dsh-tower 2.4.2 → 2.5.0

package/docs/guide/quickstart.md

@@ -100,3 +100,74 @@ Statuses are `open → triaged → fixed` / `wontfix`, and `fixed`/`wontfix` can
 tower or a worker may change a finding; reviewers can list and read.
 
 A complete copy-paste example: [examples/first-mission.md](../examples/first-mission.md).
+
+## Component rows, runtime preconditions and message language
+
+The optional component rows are the only switches in this bundle (#121, #136). Three runtime rules
+follow from that, plus the language policy for everything a tool prints.
+
+### A row is the only switch
+
+`tests.enabled` was removed (#136). Discovery is on exactly while the `tower-tests` row is mounted:
+with the row off there is no `tower_test` tool and no test receipt to gate on, so a second boolean
+could only disagree with the mounted profile. A repository config that still writes
+`tests.enabled` is rejected as `config-unknown-key`; delete the key and enable or disable the row
+instead.
+
+The same reasoning covers the other rows:
+
+- `tower-leases` owns `tower_resource`. `spawn.requireLease` is satisfied through that tool, so a
+  config that requires a lease while the row is off is refused by the runtime preconditions with
+  `config-invalid`, naming the row and both remedies ("re-enable the tower-leases component or clear
+  spawn.requireLease") instead of failing every spawn at `lease-busy` with advice to use a tool that
+  is not registered (#131).
+- `tower-tests` must stay mounted while `gates.requireTests` is true. Planning and mode entry refuse
+  the combination; the merge gate's `tests-missing` blocker also names the disabled row as the cause
+  (#140).
+- `tower-hmr` ships off; `/tower reload` reports it by row name.
+
+No runtime path may claim a repository is "not configured" when a component row is the reason.
+Runtime refusals report the cause as `disabled by component <id>` and come with the fix (`enable the
+<id> row in the plugin page and restart DSH`).
+
+### Preconditions run on mode entry, not on every `/tower` input (#142)
+
+`/tower` re-validates the runtime preconditions (presets, component/config contradictions) only when
+it **enters** Tower mode:
+
+| Input | Preconditions |
+|---|---|
+| `/tower`, `/tower on`, `/tower <text>` while the mode is off | validated |
+| `/tower off`, `/tower off <text>` | not validated |
+| `/tower <text>` while the mode is already on | not validated |
+| `/tower ack`, `/tower base <branch>`, `/tower reload` | not validated |
+
+The reason: a row disabled after the session started (or a profile reloaded with a stricter config)
+must not make `/tower off` — the command a human needs to leave the mode — or an ordinary forwarded
+instruction fail. Capability guards still run where the work happens: `tower_spawn`, planning and
+merge/preflight evaluate their own preconditions, so the checks cannot be bypassed by entering the
+mode first.
+
+### Language of tool output
+
+Machine-facing output is **English only**, regardless of the request locale:
+
+- tool errors (`[tower:<code>] ...`), `nextAction`, blocker `detail` strings, `tower_status` /
+  `tower_doctor` detail lines, and completion reports;
+- anything that a script, a log search or another agent is expected to pattern-match.
+
+Localized, human-facing copy lives in `locale/*.json` (component descriptions, UI labels) and is the
+only translated surface. Two rules keep the split honest:
+
+1. New detail/error strings are written in English even when the surrounding UI is Chinese; they are
+   not added to `locale/*.json`.
+2. A localized label never shadows a machine-readable cause. The row id, the error code and the
+   English remedy phrase stay verbatim inside the message, so a grep for
+   `disabled by component tower-tests` works in every locale.
+
+`tower_status` and `tower_doctor` follow this policy but are not textually identical: `tower_status`
+returns the cause only — `components.disabled` is `[{id, reason}]` with `reason` set to
+`disabled by component <id>` — while `tower_doctor` repeats that reason and adds the English remedy
+(`enable the reported row in the plugin page and restart DSH` for the `components` check; a
+capability-specific check names the row directly, e.g. `enable the tower-tests row and restart DSH`).
+Neither interpolates a translated label.

package/docs/guide/release.md

@@ -97,29 +97,70 @@ git for-each-ref refs/tags/v2.1.0-beta.1 --format='%(objecttype)|%(subject)'
 The pushed tag must be exactly `v<version>`. The tag push re-runs `release:check` against
 `<tag>^`; this is why tagging a commit whose `package.json` did not move fails.
 
-## 6. GitHub Release from the CHANGELOG section
+## 6. GitHub Release with cumulative notes
+
+A Release body is not just its own CHANGELOG section: it carries **every** section after the
+previous GitHub Release (see [Cumulative Release notes](#cumulative-release-notes--累积发布说明)
+below). `scripts/release-notes.mjs` is the authority for that body — do not hand-extract a single
+section. The checklist step is `npm run release:notes -- --version <v> --since <prev-release> --output notes.md`, then pass that file to `gh release create`/`gh release edit` with `--notes-file notes.md`.
 
 ```bash
-VERSION=2.1.0-beta.1
-awk -v v="$VERSION" '$0 ~ "^##[[:space:]]+.*" v {s=1; next} s && /^##[[:space:]]/ {exit} s {print}' \
-  CHANGELOG.md > release-notes.md
-test -s release-notes.md || { echo "empty section for $VERSION" >&2; exit 1; }
-gh release create "v$VERSION" --title "dsh-tower $VERSION" --notes-file release-notes.md \
-  --prerelease --verify-tag --latest=false
+# Stable release (the common case): no pre-release flags.
+VERSION=2.3.0
+SINCE=2.1.0                 # the previous GitHub Release, not the previous tag
+npm run release:notes -- --version "$VERSION" --since "$SINCE" --output notes.md
+npm run release:notes -- --version "$VERSION" --since "$SINCE" --check notes.md
+gh release create "v$VERSION" --title "dsh-tower $VERSION" --notes-file notes.md --verify-tag
+# editing a Release that already exists (for example, to correct its window):
+gh release edit "v$VERSION" --notes-file notes.md
 gh release view "v$VERSION" --json tagName,isPrerelease,body
 ```
 
-PowerShell extraction of the same section:
-
-```powershell
-$version = '2.1.0-beta.1'; $lines = Get-Content CHANGELOG.md
-$start = ($lines | Select-String -Pattern "^##\s+.*$([regex]::Escape($version))" | Select-Object -First 1).LineNumber
-if (-not $start) { throw "CHANGELOG has no section for $version" }
-$next = ($lines | Select-String -Pattern '^##\s+' | Where-Object LineNumber -gt $start | Select-Object -First 1).LineNumber
-$end = if ($next) { $next - 2 } else { $lines.Count - 1 }
-($lines[$start..$end] -join "`n").Trim() | Set-Content release-notes.md -Encoding utf8
+```bash
+# Pre-release variant (a beta, for example 2.5.0-beta.1): mark the Release and keep "latest"
+# on the previous stable Release.
+VERSION=2.5.0-beta.1
+SINCE=2.4.2                 # the previous GitHub Release; a pre-release counts as one too
+npm run release:notes -- --version "$VERSION" --since "$SINCE" --output notes.md
+gh release create "v$VERSION" --title "dsh-tower $VERSION" --notes-file notes.md \
+  --prerelease --verify-tag --latest=false
 ```
 
-`--verify-tag` refuses to create the tag at the default branch when the pushed tag is missing;
-`--prerelease --latest=false` keeps the GitHub "latest" marker on the stable release. Releases
-are what consumers and the plugin directory can see — a tag alone is not a release.
+`--check notes.md` exits 1 when the file differs from the generated text (it prints the first
+differing line and both byte counts), so a correction is verifiable. The script exits 2 on a
+missing/unknown flag, an invalid version, `since >= version`, or an empty window; it never emits
+a Release body it cannot justify.
+
+`--verify-tag` refuses to create the tag at the default branch when the pushed tag is missing.
+A beta Release adds `--prerelease --latest=false`: GitHub marks it as a pre-release and keeps
+the "latest" marker on the stable Release. Releases are what consumers and the plugin directory
+can see — a tag alone is not a release.
+
+## Cumulative Release notes / 累积发布说明
+
+A GitHub Release is cumulative: it aggregates every CHANGELOG section **after the previous
+Release**, up to and including the version being released.
+
+- The **previous Release** is the latest published GitHub Release by version. Pre-releases
+  created with `--prerelease` count as Releases, so a `2.1.0-beta.1` Release is a boundary too.
+- **Tag-only versions have no Release.** A version that was tagged or published to npm without
+  creating a GitHub Release — 2.1.1 and 2.1.2 were tag-only, and 2.2.0 too — would otherwise
+  lose its notes; its CHANGELOG section rolls into the next Release.
+- Example: once 2.1.0 is the previous Release, the 2.3.0 Release includes 2.1.1, 2.1.2, 2.2.0
+  and 2.3.0:
+
+  ```bash
+  npm run release:notes -- --version 2.3.0 --since 2.1.0 --output notes.md
+  ```
+
+  The window is `(2.1.0, 2.3.0]`; `2.1.0-beta.1` sorts before 2.1.0 and therefore stays out.
+- `npm run release:notes` (`scripts/release-notes.mjs`) is the authoritative generator: it reads
+  `CHANGELOG.md`, filters the window, orders sections by SemVer (pre-release identifiers
+  included), and emits the `# dsh-tower <v>` title, a provenance quote naming the previous
+  Release and the included versions, then the sections separated by `---`.
+- `--check <file>` re-verifies an existing notes file byte-for-byte (exit 1 on a mismatch), so
+  the body of a published Release can be audited without editing it. Use `--root <dir>` to check
+  another checkout.
+
+Never hand-extract only the current version's section: that is what produced single-section
+Releases whose tag-only predecessors were invisible.

package/docs/reference/component-surface.md

@@ -3,7 +3,7 @@
 > Generated by `npm run docs:generate:components` from `scripts/component-surface.json` and
 > `scripts/surface-baseline.json`. Do not edit by hand.
 
-Decision: [ADR 0005](../adr/0005-component-surface.md) · decision date: 2026-10-23 · baseline 2026-10-23 · visible components: 8 (`tower`, `tower-skills`, `tower-batch`, `tower-import`, `tower-leases`, `tower-tests`, `tower-hmr`, `preset-tower-reviewer`)
+Decision: [ADR 0005](../adr/0005-component-surface.md) · decision date: 2026-10-23 · baseline 2026-10-23 · visible components: 11 (`tower`, `tower-skills`, `tower-batch`, `tower-import`, `tower-leases`, `tower-tests`, `tower-board`, `tower-archive`, `tower-hmr`, `preset-tower-reviewer`, `tower-ui`)
 
 The component axis answers one question for every config key: may a user turn it
 off, and if so, must that switch be a component? Four classes cover every key, so
@@ -29,11 +29,14 @@ row is a section of its parent and is not independently switchable.
 | `tower-skills` | visible | row | The 3 skills leave the catalog; the worker/reviewer PROTOCOL sections still ship through systemPrompt.section, so only the tower-recovery guidance is lost. |
 | `tower-batch` | visible | row | tower_batch is not registered; missions, gates and merges are unaffected because no state depends on a batch. |
 | `tower-import` | visible | row | tower_import_legacy and tower_legacy_map are not registered; new repository state is unaffected. |
-| `tower-leases` | visible | row | tower_resource is not registered; advisory leases are coordination only, so nothing else depends on them. |
+| `tower-leases` | visible | row | tower_resource is not registered; advisory leases are coordination only, but spawn.requireLease still needs the tool to acquire one, so a config that sets spawn.requireLease is rejected at runtime preconditions instead of failing every spawn at lease-busy. |
 | `tower-tests` | visible | row | tower_test is not registered and no test receipt can be recorded. With gates.requireTests:true planning/mode entry is rejected with an explanation, and the merge gate still reports tests-missing. |
-| `tower-hmr` | visible | row | tower_reload and /tower reload are unavailable; a profile without HMR behaves exactly as before. Shipped disabled: enable the row for a linked dev profile. |
+| `tower-board` | visible | row | MISSIONS.md is not written or refreshed, so an existing board goes stale. Mission state tools, gates and every other capability keep working; docs.boardLocation still chooses where a board would be written. |
+| `tower-archive` | visible | row | Terminal missions are not moved out of state.json, so the hot state keeps growing and status/doctor keep loading their full history. Merges, gates and every other capability keep working; nothing is deleted. afterDays/maxMissions keep their tuning meaning. |
+| `tower-hmr` | visible | row | Development-only tooling: tower_reload and /tower reload are unavailable, so a linked-profile reload has to be triggered outside Tower. A normal profile behaves exactly as before; the row ships disabled on purpose. |
 | `preset-tower-worker` | internal | row | Declared by dsh-tower/preset-worker: tower_spawn fails without the worker preset. A mandatory dependency, never a switch. |
 | `preset-tower-reviewer` | visible | row | Declared by dsh-tower/preset-reviewer: the reviewer cannot be dispatched. Supported while review.requireReview is false (merge is unaffected); with the gate on planning/mode entry is locked with an explanatory error. |
+| `tower-ui` | visible | row | The Tower web UI plugin does not load in this profile: no Tower tool cards, composer-dock summary or status strip. Host tools, missions, state and the MISSIONS.md board are unaffected. |
 
 ## Forbidden to disable
 
@@ -71,9 +74,9 @@ All keys from `domain/config/schema.js`, classified on the component axis.
 |---|---|---|
 | `section` | `core` | Legacy alias for mode.promptSection: the Tower-mode prompt contract, not a capability. |
 | `allowAgentControl` | `core` | Legacy alias for mode.allowAgentControl: the human-owned mode rule (ADR 0003), not a component. |
-| `init.autoGitInit` | `optional-config` | Bootstrap convenience; off only means tower_init will not run git init. |
-| `init.snapshotDirty` | `optional-config` | Dirty-work baseline convenience; no capability is removed. |
-| `init.autoExclude` | `optional-config` | Keeps Tower artifacts out of .git/info/exclude; safe either way. |
+| `init.autoGitInit` | `optional-config` | Bootstrap convenience; off only means tower_init will not run git init. Tuning exemption: Tuning, not capability: tower_init stays the component and the switch only decides whether it runs git init. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
+| `init.snapshotDirty` | `optional-config` | Dirty-work baseline convenience; no capability is removed. Tuning exemption: Tuning, not capability: the init component remains available with or without a dirty-work snapshot baseline. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
+| `init.autoExclude` | `optional-config` | Keeps Tower artifacts out of .git/info/exclude; safe either way. Tuning exemption: Tuning, not capability: both values keep the init component and only change which artifacts the exclude file names. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `mode.promptSection` | `core` | Replaces the whole Tower-mode prompt text; contract text, not a capability. |
 | `mode.sectionAppend` | `optional-config` | Appends team conventions to the prompt. |
 | `mode.allowAgentControl` | `core` | Decides whether the model may toggle the mode (ADR 0003). A governance rule, never a component. |
@@ -104,28 +107,37 @@ All keys from `domain/config/schema.js`, classified on the component axis.
 | `spawn.maxLiveWorkers` | `core` | Resource-safety cap on live workers. |
 | `spawn.staleMs` | `optional-config` | Roster staleness window before merge is blocked. |
 | `spawn.maxWaitMs` | `optional-config` | Upper bound for a blocking spawn wait. |
-| `spawn.requireLease` | `optional-config` | Advisory-lease gate before a worker starts. |
+| `spawn.requireLease` | `optional-config` | Advisory-lease gate before a worker starts. Tuning exemption: Tuning the safety level inside the optional tower-leases row; with leases off the Host refuses requireLease instead of removing the spawn capability. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `send.maxPerMinute` | `optional-config` | Message rate limit; zero disables it. |
-| `send.interruptDefault` | `optional-config` | Default for the interrupt-before-deliver flag. |
-| `tests.enabled` | `optional-component` | Tuning inside the optional tower-tests component: it decides whether discovery runs when the row is on. Off with gates.requireTests:true is rejected at config resolution. |
-| `tests.admission` | `optional-config` | Chooses when discovery runs inside the optional tests capability. |
+| `send.interruptDefault` | `optional-config` | Default for the interrupt-before-deliver flag. Tuning exemption: Tuning, not capability: the send component always exists and the switch only picks a delivery default. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
+| `tests.admission` | `optional-config` | Chooses when discovery runs inside the optional tests capability. Tuning exemption: Tuning when the admission check runs inside the optional tower-tests row, which still owns whether test tooling exists. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `tests.timeoutMs` | `optional-config` | Per-command discovery timeout. |
 | `tests.maxBytes` | `optional-config` | Captured discovery output cap. |
-| `tests.autoChecks` | `optional-config` | Attaches a tests check to completion when discovery runs. |
+| `tests.autoChecks` | `optional-config` | Attaches a tests check to completion when discovery runs. Tuning exemption: Tuning the default receipt policy inside the optional tower-tests row, which still owns whether any test tooling exists. (2026-11-03 · #138 · [0005-component-surface.md](../adr/0005-component-surface.md)) |
 | `tests.allowPackageDiscovery` | `core` | Allows repository code to execute; a security contract, not a component. |
 | `gates.requireChecks` | `forbidden-to-disable` | Requires completion evidence before merge; a merge gate. |
 | `gates.requireTests` | `forbidden-to-disable` | Requires a test receipt before merge; a merge gate. With the tower-tests row off, planning/mode entry refuse the combination. |
 | `gates.allowReviewExemption` | `forbidden-to-disable` | The review-exemption path is part of the review and merge contract. |
 | `gates.maxReportBytes` | `forbidden-to-disable` | The report cap is part of the completion contract; the refusal itself is never configurable away. |
-| `docs.board` | `optional-config` | Writes the human-readable board; no capability is removed. |
-| `docs.boardLocation` | `optional-config` | Chooses the board location. |
-| `archive.enabled` | `optional-config` | Archival is maintenance, not a tool capability; off only leaves terminal missions hot. |
-| `archive.afterDays` | `optional-config` | Archive age threshold. |
+| `docs.boardLocation` | `optional-config` | Chooses where the board is written; whether it is written is the tower-board component row (#133). |
+| `archive.afterDays` | `optional-config` | Archive age threshold inside the optional tower-archive component (#135). |
 | `archive.maxMissions` | `optional-config` | Hot terminal-mission cap. |
 | `leases.ttlMs` | `optional-config` | Tuning inside the optional tower-leases component. |
 | `dev.reloadDelayMs` | `optional-config` | Delay so a tool result is delivered before a scheduled reload inside the optional tower-hmr component. |
 | `dev.reloadRequiredIds` | `optional-config` | Loader ids passed to reconcileProfile as required by the tower-hmr component. |
 
+## Behaviour knobs
+
+Non-boolean keys that gate behaviour are reviewed on the same axis as booleans
+(#138): each must be `core`, `optional-component`, `forbidden-to-disable`, or an
+`optional-config` key with a dated tuning-only exemption. A string or union that
+hides a capability cannot use the tuning class without that record.
+
+| Key |
+|---|
+| `spawn.requireLease` |
+| `tests.admission` |
+
 ## Non-goals
 
 This page does not decide whether a key is useful, and it is not an approval

package/docs/reference/config.generated.md

@@ -1,7 +1,7 @@
 # Config reference (generated)
 
 > Generated by `npm run docs:generate:config` from `domain/config/schema.js`. Values are defaults before repo config.
-> Surface: config keys: 56 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
+> Surface: config keys: 53 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
 
 | Key | Default | Description |
 |---|---|---|
@@ -10,7 +10,7 @@
 | `init.autoGitInit` | `false` | tower_init may run git init and create an empty initial commit when the directory is not a repository. |
 | `init.snapshotDirty` | `false` | tower_init may snapshot uncommitted tracked changes into a dangling commit used as the mission baseline. |
 | `init.autoExclude` | `true` | Add in-repo Tower artifacts (MISSIONS.md, in-repo worktree roots) to .git/info/exclude so they do not look like user dirt. |
-| `mode.promptSection` | `` | Replacement Tower-mode system prompt text. Empty keeps the built-in reminder. |
+| `mode.promptSection` | `""` | Replacement Tower-mode system prompt text. Empty keeps the built-in reminder. |
 | `mode.sectionAppend` | `` | Extra text appended to the Tower-mode system prompt section (team conventions). |
 | `mode.allowAgentControl` | `true` | Register tower_control so the model may enter/leave the mode with a reason. |
 | `mode.autoPauseGoal` | `true` | Pause an active goal when entering Tower mode. |
@@ -43,7 +43,6 @@
 | `spawn.requireLease` | `` | Optional lease name tower_spawn must hold before starting a worker. |
 | `send.maxPerMinute` | `120` | Per-repository tower_send rate limit per minute (0 disables). |
 | `send.interruptDefault` | `false` | Default value of tower_send.interrupt when the caller omits it. |
-| `tests.enabled` | `true` | Run declared test discovery when a mission configures it. |
 | `tests.admission` | `"off"` | Run discovery before spawning a worker, when completing, or only on explicit tower_test (default off: repository code runs only on an explicit tower_test). |
 | `tests.timeoutMs` | `60000` | Per discovery command timeout. |
 | `tests.maxBytes` | `16777216` | Maximum captured stdout bytes per command. |
@@ -53,10 +52,8 @@
 | `gates.requireTests` | `false` | Require a passing test-discovery receipt for the reviewed worktree tip before merge. |
 | `gates.allowReviewExemption` | `false` | Allow reviewPolicy:none missions with a non-empty reviewExemptionReason to skip review blockers. |
 | `gates.maxReportBytes` | `32768` | Hard cap, in UTF-8 bytes, for tower_complete.report; a larger report is rejected with an actionable nextAction, never truncated. |
-| `docs.board` | `true` | Write a human-readable MISSIONS.md after mission changes. |
-| `docs.boardLocation` | `"common"` | common = <git-common-dir>/dsh-tower/MISSIONS.md; repo = <repoRoot>/MISSIONS.md. |
-| `archive.enabled` | `true` | Move terminal (merged/abandoned) missions whose worktree is gone into <git-common-dir>/dsh-tower/archive/ at the next mutation, so state.json stops carrying their full history. |
-| `archive.afterDays` | `30` | Terminal missions untouched for at least this many days are archived on the next mutation (0 archives them immediately). |
+| `docs.boardLocation` | `"common"` | common = <git-common-dir>/dsh-tower/MISSIONS.md; repo = <repoRoot>/MISSIONS.md. Whether the board is written at all is the tower-board component row (#133). |
+| `archive.afterDays` | `30` | Terminal missions untouched for at least this many days are archived on the next mutation (0 archives them immediately). Archival itself is the tower-archive component row (#135). |
 | `archive.maxMissions` | `100` | Maximum terminal missions kept hot; once exceeded, the oldest eligible terminal missions are archived until the cap holds (0 archives every eligible terminal mission). |
 | `leases.ttlMs` | `900000` | Default advisory lease lifetime; expiry never auto-releases. |
 | `dev.reloadDelayMs` | `50` | Delay before a scheduled reload, so the tool result is delivered first. |

package/docs/reference/config.md

@@ -5,6 +5,11 @@ Every key is optional; defaults reproduce the shipped behavior. Unknown top-leve
 `mode.allowAgentControl`. A legacy alias only fills a gap: when both forms are set, the canonical
 `mode.*` key wins.
 
+Two component-shaped switches left the config form (#133/#135): `docs.board` is now the `tower-board`
+component row and `archive.enabled` is now the `tower-archive` component row. A config that still sets
+either one fails with `config-unknown-key` and an upgrade note naming the replacing row; the tuning
+keys (`docs.boardLocation`, `archive.afterDays`, `archive.maxMissions`) stay here.
+
 ## Layers and precedence
 
 Lowest precedence first:
@@ -74,7 +79,6 @@ violates the declared schema (for example `merge.timeoutMs` below 1000) fail wit
 | `spawn.requireLease` | `''` | Optional lease name that must be held before a worker can spawn. |
 | `send.maxPerMinute` | `120` | Per-repository `tower_send` rate limit (0 disables); exceeding it returns `rate-limited`. |
 | `send.interruptDefault` | `false` (bundled patch: `true`) | Default for `tower_send.interrupt` (interrupt the running turn before delivering). |
-| `tests.enabled` | `true` | Run declared test discovery when the worktree `package.json` configures it. It only tunes the optional `tower-tests` component: with that row off there is no `tower_test` tool and no receipt, and `gates.requireTests:true` is refused rather than silently unmet. |
 | `tests.admission` | `off` | `spawn` runs discovery before starting a worker, `complete` at `tower_complete`, `off` only on explicit `tower_test` (default; repository code is not executed automatically). |
 | `tests.timeoutMs` | `60000` | Per discovery command timeout. |
 | `tests.maxBytes` | `16777216` (16 MiB) | Captured stdout cap per command. |
@@ -84,10 +88,8 @@ violates the declared schema (for example `merge.timeoutMs` below 1000) fail wit
 | `gates.requireTests` | `false` | Require a passing discovery receipt for the current mission branch tip (`tests-missing`); independent of the review gate. With the `tower-tests` component row off, planning/mode entry refuse this combination with an explanation. |
 | `gates.allowReviewExemption` | `false` | With `review.requireReview:true`, allow `reviewPolicy:"none"` + a non-empty reason to skip review blockers. Off deliberately; irrelevant while the global review gate is off. |
 | `gates.maxReportBytes` | `32768` (32 KiB) | Hard cap in UTF-8 bytes for `tower_complete.report`. A larger report is rejected with `invalid-argument` and an actionable `nextAction` (file the full text in the mission worktree and reference its path); it is never truncated. Existing larger reports still load. |
-| `docs.board` | `true` | Write `MISSIONS.md` after mutations. |
-| `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`; `repo` = `<repoRoot>/MISSIONS.md`. |
-| `archive.enabled` | `true` | Move terminal (`merged`/`abandoned`) missions whose worktree is gone into `<git-common-dir>/dsh-tower/archive/` at a mutation boundary. Archived missions keep tasks, reviews, findings and the completion report; they are moved, never deleted. |
-| `archive.afterDays` | `30` | Age trigger: a terminal mission untouched for at least this many days is archived on the next mutation (`0` archives immediately). |
+| `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`; `repo` = `<repoRoot>/MISSIONS.md`. Whether the board is written at all is the `tower-board` component row (#133); `docs.board` was removed and is rejected as an unknown key. |
+| `archive.afterDays` | `30` | Age trigger: a terminal mission untouched for at least this many days is archived on the next mutation (`0` archives immediately). Archival itself is the `tower-archive` component row (#135); `archive.enabled` was removed and is rejected as an unknown key. |
 | `archive.maxMissions` | `100` | Cap trigger: once more than this many terminal missions are hot, the oldest eligible ones are archived until the cap holds (`0` archives every eligible terminal mission). A mission with a live worktree is never archived. |
 | `leases.ttlMs` | `900000` | Default advisory lease lifetime; expiry never auto-releases. |
 | `dev.reloadDelayMs` | `50` | Delay before a scheduled reload so the tool result is delivered first. Tuning inside the optional `tower-hmr` component. |

package/docs/reference/doctor.md

@@ -8,17 +8,17 @@ It returns:
   "ok": true,
   "checks": [
     { "id": "git", "status": "pass", "detail": "git version 2.55.0" },
-    { "id": "surface", "status": "pass", "detail": "config keys: 56 · sections: 14 · tools: 29 (baseline 2026-10-23)" },
+    { "id": "surface", "status": "pass", "detail": "config keys: 53 · sections: 14 · tools: 29 (baseline 2026-10-23)" },
     { "id": "state", "status": "pass", "detail": ".../state.json revision 7" },
     { "id": "state-schema", "status": "pass", "detail": "schemaVersion 3 is current" },
     { "id": "case-mode", "status": "pass", "detail": "caseInsensitive: true; scope matching uses case-insensitive comparison" }
   ],
   "surface": {
-    "configKeys": 56,
+    "configKeys": 53,
     "sections": 14,
     "tools": 29,
     "baselineDate": "2026-10-23",
-    "line": "config keys: 56 · sections: 14 · tools: 29"
+    "line": "config keys: 53 · sections: 14 · tools: 29"
   },
   "stateLock": {
     "held": true,
@@ -100,9 +100,15 @@ it for the configured merge timeout (15 minutes by default), so a held lock is a
 failure; the holder's phase and age make a stalled tower diagnosable. `tower_status` returns the same
 `gitLock` object.
 
+`board` names the `MISSIONS.md` location (`docs.boardLocation`) and whether the `tower-board` component
+row is mounted. With the row off the check is a `warn` that says the board is not written (an existing
+board goes stale) and names the row; every state tool and gate still works.
+
 `archive` reports the terminal-mission archive: active `missions`, `archivedMissions` and `stateBytes`,
-the archive directory's `archiveBytes`/`years`/`files`, every `unreadable` diagnostic, and the configured
-`policy` (`enabled`, `afterDays`, `maxMissions`). A missing archive directory is a healthy empty archive
+the archive directory's `archiveBytes`/`years`/`files`, every `unreadable` diagnostic, and the tuning
+`policy` (`afterDays`, `maxMissions`). `policy.enabled` reflects the `tower-archive` component row, not a
+config key: with the row off the policy line says archival is disabled by the component, terminal
+missions stay hot and `state.json` keeps growing. A missing archive directory is a healthy empty archive
 (`archive` check `pass`); a truncated index or year file is a `warn` with the diagnostic, and archiving is
 paused until it is repaired rather than overwriting it. Nothing is lost while the archive is unreadable:
 the eligible missions stay in `state.json`.

package/docs/reference/surface-budget.md

@@ -19,10 +19,15 @@ these tables fails `npm run surface:check`.
 A second axis asks who may turn a key off. It is generated from
 [`scripts/component-surface.json`](../../scripts/component-surface.json) into
 [component-surface.md](component-surface.md): every key is `core`,
-`optional-component`, `optional-config` or `forbidden-to-disable`, and the
-component count is the fourth baselined surface, two-way: a contraction needs a
-dated decision just like growth does (`npm run docs:check:components`,
-[ADR 0005](../adr/0005-component-surface.md)). The same source of truth records
+`optional-component`, `optional-config` or `forbidden-to-disable`. A boolean (or a
+recorded non-boolean behaviour knob) cannot stay `optional-config` without a dated
+tuning-only exemption. Both the component count and the config-key count are
+baselined two-way: an increase or a contraction needs a dated decision
+(`npm run docs:check:components`, [ADR 0005](../adr/0005-component-surface.md)).
+Every decision on those two surfaces must carry a real `date` (`YYYY-MM-DD`); a
+from/to record without one fails the brake even when it reaches the committed
+count.
+The same source of truth records
 the `gateableTools` allowlist; it is empty since #122, so a future
 `tools.expose*` route to any tool is refused before it can remove a review,
 merge or host tool.
@@ -44,8 +49,24 @@ profile's 28 loaded tools and pins 29 for the all-rows-on surface.
 
 #121 also shrank the config surface: the seven capability `tools.expose*` keys
 and `dev.hotReload` became component rows, so config keys went 64 → 56 and
-sections 15 → 14. Those are recorded shrank values in the committed baseline,
-not free growth: a later increase still needs its own decision.
+sections 15 → 14. Sections keep the ADR 0004 cheap-shrink rule. #136 shrank the
+config keys once more, 56 → 55: `tests.enabled` was a second switch over the
+`tower-tests` component row, so the row is now the only switch and the key is
+gone (a config that still writes it fails with `config-unknown-key`). #133 and
+#135 shrank it again, 55 → 53: `docs.board` and `archive.enabled` were the same
+kind of second switch over the new `tower-board` and `tower-archive` rows, so
+each row is now the only switch and both keys are gone (a config that still sets
+either fails with `config-unknown-key`, and the upgrade note names the replacing
+row).
+
+Since #138 that 64 → 53 history is one dated decision in
+[`scripts/surface-baseline.json`](../../scripts/surface-baseline.json), and the
+config-key count is two-way: a later increase **or** decrease needs its own
+decision naming an ADR, unlike sections and tools. The same wave makes the gate
+import `OPERATIONAL_TOOLS` instead of scraping it, discover every shipped
+`cordis.patch.yml` in both directions, review the non-boolean behaviour knobs
+(`spawn.requireLease`, `tests.admission`), and refuse a row config outside its
+component's `allowedOverrides`.
 
 ## Config keys
 
@@ -89,7 +110,6 @@ not free growth: a later increase still needs its own decision.
 | `spawn.requireLease` | niche | Advisory-lease gate added for one multi-agent workflow. Removal note: fold into `tower_resource` policy in the next minor unless a second workflow uses it. |
 | `send.maxPerMinute` | tuning | Message rate limit; zero disables it. |
 | `send.interruptDefault` | tuning | Default for the interrupt-before-deliver flag. |
-| `tests.enabled` | core | Whether declared discovery may run at all. |
 | `tests.admission` | core | Chooses when repository code is executed. |
 | `tests.timeoutMs` | tuning | Per-command discovery timeout. |
 | `tests.maxBytes` | tuning | Captured discovery output cap. |
@@ -99,10 +119,8 @@ not free growth: a later increase still needs its own decision.
 | `gates.requireTests` | core | Requires a test receipt before merge. |
 | `gates.allowReviewExemption` | core | Allows a review exemption and its reason. |
 | `gates.maxReportBytes` | tuning | Report size cap; the refusal itself is not configurable. |
-| `docs.board` | tuning | Writes the human-readable board. |
-| `docs.boardLocation` | tuning | Chooses the board location. |
-| `archive.enabled` | core | Controls whether terminal missions leave the hot state. |
-| `archive.afterDays` | tuning | Archive age threshold. |
+| `docs.boardLocation` | tuning | Chooses where the board is written; whether it is written is the tower-board row. |
+| `archive.afterDays` | tuning | Archive age threshold; archival itself is the tower-archive row. |
 | `archive.maxMissions` | tuning | Hot terminal-mission cap. |
 | `leases.ttlMs` | tuning | Default advisory lease lifetime. |
 | `dev.reloadDelayMs` | tuning | Delay so a tool result is delivered before reload. |

package/docs/reference/tools.generated.md

@@ -1,7 +1,7 @@
 # Tools overview (generated)
 
 > Generated by `npm run docs:generate:tools` from the registered tool definitions. Do not edit by hand.
-> Surface: config keys: 56 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
+> Surface: config keys: 53 · sections: 14 · tools: 29 · baseline 2026-10-23. Generated from `scripts/surface-baseline.json`; do not edit by hand.
 
 | Tool | Description |
 |---|---|

package/docs/reference/tools.md

@@ -52,7 +52,7 @@ findings but not mutate them. Violations throw `[tower:not-authorized]` or
 | `tower_preflight` | `missionId` (alias `id`) | Read-only gate: returns `{ok, blockers[], branchTip, baseTip, changedFiles, review}`. |
 | `tower_merge` | `missionId` (alias `id`), `timeoutMs?` (alias `timeout_ms`) | Merge after a green gate. Records already-landed merges (`reconciled`), recovers a failed call whose commit exists (`recoveredFromFailure`), and separates `merge-hook-failed` from `merge-conflict`. |
 | `tower_rebase` | `missionId` (alias `id`) | Rebase the branch onto the base in its worktree. Refuses while the worker runs or the worktree is dirty. Already-contained branches return `alreadyMerged` untouched. |
-| `tower_teardown` | `force?`, `exclude?`, `dry_run?` (alias `dryRun`) | Remove eligible merged/abandoned worktrees and branches; running agents are always kept. The final pass applies the `archive` policy: terminal missions whose worktree is gone are moved to `<git-common-dir>/dsh-tower/archive/` once `archive.afterDays`/`archive.maxMissions` says so, and `archived` lists their ids. Nothing is deleted; `archive.afterDays:0` archives a just-torn-down mission immediately. |
+| `tower_teardown` | `force?`, `exclude?`, `dry_run?` (alias `dryRun`) | Remove eligible merged/abandoned worktrees and branches; running agents are always kept. The final pass applies the `archive` policy while the `tower-archive` component row is mounted: terminal missions whose worktree is gone are moved to `<git-common-dir>/dsh-tower/archive/` once `archive.afterDays`/`archive.maxMissions` says so, and `archived` lists their ids. Nothing is deleted; `archive.afterDays:0` archives a just-torn-down mission immediately. |
 | `tower_mode` | — | Report mode, last change, paused goal, denied tools, store path, plugin version, HMR availability, workspace-lock holder. |
 | `tower_control` | `action` (`enter`/`exit`), `reason` | Model-initiated mode change; registered by default; disable with `mode.allowAgentControl:false`; reason is mandatory. |
 | `tower_reload` | `repoRoot?` | Dev-only: ask DSH HMR to reconcile the profile and reload the Host plugin from disk. Registered while the `tower-hmr` component row is on (the row ships off); scheduled after the result (default 50 ms); fails with `reload-unavailable` without HMR. When `repoRoot` is supplied the caller must be the tower. |
@@ -77,4 +77,4 @@ Code default is off; the shipped patch is on for Kimi-compatible single-active-t
 Gate tools return `{ok:false, blockers:[{code, detail}]}`; the code list is in
 [blockers.md](blockers.md). Thrown tool errors carry a stable `[tower:<code>]` prefix
 ([errors.md](errors.md)). Successful mutations emit process-local events ([events.md](events.md)),
-and, with `docs.board:true`, refresh `<git-common-dir>/dsh-tower/MISSIONS.md`.
+and, with the `tower-board` component row mounted, refresh `<git-common-dir>/dsh-tower/MISSIONS.md`. The board location stays `docs.boardLocation`; the old `docs.board` switch is a component row now (#133).

package/docs/zh/guide/install-upgrade-migration.md

@@ -56,7 +56,7 @@ Host 插件在 DSH 启动时加载：**安装或更新后需要重启 DSH**。
   这是发布到 `next` dist-tag 的**预发布**，
   `latest` 仍指向 2.0.4——请用 `dsh plugin --profile web add dsh-tower@next`（或精确版本号）安装。
   运行时行为未变；本版本承载的是交付闸门（CI 中的 mount smoke、`npm run release:check`、证据约定
-  与追踪策略），而不是工具变化。本文档先于人工发布步骤合入：只有在[发布清单](release.md)执行
+  与追踪策略），而不是工具变化。本文档先于人工发布步骤合入：只有在[发布清单（英文）](../../guide/release.md)执行
   `npm publish --tag next` 之后，`next` 才会解析到 2.1.0-beta.1；`latest` 在稳定版发布前保持 2.0.4。
 - **2.0.3 → 2.0.4**：不需要迁移 state/config。本版本是安全加固与完整性修复（授权、merge SHA 绑定、
   dirty worktree 完成拒绝、stale lock 恢复、限制 test/git 进程环境、`tower_recover`、UI 0.2.2）。

package/docs/zh/reference/config.md

@@ -6,6 +6,11 @@
 `section` 与 `allowAgentControl` 是 `mode.promptSection` 与 `mode.allowAgentControl` 的兼容别名。
 兼容别名只用于补缺：同时设置两种写法时，规范的 `mode.*` 键优先。
 
+两个组件形态的开关已离开配置（#133/#135）：`docs.board` 现在是 `tower-board` 组件行，
+`archive.enabled` 现在是 `tower-archive` 组件行。仍设置其中任一个的配置会以 `config-unknown-key`
+失败，并附上指明替代行的升级提示；调优键（`docs.boardLocation`、`archive.afterDays`、
+`archive.maxMissions`）仍保留在这里。
+
 ## 层级与优先级
 
 从低到高：
@@ -73,7 +78,6 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 | `spawn.requireLease` | `''` | worker spawn 前必须持有的可选租约名。 |
 | `send.maxPerMinute` | `120` | 每个仓库的 `tower_send` 每分钟速率限制（0 关闭）；超出返回 `rate-limited`。 |
 | `send.interruptDefault` | `false`（随包 patch：`true`） | `tower_send.interrupt` 的默认值（投递前先中断运行中的回合）。 |
-| `tests.enabled` | `true` | worktree 的 `package.json` 配置了测试发现时运行它。它只调整可选的 `tower-tests` 组件：该行关闭时既没有 `tower_test` 工具也无法记录回执，`gates.requireTests:true` 会被拒绝而不是静默失效。 |
 | `tests.admission` | `off` | `spawn` 在启动 worker 前运行发现（fail-closed，不启动子代理）；`complete` 在 `tower_complete` 时运行；`off` 只在显式 `tower_test` 时运行（默认；不会自动执行仓库代码）。 |
 | `tests.timeoutMs` | `60000` | 每条发现命令的超时。 |
 | `tests.maxBytes` | `16777216`（16 MiB） | 每条命令捕获的 stdout 上限。 |
@@ -83,10 +87,8 @@ merge、worktree 与 spawn 策略。它使用与 profile 配置相同的 JSON
 | `gates.requireTests` | `false` | 要求针对当前 mission 分支 tip 的通过测试回执（`tests-missing`）；与审查门禁独立。`tower-tests` 组件行关闭时，规划/进入模式会带解释拒绝该组合。 |
 | `gates.allowReviewExemption` | `false` | 在 `review.requireReview:true` 时，允许用 `reviewPolicy:"none"` + 非空理由跳过审查 blocker；默认故意关闭；全局审查关闭时无影响。 |
 | `gates.maxReportBytes` | `32768`（32 KiB） | `tower_complete.report` 的 UTF-8 字节硬上限。超出时以 `invalid-argument` 拒绝并给出可执行的 `nextAction`（把全文写进 mission worktree 的文件并引用路径），绝不截断。已存在的超限报告仍可读取。 |
-| `docs.board` | `true` | 变更后写入 `MISSIONS.md`。 |
-| `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`；`repo` = `<repoRoot>/MISSIONS.md`。 |
-| `archive.enabled` | `true` | 在变更边界把 worktree 已移除的终态（`merged`/`abandoned`）任务移入 `<git-common-dir>/dsh-tower/archive/`。归档任务保留 tasks、reviews、findings 与完成报告；这是移动，不是删除。 |
-| `archive.afterDays` | `30` | 年龄触发：终态任务超过这么多天未更新，会在下次变更时归档（`0` 表示立即归档）。 |
+| `docs.boardLocation` | `common` | `common` = `<git-common-dir>/dsh-tower/MISSIONS.md`；`repo` = `<repoRoot>/MISSIONS.md`。是否写出看板由 `tower-board` 组件行决定（#133）；`docs.board` 已移除，会作为未知键被拒绝。 |
+| `archive.afterDays` | `30` | 年龄触发：终态任务超过这么多天未更新，会在下次变更时归档（`0` 表示立即归档）。归档本身由 `tower-archive` 组件行决定（#135）；`archive.enabled` 已移除，会作为未知键被拒绝。 |
 | `archive.maxMissions` | `100` | 数量触发：热状态中的终态任务超过此数时，从最旧的开始归档直到满足上限（`0` 表示归档所有符合条件的终态任务）。worktree 仍存在的任务永不归档。 |
 | `leases.ttlMs` | `900000` | 默认咨询式租约寿命；过期不会自动释放。 |
 | `dev.reloadDelayMs` | `50` | 计划中的 reload 延迟，先让工具结果送达。属于可选的 `tower-hmr` 组件。 |

package/docs/zh/reference/doctor.md

@@ -61,9 +61,14 @@ PID 存活并不等于写者存活：停止心跳的持有者会报告 `stale: t
 因此“被持有”是 `warn` 而不是失败；持有者的阶段与时长让卡住的控制塔可被诊断。`tower_status` 返回同一个
 `gitLock` 对象。
 
+`board` 报告 `MISSIONS.md` 位置（`docs.boardLocation`）以及 `tower-board` 组件行是否挂载。该行关闭时
+检查为 `warn`，说明看板不会被写出（已有看板会变陈旧）并指出该行名；所有状态工具与门禁仍然工作。
+
 `archive` 报告终态任务归档：活跃 `missions`、`archivedMissions` 与 `stateBytes`，归档目录的
-`archiveBytes`/`years`/`files`，每条 `unreadable` 诊断，以及配置的 `policy`（`enabled`、`afterDays`、
-`maxMissions`）。归档目录不存在是健康的空归档（`archive` 检查为 `pass`）；截断的 index/year 文件是
+`archiveBytes`/`years`/`files`，每条 `unreadable` 诊断，以及调优字段 `policy`（`afterDays`、
+`maxMissions`）。`policy.enabled` 反映 `tower-archive` 组件行，而不是配置键：该行关闭时策略行说明
+归档被组件禁用，终态任务留在热状态，`state.json` 持续增长。归档目录不存在是健康的空归档
+（`archive` 检查为 `pass`）；截断的 index/year 文件是
 `warn` 并附带诊断，且归档会暂停而不是覆盖它——归档不可读期间没有数据会丢失，符合条件的 mission 仍留在
 `state.json`。
 

package/docs/zh/reference/tools.md

@@ -74,5 +74,6 @@ roster 角色由 `exec.agent` 与 roster 共同决定。mission 级工具（`tow
 
 门禁类工具返回 `{ok:false, blockers:[{code, detail}]}`；code 列表见 [blockers.md](blockers.md)。
 抛出的工具错误带稳定的 `[tower:<code>]` 前缀（见 [errors.md](errors.md)）。成功的变更会发出进程内
-事件（见 [events.md](events.md)），并且在 `docs.board:true` 时刷新
-`<git-common-dir>/dsh-tower/MISSIONS.md`。
+事件（见 [events.md](events.md)），并在挂载 `tower-board` 组件行时刷新
+`<git-common-dir>/dsh-tower/MISSIONS.md`。看板位置仍由 `docs.boardLocation` 决定；原先的
+`docs.board` 开关现在是组件行（#133）。