dsh-tower 2.4.1 → 2.5.0

package/domain/scope.js

@@ -155,6 +155,180 @@ function scopePrefix(pattern) {
 }
 
 /**
+ * The historical directory-prefix heuristic. Cheap, and deliberately wider
+ * than the exact glob intersection: it serializes `a/**` with `a` and
+ * `src/*.js` with `src/a/x.js`, and pairs anything with a leading wildcard.
+ * It is only an over-approximation, so it misses inline prefixes such as
+ * `a/b*` vs `a/bc*`; `globLanguagesIntersect` below covers those.
+ * @param {string} pa folded pattern
+ * @param {string} pb folded pattern
+ * @returns {boolean}
+ */
+function prefixesOverlap(pa, pb) {
+  const x = scopePrefix(pa)
+  const y = scopePrefix(pb)
+  if (!x || !y) return true
+  if (x === y) return true
+  return x.startsWith(`${y}/`) || y.startsWith(`${x}/`)
+}
+
+// ---------------------------------------------------------------------------
+// Exact glob-language intersection (F16, #130).
+//
+// Each pattern becomes an NFA over the documented grammar: a literal matches
+// itself, `?` matches one non-`/` character, `*` matches zero or more non-`/`
+// characters, and `**` matches zero or more of any character. Two patterns
+// share a concrete path exactly when the product of their NFAs can reach the
+// accepting states, so the check is complete for that grammar.
+
+/** @typedef {{ kind: 'literal', char: string } | { kind: 'nonSlash' } | { kind: 'any' }} CharSet */
+/** @typedef {{ charset: CharSet, to: number }} GlobTransition */
+/** @typedef {{ kind: 'literal', char: string } | { kind: 'star' } | { kind: 'any' } | { kind: 'question' }} GlobToken */
+
+/**
+ * Split a pattern into glob tokens exactly like `globToRegExp` walks it: a
+ * doubled `*` is one `**` token (anything, including `/`), every other `*` is
+ * one non-`/` token, `?` is one non-`/` character, and everything else is a
+ * literal (including `[`, `]`, `{` and `}` — they are not grammar, #130).
+ * @param {string} pattern
+ * @returns {GlobToken[]}
+ */
+function globTokens(pattern) {
+  /** @type {GlobToken[]} */
+  const tokens = []
+  for (let index = 0; index < pattern.length; index += 1) {
+    const char = pattern[index]
+    if (char === '*') {
+      if (pattern[index + 1] === '*') {
+        tokens.push({ kind: 'any' })
+        index += 1
+      } else {
+        tokens.push({ kind: 'star' })
+      }
+    } else if (char === '?') {
+      tokens.push({ kind: 'question' })
+    } else {
+      tokens.push({ kind: 'literal', char })
+    }
+  }
+  return tokens
+}
+
+/**
+ * The characters one token can consume from `state`, and where they lead.
+ * A `*`/`**` token loops on itself; skipping it (consuming nothing) is the
+ * epsilon transition, handled by `epsilonClosure`.
+ * @param {GlobToken | undefined} token
+ * @param {number} state
+ * @returns {GlobTransition[]}
+ */
+function tokenTransitions(token, state) {
+  if (token === undefined) return []
+  if (token.kind === 'literal') return [{ charset: { kind: 'literal', char: token.char }, to: state + 1 }]
+  if (token.kind === 'question') return [{ charset: { kind: 'nonSlash' }, to: state + 1 }]
+  if (token.kind === 'star') return [{ charset: { kind: 'nonSlash' }, to: state }]
+  return [{ charset: { kind: 'any' }, to: state }]
+}
+
+/**
+ * States reachable from `state` without consuming a character: a `*` or `**`
+ * token may be skipped, and consecutive skippable tokens chain.
+ * @param {GlobToken[]} tokens
+ * @param {number} state
+ * @returns {number[]}
+ */
+function epsilonClosure(tokens, state) {
+  const out = [state]
+  let cursor = state
+  while (cursor < tokens.length) {
+    const token = tokens[cursor]
+    if (token === undefined || (token.kind !== 'star' && token.kind !== 'any')) break
+    cursor += 1
+    out.push(cursor)
+  }
+  return out
+}
+
+/**
+ * Whether one character can satisfy both transitions' character sets.
+ * `any` includes `/`, so it intersects every set.
+ * @param {CharSet} left
+ * @param {CharSet} right
+ * @returns {boolean}
+ */
+function charsetsIntersect(left, right) {
+  if (left.kind === 'literal' && right.kind === 'literal') return left.char === right.char
+  if (left.kind === 'literal') return left.char !== '/' || right.kind === 'any'
+  if (right.kind === 'literal') return right.char !== '/' || left.kind === 'any'
+  return true
+}
+
+/**
+ * Whether the two patterns match at least one common path.
+ * @param {GlobToken[]} left
+ * @param {GlobToken[]} right
+ * @returns {boolean}
+ */
+function globLanguagesIntersect(left, right) {
+  /** @type {number[][]} */
+  const leftClosures = []
+  for (let state = 0; state <= left.length; state += 1) leftClosures.push(epsilonClosure(left, state))
+  /** @type {number[][]} */
+  const rightClosures = []
+  for (let state = 0; state <= right.length; state += 1) rightClosures.push(epsilonClosure(right, state))
+
+  /** @type {[number, number][]} */
+  const queue = [[0, 0]]
+  const seen = new Set(['0:0'])
+  while (queue.length > 0) {
+    const pair = queue.pop()
+    if (pair === undefined) break
+    const [leftState, rightState] = pair
+    const leftClosure = leftClosures[leftState] ?? [leftState]
+    const rightClosure = rightClosures[rightState] ?? [rightState]
+    if (leftClosure.includes(left.length) && rightClosure.includes(right.length)) return true
+    for (const fromLeft of leftClosure) {
+      for (const fromRight of rightClosure) {
+        for (const leftMove of tokenTransitions(left[fromLeft], fromLeft)) {
+          for (const rightMove of tokenTransitions(right[fromRight], fromRight)) {
+            if (!charsetsIntersect(leftMove.charset, rightMove.charset)) continue
+            const key = `${leftMove.to}:${rightMove.to}`
+            if (seen.has(key)) continue
+            seen.add(key)
+            queue.push([leftMove.to, rightMove.to])
+          }
+        }
+      }
+    }
+  }
+  return false
+}
+
+/**
+ * Whether two scopes may own the same path, i.e. whether the missions that
+ * declare them must serialize. The contract is a *sound over-approximation*:
+ *
+ *   * if one concrete path is in both scopes, this returns true;
+ *   * it may also return true for scopes that only look adjacent, because the
+ *     directory-prefix heuristic is deliberately conservative (`a/**` vs `a`,
+ *     `src/*.js` vs `src/a/x.js`, anything with a leading wildcard).
+ *
+ * `false` therefore means "provably disjoint within the documented grammar"
+ * (`*` never crosses `/`, `**` does, `?` is one non-`/` character, everything
+ * else is literal, and only `*`, `**` and `?` are special).
+ *
+ * Each pair of entries is checked twice, and either check may return true:
+ *   1. the legacy directory-prefix heuristic (cheap, conservative);
+ *   2. an exact intersection of the two glob languages, which catches the
+ *      inline prefixes the heuristic misses: `a/b*` and `a/bc*` both match
+ *      `a/bcd`, and `src/a*.mjs` and `src/ab*.mjs` both match `src/abx.mjs`.
+ *
+ * Known limits: `[...]` and `{...}` are not grammar (they match literally,
+ * same as `fileInScope`); a leading wildcard is treated as a wildcard tree, so
+ * a scope that starts with a glob token overlaps every scope.
+ * `caseInsensitive` only decides the comparison — neither the stored scope
+ * text nor the result is rewritten.
+ *
  * @param {string[]} a
  * @param {string[]} b
  * @param {MatchOptions} [options]
@@ -166,11 +340,8 @@ export function scopesOverlap(a, b, { caseInsensitive = false } = {}) {
       const pa = foldCase(rawA, caseInsensitive)
       const pb = foldCase(rawB, caseInsensitive)
       if (pa === pb) return true
-      const x = scopePrefix(pa)
-      const y = scopePrefix(pb)
-      if (!x || !y) return true
-      if (x === y) return true
-      if (x.startsWith(`${y}/`) || y.startsWith(`${x}/`)) return true
+      if (prefixesOverlap(pa, pb)) return true
+      if (globLanguagesIntersect(globTokens(pa), globTokens(pb))) return true
     }
   }
   return false

package/domain/surface.js

@@ -20,8 +20,10 @@ export const SURFACE_KEYS = ['configKeys', 'sections', 'tools', 'components']
 // A count in this list is two-way: a contraction needs a decision record just
 // like growth does. The component surface is where the failure actually
 // happened (4 top-level rows -> 1 group row), so "a reduction is cheap" is
-// exactly the policy hole #120 closes.
-export const SURFACE_TWO_WAY_KEYS = ['components']
+// exactly the policy hole #120 closes. #138 extends the same brake to the config
+// keys: a removed switch is a capability decision too, so the key count may not
+// shrink silently either. Sections and tools keep the ADR 0004 cheap-shrink rule.
+export const SURFACE_TWO_WAY_KEYS = ['components', 'configKeys']
 export const CONFIG_CLASSES = ['core', 'tuning', 'niche']
 export const TOOL_CLASSES = ['core', 'optional']
 export const SURFACE_SCHEMA_VERSION = 1
@@ -240,8 +242,10 @@ function correctionEvidence(decision, where, record, exists) {
  * live surface, or a valid measurement-correction record.
  *
  * A two-way surface (see SURFACE_TWO_WAY_KEYS) also refuses a contraction whose
- * new count is not reached by a decision record; the other surfaces keep the
- * "a reduction is cheap" rule from ADR 0004.
+ * new count is not reached by a decision record, and every one of its decisions
+ * must carry a real `date` (YYYY-MM-DD): "needs a decision" means a dated
+ * decision, not a bare from/to step. The other surfaces keep the "a reduction is
+ * cheap" rule from ADR 0004 and only format-check a date when one is present.
  *
  * Extracted from `validateBaseline` so a narrower gate (`docs:check:components`,
  * #120) can validate just the component count without re-measuring the others.
@@ -268,14 +272,25 @@ export function validateSurfaceEntry(key, entry, live, liveNames, options = {})
       `${key} ${direction} from the committed baseline ${entry.value} to ${live}; update ${SURFACE_BASELINE_FILE} with an ADR or a deletion record before landing`,
     )
   }
+  const twoWay = SURFACE_TWO_WAY_KEYS.includes(key)
   let running = entry.seed
   entry.decisions.forEach((decision, index) => {
     const where = `${key}.decisions[${index}]`
     if (decision.from !== running) {
       record('broken-chain', `${where}.from ${decision.from} does not continue from ${running}`)
     }
-    if (decision.date !== undefined && !ISO_DATE.test(String(decision.date))) {
-      record('broken-chain', `${where}.date is not YYYY-MM-DD`)
+    const dated = typeof decision.date === 'string' && ISO_DATE.test(decision.date)
+    if (!dated) {
+      if (decision.date === undefined) {
+        if (twoWay) {
+          record(
+            'broken-chain',
+            `${where}.date is required: a two-way surface needs a dated decision (YYYY-MM-DD), not just a from/to record`,
+          )
+        }
+      } else {
+        record('broken-chain', `${where}.date is not YYYY-MM-DD`)
+      }
     }
     const growth = decision.to - decision.from
     if (growth > 0) {
@@ -300,7 +315,6 @@ export function validateSurfaceEntry(key, entry, live, liveNames, options = {})
     }
     running = decision.to
   })
-  const twoWay = SURFACE_TWO_WAY_KEYS.includes(key)
   if (running !== entry.value && !(entry.decisions.length === 0 && entry.value < running && !twoWay)) {
     record(
       'broken-chain',

package/host/capability-archive.js

@@ -0,0 +1,18 @@
+// tower-archive component entry (#135): terminal-mission archival only.
+//
+// Archival used to be the `archive.enabled` tuning boolean. It is a capability —
+// off means terminal missions stay hot in state.json — so it is its own row and
+// its own switch. The row owns no tool: the sweep runs after mutations and asks
+// this registry whether the row is mounted. Off means the hot state keeps
+// growing; merges, gates and every other capability keep working and nothing is
+// deleted. `archive.afterDays` / `archive.maxMissions` stay genuine tuning.
+//
+// The row is declared in cordis.patch.yml; the package export is `./archive`.
+import { holdComponent } from './capability-registry.js'
+
+export const name = 'dsh-tower/archive'
+export const inject = ['tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-archive')
+}

package/host/capability-board.js

@@ -0,0 +1,18 @@
+// tower-board component entry (#133): the generated MISSIONS.md board only.
+//
+// The board used to be the `docs.board` tuning boolean. It is a capability — off
+// means the human-readable artifact is simply not written — so it is its own row
+// and its own switch. The row owns no tool: the board is written by the
+// composition that registers tools, which asks this registry whether the row is
+// mounted. Off leaves every mission tool, gate and other capability working; an
+// existing board just goes stale. `docs.boardLocation` stays genuine tuning.
+//
+// The row is declared in cordis.patch.yml; the package export is `./board`.
+import { holdComponent } from './capability-registry.js'
+
+export const name = 'dsh-tower/board'
+export const inject = ['tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-board')
+}

package/host/capability-registry.js

@@ -21,6 +21,8 @@ export const TOWER_COMPONENT_IDS = Object.freeze([
   'tower-import',
   'tower-leases',
   'tower-tests',
+  'tower-board',
+  'tower-archive',
   'tower-hmr',
   'preset-tower-reviewer',
 ])
@@ -32,6 +34,8 @@ export const COMPONENT_TOOLS = Object.freeze({
   'tower-import': Object.freeze(['tower_import_legacy', 'tower_legacy_map']),
   'tower-leases': Object.freeze(['tower_resource']),
   'tower-tests': Object.freeze(['tower_test']),
+  'tower-board': Object.freeze([]),
+  'tower-archive': Object.freeze([]),
   'tower-hmr': Object.freeze(['tower_reload']),
   'preset-tower-reviewer': Object.freeze([]),
 })

package/host/doctor.js

@@ -331,6 +331,25 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       : check('components', 'pass', componentSummary(components)),
   )
 
+  // #131: `spawn.requireLease` is acquired through `tower_resource`, which belongs
+  // to the tower-leases row. The runtime preconditions refuse this combination, so
+  // the doctor reports it first and names both remedies instead of letting it
+  // surface as a lease-busy from every spawn.
+  const requiredLease = String(config.spawn?.requireLease ?? '').trim()
+  if (requiredLease) {
+    const leasesDisabled = components.disabled.some((entry) => entry.id === 'tower-leases')
+    checks.push(
+      leasesDisabled
+        ? check(
+            'spawn-lease',
+            'fail',
+            `spawn.requireLease="${requiredLease}" is set but the tower-leases row is disabled, so tower_resource cannot acquire the lease`,
+            're-enable the tower-leases row in the plugin page and restart DSH, or clear spawn.requireLease',
+          )
+        : check('spawn-lease', 'pass', `spawn.requireLease="${requiredLease}" is satisfiable (tower-leases row enabled)`),
+    )
+  }
+
   const subagents = ctx.get?.('subagents')
   checks.push(subagents ? check('subagents', 'pass', 'service mounted') : check('subagents', 'fail', 'subagents service is unavailable', 'enable the subagent bundle'))
   const hmr = ctx.get?.('hmr')
@@ -426,20 +445,41 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
     )
 
     const testConfigured = state.missions?.some((mission) => mission.testRuns !== undefined)
-    const testsDisabled =
-      config.tests?.enabled === false || components.disabled.some((entry) => entry.id === 'tower-tests')
+    // #136: the `tower-tests` component row is the only switch (there is no
+    // tests.enabled), so this check reads the registry and nothing else.
+    const testsDisabled = components.disabled.some((entry) => entry.id === 'tower-tests')
     checks.push(
       check(
         'tests',
         testsDisabled ? 'warn' : 'pass',
         testsDisabled
-          ? `test discovery disabled${config.tests?.enabled === false ? ' (tests.enabled:false)' : ' (disabled by component tower-tests)'}`
+          ? 'test discovery disabled (disabled by component tower-tests; enable the tower-tests row and restart DSH)'
           : `admission=${config.tests?.admission ?? 'complete'} timeoutMs=${config.tests?.timeoutMs ?? 60000}${testConfigured ? '; receipts present' : ''}`,
       ),
     )
     checks.push(check('legacy', 'pass', `${state.legacySnapshots?.length ?? 0} legacy snapshot(s)`))
     checks.push(check('batches', 'pass', `${state.batches?.length ?? 0} batch(es)`))
 
+    // #133: whether MISSIONS.md is written is the `tower-board` row, not a config
+    // key, so name the component when it is off instead of a phantom key.
+    const boardDisabled = components.disabled.some((entry) => entry.id === 'tower-board')
+    const boardPath =
+      config.docs?.boardLocation === 'repo'
+        ? path.join(tower.root, 'MISSIONS.md')
+        : path.join(tower.paths.dir, 'MISSIONS.md')
+    checks.push(
+      check(
+        'board',
+        boardDisabled ? 'warn' : 'pass',
+        boardDisabled
+          ? `MISSIONS.md is not written (disabled by component tower-board); expected at ${boardPath}`
+          : `MISSIONS.md refreshes after mission changes at ${boardPath}`,
+        boardDisabled
+          ? 'enable the tower-board row and restart DSH, or accept a stale board; every state tool and gate still works'
+          : undefined,
+      ),
+    )
+
     // Completion reports are the largest model-supplied strings in state.json;
     // report the biggest one so growth is visible before it becomes a problem.
     const reportSizes = (state.missions ?? [])
@@ -519,7 +559,12 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   const archiveInventory = await inspectArchive(tower.paths)
   const stateBytes = await fsp.stat(tower.paths.state).then((stat) => stat.size).catch(() => null)
   const archivePolicy = config.archive ?? {}
-  const policyText = `afterDays=${archivePolicy.afterDays ?? 30} maxMissions=${archivePolicy.maxMissions ?? 100}${archivePolicy.enabled === false ? ' disabled' : ''}`
+  // #135: archival is the `tower-archive` row. Name the component when it is off;
+  // the documented consequence is that terminal missions stay hot.
+  const archiveEnabled = !components.disabled.some((entry) => entry.id === 'tower-archive')
+  const policyText = `afterDays=${archivePolicy.afterDays ?? 30} maxMissions=${archivePolicy.maxMissions ?? 100}${
+    archiveEnabled ? '' : ' (disabled by component tower-archive: terminal missions stay hot and state.json keeps growing)'
+  }`
   if (!archiveInventory.exists) {
     checks.push(check('archive', 'pass', `no archived missions; ${policyText}`))
   } else if (archiveInventory.unreadable.length > 0) {
@@ -562,7 +607,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       files: archiveInventory.files.length,
       unreadable: archiveInventory.unreadable,
       policy: {
-        enabled: archivePolicy.enabled !== false,
+        enabled: archiveEnabled,
         afterDays: archivePolicy.afterDays ?? 30,
         maxMissions: archivePolicy.maxMissions ?? 100,
       },

package/host/preset-reviewer.js

@@ -0,0 +1,27 @@
+// Tower reviewer preset declaration (#121): the read-only preset's own label.
+//
+// This is the reviewer half of the pair documented in `host/preset-worker.js`.
+// The row used to mount `@deepseek-ai/dsh-agent-preset`, so DSH resolved that
+// shared module's locale and both preset rows rendered the same title; the
+// conditional reviewer switch was therefore indistinguishable from the
+// mandatory worker dependency. A Tower-owned module gives each row its own
+// `<specifier>/locale/<lang>.json` resource without importing the agent-preset
+// package (which is not resolvable from this package anyway).
+//
+// The module forwards the unchanged row config to the injected `agentPresets`
+// service and returns its disposer, so `register`/unregister lifecycle, the
+// definition's `plugins` mount and the activation diagnostic all stay registry
+// owned. It imports nothing and renders nothing.
+export const name = 'dsh-tower/preset-reviewer'
+
+export const inject = ['agentPresets']
+
+/**
+ * Register the reviewer preset with the profile's preset registry.
+ * @param {{ agentPresets: { register: (config: any) => Promise<() => Promise<void> | void> } }} ctx
+ * @param {any} config the `cordis.patch.yml` row config (id/name/description/order/plugins)
+ * @returns {Promise<() => Promise<void> | void>} the registry's unregister disposer
+ */
+export async function apply(ctx, config) {
+  return ctx.agentPresets.register(config)
+}

package/host/preset-worker.js

@@ -0,0 +1,32 @@
+// Tower worker preset declaration (#121): one row, one Plugins-page label.
+//
+// DSH labels a row from `readPluginMeta(row.moduleName)`, which resolves
+// `<specifier>/locale/en.json` and every sibling `<lang>.json` there. Both
+// preset rows used to mount `@deepseek-ai/dsh-agent-preset`, so both shared that
+// module's single label and the page could not tell the worker from the
+// reviewer. That package is also not resolvable from this package, so Tower
+// cannot add per-row locale files to it.
+//
+// This module is the tiny Tower-owned twin: it keeps the row config in
+// `cordis.patch.yml` and forwards it to the injected `agentPresets` service. The
+// service owns preset semantics — it mounts the definition's `plugins` list
+// itself and returns the disposer that unmounts it — so this module stays
+// renderer-free and imports nothing. Its specifier carries the worker label
+// (`dsh-tower/preset-worker/locale/<lang>.json`).
+//
+// Shape: a plain object plugin (named exports) whose async `apply` returns the
+// registry's disposer. Cordis collects the resolved function as the plugin's
+// disposer, so disabling the row (or an HMR unload) unregisters the preset.
+export const name = 'dsh-tower/preset-worker'
+
+export const inject = ['agentPresets']
+
+/**
+ * Register the worker preset with the profile's preset registry.
+ * @param {{ agentPresets: { register: (config: any) => Promise<() => Promise<void> | void> } }} ctx
+ * @param {any} config the `cordis.patch.yml` row config (id/name/description/order/plugins)
+ * @returns {Promise<() => Promise<void> | void>} the registry's unregister disposer
+ */
+export async function apply(ctx, config) {
+  return ctx.agentPresets.register(config)
+}

package/host/presets.js

@@ -13,6 +13,11 @@
 // `tower-tests` adds a third: with the component row off there is no
 // `tower_test` tool and no receipt, so `gates.requireTests: true` is refused
 // here rather than left to fail at merge time with a misleading blocker.
+//
+// `tower-leases` adds a fourth (#131): `spawn.requireLease` is satisfied through
+// `tower_resource`, the tool the `tower-leases` row owns. With that row off every
+// spawn would fail at `lease-busy` advising a tool that is not registered, so the
+// contradiction is refused up front instead.
 import { TowerToolError } from '../domain/errors.js'
 import { componentEnabled, disabledReason } from './capability-registry.js'
 
@@ -73,5 +78,17 @@ export async function assertRuntimePreconditions(ctx, config = {}) {
       `gates.requireTests is true but ${disabledReason('tower-tests')}; re-enable the tower-tests component or set gates.requireTests:false`,
     )
   }
+  // #131: `spawn.requireLease` is acquired through `tower_resource`, which only
+  // exists while the tower-leases row is mounted. Without this check the config
+  // looks valid and every spawn dies at `lease-busy` pointing at a tool that is
+  // not registered. Both remedies are named because either side may be the
+  // accidental one.
+  const requiredLease = String(config.spawn?.requireLease ?? '').trim()
+  if (requiredLease && !componentEnabled('tower-leases')) {
+    throw new TowerToolError(
+      'config-invalid',
+      `spawn.requireLease="${requiredLease}" is set but ${disabledReason('tower-leases')}; tower_resource is not registered, so the lease can never be acquired. Re-enable the tower-leases component or clear spawn.requireLease`,
+    )
+  }
   return presets
 }

package/host/tool-registry.js

@@ -378,7 +378,11 @@ async function ensureRepository(repoRootInput, autoGitInit) {
   }
 }
 
-const OPERATIONAL_TOOLS = new Map()
+// #138: exported so `scripts/check-components.mjs` can import the route table
+// instead of scraping this file. The table is empty since #122; an empty Map is
+// the determined state, while a missing export or a failed import is a gate
+// failure.
+export const OPERATIONAL_TOOLS = new Map()
 
 function plainSchema(value) {
   return JSON.parse(JSON.stringify(value))
@@ -473,8 +477,11 @@ async function runMissionDiscovery(tower, mission) {
     return { configured: false, disabledBy: 'tower-tests', reason: disabledReason('tower-tests') }
   }
   const testsConfig = tower.config.tests ?? {}
-  if (testsConfig.enabled === false || testsConfig.allowPackageDiscovery === false) {
-    return { configured: false }
+  // #136: there is no second switch. The `tower-tests` row decided above; the
+  // only remaining reason to skip discovery is an explicit opt-out of repository
+  // package discovery.
+  if (testsConfig.allowPackageDiscovery === false) {
+    return { configured: false, error: 'test discovery is disabled by tests.allowPackageDiscovery:false' }
   }
   const worktreePath = mission?.worktree?.path
   if (!worktreePath) return { configured: false, error: 'mission has no worktree' }
@@ -565,6 +572,14 @@ export function registerCoreTowerTools(ctx, options = {}) {
   const baseDeps = options.deps ? assertPorts(options.deps) : (runtimeState.deps ?? createDefaultDeps())
   runtimeState.deps = {
     ...baseDeps,
+    // #140: the merge gate lives in the pure domain, which cannot read the
+    // component registry. Publish the two probes it needs on the port bag the
+    // store already receives, so `evaluateGate` can name a disabled row as the
+    // cause instead of guessing from config.
+    components: {
+      enabled: (id) => componentEnabled(id),
+      reason: (id) => disabledReason(id),
+    },
     events: {
       emit(name, payload) {
         try {
@@ -615,7 +630,9 @@ export function registerCoreTowerTools(ctx, options = {}) {
 
   registerStatusTool(ctx, { openTower, define, workspaceHook: runtimeState.workspaceHook, spawnBackoffView, observeActivity, componentReport })
 
-  registerSpawnTool(ctx, { openTower, define, actorFor, requireTowerActor, enqueueSpawn, observeActivity, spawnBackoffState, recordSpawnThrottle, recordSpawnSuccess, runMissionDiscovery, textOf, inspectLeases })
+  // #131: the lease precondition needs the row state, and the app layer may not
+  // import the registry, so the probe travels with the other spawn deps.
+  registerSpawnTool(ctx, { openTower, define, actorFor, requireTowerActor, enqueueSpawn, observeActivity, spawnBackoffState, recordSpawnThrottle, recordSpawnSuccess, runMissionDiscovery, textOf, inspectLeases, leaseComponent: () => ({ enabled: componentEnabled('tower-leases'), reason: disabledReason('tower-leases') }) })
 
   registerRosterTool(ctx, { openTower, define })
 

package/index.js

@@ -398,11 +398,15 @@ export function apply(ctx, rawConfig) {
       : () => {},
   )
 
-  ctx.systemPrompt.section({
-    name: 'tower:mode',
-    order: 15000,
-    text: (context) => (context && modeOn(agentKey(context.agent)) ? reminder : ''),
-  })
+  // #139: same leak as the skills provider — the section belongs to the plugin
+  // lifetime, so registration goes through `ctx.effect`.
+  ctx.effect(() =>
+    ctx.systemPrompt.section({
+      name: 'tower:mode',
+      order: 15000,
+      text: (context) => (context && modeOn(agentKey(context.agent)) ? reminder : ''),
+    }),
+  )
 
   // Workspace-lock heartbeat; only sessions holding a lock do I/O.
   ctx.effect(() => {
@@ -583,7 +587,14 @@ export function apply(ctx, rawConfig) {
           }
         }
         const { active, message } = parsed
-        if (active) await assertRuntimePreconditions(ctx, config)
+        // #142: preconditions guard the *transition* into Tower mode, not every
+        // `/tower` instruction. Re-validating on an already-active session meant a
+        // row disabled later in the session (tower-hmr ships off) blocked
+        // `/tower off` and ordinary forwarded text — the two commands a human
+        // needs precisely when something is broken. Spawn/plan/merge keep their own
+        // guards, so the capability checks still run before any real work.
+        const transition = active && !modeOn(key)
+        if (transition) await assertRuntimePreconditions(ctx, config)
         const outcome = active
           ? enterMode(ctx, key, agent, 'user', message || null)
           : await exitMode(key, 'user', message || null)

package/locale/archive/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Mission archive",
+    "description": "Move finished missions and their linked records into the on-disk archive, so the live state file stops carrying their full history. When off: Finished missions stay in the live state file, so it keeps growing; merges and every other capability keep working, and nothing is deleted."
+  }
+}

package/locale/archive/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "任务线归档",
+    "description": "把已结束的任务线及其关联记录移入磁盘归档，让当前状态文件不再承载它们的完整历史。关闭后：已结束的任务线继续留在当前状态文件中，文件会持续增大；合并与其他能力继续工作，且不会删除任何内容。"
+  }
+}

package/locale/batch/en.json

@@ -1,6 +1,6 @@
 {
   "meta": {
     "title": "Evidence batches",
-    "description": "Group missions into finite evidence batches and close them against required checks and receipts. When off: tower_batch is not registered; missions, gates and merges are unaffected."
+    "description": "Collect a finite set of missions into a batch and close it only when every required check and evidence receipt is present. When off: Batch tools and their checks are unavailable; missions, merges and every other capability keep working."
   }
 }

package/locale/batch/zh.json

@@ -1,6 +1,6 @@
 {
   "meta": {
     "title": "证据批次",
-    "description": "把 mission 归入有限证据批次，并按必需检查与回执关闭批次。关闭后：不再注册 tower_batch；mission、门禁与合并不受影响。"
+    "description": "把一组任务线收进一个批次，只有当所有必需检查与证据回执齐全时才允许关闭该批次（或结案）。关闭后：批次工具及其检查不可用；任务线、合并与其他能力继续工作。"
   }
 }

package/locale/board/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Mission board",
+    "description": "Write a plain-text board file (MISSIONS.md) beside the state so a person can read the mission list without calling a tool. When off: The board file is not written or refreshed, so an existing board goes stale; missions, merges and every other capability keep working."
+  }
+}

package/locale/board/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "任务线看板",
+    "description": "在状态文件旁写入纯文本看板文件（MISSIONS.md），让人无需调用工具就能阅读任务线列表。关闭后：不再写入或刷新看板文件，已有看板会过期；任务线、合并与其他能力继续工作。"
+  }
+}