build surface (29 tools) rather than one profile's mounted subset (28
+  // with the shipped `tower-hmr` row off). `recordToolRegistration` is the one
+  // recorder: define() calls it for every definition, the Host entry calls it
+  // for the directly registered tower_mode/tower_control pair, and the host
+  // records the declared capability tools (COMPONENT_TOOLS) because those entry
+  // points only run when their row is on. The number is reported by
+  // tower_doctor and compared with the committed scripts/surface-baseline.json.
   definedTools: new Set(),
 }
 
-/** The full defined tool surface (names, sorted), independent of exposure flags. */
+/**
+ * Record one tool name in the concept-budget surface (#84, #118, #121).
+ *
+ * This is the single recorder for the *build* tool surface. `define()` calls it
+ * for every definition when a capability is mounted; the Host entry (`index.js`)
+ * calls it for the two tools it registers directly, `tower_mode` and
+ * `tower_control`; and `registerCoreTowerTools` records the declared capability
+ * tools up front so a row that ships off does not shrink the budget. One
+ * recorder means the count cannot silently miss a registration path again: #118
+ * found 27 of the 29 names because only the `define()` path was recorded.
+ */
+export function recordToolRegistration(name) {
+  if (typeof name !== 'string' || name.trim().length === 0) {
+    throw new TypeError('recordToolRegistration requires a non-empty tool name')
+  }
+  runtimeState.definedTools.add(name.trim())
+}
+
+/**
+ * The full shipped tool surface (names, sorted). It covers every tool this build
+ * can register, including capabilities whose component row is currently off.
+ */
 export function definedToolNames() {
   return [...runtimeState.definedTools].sort()
 }
 
-/** The number of tools defined by this build, used by the concept budget (#84). */
+/** The number of tools this build ships, used by the concept budget (#84). */
 export function definedToolCount() {
   return runtimeState.definedTools.size
 }
 
+/** Test hook: the recorded set is process state and must be reset per fixture. */
+export function __testResetToolSurface() {
+  runtimeState.definedTools.clear()
+}
+
 /** The injected port set for the app layer (built once per process). */
 function towerDeps() {
   if (!runtimeState.deps) runtimeState.deps = createDefaultDeps()
@@ -335,15 +378,7 @@ async function ensureRepository(repoRootInput, autoGitInit) {
   }
 }
 
-const OPERATIONAL_TOOLS = new Map([
-  ['tower_batch', 'exposeBatch'],
-  ['tower_resource', 'exposeLeases'],
-  ['tower_import_legacy', 'exposeImport'],
-  ['tower_legacy_map', 'exposeImport'],
-  ['tower_recover', 'exposeRecovery'],
-  ['tower_test', 'exposeTests'],
-  ['tower_doctor', 'exposeDoctor'],
-])
+const OPERATIONAL_TOOLS = new Map()
 
 function plainSchema(value) {
   return JSON.parse(JSON.stringify(value))
@@ -368,12 +403,10 @@ function plainSchema(value) {
  */
 function define(ctx, definition) {
   const { aliases, requiresMissionId, board, execute, ...rest } = definition
-  // Record the definition before the exposure gate: the concept budget counts
-  // the tools this build can register, not only the ones a profile exposes.
-  runtimeState.definedTools.add(rest.name)
-  const toolsConfig = runtimeConfig().tools ?? {}
-  const flag = OPERATIONAL_TOOLS.get(rest.name)
-  if (flag && (toolsConfig.exposeOperational === false || toolsConfig[flag] === false)) return
+  // Record the definition for the concept budget. The capability that owns the
+  // tool decides whether it is registered at all (#121): the component row is
+  // the switch, so `define()` no longer consults a `tools.expose*` boolean.
+  recordToolRegistration(rest.name)
   ctx.effect(() =>
     ctx.tools.register({
       ...rest,
@@ -433,6 +466,12 @@ function textOf(blocks) {
 /** Read `package.json tower.testDiscovery` and run it for one mission worktree.
  * Returns `{configured:false}` when the repository has no discovery block. */
 async function runMissionDiscovery(tower, mission) {
+  // #121: test discovery is the tower-tests component. With the row off there is
+  // no tower_test tool and no receipt; never execute repository code silently
+  // because a config key still says admission complete/spawn.
+  if (!componentEnabled('tower-tests')) {
+    return { configured: false, disabledBy: 'tower-tests', reason: disabledReason('tower-tests') }
+  }
   const testsConfig = tower.config.tests ?? {}
   if (testsConfig.enabled === false || testsConfig.allowPackageDiscovery === false) {
     return { configured: false }
@@ -495,9 +534,29 @@ async function observeActivity(ctx, tower) {
   return { activity, parentStatus }
 }
 
-export function registerTowerTools(ctx, options = {}) {
+/**
+ * Register the mandatory Tower host surface (#121).
+ *
+ * The host owns planning, mode integration, the health contract
+ * (`tower_doctor`) and the recovery escape (`tower_recover`); neither is a
+ * component and neither can be switched off. The optional capabilities
+ * (batch/import/leases/tests/reload) are registered by their own entry points
+ * (`registerBatchCapability`, ...), so switching a component row off removes
+ * exactly that capability while the host keeps working.
+ */
+export function registerCoreTowerTools(ctx, options = {}) {
   runtimeState.workspaceHook = options.workspace ?? null
   runtimeState.hmrBridge = options.hmrBridge ?? null
+  // #121/#122: capability tools are part of this build even while their
+  // component row is off. A row's entry point only runs when the row is on, so
+  // record the declared capability names here — before any row gates
+  // registration — and the concept budget reports the full 29-tool build
+  // surface in every profile. `componentReport` is what names the subset that
+  // is actually mounted; this count never shrinks because a user switched a
+  // component off.
+  for (const toolIds of Object.values(COMPONENT_TOOLS)) {
+    for (const toolId of toolIds) recordToolRegistration(toolId)
+  }
   // #69: the host entry (index.js) is the composition root. When it supplies the
   // port set, adopt it — validated once — instead of constructing a second set
   // here. Tests/embedders that omit deps fall back to one lazily built set.
@@ -548,19 +607,21 @@ export function registerTowerTools(ctx, options = {}) {
   ctx.effect(() => () => clearInterval(timer))
   registerInitTool(ctx, { openTower, define, actorFor, requireTowerActor, workspaceHook: runtimeState.workspaceHook, ensureRepository, resolveRepo, runtimeConfig })
 
-  registerPlanTool(ctx, { openTower, define, actorFor, requireTowerActor, assertPresetsAvailable })
+  // #121: planning validates the mounted component rows as well as the presets,
+  // so a review gate without its reviewer row is refused before work starts.
+  registerPlanTool(ctx, { openTower, define, actorFor, requireTowerActor, assertPresetsAvailable: assertRuntimePreconditions })
 
   registerMissionTool(ctx, { openTower, define, actorFor, requireKnownActor })
 
-  registerStatusTool(ctx, { openTower, define, workspaceHook: runtimeState.workspaceHook, spawnBackoffView, observeActivity })
+  registerStatusTool(ctx, { openTower, define, workspaceHook: runtimeState.workspaceHook, spawnBackoffView, observeActivity, componentReport })
 
-  registerSpawnTool(ctx, { openTower, define, actorFor, requireTowerActor, enqueueSpawn, observeActivity, spawnBackoffState, spawnBackoffView, recordSpawnThrottle, recordSpawnSuccess, runMissionDiscovery, textOf, inspectLeases })
+  registerSpawnTool(ctx, { openTower, define, actorFor, requireTowerActor, enqueueSpawn, observeActivity, spawnBackoffState, recordSpawnThrottle, recordSpawnSuccess, runMissionDiscovery, textOf, inspectLeases })
 
-  registerRosterTool(ctx, { openTower, define, workspaceHook: runtimeState.workspaceHook, observeActivity, actorFor, requireTowerActor, interruptRosterAgent })
+  registerRosterTool(ctx, { openTower, define })
 
   registerInterruptTool(ctx, { openTower, define, actorFor, requireTowerActor, interruptRosterAgent })
 
-  registerDiffTool(ctx, { openTower, define, actorFor, requireTowerActor })
+  registerDiffTool(ctx, { openTower, define })
 
   registerAdoptTool(ctx, { openTower, define, actorFor, requireTowerActor })
 
@@ -591,24 +652,79 @@ export function registerTowerTools(ctx, options = {}) {
     resolveRepo,
     runtimeConfig,
     runDoctor,
-    // #84: the doctor reports the live surface; the count is the full defined
-    // tool surface, independent of which operational switches this profile uses.
+    // #84/#122: the doctor reports the full registered surface. It is always
+    // registered itself, and it is the reporter that names a disabled component.
     surface: () => ({ tools: definedToolCount() }),
   })
 
+  // #122: the recovery escape is registered for every configuration. The lock it
+  // repairs can be left behind by any crashed mutation, so an off state would be
+  // worse than uninstalling the plugin.
   registerRecoverTool(ctx, { openTower, define, actorFor, requireTowerActor, readStateLock, lockTiming })
+}
 
-  registerTestTool(ctx, { openTower, define, actorFor, requireKnownActor, runMissionDiscovery })
-
+/** Evidence batches — the `tower-batch` component. */
+export function registerBatchCapability(ctx) {
   registerBatchTool(ctx, { openTower, define, actorFor, requireTowerActor, summarizeBatch, verifyBatchReceiptFiles })
+}
 
+/** Advisory leases — the `tower-leases` component. */
+export function registerLeasesCapability(ctx) {
   registerResourceTool(ctx, { openTower, define, actorFor, requireTowerActor, acquireLease, releaseLease, inspectLeases })
+}
 
+/** Legacy import and its audit map — the `tower-import` component. */
+export function registerImportCapability(ctx) {
   registerImportLegacyTool(ctx, { openTower, define, actorFor, requireTowerActor, importLegacySnapshot })
-
   registerLegacyMapTool(ctx, { openTower, define, actorFor, requireTowerActor, validateLegacyMap })
+}
 
-  registerReloadTool(ctx, { openTower, define, actorFor, requireTowerActor, sharedHmrBridge: runtimeState.hmrBridge, runtimeConfig, createHmrBridge })
+/** Declared test discovery — the `tower-tests` component. */
+export function registerTestsCapability(ctx) {
+  registerTestTool(ctx, { openTower, define, actorFor, requireKnownActor, runMissionDiscovery })
+}
+
+/**
+ * Dev hot reload — the `tower-hmr` component (shipped off).
+ * The returned bridge is the one `/tower reload` and `tower_mode` report.
+ */
+export function registerHmrCapability(ctx, options = {}) {
+  const dev = runtimeConfig().dev ?? {}
+  const bridge =
+    options.bridge ??
+    runtimeState.hmrBridge ??
+    createHmrBridge(ctx, {
+      requiredIds: dev.reloadRequiredIds,
+      delayMs: dev.reloadDelayMs,
+      logger: ctx.logger ?? console,
+    })
+  registerReloadTool(ctx, { openTower, define, actorFor, requireTowerActor, sharedHmrBridge: bridge, runtimeConfig, createHmrBridge })
+  return bridge
+}
+
+/**
+ * Register every optional capability in-process. This is the aggregate used by
+ * tests and embedders; the shipped profile mounts the capability rows instead,
+ * so one row can be off without removing the rest.
+ */
+export function registerAllCapabilities(ctx, options = {}) {
+  for (const id of ['tower-batch', 'tower-import', 'tower-leases', 'tower-tests', 'tower-hmr']) holdComponent(ctx, id)
+  registerBatchCapability(ctx)
+  registerImportCapability(ctx)
+  registerLeasesCapability(ctx)
+  registerTestsCapability(ctx)
+  registerHmrCapability(ctx, options)
+}
+
+/**
+ * Backwards-compatible aggregate: the mandatory host surface plus every
+ * optional capability. Tests and embedders call this; the shipped composition
+ * calls `registerCoreTowerTools` and lets the component rows register their own
+ * capability.
+ */
+export function registerTowerTools(ctx, options = {}) {
+  registerCoreTowerTools(ctx, options)
+  registerAllCapabilities(ctx, options)
 }
 
 export const __testSpawnBackoff = {