dsh-tower 2.4.1 → 2.5.0

package/docs/architecture/overview.md

@@ -23,7 +23,7 @@ to a tool that is not on the recorded allowlist (empty since #122) and any
 
 ### Row display metadata (#121)
 
-The Plugins page renders an optional row as `row.meta.title ?? row.moduleName`
+The Plugins page renders a row as `row.meta.title ?? row.moduleName`
 plus `row.meta.description`. The Host fills `row.meta` by resolving
 `<specifier>/locale/en.json` and then every sibling `<lang>.json` in that
 directory, reading `meta.title` / `meta.description`; title falls back to the full
@@ -31,7 +31,7 @@ module specifier and description to empty when no resource resolves. That is why
 the mandatory `tower` card explains itself (the package root ships
 `locale/*.json`) while a bare subpath row would show only `dsh-tower/batch`.
 
-Each optional capability therefore ships its own resolvable subpath resource:
+Each optional capability row therefore ships its own resolvable subpath resource:
 `dsh-tower/skills/locale/{en,zh}.json` and the same for `batch`, `import`,
 `leases`, `tests` and `hmr`. `package.json` `exports` maps every
 `./<capability>/locale/*.json` to `./locale/<capability>/*.json`, and
@@ -39,31 +39,56 @@ Each optional capability therefore ships its own resolvable subpath resource:
 package. The root `./locale/*.json` export stays so the Tower group keeps its own
 `meta`.
 
-The capability files are generated, never hand-written. `npm run
-docs:generate:locale` renders them from the `components` block of
-`locale/en.json` and `locale/zh.json` (the same source `docs:check:components`
-audits): `meta.title` is the component `title`, and `meta.description` joins the
-component `summary` (what the capability enables) with its `disables` text (what
-turning it off removes) behind a per-language "When off / 关闭后" label. The
-row is therefore decidable from the page alone. `npm run
-docs:check:generated:locale` fails on drift, runs in `npm run check`, and is its
-own step in the `test` CI job (`.github/workflows/test.yml`).
-
-To label a new capability row:
+The two preset-declaring rows need the same treatment but cannot share a module.
+DSH labels a row from its own `moduleName`, so while both rows mounted
+`@deepseek-ai/dsh-agent-preset` they resolved one locale resource and rendered the
+same title: the mandatory worker dependency and the conditional reviewer switch
+were indistinguishable. That package is also supplied by the DSH profile, not by
+this bundle, so Tower cannot add per-row locale files beside its label. Tower
+therefore owns one tiny declaration module per preset row:
+`host/preset-worker.js` (row specifier `dsh-tower/preset-worker`) and
+`host/preset-reviewer.js` (`dsh-tower/preset-reviewer`). Each is a plain object
+plugin with `inject: ['agentPresets']` whose async `apply` returns
+`ctx.agentPresets.register(config)`; Cordis collects the resolved function as the
+plugin's disposer, so disabling the row or an HMR unload unregisters the preset.
+The registry still owns preset semantics — it mounts the definition's `plugins`
+list itself — and the modules import nothing, so they are renderer-free and do
+not depend on `@deepseek-ai/dsh-agent-preset`. In `cordis.patch.yml` only the two
+`name:` lines changed; the id/name/description/order/plugins config blocks are
+unchanged.
+
+The row label files are generated, never hand-written. `npm run
+docs:generate:locale` renders every row label — capability and preset — from the
+`components` block of `locale/en.json` and `locale/zh.json` (the same source
+`docs:check:components` audits): `meta.title` is the component `title`, and
+`meta.description` joins the component `summary` (what the row provides) with its
+`disables` text (what turning it off removes) behind a per-language "When off /
+关闭后" label. The mandatory worker preset has no off state, so its description
+uses a "Mandatory dependency, not a switch / 强制依赖，不是开关" label instead; the
+conditional reviewer keeps the off-effect wording. The row is therefore decidable
+from the page alone. `npm run docs:check:generated:locale` fails on drift, runs in
+`npm run check`, and is its own step in the `test` CI job
+(`.github/workflows/test.yml`). `npm run docs:check:components` also covers the
+generated rows: a label whose `components` entry is missing, or whose `mandatory`
+flag disagrees with the component scope, is refused there. The real
+`npm run smoke:mount` calls the same host `readPluginMeta` the Plugins page uses
+and fails unless the two preset rows resolve distinct title/description maps, so
+the shared-label defect cannot return unnoticed.
+
+To label a new row:
 
 1. Classify it in `scripts/component-surface.json`, ship it in
    `cordis.patch.yml`, and add `title` / `summary` / `disables` to the
    `components` block of both `locale/en.json` and `locale/zh.json`.
-2. Add `{ specifier, component }` to `CAPABILITY_LOCALES` in
-   `scripts/generate-capability-locale.mjs`, the matching
-   `./<specifier>/locale/*.json` export in `package.json`, and the row to the
-   coverage map in `tests/capability-locales.test.mjs`.
+2. Add `{ specifier, component }` to `CAPABILITY_LOCALES` — or to
+   `PRESET_LOCALES` with `mandatory` matching the component scope for a
+   preset-declaring row — in `scripts/generate-capability-locale.mjs`, the
+   matching `./<specifier>/locale/*.json` export in `package.json`, and the row
+   to the coverage map in `tests/capability-locales.test.mjs`.
 3. Run `npm run docs:generate:locale`, then regenerate
    `scripts/pack-manifest.txt` with `npm run pack:check -- --write`.
 
-The reviewer preset row is the one visible component that is not a package
-specifier: its label comes from the `cordis.patch.yml` preset `config.name` /
-`description`. The generated capability files never touch the root locale `meta`.
+The generated row files never touch the root locale `meta`.
 
 ```
 Host plugin (index.js)
@@ -90,6 +115,8 @@ Host plugin (index.js)
        host/modeStore.js       per-agent Tower mode persistence
        host/modeState.js       owned in-memory mode state
        host/presets.js         cross-field preset validation before work starts
+       host/preset-worker.js   mandatory worker preset declaration (dsh-tower/preset-worker)
+       host/preset-reviewer.js conditional reviewer preset declaration (dsh-tower/preset-reviewer)
        host/compatibility.js   COMPATIBILITY.md provenance
        host/tower.js           default-deps Tower binding for tests/embedders
  ports (explicit runtime contracts, no implementation):

package/docs/guide/install-upgrade-migration.md

@@ -29,6 +29,27 @@ The Host plugin loads at DSH startup: **restart DSH after install or update**.
 
 ## Migration notes
 
+- **2.4.2 → 2.5.0 (#131/#133/#135/#136/#142)**: three component-shaped config
+  keys are gone — `tests.enabled`, `docs.board`, and `archive.enabled`. The
+  `tower-tests`, `tower-board`, and `tower-archive` component rows are the only
+  switches. A profile or repository config that still writes any of these keys is
+  rejected as `config-unknown-key` with an upgrade note and the host stops
+  mounting, so delete the key and enable or disable the row in the plugin page
+  instead. `docs.boardLocation` and `archive.afterDays`/`archive.maxMissions`
+  remain tuning keys. With `tower-tests` off there is no `tower_test` tool and no
+  receipt, which also means `gates.requireTests` cannot be satisfied: planning and
+  mode entry refuse that combination, and the merge gate's `tests-missing` blocker
+  names the disabled row and the fix. `tower_test` no longer reports "not
+  configured" for a component cause; it reports `disabled by component
+  tower-tests` with the remedy.
+  Two more runtime rules became explicit: a config that sets `spawn.requireLease`
+  while the `tower-leases` row is off is refused up front with `config-invalid`
+  naming the row and both remedies (previously every spawn failed at `lease-busy`
+  advising an unregistered `tower_resource`), and `/tower` re-validates the runtime
+  preconditions only when it enters the mode, so `/tower off` and a forwarded
+  `/tower <text>` keep working while an unrelated row is disabled. No state
+  migration; see [component rows and messages](quickstart.md#component-rows-runtime-preconditions-and-message-language).
+
 - **state schema v1 → v2 (unreleased)**: `state.json` migrates automatically. The first **write** after
   upgrading keeps a `state.json.v1.bak` backup, advances `revision` once, and appends
   `state.migrated {from,to}` to `activity.jsonl`; read-only tools keep reading a v1 file without

package/docs/guide/quickstart.md

@@ -100,3 +100,74 @@ Statuses are `open → triaged → fixed` / `wontfix`, and `fixed`/`wontfix` can
 tower or a worker may change a finding; reviewers can list and read.
 
 A complete copy-paste example: [examples/first-mission.md](../examples/first-mission.md).
+
+## Component rows, runtime preconditions and message language
+
+The optional component rows are the only switches in this bundle (#121, #136). Three runtime rules
+follow from that, plus the language policy for everything a tool prints.
+
+### A row is the only switch
+
+`tests.enabled` was removed (#136). Discovery is on exactly while the `tower-tests` row is mounted:
+with the row off there is no `tower_test` tool and no test receipt to gate on, so a second boolean
+could only disagree with the mounted profile. A repository config that still writes
+`tests.enabled` is rejected as `config-unknown-key`; delete the key and enable or disable the row
+instead.
+
+The same reasoning covers the other rows:
+
+- `tower-leases` owns `tower_resource`. `spawn.requireLease` is satisfied through that tool, so a
+  config that requires a lease while the row is off is refused by the runtime preconditions with
+  `config-invalid`, naming the row and both remedies ("re-enable the tower-leases component or clear
+  spawn.requireLease") instead of failing every spawn at `lease-busy` with advice to use a tool that
+  is not registered (#131).
+- `tower-tests` must stay mounted while `gates.requireTests` is true. Planning and mode entry refuse
+  the combination; the merge gate's `tests-missing` blocker also names the disabled row as the cause
+  (#140).
+- `tower-hmr` ships off; `/tower reload` reports it by row name.
+
+No runtime path may claim a repository is "not configured" when a component row is the reason.
+Runtime refusals report the cause as `disabled by component <id>` and come with the fix (`enable the
+<id> row in the plugin page and restart DSH`).
+
+### Preconditions run on mode entry, not on every `/tower` input (#142)
+
+`/tower` re-validates the runtime preconditions (presets, component/config contradictions) only when
+it **enters** Tower mode:
+
+| Input | Preconditions |
+|---|---|
+| `/tower`, `/tower on`, `/tower <text>` while the mode is off | validated |
+| `/tower off`, `/tower off <text>` | not validated |
+| `/tower <text>` while the mode is already on | not validated |
+| `/tower ack`, `/tower base <branch>`, `/tower reload` | not validated |
+
+The reason: a row disabled after the session started (or a profile reloaded with a stricter config)
+must not make `/tower off` — the command a human needs to leave the mode — or an ordinary forwarded
+instruction fail. Capability guards still run where the work happens: `tower_spawn`, planning and
+merge/preflight evaluate their own preconditions, so the checks cannot be bypassed by entering the
+mode first.
+
+### Language of tool output
+
+Machine-facing output is **English only**, regardless of the request locale:
+
+- tool errors (`[tower:<code>] ...`), `nextAction`, blocker `detail` strings, `tower_status` /
+  `tower_doctor` detail lines, and completion reports;
+- anything that a script, a log search or another agent is expected to pattern-match.
+
+Localized, human-facing copy lives in `locale/*.json` (component descriptions, UI labels) and is the
+only translated surface. Two rules keep the split honest:
+
+1. New detail/error strings are written in English even when the surrounding UI is Chinese; they are
+   not added to `locale/*.json`.
+2. A localized label never shadows a machine-readable cause. The row id, the error code and the
+   English remedy phrase stay verbatim inside the message, so a grep for
+   `disabled by component tower-tests` works in every locale.
+
+`tower_status` and `tower_doctor` follow this policy but are not textually identical: `tower_status`
+returns the cause only — `components.disabled` is `[{id, reason}]` with `reason` set to
+`disabled by component <id>` — while `tower_doctor` repeats that reason and adds the English remedy
+(`enable the reported row in the plugin page and restart DSH` for the `components` check; a
+capability-specific check names the row directly, e.g. `enable the tower-tests row and restart DSH`).
+Neither interpolates a translated label.

package/docs/guide/release.md

@@ -97,29 +97,70 @@ git for-each-ref refs/tags/v2.1.0-beta.1 --format='%(objecttype)|%(subject)'
 The pushed tag must be exactly `v<version>`. The tag push re-runs `release:check` against
 `<tag>^`; this is why tagging a commit whose `package.json` did not move fails.
 
-## 6. GitHub Release from the CHANGELOG section
+## 6. GitHub Release with cumulative notes
+
+A Release body is not just its own CHANGELOG section: it carries **every** section after the
+previous GitHub Release (see [Cumulative Release notes](#cumulative-release-notes--累积发布说明)
+below). `scripts/release-notes.mjs` is the authority for that body — do not hand-extract a single
+section. The checklist step is `npm run release:notes -- --version <v> --since <prev-release> --output notes.md`, then pass that file to `gh release create`/`gh release edit` with `--notes-file notes.md`.
 
 ```bash
-VERSION=2.1.0-beta.1
-awk -v v="$VERSION" '$0 ~ "^##[[:space:]]+.*" v {s=1; next} s && /^##[[:space:]]/ {exit} s {print}' \
-  CHANGELOG.md > release-notes.md
-test -s release-notes.md || { echo "empty section for $VERSION" >&2; exit 1; }
-gh release create "v$VERSION" --title "dsh-tower $VERSION" --notes-file release-notes.md \
-  --prerelease --verify-tag --latest=false
+# Stable release (the common case): no pre-release flags.
+VERSION=2.3.0
+SINCE=2.1.0                 # the previous GitHub Release, not the previous tag
+npm run release:notes -- --version "$VERSION" --since "$SINCE" --output notes.md
+npm run release:notes -- --version "$VERSION" --since "$SINCE" --check notes.md
+gh release create "v$VERSION" --title "dsh-tower $VERSION" --notes-file notes.md --verify-tag
+# editing a Release that already exists (for example, to correct its window):
+gh release edit "v$VERSION" --notes-file notes.md
 gh release view "v$VERSION" --json tagName,isPrerelease,body
 ```
 
-PowerShell extraction of the same section:
-
-```powershell
-$version = '2.1.0-beta.1'; $lines = Get-Content CHANGELOG.md
-$start = ($lines | Select-String -Pattern "^##\s+.*$([regex]::Escape($version))" | Select-Object -First 1).LineNumber
-if (-not $start) { throw "CHANGELOG has no section for $version" }
-$next = ($lines | Select-String -Pattern '^##\s+' | Where-Object LineNumber -gt $start | Select-Object -First 1).LineNumber
-$end = if ($next) { $next - 2 } else { $lines.Count - 1 }
-($lines[$start..$end] -join "`n").Trim() | Set-Content release-notes.md -Encoding utf8
+```bash
+# Pre-release variant (a beta, for example 2.5.0-beta.1): mark the Release and keep "latest"
+# on the previous stable Release.
+VERSION=2.5.0-beta.1
+SINCE=2.4.2                 # the previous GitHub Release; a pre-release counts as one too
+npm run release:notes -- --version "$VERSION" --since "$SINCE" --output notes.md
+gh release create "v$VERSION" --title "dsh-tower $VERSION" --notes-file notes.md \
+  --prerelease --verify-tag --latest=false
 ```
 
-`--verify-tag` refuses to create the tag at the default branch when the pushed tag is missing;
-`--prerelease --latest=false` keeps the GitHub "latest" marker on the stable release. Releases
-are what consumers and the plugin directory can see — a tag alone is not a release.
+`--check notes.md` exits 1 when the file differs from the generated text (it prints the first
+differing line and both byte counts), so a correction is verifiable. The script exits 2 on a
+missing/unknown flag, an invalid version, `since >= version`, or an empty window; it never emits
+a Release body it cannot justify.
+
+`--verify-tag` refuses to create the tag at the default branch when the pushed tag is missing.
+A beta Release adds `--prerelease --latest=false`: GitHub marks it as a pre-release and keeps
+the "latest" marker on the stable Release. Releases are what consumers and the plugin directory
+can see — a tag alone is not a release.
+
+## Cumulative Release notes / 累积发布说明
+
+A GitHub Release is cumulative: it aggregates every CHANGELOG section **after the previous
+Release**, up to and including the version being released.
+
+- The **previous Release** is the latest published GitHub Release by version. Pre-releases
+  created with `--prerelease` count as Releases, so a `2.1.0-beta.1` Release is a boundary too.
+- **Tag-only versions have no Release.** A version that was tagged or published to npm without
+  creating a GitHub Release — 2.1.1 and 2.1.2 were tag-only, and 2.2.0 too — would otherwise
+  lose its notes; its CHANGELOG section rolls into the next Release.
+- Example: once 2.1.0 is the previous Release, the 2.3.0 Release includes 2.1.1, 2.1.2, 2.2.0
+  and 2.3.0:
+
+  ```bash
+  npm run release:notes -- --version 2.3.0 --since 2.1.0 --output notes.md
+  ```
+
+  The window is `(2.1.0, 2.3.0]`; `2.1.0-beta.1` sorts before 2.1.0 and therefore stays out.
+- `npm run release:notes` (`scripts/release-notes.mjs`) is the authoritative generator: it reads
+  `CHANGELOG.md`, filters the window, orders sections by SemVer (pre-release identifiers
+  included), and emits the `# dsh-tower <v>` title, a provenance quote naming the previous
+  Release and the included versions, then the sections separated by `---`.
+- `--check <file>` re-verifies an existing notes file byte-for-byte (exit 1 on a mismatch), so
+  the body of a published Release can be audited without editing it. Use `--root <dir>` to check
+  another checkout.
+
+Never hand-extract only the current version's section: that is what produced single-section
+Releases whose tag-only predecessors were invisible.

package/docs/reference/component-surface.md

@@ -3,7 +3,7 @@
 > Generated by `npm run docs:generate:components` from `scripts/component-surface.json` and
 > `scripts/surface-baseline.json`. Do not edit by hand.
 
-Decision: [ADR 0005](../adr/0005-component-surface.md) · decision date: 2026-10-23 · baseline 2026-10-23 · visible components: 8 (`tower`, `tower-skills`, `tower-batch`, `tower-import`, `tower-leases`, `tower-tests`, `tower-hmr`, `preset-tower-reviewer`)
+Decision: [ADR 0005](../adr/0005-component-surface.md) · decision date: 2026-10-23 · baseline 2026-10-23 · visible components: 11 (`tower`, `tower-skills`, `tower-batch`, `tower-import`, `tower-leases`, `tower-tests`, `tower-board`, `tower-archive`, `tower-hmr`, `preset-tower-reviewer`, `tower-ui`)
 
 The component axis answers one question for every config key: may a user turn it
 off, and if so, must that switch be a component? Four classes cover every key, so
@@ -29,11 +29,14 @@ row is a section of its parent and is not independently switchable.
 | `tower-skills` | visible | row | The 3 skills leave the catalog; the worker/reviewer PROTOCOL sections still ship through systemPrompt.section, so only the tower-recovery guidance is lost. |
 | `tower-batch` | visible | row | tower_batch is not registered; missions, gates and merges are unaffected because no state depends on a batch. |
 | `tower-import` | visible | row | tower_import_legacy and tower_legacy_map are not registered; new repository state is unaffected. |
-| `tower-leases` | visible | row | tower_resource is not registered; advisory leases are coordination only, so nothing else depends on them. |
+| `tower-leases` | visible | row | tower_resource is not registered; advisory leases are coordination only, but spawn.requireLease still needs the tool to acquire one, so a config that sets spawn.requireLease is rejected at runtime preconditions instead of failing every spawn at lease-busy. |
 | `tower-tests` | visible | row | tower_test is not registered and no test receipt can be recorded. With gates.requireTests:true planning/mode entry is rejected with an explanation, and the merge gate still reports tests-missing. |
-| `tower-hmr` | visible | row | tower_reload and /tower reload are unavailable; a profile without HMR behaves exactly as before. Shipped disabled: enable the row for a linked dev profile. |
-| `preset-tower-worker` | internal | row | tower_spawn fails without the worker preset. A mandatory dependency, never a switch. |
-| `preset-tower-reviewer` | visible | row | The reviewer cannot be dispatched. Supported while review.requireReview is false (merge is unaffected); with the gate on planning/mode entry is locked with an explanatory error. |
+| `tower-board` | visible | row | MISSIONS.md is not written or refreshed, so an existing board goes stale. Mission state tools, gates and every other capability keep working; docs.boardLocation still chooses where a board would be written. |
+| `tower-archive` | visible | row | Terminal missions are not moved out of state.json, so the hot state keeps growing and status/doctor keep loading their full history. Merges, gates and every other capability keep working; nothing is deleted. afterDays/maxMissions keep their tuning meaning. |
+| `tower-hmr` | visible | row | Development-only tooling: tower_reload and /tower reload are unavailable, so a linked-profile reload has to be triggered outside Tower. A normal profile behaves exactly as before; the row ships disabled on purpose. |
+| `preset-tower-worker` | internal | row | Declared by dsh-tower/preset-worker: tower_spawn fails without the worker preset. A mandatory dependency, never a switch. |
+| `preset-tower-reviewer` | visible | row | Declared by dsh-tower/preset-reviewer: the reviewer cannot be dispatched. Supported while review.requireReview is false (merge is unaffected); with the gate on planning/mode entry is locked with an explanatory error. |
+| `tower-ui` | visible | row | The Tower web UI plugin does not load in this profile: no Tower tool cards, composer-dock summary or status strip. Host tools, missions, state and the MISSIONS.md board are unaffected. |
 
 ## Forbidden to disable
 
@@ -71,9 +74,9 @@ All keys from `domain/config/schema.js`, classified on the component axis.
 |---|---|---|
 | `section` | `core` | Legacy alias for mode.promptSection: the Tower-mode prompt contract, not a capability. |
 | `allowAgentControl` | `core` | Legacy alias for mode.allowAgentControl: the human-owned mode rule (ADR 0003), not a component. |
-| `init.autoGitInit` | `optional-config` | Bootstrap convenience; off only means tower_init will not run git init. |
-| `init.snapshotDirty` | `optional-config` | Dirty-work baseline convenience; no capability is removed. |
-| `init.autoExclude` | `optional-config` | Keeps Tower artifacts out of .git/info/exclude; safe either way. |
+| `init.autoGitInit` | `optional-config` | Bootstrap convenience; off only means tower_init will not run git init. Tuning exemption: Tuning, not capability: tower_init stays the component and the switch only decides whether it runs git init. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
+| `init.snapshotDirty` | `optional-config` | Dirty-work baseline convenience; no capability is removed. Tuning exemption: Tuning, not capability: the init component remains available with or without a dirty-work snapshot baseline. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
+| `init.autoExclude` | `optional-config` | Keeps Tower artifacts out of .git/info/exclude; safe either way. Tuning exemption: Tuning, not capability: both values keep the init component and only change which artifacts the exclude file names. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `mode.promptSection` | `core` | Replaces the whole Tower-mode prompt text; contract text, not a capability. |
 | `mode.sectionAppend` | `optional-config` | Appends team conventions to the prompt. |
 | `mode.allowAgentControl` | `core` | Decides whether the model may toggle the mode (ADR 0003). A governance rule, never a component. |
@@ -104,28 +107,37 @@ All keys from `domain/config/schema.js`, classified on the component axis.
 | `spawn.maxLiveWorkers` | `core` | Resource-safety cap on live workers. |
 | `spawn.staleMs` | `optional-config` | Roster staleness window before merge is blocked. |
 | `spawn.maxWaitMs` | `optional-config` | Upper bound for a blocking spawn wait. |
-| `spawn.requireLease` | `optional-config` | Advisory-lease gate before a worker starts. |
+| `spawn.requireLease` | `optional-config` | Advisory-lease gate before a worker starts. Tuning exemption: Tuning the safety level inside the optional tower-leases row; with leases off the Host refuses requireLease instead of removing the spawn capability. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `send.maxPerMinute` | `optional-config` | Message rate limit; zero disables it. |
-| `send.interruptDefault` | `optional-config` | Default for the interrupt-before-deliver flag. |
-| `tests.enabled` | `optional-component` | Tuning inside the optional tower-tests component: it decides whether discovery runs when the row is on. Off with gates.requireTests:true is rejected at config resolution. |
-| `tests.admission` | `optional-config` | Chooses when discovery runs inside the optional tests capability. |
+| `send.interruptDefault` | `optional-config` | Default for the interrupt-before-deliver flag. Tuning exemption: Tuning, not capability: the send component always exists and the switch only picks a delivery default. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
+| `tests.admission` | `optional-config` | Chooses when discovery runs inside the optional tests capability. Tuning exemption: Tuning when the admission check runs inside the optional tower-tests row, which still owns whether test tooling exists. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `tests.timeoutMs` | `optional-config` | Per-command discovery timeout. |
 | `tests.maxBytes` | `optional-config` | Captured discovery output cap. |
-| `tests.autoChecks` | `optional-config` | Attaches a tests check to completion when discovery runs. |
+| `tests.autoChecks` | `optional-config` | Attaches a tests check to completion when discovery runs. Tuning exemption: Tuning the default receipt policy inside the optional tower-tests row, which still owns whether any test tooling exists. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `tests.allowPackageDiscovery` | `core` | Allows repository code to execute; a security contract, not a component. |
 | `gates.requireChecks` | `forbidden-to-disable` | Requires completion evidence before merge; a merge gate. |
 | `gates.requireTests` | `forbidden-to-disable` | Requires a test receipt before merge; a merge gate. With the tower-tests row off, planning/mode entry refuse the combination. |
 | `gates.allowReviewExemption` | `forbidden-to-disable` | The review-exemption path is part of the review and merge contract. |
 | `gates.maxReportBytes` | `forbidden-to-disable` | The report cap is part of the completion contract; the refusal itself is never configurable away. |
-| `docs.board` | `optional-config` | Writes the human-readable board; no capability is removed. |
-| `docs.boardLocation` | `optional-config` | Chooses the board location. |
-| `archive.enabled` | `optional-config` | Archival is maintenance, not a tool capability; off only leaves terminal missions hot. |
-| `archive.afterDays` | `optional-config` | Archive age threshold. |
+| `docs.boardLocation` | `optional-config` | Chooses where the board is written; whether it is written is the tower-board component row (#133). |
+| `archive.afterDays` | `optional-config` | Archive age threshold inside the optional tower-archive component (#135). |
 | `archive.maxMissions` | `optional-config` | Hot terminal-mission cap. |
 | `leases.ttlMs` | `optional-config` | Tuning inside the optional tower-leases component. |
 | `dev.reloadDelayMs` | `optional-config` | Delay so a tool result is delivered before a scheduled reload inside the optional tower-hmr component. |
 | `dev.reloadRequiredIds` | `optional-config` | Loader ids passed to reconcileProfile as required by the tower-hmr component. |
 
+## Behaviour knobs
+
+Non-boolean keys that gate behaviour are reviewed on the same axis as booleans
+(#138): each must be `core`, `optional-component`, `forbidden-to-disable`, or an
+`optional-config` key with a dated tuning-only exemption. A string or union that
+hides a capability cannot use the tuning class without that record.
+
+| Key |
+|---|
+| `spawn.requireLease` |
+| `tests.admission` |
+
 ## Non-goals
 
 This page does not decide whether a key is useful, and it is not an approval

package/docs/reference/config.generated.md

@@ -1,7 +1,7 @@
 # Config reference (generated)
 
 > Generated by `npm run docs:generate:config` from `domain/config/schema.js`. Values are defaults before repo config.
-> Surface: config keys: 56 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
+> Surface: config keys: 53 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
 
 | Key | Default | Description |
 |---|---|---|
@@ -10,7 +10,7 @@
 | `init.autoGitInit` | `false` | tower_init may run git init and create an empty initial commit when the directory is not a repository. |
 | `init.snapshotDirty` | `false` | tower_init may snapshot uncommitted tracked changes into a dangling commit used as the mission baseline. |
 | `init.autoExclude` | `true` | Add in-repo Tower artifacts (MISSIONS.md, in-repo worktree roots) to .git/info/exclude so they do not look like user dirt. |
-| `mode.promptSection` | `` | Replacement Tower-mode system prompt text. Empty keeps the built-in reminder. |
+| `mode.promptSection` | `""` | Replacement Tower-mode system prompt text. Empty keeps the built-in reminder. |
 | `mode.sectionAppend` | `` | Extra text appended to the Tower-mode system prompt section (team conventions). |
 | `mode.allowAgentControl` | `true` | Register tower_control so the model may enter/leave the mode with a reason. |
 | `mode.autoPauseGoal` | `true` | Pause an active goal when entering Tower mode. |
@@ -43,7 +43,6 @@
 | `spawn.requireLease` | `` | Optional lease name tower_spawn must hold before starting a worker. |
 | `send.maxPerMinute` | `120` | Per-repository tower_send rate limit per minute (0 disables). |
 | `send.interruptDefault` | `false` | Default value of tower_send.interrupt when the caller omits it. |
-| `tests.enabled` | `true` | Run declared test discovery when a mission configures it. |
 | `tests.admission` | `"off"` | Run discovery before spawning a worker, when completing, or only on explicit tower_test (default off: repository code runs only on an explicit tower_test). |
 | `tests.timeoutMs` | `60000` | Per discovery command timeout. |
 | `tests.maxBytes` | `16777216` | Maximum captured stdout bytes per command. |
@@ -53,10 +52,8 @@
 | `gates.requireTests` | `false` | Require a passing test-discovery receipt for the reviewed worktree tip before merge. |
 | `gates.allowReviewExemption` | `false` | Allow reviewPolicy:none missions with a non-empty reviewExemptionReason to skip review blockers. |
 | `gates.maxReportBytes` | `32768` | Hard cap, in UTF-8 bytes, for tower_complete.report; a larger report is rejected with an actionable nextAction, never truncated. |
-| `docs.board` | `true` | Write a human-readable MISSIONS.md after mission changes. |
-| `docs.boardLocation` | `"common"` | common = <git-common-dir>/dsh-tower/MISSIONS.md; repo = <repoRoot>/MISSIONS.md. |
-| `archive.enabled` | `true` | Move terminal (merged/abandoned) missions whose worktree is gone into <git-common-dir>/dsh-tower/archive/ at the next mutation, so state.json stops carrying their full history. |
-| `archive.afterDays` | `30` | Terminal missions untouched for at least this many days are archived on the next mutation (0 archives them immediately). |
+| `docs.boardLocation` | `"common"` | common = <git-common-dir>/dsh-tower/MISSIONS.md; repo = <repoRoot>/MISSIONS.md. Whether the board is written at all is the tower-board component row (#133). |
+| `archive.afterDays` | `30` | Terminal missions untouched for at least this many days are archived on the next mutation (0 archives them immediately). Archival itself is the tower-archive component row (#135). |
 | `archive.maxMissions` | `100` | Maximum terminal missions kept hot; once exceeded, the oldest eligible terminal missions are archived until the cap holds (0 archives every eligible terminal mission). |
 | `leases.ttlMs` | `900000` | Default advisory lease lifetime; expiry never auto-releases. |
 | `dev.reloadDelayMs` | `50` | Delay before a scheduled reload, so the tool result is delivered first. |

package/docs/reference/config.md

@@ -5,6 +5,11 @@ Every key is optional; defaults reproduce the shipped behavior. Unknown top-leve
 `mode.allowAgentControl`. A legacy alias only fills a gap: when both forms are set, the canonical
 `mode.*` key wins.
 
+Two component-shaped switches left the config form (#133/#135): `docs.board` is now the `tower-board`
+component row and `archive.enabled` is now the `tower-archive` component row. A config that still sets
+either one fails with `config-unknown-key` and an upgrade note naming the replacing row; the tuning
+keys (`docs.boardLocation`, `archive.afterDays`, `archive.maxMissions`) stay here.
+
 ## Layers and precedence
 
 Lowest precedence first:
@@ -74,7 +79,6 @@ violates the declared schema (for example `merge.timeoutMs` below 1000) fail wit
 | `spawn.requireLease` | `''` | Optional lease name that must be held before a worker can spawn. |
 | `send.maxPerMinute` | `120` | Per-repository `tower_send` rate limit (0 disables); exceeding it returns `rate-limited`. |
 | `send.interruptDefault` | `false` (bundled patch: `true`) | Default for `tower_send.interrupt` (interrupt the running turn before delivering). |
-| `tests.enabled` | `true` | Run declared test discovery when the worktree `package.json` configures it. It only tunes the optional `tower-tests` component: with that row off there is no `tower_test` tool and no receipt, and `gates.requireTests:true` is refused rather than silently unmet. |
 | `tests.admission` | `off` | `spawn` runs discovery before starting a worker, `complete` at `tower_complete`, `off` only on explicit `tower_test` (default; repository code is not executed automatically). |
 | `tests.timeoutMs` | `60000` | Per discovery command timeout. |
 | `tests.maxBytes` | `16777216` (16 MiB) | Captured stdout cap per command. |
@@ -84,10 +88,8 @@ violates the declared schema (for example `merge.timeoutMs` below 1000) fail wit
 | `gates.requireTests` | `false` | Require a passing discovery receipt for the current mission branch tip (`tests-missing`); independent of the review gate. With the `tower-tests` component row off, planning/mode entry refuse this combination with an explanation. |
 | `gates.allowReviewExemption` | `false` | With `review.requireReview:true`, allow `reviewPolicy:"none"` + a non-empty reason to skip review blockers. Off deliberately; irrelevant while the global review gate is off. |
 | `gates.maxReportBytes` | `32768` (32 KiB) | Hard cap in UTF-8 bytes for `tower_complete.report`. A larger report is rejected with `invalid-argument` and an actionable `nextAction` (file the full text in the mission worktree and reference its path); it is never truncated. Existing larger reports still load. |
-| `docs.board` | `true` | Write `MISSIONS.md` after mutations. |
-| `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`; `repo` = `<repoRoot>/MISSIONS.md`. |
-| `archive.enabled` | `true` | Move terminal (`merged`/`abandoned`) missions whose worktree is gone into `<git-common-dir>/dsh-tower/archive/` at a mutation boundary. Archived missions keep tasks, reviews, findings and the completion report; they are moved, never deleted. |
-| `archive.afterDays` | `30` | Age trigger: a terminal mission untouched for at least this many days is archived on the next mutation (`0` archives immediately). |
+| `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`; `repo` = `<repoRoot>/MISSIONS.md`. Whether the board is written at all is the `tower-board` component row (#133); `docs.board` was removed and is rejected as an unknown key. |
+| `archive.afterDays` | `30` | Age trigger: a terminal mission untouched for at least this many days is archived on the next mutation (`0` archives immediately). Archival itself is the `tower-archive` component row (#135); `archive.enabled` was removed and is rejected as an unknown key. |
 | `archive.maxMissions` | `100` | Cap trigger: once more than this many terminal missions are hot, the oldest eligible ones are archived until the cap holds (`0` archives every eligible terminal mission). A mission with a live worktree is never archived. |
 | `leases.ttlMs` | `900000` | Default advisory lease lifetime; expiry never auto-releases. |
 | `dev.reloadDelayMs` | `50` | Delay before a scheduled reload so the tool result is delivered first. Tuning inside the optional `tower-hmr` component. |

package/docs/reference/doctor.md

@@ -8,17 +8,17 @@ It returns:
   "ok": true,
   "checks": [
     { "id": "git", "status": "pass", "detail": "git version 2.55.0" },
-    { "id": "surface", "status": "pass", "detail": "config keys: 56 · sections: 14 · tools: 29 (baseline 2026-10-23)" },
+    { "id": "surface", "status": "pass", "detail": "config keys: 53 · sections: 14 · tools: 29 (baseline 2026-10-23)" },
     { "id": "state", "status": "pass", "detail": ".../state.json revision 7" },
     { "id": "state-schema", "status": "pass", "detail": "schemaVersion 3 is current" },
     { "id": "case-mode", "status": "pass", "detail": "caseInsensitive: true; scope matching uses case-insensitive comparison" }
   ],
   "surface": {
-    "configKeys": 56,
+    "configKeys": 53,
     "sections": 14,
     "tools": 29,
     "baselineDate": "2026-10-23",
-    "line": "config keys: 56 · sections: 14 · tools: 29"
+    "line": "config keys: 53 · sections: 14 · tools: 29"
   },
   "stateLock": {
     "held": true,
@@ -100,9 +100,15 @@ it for the configured merge timeout (15 minutes by default), so a held lock is a
 failure; the holder's phase and age make a stalled tower diagnosable. `tower_status` returns the same
 `gitLock` object.
 
+`board` names the `MISSIONS.md` location (`docs.boardLocation`) and whether the `tower-board` component
+row is mounted. With the row off the check is a `warn` that says the board is not written (an existing
+board goes stale) and names the row; every state tool and gate still works.
+
 `archive` reports the terminal-mission archive: active `missions`, `archivedMissions` and `stateBytes`,
-the archive directory's `archiveBytes`/`years`/`files`, every `unreadable` diagnostic, and the configured
-`policy` (`enabled`, `afterDays`, `maxMissions`). A missing archive directory is a healthy empty archive
+the archive directory's `archiveBytes`/`years`/`files`, every `unreadable` diagnostic, and the tuning
+`policy` (`afterDays`, `maxMissions`). `policy.enabled` reflects the `tower-archive` component row, not a
+config key: with the row off the policy line says archival is disabled by the component, terminal
+missions stay hot and `state.json` keeps growing. A missing archive directory is a healthy empty archive
 (`archive` check `pass`); a truncated index or year file is a `warn` with the diagnostic, and archiving is
 paused until it is repaired rather than overwriting it. Nothing is lost while the archive is unreadable:
 the eligible missions stay in `state.json`.

package/docs/reference/surface-budget.md

@@ -19,10 +19,15 @@ these tables fails `npm run surface:check`.
 A second axis asks who may turn a key off. It is generated from
 [`scripts/component-surface.json`](../../scripts/component-surface.json) into
 [component-surface.md](component-surface.md): every key is `core`,
-`optional-component`, `optional-config` or `forbidden-to-disable`, and the
-component count is the fourth baselined surface, two-way: a contraction needs a
-dated decision just like growth does (`npm run docs:check:components`,
-[ADR 0005](../adr/0005-component-surface.md)). The same source of truth records
+`optional-component`, `optional-config` or `forbidden-to-disable`. A boolean (or a
+recorded non-boolean behaviour knob) cannot stay `optional-config` without a dated
+tuning-only exemption. Both the component count and the config-key count are
+baselined two-way: an increase or a contraction needs a dated decision
+(`npm run docs:check:components`, [ADR 0005](../adr/0005-component-surface.md)).
+Every decision on those two surfaces must carry a real `date` (`YYYY-MM-DD`); a
+from/to record without one fails the brake even when it reaches the committed
+count.
+The same source of truth records
 the `gateableTools` allowlist; it is empty since #122, so a future
 `tools.expose*` route to any tool is refused before it can remove a review,
 merge or host tool.
@@ -44,8 +49,24 @@ profile's 28 loaded tools and pins 29 for the all-rows-on surface.
 
 #121 also shrank the config surface: the seven capability `tools.expose*` keys
 and `dev.hotReload` became component rows, so config keys went 64 → 56 and
-sections 15 → 14. Those are recorded shrank values in the committed baseline,
-not free growth: a later increase still needs its own decision.
+sections 15 → 14. Sections keep the ADR 0004 cheap-shrink rule. #136 shrank the
+config keys once more, 56 → 55: `tests.enabled` was a second switch over the
+`tower-tests` component row, so the row is now the only switch and the key is
+gone (a config that still writes it fails with `config-unknown-key`). #133 and
+#135 shrank it again, 55 → 53: `docs.board` and `archive.enabled` were the same
+kind of second switch over the new `tower-board` and `tower-archive` rows, so
+each row is now the only switch and both keys are gone (a config that still sets
+either fails with `config-unknown-key`, and the upgrade note names the replacing
+row).
+
+Since #138 that 64 → 53 history is one dated decision in
+[`scripts/surface-baseline.json`](../../scripts/surface-baseline.json), and the
+config-key count is two-way: a later increase **or** decrease needs its own
+decision naming an ADR, unlike sections and tools. The same wave makes the gate
+import `OPERATIONAL_TOOLS` instead of scraping it, discover every shipped
+`cordis.patch.yml` in both directions, review the non-boolean behaviour knobs
+(`spawn.requireLease`, `tests.admission`), and refuse a row config outside its
+component's `allowedOverrides`.
 
 ## Config keys
 
@@ -89,7 +110,6 @@ not free growth: a later increase still needs its own decision.
 | `spawn.requireLease` | niche | Advisory-lease gate added for one multi-agent workflow. Removal note: fold into `tower_resource` policy in the next minor unless a second workflow uses it. |
 | `send.maxPerMinute` | tuning | Message rate limit; zero disables it. |
 | `send.interruptDefault` | tuning | Default for the interrupt-before-deliver flag. |
-| `tests.enabled` | core | Whether declared discovery may run at all. |
 | `tests.admission` | core | Chooses when repository code is executed. |
 | `tests.timeoutMs` | tuning | Per-command discovery timeout. |
 | `tests.maxBytes` | tuning | Captured discovery output cap. |
@@ -99,10 +119,8 @@ not free growth: a later increase still needs its own decision.
 | `gates.requireTests` | core | Requires a test receipt before merge. |
 | `gates.allowReviewExemption` | core | Allows a review exemption and its reason. |
 | `gates.maxReportBytes` | tuning | Report size cap; the refusal itself is not configurable. |
-| `docs.board` | tuning | Writes the human-readable board. |
-| `docs.boardLocation` | tuning | Chooses the board location. |
-| `archive.enabled` | core | Controls whether terminal missions leave the hot state. |
-| `archive.afterDays` | tuning | Archive age threshold. |
+| `docs.boardLocation` | tuning | Chooses where the board is written; whether it is written is the tower-board row. |
+| `archive.afterDays` | tuning | Archive age threshold; archival itself is the tower-archive row. |
 | `archive.maxMissions` | tuning | Hot terminal-mission cap. |
 | `leases.ttlMs` | tuning | Default advisory lease lifetime. |
 | `dev.reloadDelayMs` | tuning | Delay so a tool result is delivered before reload. |

package/docs/reference/tools.generated.md

@@ -1,7 +1,7 @@
 # Tools overview (generated)
 
 > Generated by `npm run docs:generate:tools` from the registered tool definitions. Do not edit by hand.
-> Surface: config keys: 56 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
+> Surface: config keys: 53 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
 
 | Tool | Description |
 |---|---|