dsh-tower 2.4.2 → 2.6.0

package/domain/scope.js

@@ -155,6 +155,180 @@ function scopePrefix(pattern) {
 }
 
 /**
+ * The historical directory-prefix heuristic. Cheap, and deliberately wider
+ * than the exact glob intersection: it serializes `a/**` with `a` and
+ * `src/*.js` with `src/a/x.js`, and pairs anything with a leading wildcard.
+ * It is only an over-approximation, so it misses inline prefixes such as
+ * `a/b*` vs `a/bc*`; `globLanguagesIntersect` below covers those.
+ * @param {string} pa folded pattern
+ * @param {string} pb folded pattern
+ * @returns {boolean}
+ */
+function prefixesOverlap(pa, pb) {
+  const x = scopePrefix(pa)
+  const y = scopePrefix(pb)
+  if (!x || !y) return true
+  if (x === y) return true
+  return x.startsWith(`${y}/`) || y.startsWith(`${x}/`)
+}
+
+// ---------------------------------------------------------------------------
+// Exact glob-language intersection (F16, #130).
+//
+// Each pattern becomes an NFA over the documented grammar: a literal matches
+// itself, `?` matches one non-`/` character, `*` matches zero or more non-`/`
+// characters, and `**` matches zero or more of any character. Two patterns
+// share a concrete path exactly when the product of their NFAs can reach the
+// accepting states, so the check is complete for that grammar.
+
+/** @typedef {{ kind: 'literal', char: string } | { kind: 'nonSlash' } | { kind: 'any' }} CharSet */
+/** @typedef {{ charset: CharSet, to: number }} GlobTransition */
+/** @typedef {{ kind: 'literal', char: string } | { kind: 'star' } | { kind: 'any' } | { kind: 'question' }} GlobToken */
+
+/**
+ * Split a pattern into glob tokens exactly like `globToRegExp` walks it: a
+ * doubled `*` is one `**` token (anything, including `/`), every other `*` is
+ * one non-`/` token, `?` is one non-`/` character, and everything else is a
+ * literal (including `[`, `]`, `{` and `}` — they are not grammar, #130).
+ * @param {string} pattern
+ * @returns {GlobToken[]}
+ */
+function globTokens(pattern) {
+  /** @type {GlobToken[]} */
+  const tokens = []
+  for (let index = 0; index < pattern.length; index += 1) {
+    const char = pattern[index]
+    if (char === '*') {
+      if (pattern[index + 1] === '*') {
+        tokens.push({ kind: 'any' })
+        index += 1
+      } else {
+        tokens.push({ kind: 'star' })
+      }
+    } else if (char === '?') {
+      tokens.push({ kind: 'question' })
+    } else {
+      tokens.push({ kind: 'literal', char })
+    }
+  }
+  return tokens
+}
+
+/**
+ * The characters one token can consume from `state`, and where they lead.
+ * A `*`/`**` token loops on itself; skipping it (consuming nothing) is the
+ * epsilon transition, handled by `epsilonClosure`.
+ * @param {GlobToken | undefined} token
+ * @param {number} state
+ * @returns {GlobTransition[]}
+ */
+function tokenTransitions(token, state) {
+  if (token === undefined) return []
+  if (token.kind === 'literal') return [{ charset: { kind: 'literal', char: token.char }, to: state + 1 }]
+  if (token.kind === 'question') return [{ charset: { kind: 'nonSlash' }, to: state + 1 }]
+  if (token.kind === 'star') return [{ charset: { kind: 'nonSlash' }, to: state }]
+  return [{ charset: { kind: 'any' }, to: state }]
+}
+
+/**
+ * States reachable from `state` without consuming a character: a `*` or `**`
+ * token may be skipped, and consecutive skippable tokens chain.
+ * @param {GlobToken[]} tokens
+ * @param {number} state
+ * @returns {number[]}
+ */
+function epsilonClosure(tokens, state) {
+  const out = [state]
+  let cursor = state
+  while (cursor < tokens.length) {
+    const token = tokens[cursor]
+    if (token === undefined || (token.kind !== 'star' && token.kind !== 'any')) break
+    cursor += 1
+    out.push(cursor)
+  }
+  return out
+}
+
+/**
+ * Whether one character can satisfy both transitions' character sets.
+ * `any` includes `/`, so it intersects every set.
+ * @param {CharSet} left
+ * @param {CharSet} right
+ * @returns {boolean}
+ */
+function charsetsIntersect(left, right) {
+  if (left.kind === 'literal' && right.kind === 'literal') return left.char === right.char
+  if (left.kind === 'literal') return left.char !== '/' || right.kind === 'any'
+  if (right.kind === 'literal') return right.char !== '/' || left.kind === 'any'
+  return true
+}
+
+/**
+ * Whether the two patterns match at least one common path.
+ * @param {GlobToken[]} left
+ * @param {GlobToken[]} right
+ * @returns {boolean}
+ */
+function globLanguagesIntersect(left, right) {
+  /** @type {number[][]} */
+  const leftClosures = []
+  for (let state = 0; state <= left.length; state += 1) leftClosures.push(epsilonClosure(left, state))
+  /** @type {number[][]} */
+  const rightClosures = []
+  for (let state = 0; state <= right.length; state += 1) rightClosures.push(epsilonClosure(right, state))
+
+  /** @type {[number, number][]} */
+  const queue = [[0, 0]]
+  const seen = new Set(['0:0'])
+  while (queue.length > 0) {
+    const pair = queue.pop()
+    if (pair === undefined) break
+    const [leftState, rightState] = pair
+    const leftClosure = leftClosures[leftState] ?? [leftState]
+    const rightClosure = rightClosures[rightState] ?? [rightState]
+    if (leftClosure.includes(left.length) && rightClosure.includes(right.length)) return true
+    for (const fromLeft of leftClosure) {
+      for (const fromRight of rightClosure) {
+        for (const leftMove of tokenTransitions(left[fromLeft], fromLeft)) {
+          for (const rightMove of tokenTransitions(right[fromRight], fromRight)) {
+            if (!charsetsIntersect(leftMove.charset, rightMove.charset)) continue
+            const key = `${leftMove.to}:${rightMove.to}`
+            if (seen.has(key)) continue
+            seen.add(key)
+            queue.push([leftMove.to, rightMove.to])
+          }
+        }
+      }
+    }
+  }
+  return false
+}
+
+/**
+ * Whether two scopes may own the same path, i.e. whether the missions that
+ * declare them must serialize. The contract is a *sound over-approximation*:
+ *
+ *   * if one concrete path is in both scopes, this returns true;
+ *   * it may also return true for scopes that only look adjacent, because the
+ *     directory-prefix heuristic is deliberately conservative (`a/**` vs `a`,
+ *     `src/*.js` vs `src/a/x.js`, anything with a leading wildcard).
+ *
+ * `false` therefore means "provably disjoint within the documented grammar"
+ * (`*` never crosses `/`, `**` does, `?` is one non-`/` character, everything
+ * else is literal, and only `*`, `**` and `?` are special).
+ *
+ * Each pair of entries is checked twice, and either check may return true:
+ *   1. the legacy directory-prefix heuristic (cheap, conservative);
+ *   2. an exact intersection of the two glob languages, which catches the
+ *      inline prefixes the heuristic misses: `a/b*` and `a/bc*` both match
+ *      `a/bcd`, and `src/a*.mjs` and `src/ab*.mjs` both match `src/abx.mjs`.
+ *
+ * Known limits: `[...]` and `{...}` are not grammar (they match literally,
+ * same as `fileInScope`); a leading wildcard is treated as a wildcard tree, so
+ * a scope that starts with a glob token overlaps every scope.
+ * `caseInsensitive` only decides the comparison — neither the stored scope
+ * text nor the result is rewritten.
+ *
  * @param {string[]} a
  * @param {string[]} b
  * @param {MatchOptions} [options]
@@ -166,11 +340,8 @@ export function scopesOverlap(a, b, { caseInsensitive = false } = {}) {
       const pa = foldCase(rawA, caseInsensitive)
       const pb = foldCase(rawB, caseInsensitive)
       if (pa === pb) return true
-      const x = scopePrefix(pa)
-      const y = scopePrefix(pb)
-      if (!x || !y) return true
-      if (x === y) return true
-      if (x.startsWith(`${y}/`) || y.startsWith(`${x}/`)) return true
+      if (prefixesOverlap(pa, pb)) return true
+      if (globLanguagesIntersect(globTokens(pa), globTokens(pb))) return true
     }
   }
   return false

package/domain/surface.js

@@ -20,8 +20,10 @@ export const SURFACE_KEYS = ['configKeys', 'sections', 'tools', 'components']
 // A count in this list is two-way: a contraction needs a decision record just
 // like growth does. The component surface is where the failure actually
 // happened (4 top-level rows -> 1 group row), so "a reduction is cheap" is
-// exactly the policy hole #120 closes.
-export const SURFACE_TWO_WAY_KEYS = ['components']
+// exactly the policy hole #120 closes. #138 extends the same brake to the config
+// keys: a removed switch is a capability decision too, so the key count may not
+// shrink silently either. Sections and tools keep the ADR 0004 cheap-shrink rule.
+export const SURFACE_TWO_WAY_KEYS = ['components', 'configKeys']
 export const CONFIG_CLASSES = ['core', 'tuning', 'niche']
 export const TOOL_CLASSES = ['core', 'optional']
 export const SURFACE_SCHEMA_VERSION = 1
@@ -240,8 +242,10 @@ function correctionEvidence(decision, where, record, exists) {
  * live surface, or a valid measurement-correction record.
  *
  * A two-way surface (see SURFACE_TWO_WAY_KEYS) also refuses a contraction whose
- * new count is not reached by a decision record; the other surfaces keep the
- * "a reduction is cheap" rule from ADR 0004.
+ * new count is not reached by a decision record, and every one of its decisions
+ * must carry a real `date` (YYYY-MM-DD): "needs a decision" means a dated
+ * decision, not a bare from/to step. The other surfaces keep the "a reduction is
+ * cheap" rule from ADR 0004 and only format-check a date when one is present.
  *
  * Extracted from `validateBaseline` so a narrower gate (`docs:check:components`,
  * #120) can validate just the component count without re-measuring the others.
@@ -268,14 +272,25 @@ export function validateSurfaceEntry(key, entry, live, liveNames, options = {})
       `${key} ${direction} from the committed baseline ${entry.value} to ${live}; update ${SURFACE_BASELINE_FILE} with an ADR or a deletion record before landing`,
     )
   }
+  const twoWay = SURFACE_TWO_WAY_KEYS.includes(key)
   let running = entry.seed
   entry.decisions.forEach((decision, index) => {
     const where = `${key}.decisions[${index}]`
     if (decision.from !== running) {
       record('broken-chain', `${where}.from ${decision.from} does not continue from ${running}`)
     }
-    if (decision.date !== undefined && !ISO_DATE.test(String(decision.date))) {
-      record('broken-chain', `${where}.date is not YYYY-MM-DD`)
+    const dated = typeof decision.date === 'string' && ISO_DATE.test(decision.date)
+    if (!dated) {
+      if (decision.date === undefined) {
+        if (twoWay) {
+          record(
+            'broken-chain',
+            `${where}.date is required: a two-way surface needs a dated decision (YYYY-MM-DD), not just a from/to record`,
+          )
+        }
+      } else {
+        record('broken-chain', `${where}.date is not YYYY-MM-DD`)
+      }
     }
     const growth = decision.to - decision.from
     if (growth > 0) {
@@ -300,7 +315,6 @@ export function validateSurfaceEntry(key, entry, live, liveNames, options = {})
     }
     running = decision.to
   })
-  const twoWay = SURFACE_TWO_WAY_KEYS.includes(key)
   if (running !== entry.value && !(entry.decisions.length === 0 && entry.value < running && !twoWay)) {
     record(
       'broken-chain',

package/host/capability-archive.js

@@ -0,0 +1,18 @@
+// tower-archive component entry (#135): terminal-mission archival only.
+//
+// Archival used to be the `archive.enabled` tuning boolean. It is a capability —
+// off means terminal missions stay hot in state.json — so it is its own row and
+// its own switch. The row owns no tool: the sweep runs after mutations and asks
+// this registry whether the row is mounted. Off means the hot state keeps
+// growing; merges, gates and every other capability keep working and nothing is
+// deleted. `archive.afterDays` / `archive.maxMissions` stay genuine tuning.
+//
+// The row is declared in cordis.patch.yml; the package export is `./archive`.
+import { holdComponent } from './capability-registry.js'
+
+export const name = 'dsh-tower/archive'
+export const inject = ['tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-archive')
+}

package/host/capability-board.js

@@ -0,0 +1,18 @@
+// tower-board component entry (#133): the generated MISSIONS.md board only.
+//
+// The board used to be the `docs.board` tuning boolean. It is a capability — off
+// means the human-readable artifact is simply not written — so it is its own row
+// and its own switch. The row owns no tool: the board is written by the
+// composition that registers tools, which asks this registry whether the row is
+// mounted. Off leaves every mission tool, gate and other capability working; an
+// existing board just goes stale. `docs.boardLocation` stays genuine tuning.
+//
+// The row is declared in cordis.patch.yml; the package export is `./board`.
+import { holdComponent } from './capability-registry.js'
+
+export const name = 'dsh-tower/board'
+export const inject = ['tower']
+
+export function apply(ctx) {
+  holdComponent(ctx, 'tower-board')
+}

package/host/capability-registry.js

@@ -21,6 +21,8 @@ export const TOWER_COMPONENT_IDS = Object.freeze([
   'tower-import',
   'tower-leases',
   'tower-tests',
+  'tower-board',
+  'tower-archive',
   'tower-hmr',
   'preset-tower-reviewer',
 ])
@@ -32,6 +34,8 @@ export const COMPONENT_TOOLS = Object.freeze({
   'tower-import': Object.freeze(['tower_import_legacy', 'tower_legacy_map']),
   'tower-leases': Object.freeze(['tower_resource']),
   'tower-tests': Object.freeze(['tower_test']),
+  'tower-board': Object.freeze([]),
+  'tower-archive': Object.freeze([]),
   'tower-hmr': Object.freeze(['tower_reload']),
   'preset-tower-reviewer': Object.freeze([]),
 })

package/host/config.js

@@ -24,6 +24,7 @@ import {
   resolveTowerConfig,
 } from '../domain/config/schema.js'
 import { TowerToolError } from '../domain/errors.js'
+import { materializeVolatile, resolveReviewPolicy, reviewUnavailable } from '../domain/integration/review.js'
 
 export { Config, DEFAULT_DENY_TOOLS, resolveTowerConfig }
 
@@ -31,11 +32,16 @@ const REPO_CONFIG_MAX_BYTES = 1024 * 1024
 
 // The last raw profile config `apply()` received; repository config is merged
 // over it so a repo can tune spawn/merge/review without editing the profile.
+//
+// #M40: this must stay the *raw* object. A `.volatile()` field arrives as a
+// live reference that Cordis updates in place on a settings write, and cloning
+// (JSON) would freeze a copy and hide the new value from runtimeConfig(). Only
+// readers that need plain data (profileConfig) materialize it.
 let profileRaw = {}
 
 export function configureRuntime(config) {
-  profileRaw = clone(config ?? {}) ?? {}
-  return resolveTowerConfig(config)
+  profileRaw = config ?? {}
+  return resolveTowerConfig(profileRaw)
 }
 
 export function runtimeConfig() {
@@ -44,7 +50,7 @@ export function runtimeConfig() {
 
 /** Raw profile config before defaults are materialized (for doctor warnings). */
 export function profileConfig() {
-  return clone(profileRaw) ?? {}
+  return clone(materializeVolatile(profileRaw)) ?? {}
 }
 
 export function repoConfigPath(commonDir) {
@@ -92,6 +98,10 @@ export async function readRepoConfig(commonDir) {
     // Validate value types without letting the schema's defaults win over the
     // profile layer: merge into an empty raw object and discard the result.
     Config(parsed)
+    // #M39: the schema accepts both review keys; only the resolver knows that an
+    // explicit `requireReview:true` next to a conflicting `review.mode` is a
+    // contradiction. Reject it here, before the layer can be merged.
+    resolveReviewPolicy(parsed.review)
   } catch (error) {
     throw new TowerToolError('config-invalid', `repo config at ${file} is invalid: ${String(error?.message ?? error)}`)
   }
@@ -130,6 +140,33 @@ export async function resolveRepoConfig(repo) {
   if (!Array.isArray(merged.mode?.denyTools) || merged.mode.denyTools.length === 0) {
     merged.mode = { ...(merged.mode ?? {}), denyTools: [...DEFAULT_DENY_TOOLS] }
   }
+  // #M39: the review policy is resolved per layer instead of deep-merging two
+  // resolved shapes. A resolved base always carries both `review.mode` and its
+  // mirrored alias, so a repository layer that sets only one of the two would
+  // otherwise pair a stale inherited `mode` with the new alias. The repository
+  // layer wins as a whole when it names either key; a layer that names neither
+  // inherits the profile policy untouched.
+  const repoReview = repoLayer.review
+  if (repoReview && typeof repoReview === 'object' && !Array.isArray(repoReview)) {
+    const explicit = repoReview.mode !== undefined || repoReview.requireReview !== undefined
+    if (explicit) {
+      const repoPolicy = resolveReviewPolicy(repoReview)
+      if (reviewUnavailable(base) && repoPolicy.mode !== 'off') {
+        // The tool surface is fixed when the plugin applies: a profile with
+        // review off never registered tower_review, so a repository may relax
+        // review further but cannot re-enable a tool that does not exist.
+        throw new TowerToolError(
+          'config-invalid',
+          `review.mode is off in the profile, so tower_review is not registered; repository config cannot set review.mode:${repoPolicy.mode}. Set review.mode in the profile instead.`,
+        )
+      }
+      merged.review = {
+        ...(merged.review ?? {}),
+        mode: repoPolicy.mode,
+        requireReview: repoPolicy.mode === 'required',
+      }
+    }
+  }
   merged.section = merged.mode?.promptSection ?? merged.section ?? ''
   return {
     ...merged,

package/host/doctor.js

@@ -13,6 +13,7 @@ import { SCHEMA_VERSION } from '../domain/mission.js'
 import { DEFAULT_MAX_REPORT_BYTES, completionReportBytes } from '../domain/missions/completion.js'
 import { comparisonMode } from '../domain/scope.js'
 import { configSurface } from '../domain/config/schema.js'
+import { reviewPolicyView, reviewRequired } from '../domain/integration/review.js'
 import { parseBaseline, surfaceLine, SURFACE_BASELINE_FILE } from '../domain/surface.js'
 import { assessHostVersion, detectHostVersion, readCompatibility } from './compatibility.js'
 import { profileConfig } from './config.js'
@@ -242,8 +243,11 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   const config = tower.config ?? {}
   const profile = profileConfig()
   const staleDefaults = []
-  if (profile.review && profile.review.requireReview === undefined) {
-    staleDefaults.push('review.requireReview now defaults to false (2.0.3)')
+  // #M39: `review.mode` replaces the deprecated boolean. A profile that names
+  // neither key relies on the default (optional), so say so rather than letting
+  // a reader assume review is enforced.
+  if (profile.review && profile.review.mode === undefined && profile.review.requireReview === undefined) {
+    staleDefaults.push('review.mode defaults to optional; review.requireReview is a deprecated alias')
   }
   if (profile.mode && profile.mode.allowAgentControl === undefined) {
     staleDefaults.push('mode.allowAgentControl now defaults to true (2.0.4)')
@@ -261,6 +265,11 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       'optional: add <git-common-dir>/dsh-tower/config.json',
     ),
   )
+  // #M39: the resolved review mode is its own diagnostic fact. `off` is a
+  // supported, intentional posture (not a degradation), so it is a pass whose
+  // detail says exactly what is unavailable.
+  const reviewPolicy = reviewPolicyView(config)
+  checks.push(check('review', 'pass', reviewPolicy.detail))
   // #84: report the concept-budget surface instead of implying it. The counts
   // are the live schema/tool surface; the date is the committed baseline, so a
   // reader sees both the number and the decision it was frozen at.
@@ -288,7 +297,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
         ),
   )
   const presets = ctx.get?.('agentPresets')
-  const reviewerRequired = config.review?.requireReview === true
+  const reviewerRequired = reviewRequired(config)
   if (presets && typeof presets.list === 'function') {
     try {
       const available = (await presets.list()).map((entry) => String(entry.id))
@@ -296,9 +305,10 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       const reviewer = config.spawn?.reviewerPreset ?? 'tower-reviewer'
       const required = reviewerRequired ? [worker, reviewer] : [worker]
       const missing = required.filter((id) => !available.includes(id))
-      // #121: `preset-tower-reviewer` is a conditional component. Its off state
-      // is supported while review.requireReview is false; with the gate on it is
-      // a fail, because no independent review can be dispatched.
+      // #121/#M39: `preset-tower-reviewer` is a conditional component. Its off
+      // state is supported while review is off or optional; with
+      // `review.mode:required` it is a fail, because no independent review can
+      // be dispatched.
       if (missing.length === 0) {
         const reviewerNote = available.includes(reviewer)
           ? `reviewer=${reviewer}`
@@ -309,7 +319,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
           check(
             'presets',
             'fail',
-            `missing preset(s): ${missing.join(', ')}${reviewerRequired && missing.includes(reviewer) ? ' (review.requireReview is true, so preset-tower-reviewer may not be off)' : ''}`,
+            `missing preset(s): ${missing.join(', ')}${reviewerRequired && missing.includes(reviewer) ? ' (review.mode is required, so preset-tower-reviewer may not be off)' : ''}`,
             'enable the Tower preset component and retry',
           ),
         )
@@ -331,6 +341,25 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       : check('components', 'pass', componentSummary(components)),
   )
 
+  // #131: `spawn.requireLease` is acquired through `tower_resource`, which belongs
+  // to the tower-leases row. The runtime preconditions refuse this combination, so
+  // the doctor reports it first and names both remedies instead of letting it
+  // surface as a lease-busy from every spawn.
+  const requiredLease = String(config.spawn?.requireLease ?? '').trim()
+  if (requiredLease) {
+    const leasesDisabled = components.disabled.some((entry) => entry.id === 'tower-leases')
+    checks.push(
+      leasesDisabled
+        ? check(
+            'spawn-lease',
+            'fail',
+            `spawn.requireLease="${requiredLease}" is set but the tower-leases row is disabled, so tower_resource cannot acquire the lease`,
+            're-enable the tower-leases row in the plugin page and restart DSH, or clear spawn.requireLease',
+          )
+        : check('spawn-lease', 'pass', `spawn.requireLease="${requiredLease}" is satisfiable (tower-leases row enabled)`),
+    )
+  }
+
   const subagents = ctx.get?.('subagents')
   checks.push(subagents ? check('subagents', 'pass', 'service mounted') : check('subagents', 'fail', 'subagents service is unavailable', 'enable the subagent bundle'))
   const hmr = ctx.get?.('hmr')
@@ -426,20 +455,41 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
     )
 
     const testConfigured = state.missions?.some((mission) => mission.testRuns !== undefined)
-    const testsDisabled =
-      config.tests?.enabled === false || components.disabled.some((entry) => entry.id === 'tower-tests')
+    // #136: the `tower-tests` component row is the only switch (there is no
+    // tests.enabled), so this check reads the registry and nothing else.
+    const testsDisabled = components.disabled.some((entry) => entry.id === 'tower-tests')
     checks.push(
       check(
         'tests',
         testsDisabled ? 'warn' : 'pass',
         testsDisabled
-          ? `test discovery disabled${config.tests?.enabled === false ? ' (tests.enabled:false)' : ' (disabled by component tower-tests)'}`
+          ? 'test discovery disabled (disabled by component tower-tests; enable the tower-tests row and restart DSH)'
           : `admission=${config.tests?.admission ?? 'complete'} timeoutMs=${config.tests?.timeoutMs ?? 60000}${testConfigured ? '; receipts present' : ''}`,
       ),
     )
     checks.push(check('legacy', 'pass', `${state.legacySnapshots?.length ?? 0} legacy snapshot(s)`))
     checks.push(check('batches', 'pass', `${state.batches?.length ?? 0} batch(es)`))
 
+    // #133: whether MISSIONS.md is written is the `tower-board` row, not a config
+    // key, so name the component when it is off instead of a phantom key.
+    const boardDisabled = components.disabled.some((entry) => entry.id === 'tower-board')
+    const boardPath =
+      config.docs?.boardLocation === 'repo'
+        ? path.join(tower.root, 'MISSIONS.md')
+        : path.join(tower.paths.dir, 'MISSIONS.md')
+    checks.push(
+      check(
+        'board',
+        boardDisabled ? 'warn' : 'pass',
+        boardDisabled
+          ? `MISSIONS.md is not written (disabled by component tower-board); expected at ${boardPath}`
+          : `MISSIONS.md refreshes after mission changes at ${boardPath}`,
+        boardDisabled
+          ? 'enable the tower-board row and restart DSH, or accept a stale board; every state tool and gate still works'
+          : undefined,
+      ),
+    )
+
     // Completion reports are the largest model-supplied strings in state.json;
     // report the biggest one so growth is visible before it becomes a problem.
     const reportSizes = (state.missions ?? [])
@@ -519,7 +569,12 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   const archiveInventory = await inspectArchive(tower.paths)
   const stateBytes = await fsp.stat(tower.paths.state).then((stat) => stat.size).catch(() => null)
   const archivePolicy = config.archive ?? {}
-  const policyText = `afterDays=${archivePolicy.afterDays ?? 30} maxMissions=${archivePolicy.maxMissions ?? 100}${archivePolicy.enabled === false ? ' disabled' : ''}`
+  // #135: archival is the `tower-archive` row. Name the component when it is off;
+  // the documented consequence is that terminal missions stay hot.
+  const archiveEnabled = !components.disabled.some((entry) => entry.id === 'tower-archive')
+  const policyText = `afterDays=${archivePolicy.afterDays ?? 30} maxMissions=${archivePolicy.maxMissions ?? 100}${
+    archiveEnabled ? '' : ' (disabled by component tower-archive: terminal missions stay hot and state.json keeps growing)'
+  }`
   if (!archiveInventory.exists) {
     checks.push(check('archive', 'pass', `no archived missions; ${policyText}`))
   } else if (archiveInventory.unreadable.length > 0) {
@@ -551,6 +606,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
 // reports (from #89) and archive (from #73) are both kept
     reports: reportsReport,
     surface: surfaceReport,
+    review: reviewPolicy,
     components,
     archive: {
       missions: state ? state.missions.length : null,
@@ -562,7 +618,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       files: archiveInventory.files.length,
       unreadable: archiveInventory.unreadable,
       policy: {
-        enabled: archivePolicy.enabled !== false,
+        enabled: archiveEnabled,
         afterDays: archivePolicy.afterDays ?? 30,
         maxMissions: archivePolicy.maxMissions ?? 100,
       },

package/host/presets.js

@@ -6,14 +6,20 @@
 //   1. `preset-tower-worker` is a mandatory dependency: planning, mode entry and
 //      spawn must refuse when the worker preset is absent.
 //   2. `preset-tower-reviewer` is a *conditional* component. It may be off while
-//      `review.requireReview` is false (merge is unaffected); with the review
-//      gate on it must be locked with an explanatory error, never silently
-//      allowed.
+//      `review.mode` is `off` or `optional` (merge is unaffected; `off` does not
+//      use the preset at all); with `review.mode:required` it must be locked with
+//      an explanatory error, never silently allowed.
 //
 // `tower-tests` adds a third: with the component row off there is no
 // `tower_test` tool and no receipt, so `gates.requireTests: true` is refused
 // here rather than left to fail at merge time with a misleading blocker.
+//
+// `tower-leases` adds a fourth (#131): `spawn.requireLease` is satisfied through
+// `tower_resource`, the tool the `tower-leases` row owns. With that row off every
+// spawn would fail at `lease-busy` advising a tool that is not registered, so the
+// contradiction is refused up front instead.
 import { TowerToolError } from '../domain/errors.js'
+import { reviewRequired } from '../domain/integration/review.js'
 import { componentEnabled, disabledReason } from './capability-registry.js'
 
 export function presetIds(config = {}) {
@@ -33,22 +39,22 @@ function rowId(preset) {
  * registered. If the service is unavailable, doctor reports that separately and
  * this check cannot make a claim either way.
  *
- * The reviewer preset is required only when `review.requireReview` is true; the
- * off state is otherwise supported by the component contract.
+ * The reviewer preset is required only when `review.mode` is `required`; with
+ * `off`/`optional` the off state is supported by the component contract.
  */
 export async function assertPresetsAvailable(ctx, config = {}) {
   const service = ctx?.get?.('agentPresets')
   if (!service || typeof service.list !== 'function') return { checked: false, missing: [] }
   const presets = presetIds(config)
   const required = [presets.worker]
-  if (config.review?.requireReview === true) required.push(presets.reviewer)
+  if (reviewRequired(config)) required.push(presets.reviewer)
   const available = new Set((await service.list()).map((entry) => String(entry.id)))
   const missing = required.filter((id) => !available.has(id))
   if (missing.length === 0) return { checked: true, missing: [] }
   const rows = [...new Set(missing.map(rowId))]
   const reviewLock =
-    config.review?.requireReview === true && missing.includes(presets.reviewer)
-      ? ` review.requireReview is true, so the reviewer row may not be off; ${disabledReason(rowId(presets.reviewer))} is rejected`
+    reviewRequired(config) && missing.includes(presets.reviewer)
+      ? ` review.mode is required, so the reviewer row may not be off; ${disabledReason(rowId(presets.reviewer))} is rejected`
       : ''
   throw new TowerToolError(
     'preset-missing',
@@ -73,5 +79,17 @@ export async function assertRuntimePreconditions(ctx, config = {}) {
       `gates.requireTests is true but ${disabledReason('tower-tests')}; re-enable the tower-tests component or set gates.requireTests:false`,
     )
   }
+  // #131: `spawn.requireLease` is acquired through `tower_resource`, which only
+  // exists while the tower-leases row is mounted. Without this check the config
+  // looks valid and every spawn dies at `lease-busy` pointing at a tool that is
+  // not registered. Both remedies are named because either side may be the
+  // accidental one.
+  const requiredLease = String(config.spawn?.requireLease ?? '').trim()
+  if (requiredLease && !componentEnabled('tower-leases')) {
+    throw new TowerToolError(
+      'config-invalid',
+      `spawn.requireLease="${requiredLease}" is set but ${disabledReason('tower-leases')}; tower_resource is not registered, so the lease can never be acquired. Re-enable the tower-leases component or clear spawn.requireLease`,
+    )
+  }
   return presets
 }