dsh-tower 2.4.2 → 2.5.0

package/domain/config/schema.js

@@ -74,14 +74,36 @@ const SECTION_KEYS = {
     'requireLease',
   ],
   send: ['maxPerMinute', 'interruptDefault'],
-  tests: ['enabled', 'admission', 'timeoutMs', 'maxBytes', 'autoChecks', 'allowPackageDiscovery'],
+  tests: ['admission', 'timeoutMs', 'maxBytes', 'autoChecks', 'allowPackageDiscovery'],
   gates: ['requireChecks', 'requireTests', 'allowReviewExemption', 'maxReportBytes'],
-  docs: ['board', 'boardLocation'],
-  archive: ['enabled', 'afterDays', 'maxMissions'],
+  docs: ['boardLocation'],
+  archive: ['afterDays', 'maxMissions'],
   leases: ['ttlMs'],
   dev: ['reloadDelayMs', 'reloadRequiredIds'],
 }
 
+// #133/#135: `docs.board` and `archive.enabled` were component-shaped switches
+// hiding in the config form. They are component rows now, so a legacy config
+// keeps failing as an unknown key — with an upgrade note naming the row that
+// replaced it.
+/** @type {Record<string, string>} */
+const REMOVED_KEYS = {
+  'docs.board': 'tower-board',
+  'archive.enabled': 'tower-archive',
+}
+
+/**
+ * Upgrade note for a removed component switch, appended to the unknown-key error.
+ * @param {string} group
+ * @param {string} key
+ * @returns {string}
+ */
+function removedKeyNote(group, key) {
+  const component = REMOVED_KEYS[`${group}.${key}`]
+  if (!component) return ''
+  return ` — ${group}.${key} was removed: the ${component} component row in cordis.patch.yml is the switch (see docs/adr/0005-component-surface.md)`
+}
+
 const MODEL_KEYS = ['provider', 'model', 'reasoningEffort', 'maxTokens']
 
 const ModelSchema = () =>
@@ -207,7 +229,9 @@ export const Config = Schema.object({
     .default({})
     .description('Message delivery policy.'),
   tests: Schema.object({
-    enabled: Schema.boolean().default(true).description('Run declared test discovery when a mission configures it.'),
+    // #136: no `enabled` switch. The `tower-tests` component row *is* the
+    // switch; a second boolean could only disagree with it, and a row-off
+    // profile has no tower_test tool and no receipt to gate on.
     admission: Schema.union(['spawn', 'complete', 'off'])
       .default('off')
       .description('Run discovery before spawning a worker, when completing, or only on explicit tower_test (default off: repository code runs only on an explicit tower_test).'),
@@ -239,30 +263,24 @@ export const Config = Schema.object({
     .default({})
     .description('Merge-gate strictness.'),
   docs: Schema.object({
-    board: Schema.boolean()
-      .default(true)
-      .description('Write a human-readable MISSIONS.md after mission changes.'),
     boardLocation: Schema.union(['common', 'repo'])
       .default('common')
-      .description('common = <git-common-dir>/dsh-tower/MISSIONS.md; repo = <repoRoot>/MISSIONS.md.'),
+      .description('common = <git-common-dir>/dsh-tower/MISSIONS.md; repo = <repoRoot>/MISSIONS.md. Whether the board is written at all is the tower-board component row (#133).'),
   })
     .default({})
-    .description('Human-readable artifacts.'),
+    .description('Human-readable artifact location. Turning the board off is a component row, not a tuning key.'),
   archive: Schema.object({
-    enabled: Schema.boolean()
-      .default(true)
-      .description('Move terminal (merged/abandoned) missions whose worktree is gone into <git-common-dir>/dsh-tower/archive/ at the next mutation, so state.json stops carrying their full history.'),
     afterDays: Schema.natural()
       .min(0)
       .default(30)
-      .description('Terminal missions untouched for at least this many days are archived on the next mutation (0 archives them immediately).'),
+      .description('Terminal missions untouched for at least this many days are archived on the next mutation (0 archives them immediately). Archival itself is the tower-archive component row (#135).'),
     maxMissions: Schema.natural()
       .min(0)
       .default(100)
       .description('Maximum terminal missions kept hot; once exceeded, the oldest eligible terminal missions are archived until the cap holds (0 archives every eligible terminal mission).'),
   })
     .default({})
-    .description('Terminal-mission archival policy. Archived missions are moved, never deleted.'),
+    .description('Terminal-mission archival tuning. Whether archival runs at all is the tower-archive component row; archived missions are moved, never deleted.'),
   leases: Schema.object({
     ttlMs: Schema.natural().min(1000).max(86400000).default(900000).description('Default advisory lease lifetime; expiry never auto-releases.'),
   })
@@ -376,9 +394,10 @@ export function assertKnownKeys(raw, label) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) continue
     const bad = Object.keys(value).filter((key) => !allowed.includes(key))
     if (bad.length > 0) {
+      const notes = bad.map((key) => removedKeyNote(group, key)).join('')
       throw new TowerToolError(
         'config-unknown-key',
-        `${label} has unknown key(s) ${bad.map((key) => `${group}.${key}`).join(', ')}`,
+        `${label} has unknown key(s) ${bad.map((key) => `${group}.${key}`).join(', ')}${notes}`,
       )
     }
     if ((group === 'spawn') && value.workerModel && typeof value.workerModel === 'object') {
@@ -423,13 +442,10 @@ export function resolveTowerConfig(rawConfig) {
     throw new TowerToolError('config-invalid', `Tower config is invalid: ${String(error?.message ?? error)}`)
   }
   const mode = clone(parsed.mode ?? {})
-  if (parsed.gates?.requireTests === true && parsed.tests?.enabled === false) {
-    // #121: the tower-tests *component row* is the capability switch now; a
-    // repository that turns the row off cannot satisfy gates.requireTests. The
-    // component-level half of this invariant is enforced at plan/mode entry,
-    // where the mounted rows are known (host/presets.js).
-    throw new TowerToolError('config-invalid', 'Tower config is invalid: gates.requireTests is true but test discovery is disabled (tests.enabled:false)')
-  }
+  // #136: `tests.enabled` is gone, so this resolver can no longer disagree with
+  // the mounted rows. The component-level invariant (`gates.requireTests:true`
+  // with the `tower-tests` row off) is enforced where the rows are known:
+  // host/presets.js at plan/mode entry, and the merge gate reports its cause.
   // Canonical keys win; the legacy top-level aliases only fill gaps.
   const rawMode = raw.mode ?? {}
   if (rawMode.promptSection === undefined && raw.section !== undefined) mode.promptSection = raw.section
@@ -440,9 +456,16 @@ export function resolveTowerConfig(rawConfig) {
   // Cordis config may omit this key, and an explicit legacy top-level
   // `allowAgentControl:true` must not be shadowed by a schema default.
   if (mode.allowAgentControl === undefined) mode.allowAgentControl = true
+  // F17/#130: materialize the resolved prompt section as well. `section` always
+  // mirrors `mode.promptSection`, so leaving the canonical field absent for a
+  // config with neither key would make a *second* pass copy the just-added
+  // `section:''` back into `mode` (`promptSection:''`): one pass would not be a
+  // fixed point. Filling it here makes `resolve(resolve(raw))` equal
+  // `resolve(raw)` for every valid config without changing any resolved value.
+  if (mode.promptSection === undefined) mode.promptSection = ''
   if (!Array.isArray(mode.denyTools) || mode.denyTools.length === 0) mode.denyTools = [...DEFAULT_DENY_TOOLS]
   return {
-    section: mode.promptSection ?? '',
+    section: mode.promptSection,
     init: clone(parsed.init ?? {}),
     mode,
     review: clone(parsed.review ?? {}),

package/domain/gate.js

@@ -47,7 +47,11 @@ export function completionBlockers(mission, config = {}) {
 
 /**
  * Review, roster, and test-evidence blockers; all inputs are snapshots.
- * @param {MergeGateOptions} options
+ * `testsComponent` is the optional `tower-tests` row state (#140). It is passed
+ * through the options bag rather than declared on `MergeGateOptions` because the
+ * domain may not read the component registry itself: the composition root
+ * publishes the probe on the port bag and `app/gate.js` forwards the snapshot.
+ * @param {MergeGateOptions & { testsComponent?: ({ enabled?: boolean, reason?: string } | null) }} options
  * @returns {Blocker[]}
  */
 export function mergeGateBlockers({
@@ -61,6 +65,7 @@ export function mergeGateBlockers({
   parentStatus = null,
   inactiveStates = [],
   rebaseWaived = false,
+  testsComponent = null,
 }) {
   /** @type {Blocker[]} */
   const blockers = []
@@ -106,7 +111,17 @@ export function mergeGateBlockers({
   if (config.gates?.requireTests === true) {
     const runs = (mission.testRuns ?? []).filter((run) => run.ok === true && run.treeTip && branchTip && run.treeTip === branchTip)
     if (runs.length === 0) {
-      push('tests-missing', `mission ${mission.id} has no passing test discovery for tip ${branchTip ? branchTip.slice(0, 7) : '(none)'}`)
+      // #140: name the component cause when the row is off. Without this the
+      // blocker reads as a repository mistake ("no passing discovery") when the
+      // real cause is a disabled row and no tower_test tool exists to produce a
+      // receipt. The component state is a snapshot on the options bag.
+      const tip = branchTip ? branchTip.slice(0, 7) : '(none)'
+      const cause =
+        testsComponent && testsComponent.enabled !== true
+          ? `; ${testsComponent.reason ?? 'disabled by component tower-tests'} so no receipt can exist: ` +
+            're-enable the tower-tests component (or set gates.requireTests:false) and re-record discovery'
+          : ''
+      push('tests-missing', `mission ${mission.id} has no passing test discovery for tip ${tip}${cause}`)
     }
   }
   return blockers

package/domain/scope.js

@@ -155,6 +155,180 @@ function scopePrefix(pattern) {
 }
 
 /**
+ * The historical directory-prefix heuristic. Cheap, and deliberately wider
+ * than the exact glob intersection: it serializes `a/**` with `a` and
+ * `src/*.js` with `src/a/x.js`, and pairs anything with a leading wildcard.
+ * It is only an over-approximation, so it misses inline prefixes such as
+ * `a/b*` vs `a/bc*`; `globLanguagesIntersect` below covers those.
+ * @param {string} pa folded pattern
+ * @param {string} pb folded pattern
+ * @returns {boolean}
+ */
+function prefixesOverlap(pa, pb) {
+  const x = scopePrefix(pa)
+  const y = scopePrefix(pb)
+  if (!x || !y) return true
+  if (x === y) return true
+  return x.startsWith(`${y}/`) || y.startsWith(`${x}/`)
+}
+
+// ---------------------------------------------------------------------------
+// Exact glob-language intersection (F16, #130).
+//
+// Each pattern becomes an NFA over the documented grammar: a literal matches
+// itself, `?` matches one non-`/` character, `*` matches zero or more non-`/`
+// characters, and `**` matches zero or more of any character. Two patterns
+// share a concrete path exactly when the product of their NFAs can reach the
+// accepting states, so the check is complete for that grammar.
+
+/** @typedef {{ kind: 'literal', char: string } | { kind: 'nonSlash' } | { kind: 'any' }} CharSet */
+/** @typedef {{ charset: CharSet, to: number }} GlobTransition */
+/** @typedef {{ kind: 'literal', char: string } | { kind: 'star' } | { kind: 'any' } | { kind: 'question' }} GlobToken */
+
+/**
+ * Split a pattern into glob tokens exactly like `globToRegExp` walks it: a
+ * doubled `*` is one `**` token (anything, including `/`), every other `*` is
+ * one non-`/` token, `?` is one non-`/` character, and everything else is a
+ * literal (including `[`, `]`, `{` and `}` — they are not grammar, #130).
+ * @param {string} pattern
+ * @returns {GlobToken[]}
+ */
+function globTokens(pattern) {
+  /** @type {GlobToken[]} */
+  const tokens = []
+  for (let index = 0; index < pattern.length; index += 1) {
+    const char = pattern[index]
+    if (char === '*') {
+      if (pattern[index + 1] === '*') {
+        tokens.push({ kind: 'any' })
+        index += 1
+      } else {
+        tokens.push({ kind: 'star' })
+      }
+    } else if (char === '?') {
+      tokens.push({ kind: 'question' })
+    } else {
+      tokens.push({ kind: 'literal', char })
+    }
+  }
+  return tokens
+}
+
+/**
+ * The characters one token can consume from `state`, and where they lead.
+ * A `*`/`**` token loops on itself; skipping it (consuming nothing) is the
+ * epsilon transition, handled by `epsilonClosure`.
+ * @param {GlobToken | undefined} token
+ * @param {number} state
+ * @returns {GlobTransition[]}
+ */
+function tokenTransitions(token, state) {
+  if (token === undefined) return []
+  if (token.kind === 'literal') return [{ charset: { kind: 'literal', char: token.char }, to: state + 1 }]
+  if (token.kind === 'question') return [{ charset: { kind: 'nonSlash' }, to: state + 1 }]
+  if (token.kind === 'star') return [{ charset: { kind: 'nonSlash' }, to: state }]
+  return [{ charset: { kind: 'any' }, to: state }]
+}
+
+/**
+ * States reachable from `state` without consuming a character: a `*` or `**`
+ * token may be skipped, and consecutive skippable tokens chain.
+ * @param {GlobToken[]} tokens
+ * @param {number} state
+ * @returns {number[]}
+ */
+function epsilonClosure(tokens, state) {
+  const out = [state]
+  let cursor = state
+  while (cursor < tokens.length) {
+    const token = tokens[cursor]
+    if (token === undefined || (token.kind !== 'star' && token.kind !== 'any')) break
+    cursor += 1
+    out.push(cursor)
+  }
+  return out
+}
+
+/**
+ * Whether one character can satisfy both transitions' character sets.
+ * `any` includes `/`, so it intersects every set.
+ * @param {CharSet} left
+ * @param {CharSet} right
+ * @returns {boolean}
+ */
+function charsetsIntersect(left, right) {
+  if (left.kind === 'literal' && right.kind === 'literal') return left.char === right.char
+  if (left.kind === 'literal') return left.char !== '/' || right.kind === 'any'
+  if (right.kind === 'literal') return right.char !== '/' || left.kind === 'any'
+  return true
+}
+
+/**
+ * Whether the two patterns match at least one common path.
+ * @param {GlobToken[]} left
+ * @param {GlobToken[]} right
+ * @returns {boolean}
+ */
+function globLanguagesIntersect(left, right) {
+  /** @type {number[][]} */
+  const leftClosures = []
+  for (let state = 0; state <= left.length; state += 1) leftClosures.push(epsilonClosure(left, state))
+  /** @type {number[][]} */
+  const rightClosures = []
+  for (let state = 0; state <= right.length; state += 1) rightClosures.push(epsilonClosure(right, state))
+
+  /** @type {[number, number][]} */
+  const queue = [[0, 0]]
+  const seen = new Set(['0:0'])
+  while (queue.length > 0) {
+    const pair = queue.pop()
+    if (pair === undefined) break
+    const [leftState, rightState] = pair
+    const leftClosure = leftClosures[leftState] ?? [leftState]
+    const rightClosure = rightClosures[rightState] ?? [rightState]
+    if (leftClosure.includes(left.length) && rightClosure.includes(right.length)) return true
+    for (const fromLeft of leftClosure) {
+      for (const fromRight of rightClosure) {
+        for (const leftMove of tokenTransitions(left[fromLeft], fromLeft)) {
+          for (const rightMove of tokenTransitions(right[fromRight], fromRight)) {
+            if (!charsetsIntersect(leftMove.charset, rightMove.charset)) continue
+            const key = `${leftMove.to}:${rightMove.to}`
+            if (seen.has(key)) continue
+            seen.add(key)
+            queue.push([leftMove.to, rightMove.to])
+          }
+        }
+      }
+    }
+  }
+  return false
+}
+
+/**
+ * Whether two scopes may own the same path, i.e. whether the missions that
+ * declare them must serialize. The contract is a *sound over-approximation*:
+ *
+ *   * if one concrete path is in both scopes, this returns true;
+ *   * it may also return true for scopes that only look adjacent, because the
+ *     directory-prefix heuristic is deliberately conservative (`a/**` vs `a`,
+ *     `src/*.js` vs `src/a/x.js`, anything with a leading wildcard).
+ *
+ * `false` therefore means "provably disjoint within the documented grammar"
+ * (`*` never crosses `/`, `**` does, `?` is one non-`/` character, everything
+ * else is literal, and only `*`, `**` and `?` are special).
+ *
+ * Each pair of entries is checked twice, and either check may return true:
+ *   1. the legacy directory-prefix heuristic (cheap, conservative);
+ *   2. an exact intersection of the two glob languages, which catches the
+ *      inline prefixes the heuristic misses: `a/b*` and `a/bc*` both match
+ *      `a/bcd`, and `src/a*.mjs` and `src/ab*.mjs` both match `src/abx.mjs`.
+ *
+ * Known limits: `[...]` and `{...}` are not grammar (they match literally,
+ * same as `fileInScope`); a leading wildcard is treated as a wildcard tree, so
+ * a scope that starts with a glob token overlaps every scope.
+ * `caseInsensitive` only decides the comparison — neither the stored scope
+ * text nor the result is rewritten.
+ *
  * @param {string[]} a
  * @param {string[]} b
  * @param {MatchOptions} [options]
@@ -166,11 +340,8 @@ export function scopesOverlap(a, b, { caseInsensitive = false } = {}) {
       const pa = foldCase(rawA, caseInsensitive)
       const pb = foldCase(rawB, caseInsensitive)
       if (pa === pb) return true
-      const x = scopePrefix(pa)
-      const y = scopePrefix(pb)
-      if (!x || !y) return true
-      if (x === y) return true
-      if (x.startsWith(`${y}/`) || y.startsWith(`${x}/`)) return true
+      if (prefixesOverlap(pa, pb)) return true
+      if (globLanguagesIntersect(globTokens(pa), globTokens(pb))) return true
     }
   }
   return false

package/domain/surface.js

@@ -20,8 +20,10 @@ export const SURFACE_KEYS = ['configKeys', 'sections', 'tools', 'components']
 // A count in this list is two-way: a contraction needs a decision record just
 // like growth does. The component surface is where the failure actually
 // happened (4 top-level rows -> 1 group row), so "a reduction is cheap" is
-// exactly the policy hole #120 closes.
-export const SURFACE_TWO_WAY_KEYS = ['components']
+// exactly the policy hole #120 closes. #138 extends the same brake to the config
+// keys: a removed switch is a capability decision too, so the key count may not
+// shrink silently either. Sections and tools keep the ADR 0004 cheap-shrink rule.
+export const SURFACE_TWO_WAY_KEYS = ['components', 'configKeys']
 export const CONFIG_CLASSES = ['core', 'tuning', 'niche']
 export const TOOL_CLASSES = ['core', 'optional']
 export const SURFACE_SCHEMA_VERSION = 1
@@ -240,8 +242,10 @@ function correctionEvidence(decision, where, record, exists) {
  * live surface, or a valid measurement-correction record.
  *
  * A two-way surface (see SURFACE_TWO_WAY_KEYS) also refuses a contraction whose
- * new count is not reached by a decision record; the other surfaces keep the
- * "a reduction is cheap" rule from ADR 0004.
+ * new count is not reached by a decision record, and every one of its decisions
+ * must carry a real `date` (YYYY-MM-DD): "needs a decision" means a dated
+ * decision, not a bare from/to step. The other surfaces keep the "a reduction is
+ * cheap" rule from ADR 0004 and only format-check a date when one is present.
  *
  * Extracted from `validateBaseline` so a narrower gate (`docs:check:components`,
  * #120) can validate just the component count without re-measuring the others.
@@ -268,14 +272,25 @@ export function validateSurfaceEntry(key, entry, live, liveNames, options = {})
       `${key} ${direction} from the committed baseline ${entry.value} to ${live}; update ${SURFACE_BASELINE_FILE} with an ADR or a deletion record before landing`,
     )
   }
+  const twoWay = SURFACE_TWO_WAY_KEYS.includes(key)
   let running = entry.seed
   entry.decisions.forEach((decision, index) => {
     const where = `${key}.decisions[${index}]`
     if (decision.from !== running) {
       record('broken-chain', `${where}.from ${decision.from} does not continue from ${running}`)
     }
-    if (decision.date !== undefined && !ISO_DATE.test(String(decision.date))) {
-      record('broken-chain', `${where}.date is not YYYY-MM-DD`)
+    const dated = typeof decision.date === 'string' && ISO_DATE.test(decision.date)
+    if (!dated) {
+      if (decision.date === undefined) {
+        if (twoWay) {
+          record(
+            'broken-chain',
+            `${where}.date is required: a two-way surface needs a dated decision (YYYY-MM-DD), not just a from/to record`,
+          )
+        }
+      } else {
+        record('broken-chain', `${where}.date is not YYYY-MM-DD`)
+      }
     }
     const growth = decision.to - decision.from
     if (growth > 0) {
@@ -300,7 +315,6 @@ export function validateSurfaceEntry(key, entry, live, liveNames, options = {})
     }
     running = decision.to
   })
-  const twoWay = SURFACE_TWO_WAY_KEYS.includes(key)
   if (running !== entry.value && !(entry.decisions.length === 0 && entry.value < running && !twoWay)) {
     record(
       'broken-chain',

package/host/capability-archive.js

@@ -0,0 +1,18 @@
+// tower-archive component entry (#135): terminal-mission archival only.
+//
+// Archival used to be the `archive.enabled` tuning boolean. It is a capability —
+// off means terminal missions stay hot in state.json — so it is its own row and
+// its own switch. The row owns no tool: the sweep runs after mutations and asks
+// this registry whether the row is mounted. Off means the hot state keeps
+// growing; merges, gates and every other capability keep working and nothing is
+// deleted. `archive.afterDays` / `archive.maxMissions` stay genuine tuning.
+//
+// The row is declared in cordis.patch.yml; the package export is `./archive`.
+import { holdComponent } from './capability-registry.js'
+
+export const name = 'dsh-tower/archive'
+export const inject = ['tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-archive')
+}

package/host/capability-board.js

@@ -0,0 +1,18 @@
+// tower-board component entry (#133): the generated MISSIONS.md board only.
+//
+// The board used to be the `docs.board` tuning boolean. It is a capability — off
+// means the human-readable artifact is simply not written — so it is its own row
+// and its own switch. The row owns no tool: the board is written by the
+// composition that registers tools, which asks this registry whether the row is
+// mounted. Off leaves every mission tool, gate and other capability working; an
+// existing board just goes stale. `docs.boardLocation` stays genuine tuning.
+//
+// The row is declared in cordis.patch.yml; the package export is `./board`.
+import { holdComponent } from './capability-registry.js'
+
+export const name = 'dsh-tower/board'
+export const inject = ['tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-board')
+}

package/host/capability-registry.js

@@ -21,6 +21,8 @@ export const TOWER_COMPONENT_IDS = Object.freeze([
   'tower-import',
   'tower-leases',
   'tower-tests',
+  'tower-board',
+  'tower-archive',
   'tower-hmr',
   'preset-tower-reviewer',
 ])
@@ -32,6 +34,8 @@ export const COMPONENT_TOOLS = Object.freeze({
   'tower-import': Object.freeze(['tower_import_legacy', 'tower_legacy_map']),
   'tower-leases': Object.freeze(['tower_resource']),
   'tower-tests': Object.freeze(['tower_test']),
+  'tower-board': Object.freeze([]),
+  'tower-archive': Object.freeze([]),
   'tower-hmr': Object.freeze(['tower_reload']),
   'preset-tower-reviewer': Object.freeze([]),
 })

package/host/doctor.js

@@ -331,6 +331,25 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       : check('components', 'pass', componentSummary(components)),
   )
 
+  // #131: `spawn.requireLease` is acquired through `tower_resource`, which belongs
+  // to the tower-leases row. The runtime preconditions refuse this combination, so
+  // the doctor reports it first and names both remedies instead of letting it
+  // surface as a lease-busy from every spawn.
+  const requiredLease = String(config.spawn?.requireLease ?? '').trim()
+  if (requiredLease) {
+    const leasesDisabled = components.disabled.some((entry) => entry.id === 'tower-leases')
+    checks.push(
+      leasesDisabled
+        ? check(
+            'spawn-lease',
+            'fail',
+            `spawn.requireLease="${requiredLease}" is set but the tower-leases row is disabled, so tower_resource cannot acquire the lease`,
+            're-enable the tower-leases row in the plugin page and restart DSH, or clear spawn.requireLease',
+          )
+        : check('spawn-lease', 'pass', `spawn.requireLease="${requiredLease}" is satisfiable (tower-leases row enabled)`),
+    )
+  }
+
   const subagents = ctx.get?.('subagents')
   checks.push(subagents ? check('subagents', 'pass', 'service mounted') : check('subagents', 'fail', 'subagents service is unavailable', 'enable the subagent bundle'))
   const hmr = ctx.get?.('hmr')
@@ -426,20 +445,41 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
     )
 
     const testConfigured = state.missions?.some((mission) => mission.testRuns !== undefined)
-    const testsDisabled =
-      config.tests?.enabled === false || components.disabled.some((entry) => entry.id === 'tower-tests')
+    // #136: the `tower-tests` component row is the only switch (there is no
+    // tests.enabled), so this check reads the registry and nothing else.
+    const testsDisabled = components.disabled.some((entry) => entry.id === 'tower-tests')
     checks.push(
       check(
         'tests',
         testsDisabled ? 'warn' : 'pass',
         testsDisabled
-          ? `test discovery disabled${config.tests?.enabled === false ? ' (tests.enabled:false)' : ' (disabled by component tower-tests)'}`
+          ? 'test discovery disabled (disabled by component tower-tests; enable the tower-tests row and restart DSH)'
           : `admission=${config.tests?.admission ?? 'complete'} timeoutMs=${config.tests?.timeoutMs ?? 60000}${testConfigured ? '; receipts present' : ''}`,
       ),
     )
     checks.push(check('legacy', 'pass', `${state.legacySnapshots?.length ?? 0} legacy snapshot(s)`))
     checks.push(check('batches', 'pass', `${state.batches?.length ?? 0} batch(es)`))
 
+    // #133: whether MISSIONS.md is written is the `tower-board` row, not a config
+    // key, so name the component when it is off instead of a phantom key.
+    const boardDisabled = components.disabled.some((entry) => entry.id === 'tower-board')
+    const boardPath =
+      config.docs?.boardLocation === 'repo'
+        ? path.join(tower.root, 'MISSIONS.md')
+        : path.join(tower.paths.dir, 'MISSIONS.md')
+    checks.push(
+      check(
+        'board',
+        boardDisabled ? 'warn' : 'pass',
+        boardDisabled
+          ? `MISSIONS.md is not written (disabled by component tower-board); expected at ${boardPath}`
+          : `MISSIONS.md refreshes after mission changes at ${boardPath}`,
+        boardDisabled
+          ? 'enable the tower-board row and restart DSH, or accept a stale board; every state tool and gate still works'
+          : undefined,
+      ),
+    )
+
     // Completion reports are the largest model-supplied strings in state.json;
     // report the biggest one so growth is visible before it becomes a problem.
     const reportSizes = (state.missions ?? [])
@@ -519,7 +559,12 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   const archiveInventory = await inspectArchive(tower.paths)
   const stateBytes = await fsp.stat(tower.paths.state).then((stat) => stat.size).catch(() => null)
   const archivePolicy = config.archive ?? {}
-  const policyText = `afterDays=${archivePolicy.afterDays ?? 30} maxMissions=${archivePolicy.maxMissions ?? 100}${archivePolicy.enabled === false ? ' disabled' : ''}`
+  // #135: archival is the `tower-archive` row. Name the component when it is off;
+  // the documented consequence is that terminal missions stay hot.
+  const archiveEnabled = !components.disabled.some((entry) => entry.id === 'tower-archive')
+  const policyText = `afterDays=${archivePolicy.afterDays ?? 30} maxMissions=${archivePolicy.maxMissions ?? 100}${
+    archiveEnabled ? '' : ' (disabled by component tower-archive: terminal missions stay hot and state.json keeps growing)'
+  }`
   if (!archiveInventory.exists) {
     checks.push(check('archive', 'pass', `no archived missions; ${policyText}`))
   } else if (archiveInventory.unreadable.length > 0) {
@@ -562,7 +607,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       files: archiveInventory.files.length,
       unreadable: archiveInventory.unreadable,
       policy: {
-        enabled: archivePolicy.enabled !== false,
+        enabled: archiveEnabled,
         afterDays: archivePolicy.afterDays ?? 30,
         maxMissions: archivePolicy.maxMissions ?? 100,
       },

package/host/presets.js

@@ -13,6 +13,11 @@
 // `tower-tests` adds a third: with the component row off there is no
 // `tower_test` tool and no receipt, so `gates.requireTests: true` is refused
 // here rather than left to fail at merge time with a misleading blocker.
+//
+// `tower-leases` adds a fourth (#131): `spawn.requireLease` is satisfied through
+// `tower_resource`, the tool the `tower-leases` row owns. With that row off every
+// spawn would fail at `lease-busy` advising a tool that is not registered, so the
+// contradiction is refused up front instead.
 import { TowerToolError } from '../domain/errors.js'
 import { componentEnabled, disabledReason } from './capability-registry.js'
 
@@ -73,5 +78,17 @@ export async function assertRuntimePreconditions(ctx, config = {}) {
       `gates.requireTests is true but ${disabledReason('tower-tests')}; re-enable the tower-tests component or set gates.requireTests:false`,
     )
   }
+  // #131: `spawn.requireLease` is acquired through `tower_resource`, which only
+  // exists while the tower-leases row is mounted. Without this check the config
+  // looks valid and every spawn dies at `lease-busy` pointing at a tool that is
+  // not registered. Both remedies are named because either side may be the
+  // accidental one.
+  const requiredLease = String(config.spawn?.requireLease ?? '').trim()
+  if (requiredLease && !componentEnabled('tower-leases')) {
+    throw new TowerToolError(
+      'config-invalid',
+      `spawn.requireLease="${requiredLease}" is set but ${disabledReason('tower-leases')}; tower_resource is not registered, so the lease can never be acquired. Re-enable the tower-leases component or clear spawn.requireLease`,
+    )
+  }
   return presets
 }