dsh-tower 2.5.0 → 2.7.0

package/host/preset-survey.js

@@ -0,0 +1,18 @@
+// Tower survey preset declaration (#148 D7): the read-only survey preset's own
+// Plugins-page label. This is the survey twin of `host/preset-worker.js`: the row
+// config stays in `cordis.patch.yml` and this module forwards it to the injected
+// `agentPresets` service, which owns mount/unmount. A Tower-owned specifier gives
+// the row a distinct locale (`dsh-tower/preset-survey/locale/<lang>.json`).
+export const name = 'dsh-tower/preset-survey'
+
+export const inject = ['agentPresets']
+
+/**
+ * Register the survey preset with the profile's preset registry.
+ * @param {{ agentPresets: { register: (config: any) => Promise<() => Promise<void> | void> } }} ctx
+ * @param {any} config the `cordis.patch.yml` row config (id/name/description/order/plugins)
+ * @returns {Promise<() => Promise<void> | void>} the registry's unregister disposer
+ */
+export async function apply(ctx, config) {
+  return ctx.agentPresets.register(config)
+}

package/host/presets.js

@@ -6,9 +6,9 @@
 //   1. `preset-tower-worker` is a mandatory dependency: planning, mode entry and
 //      spawn must refuse when the worker preset is absent.
 //   2. `preset-tower-reviewer` is a *conditional* component. It may be off while
-//      `review.requireReview` is false (merge is unaffected); with the review
-//      gate on it must be locked with an explanatory error, never silently
-//      allowed.
+//      `review.mode` is `off` or `optional` (merge is unaffected; `off` does not
+//      use the preset at all); with `review.mode:required` it must be locked with
+//      an explanatory error, never silently allowed.
 //
 // `tower-tests` adds a third: with the component row off there is no
 // `tower_test` tool and no receipt, so `gates.requireTests: true` is refused
@@ -19,13 +19,19 @@
 // spawn would fail at `lease-busy` advising a tool that is not registered, so the
 // contradiction is refused up front instead.
 import { TowerToolError } from '../domain/errors.js'
+import { reviewRequired } from '../domain/integration/review.js'
+import { ROLES, rolePresetConfig } from '../domain/roles.js'
 import { componentEnabled, disabledReason } from './capability-registry.js'
 
 export function presetIds(config = {}) {
-  return {
-    worker: String(config.spawn?.workerPreset ?? 'tower-worker'),
-    reviewer: String(config.spawn?.reviewerPreset ?? 'tower-reviewer'),
+  const ids = {}
+  const spawn = config.spawn ?? {}
+  for (const role of ROLES) {
+    const spec = rolePresetConfig(role)
+    if (!spec) continue
+    ids[role] = String(spawn[spec.slot] ?? spec.fallback)
   }
+  return ids
 }
 
 function rowId(preset) {
@@ -38,22 +44,22 @@ function rowId(preset) {
  * registered. If the service is unavailable, doctor reports that separately and
  * this check cannot make a claim either way.
  *
- * The reviewer preset is required only when `review.requireReview` is true; the
- * off state is otherwise supported by the component contract.
+ * The reviewer preset is required only when `review.mode` is `required`; with
+ * `off`/`optional` the off state is supported by the component contract.
  */
 export async function assertPresetsAvailable(ctx, config = {}) {
   const service = ctx?.get?.('agentPresets')
   if (!service || typeof service.list !== 'function') return { checked: false, missing: [] }
   const presets = presetIds(config)
   const required = [presets.worker]
-  if (config.review?.requireReview === true) required.push(presets.reviewer)
+  if (reviewRequired(config)) required.push(presets.reviewer)
   const available = new Set((await service.list()).map((entry) => String(entry.id)))
   const missing = required.filter((id) => !available.has(id))
   if (missing.length === 0) return { checked: true, missing: [] }
   const rows = [...new Set(missing.map(rowId))]
   const reviewLock =
-    config.review?.requireReview === true && missing.includes(presets.reviewer)
-      ? ` review.requireReview is true, so the reviewer row may not be off; ${disabledReason(rowId(presets.reviewer))} is rejected`
+    reviewRequired(config) && missing.includes(presets.reviewer)
+      ? ` review.mode is required, so the reviewer row may not be off; ${disabledReason(rowId(presets.reviewer))} is rejected`
       : ''
   throw new TowerToolError(
     'preset-missing',

package/host/tool-registry.js

@@ -16,6 +16,7 @@ import {
 } from '../domain/vocabulary.js'
 import { git, resolveRepo, hasAnyCommit } from '../adapters/git.js'
 import { runtimeConfig } from './config.js'
+import { reviewUnavailable } from '../domain/integration/review.js'
 import { runDoctor } from './doctor.js'
 import { createHmrBridge } from './hmr.js'
 import { assertRuntimePreconditions } from './presets.js'
@@ -53,7 +54,7 @@ import { registerFindingsTool } from '../tools/findings.js'
 import { readDiscoveryConfig, normalizeDiscovery, runDiscovery } from '../adapters/tests.js'
 import { summarize as summarizeBatch } from '../domain/batch.js'
 import { assertPorts } from '../ports/index.js'
-import { COMPONENT_TOOLS, componentEnabled, componentReport, holdComponent, disabledReason } from './capability-registry.js'
+import { COMPONENT_TOOLS, componentEnabled, componentReport, holdComponent, disabledReason, presetAvailable, PRESET_ROW_COMPONENTS } from './capability-registry.js'
 import path from 'node:path'
 import { fsp } from '../adapters/store-fs.js'
 import { createDefaultDeps } from '../adapters/default.js'
@@ -510,16 +511,9 @@ async function runMissionDiscovery(tower, mission) {
     diagnosticsDir: path.join(tower.paths.dir, 'test-runs', `${mission.id}-${Date.now()}`),
   })
   const stored = await tower.recordTestRun({ missionId: mission.id, receipt })
-  const commands = Array.isArray(stored.commands) ? stored.commands : []
-  const check = {
-    name: 'tests',
-    command: commands.map((command) => `${command.id}: ${command.command}`).join('; ') || 'tower.testDiscovery',
-    exitCode: commands.every((command) => command.exitCode === 0) ? 0 : (commands.find((command) => command.exitCode !== 0)?.exitCode ?? 1),
-    evidence: stored.ok
-      ? `${stored.tests?.length ?? 0} test(s) passed at ${String(stored.treeTip ?? '').slice(0, 12)}; receipt ${stored.receiptPath ?? stored.diagnosticsPath}`
-      : `test discovery failed: ${String(stored.error ?? 'unknown').slice(0, 300)}`,
-  }
-  return { configured: true, receipt: stored, check }
+  // #149 W4: the recorded receipt is the only evidence shape. Consumers read it
+  // through domain/evidence.js; there is no separate `check` projection.
+  return { configured: true, receipt: stored }
 }
 
 async function observeActivity(ctx, tower) {
@@ -579,6 +573,15 @@ export function registerCoreTowerTools(ctx, options = {}) {
     components: {
       enabled: (id) => componentEnabled(id),
       reason: (id) => disabledReason(id),
+      // Preset rows are declarative and invisible to the code registry, so the
+      // synchronous `enabled` probe cannot answer for them. Callers that gate a
+      // shape read this async probe, which returns null when `agentPresets` is
+      // absent (unknown, not disabled).
+      available: async (id) => {
+        const presetId = PRESET_ROW_COMPONENTS[id]
+        if (presetId) return presetAvailable(ctx, presetId)
+        return componentEnabled(id)
+      },
     },
     events: {
       emit(name, payload) {
@@ -638,7 +641,7 @@ export function registerCoreTowerTools(ctx, options = {}) {
 
   registerInterruptTool(ctx, { openTower, define, actorFor, requireTowerActor, interruptRosterAgent })
 
-  registerDiffTool(ctx, { openTower, define })
+  registerDiffTool(ctx, { openTower, define, actorFor })
 
   registerAdoptTool(ctx, { openTower, define, actorFor, requireTowerActor })
 
@@ -652,7 +655,14 @@ export function registerCoreTowerTools(ctx, options = {}) {
 
   registerFindingsTool(ctx, { openTower, define, actorFor, requireKnownActor })
 
-  registerReviewTool(ctx, { openTower, define, actorFor })
+  // #M39: `review.mode:off` is the one configuration that removes tower_review
+  // from the mounted surface. The name is still recorded before the decision so
+  // the concept budget keeps measuring the build surface (the same rule the
+  // shipped-off component rows follow), and status/doctor report the mode as
+  // intentionally unavailable. A repository layer cannot re-enable the tool
+  // (host/config.js refuses that); the profile owns the mounted surface.
+  recordToolRegistration('tower_review')
+  if (!reviewUnavailable(runtimeConfig())) registerReviewTool(ctx, { openTower, define, actorFor })
 
   registerPreflightTool(ctx, { openTower, define, observeActivity })
 

package/locale/en.json

@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Tower",
-    "description": "Plan and track missions, isolate each one in its own worktree, hand the work to worker and reviewer agents, and merge after review when review before merging is required. Off equals uninstalling Tower: no tools, presets or skills remain."
+    "description": "Plan and track missions, isolate each one in its own worktree, hand the work to worker and reviewer agents, and merge after review when review before merging is required. Off equals uninstalling Tower: no tools, presets or skills remain. Turning off the survey capability removes both survey presets: surveys cannot be planned (planning one is refused with an actionable code) and no survey agent can be dispatched. Build missions and every other capability keep working."
   },
   "components": {
     "tower": {
@@ -59,6 +59,21 @@
       "summary": "The independent Tower Reviewer preset: a read-only reviewer agent that reads the mission diff, checks scope and acceptance, and returns a verdict. Usable while review before merging is optional; a precondition for merging once review before merging is required.",
       "disables": "The reviewer cannot be started. That is supported while review before merging is optional; once review before merging is required, planning and entering Tower mode are refused with an explanation."
     },
+    "tower-survey": {
+      "title": "Tower Survey",
+      "summary": "Inspect one recorded commit either read-only in the shared checkout or in a disposable detached sandbox that may write and run commands inside it. A survey has no branch, no commit of its own, and never merges; the sandbox is removed when the survey completes.",
+      "disables": "Turning off the survey capability removes both survey presets: surveys cannot be planned (planning one is refused with an actionable code) and no survey agent can be dispatched. Build missions and every other capability keep working."
+    },
+    "preset-tower-survey": {
+      "title": "Tower Survey preset",
+      "summary": "The shared-checkout survey dependency: read, glob, grep, skill, and the Tower mission/status/finding/inbox/complete tools, with no write, edit, or shell tool.",
+      "disables": "A shared survey cannot be dispatched; build missions and every other capability keep working."
+    },
+    "preset-tower-survey-sandbox": {
+      "title": "Tower Survey Sandbox preset",
+      "summary": "The detached-survey dependency: a disposable sandbox that may write and run commands inside its checkout while reading one recorded commit, with no branch and no commit of its own.",
+      "disables": "A detached survey cannot be dispatched; shared surveys and build missions keep working."
+    },
     "tower-ui": {
       "title": "Tower UI",
       "summary": "Adds Tower cards for tool results, a compact status summary above the message box, and a short status strip, in the web client.",

package/locale/preset-survey/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey preset",
+    "description": "The shared-checkout survey dependency: read, glob, grep, skill, and the Tower mission/status/finding/inbox/complete tools, with no write, edit, or shell tool. Mandatory dependency, not a switch: A shared survey cannot be dispatched; build missions and every other capability keep working."
+  }
+}

package/locale/preset-survey/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey 预设",
+    "description": "共享检出勘察的依赖项：read、glob、grep、skill，以及 Tower 的任务线、状态、发现、收件箱与完成工具，不包含写入、编辑或命令行工具。强制依赖，不是开关：无法派发共享检出勘察；普通构建任务线与其他能力继续工作。"
+  }
+}

package/locale/preset-survey-sandbox/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey Sandbox preset",
+    "description": "The detached-survey dependency: a disposable sandbox that may write and run commands inside its checkout while reading one recorded commit, with no branch and no commit of its own. Mandatory dependency, not a switch: A detached survey cannot be dispatched; shared surveys and build missions keep working."
+  }
+}

package/locale/preset-survey-sandbox/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey Sandbox 预设",
+    "description": "分离勘察的依赖项：一个一次性沙箱，可在读取一个已记录提交时于检出中写入并运行命令，没有分支，也没有自己的提交。强制依赖，不是开关：无法派发分离勘察；共享检出勘察与普通构建任务线继续工作。"
+  }
+}

package/locale/zh.json

@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Tower",
-    "description": "规划并跟踪任务线，让每条任务线在独立工作树中完成，交给执行代理与审查代理，并且在把合并前审查设为必须时，审查通过后再合并。关闭这一项等同于卸载 Tower：不再保留任何工具、预设或技能。"
+    "description": "规划并跟踪任务线，让每条任务线在独立工作树中完成，交给执行代理与审查代理，并且在把合并前审查设为必须时，审查通过后再合并。关闭这一项等同于卸载 Tower：不再保留任何工具、预设或技能。关闭勘察能力会移除两个勘察预设：无法规划勘察任务（规划勘察会被可操作的错误码拒绝），也无法派发勘察代理。普通构建任务线与其他能力继续工作。"
   },
   "components": {
     "tower": {
@@ -59,6 +59,21 @@
       "summary": "独立的 Tower Reviewer 审查代理预设：一个只读代理，阅读任务线差异、核对范围与验收，并给出结论。在合并前审查仍为可选时可以使用；一旦把合并前审查设为必须，它就是合并的前置条件。",
       "disables": "无法启动审查代理。在合并前审查仍为可选时，允许关闭这一项；一旦要求合并前必须审查，规划或进入 Tower 模式会被拒绝并给出解释。"
     },
+    "tower-survey": {
+      "title": "Tower 勘察",
+      "summary": "勘察一个已记录的提交：可在共享检出中只读查看，也可在一次性分离沙箱中写入并运行命令。勘察没有分支、没有自己的提交，也从不合并；勘察完成时沙箱会被移除。",
+      "disables": "关闭勘察能力会移除两个勘察预设：无法规划勘察任务（规划勘察会被可操作的错误码拒绝），也无法派发勘察代理。普通构建任务线与其他能力继续工作。"
+    },
+    "preset-tower-survey": {
+      "title": "Tower Survey 预设",
+      "summary": "共享检出勘察的依赖项：read、glob、grep、skill，以及 Tower 的任务线、状态、发现、收件箱与完成工具，不包含写入、编辑或命令行工具。",
+      "disables": "无法派发共享检出勘察；普通构建任务线与其他能力继续工作。"
+    },
+    "preset-tower-survey-sandbox": {
+      "title": "Tower Survey Sandbox 预设",
+      "summary": "分离勘察的依赖项：一个一次性沙箱，可在读取一个已记录提交时于检出中写入并运行命令，没有分支，也没有自己的提交。",
+      "disables": "无法派发分离勘察；共享检出勘察与普通构建任务线继续工作。"
+    },
     "tower-ui": {
       "title": "Tower 界面",
       "summary": "在 Web 客户端中显示 Tower 工具结果卡片、输入框上方的简要状态摘要，以及简短的状态提示条。",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-tower",
-  "version": "2.5.0",
+  "version": "2.7.0",
   "type": "module",
   "description": "DSH-native Tower: mission planning, worktree isolation, review-gated merges, and a human-owned Tower mode.",
   "license": "MIT",
@@ -28,8 +28,11 @@
   },
   "exports": {
     ".": "./index.js",
+    "./client": "./client.js",
     "./worker": "./worker.js",
     "./reviewer": "./reviewer.js",
+    "./survey": "./survey.js",
+    "./survey-sandbox": "./survey-sandbox.js",
     "./skills": "./skills.js",
     "./batch": "./host/capability-batch.js",
     "./import": "./host/capability-import.js",
@@ -40,6 +43,8 @@
     "./hmr": "./host/capability-hmr.js",
     "./preset-worker": "./host/preset-worker.js",
     "./preset-reviewer": "./host/preset-reviewer.js",
+    "./preset-survey": "./host/preset-survey.js",
+    "./preset-survey-sandbox": "./host/preset-survey-sandbox.js",
     "./skills/locale/*.json": "./locale/skills/*.json",
     "./batch/locale/*.json": "./locale/batch/*.json",
     "./import/locale/*.json": "./locale/import/*.json",
@@ -50,14 +55,19 @@
     "./hmr/locale/*.json": "./locale/hmr/*.json",
     "./preset-worker/locale/*.json": "./locale/preset-worker/*.json",
     "./preset-reviewer/locale/*.json": "./locale/preset-reviewer/*.json",
+    "./preset-survey/locale/*.json": "./locale/preset-survey/*.json",
+    "./preset-survey-sandbox/locale/*.json": "./locale/preset-survey-sandbox/*.json",
     "./locale/*.json": "./locale/*.json",
     "./icon": "./icon.svg",
     "./package.json": "./package.json"
   },
   "files": [
+    "client.js",
     "index.js",
     "worker.js",
     "reviewer.js",
+    "survey.js",
+    "survey-sandbox.js",
     "skills.js",
     "skills/",
     "host/*.js",
@@ -86,6 +96,10 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true
     }
   },
   "scripts": {
@@ -119,6 +133,9 @@
     "docs:check:generated:components": "node scripts/generate-component-surface.mjs --check",
     "docs:generate:locale": "node scripts/generate-capability-locale.mjs",
     "docs:check:generated:locale": "node scripts/generate-capability-locale.mjs --check",
+    "docs:generate:shapes": "node scripts/generate-shapes-reference.mjs",
+    "docs:check:generated:shapes": "node scripts/generate-shapes-reference.mjs --check",
+    "shape:audit": "node scripts/shape-audit.mjs",
     "docs:check:components": "node scripts/check-components.mjs",
     "pack:check": "node scripts/check-pack.mjs",
     "architecture:check": "node scripts/architecture.mjs",
@@ -126,7 +143,7 @@
     "types:coverage": "node scripts/types-coverage.mjs",
     "types:strict:check": "node scripts/types-strict.mjs",
     "types:strict:write": "node scripts/types-strict.mjs --write",
-    "check": "npm test && npm run test:property && npm run docs:check && npm run docs:check:philosophy && npm run docs:check:generated && npm run docs:check:generated:tools && npm run docs:check:generated:config && npm run docs:check:generated:events && npm run docs:check:generated:types && npm run docs:check:generated:components && npm run docs:check:generated:locale && npm run docs:check:components && npm run surface:check && npm run pack:check && npm run architecture:check && npm run types:coverage && npm run types:strict:check && npm run types:check && npm run domain:check",
+    "check": "npm test && npm run test:property && npm run docs:check && npm run docs:check:philosophy && npm run docs:check:generated && npm run docs:check:generated:tools && npm run docs:check:generated:config && npm run docs:check:generated:events && npm run docs:check:generated:types && npm run docs:check:generated:components && npm run docs:check:generated:locale && npm run docs:check:generated:shapes && npm run shape:audit && npm run docs:check:components && npm run surface:check && npm run pack:check && npm run architecture:check && npm run types:coverage && npm run types:strict:check && npm run types:check && npm run domain:check",
     "domain:metrics": "node scripts/domain-metrics.mjs",
     "domain:check": "node scripts/domain-metrics.mjs --check"
   },

package/ports/state.js

@@ -5,7 +5,14 @@ import { assertPort, definePort } from './contract.js'
 
 /**
  * @typedef {object} StatePort
- * @property {(input: { store: unknown, paths: unknown, now?: number, persist?: boolean, migrations?: readonly unknown[] }) => Promise<any>} loadStateFile
+ * @property {(input: {
+ *   store: unknown,
+ *   paths: unknown,
+ *   now?: number,
+ *   persist?: boolean,
+ *   migrations?: readonly unknown[],
+ *   resolveLegacySurvey?: (rawState: Record<string, any>) => Promise<{ readCommit: string, readDirty: string[] } | null>,
+ * }) => Promise<any>} loadStateFile
  */
 
 export const STATE_PORT = definePort('StatePort', ['loadStateFile'])

package/scripts/architecture-waivers.json

@@ -1,7 +1,6 @@
 {
   "$comment": "Justified architecture-gate exemptions (#80). Every entry needs rule, path, reason, and owner or ref. Scripts/architecture.mjs fails with waiver-contract when an entry is not justified. domain-pure, host-scope and no-lib-from-core cannot be waived at all, and domain/** accepts no waiver. Since #70 the retired lib/ layer has no waivers: host/** owns ambient state by rule, and only the two I/O adapters below are exempt.",
-  "waivers": [
-    {
+  "waivers": [    {
       "rule": "child-process-surface",
       "path": "adapters/vcs-git.js",
       "reason": "The git adapter is the single process-spawning boundary; no other module implements VcsPort with a child process.",
@@ -15,5 +14,6 @@
       "owner": "louifinn",
       "ref": "#50"
     }
-  ]
+  ],
+  "shapeWaivers": []
 }

package/scripts/check-components.mjs

@@ -8,14 +8,19 @@
 //      locale/en.json and locale/zh.json — and the same three strings for every
 //      component that ships a generated row label, including the internal
 //      worker preset (#121);
-//   2. a forbidden-to-disable capability (host, health, recovery, review
-//      contract, merge gates) that any group, row or boolean key can disable;
+//   2. a forbidden-to-disable capability (host, health, recovery, merge gates)
+//      that any group, row or boolean key can disable;
 //   3. a component count that moved without a decision in
 //      scripts/surface-baseline.json (the same brake `surface:check` applies);
 //   4. #137: user-facing label copy that leaks a config key, an internal tool id,
 //      a slash command or a module specifier, leaves a term untranslated in
 //      Chinese, drifts from the recorded glossary, or diverges between zh and en
-//      in the root locale, the generated row locales and the ui-bundle locale.
+//      in the root locale, the generated row locales and the ui-bundle locale;
+//   5. #M42: the review policy presented as a row. `review.mode` is one
+//      tri-state configuration control (off/optional/required) on the plugin
+//      page, not a component row and not three mutually exclusive rows; no row
+//      may own the policy, and the reviewer preset row may not be made
+//      incompatible with the off/optional modes.
 //
 // It also refuses the quiet forms of the same drift: a shipped component row
 // missing from the single source of truth, a live config key without a
@@ -72,9 +77,10 @@ a visible row with no label source at all, a group row whose plugin-page
 description omits its off consequence, a forbidden-to-disable capability disabled
 by a group, row or boolean key, a component count that moved without a
 scripts/surface-baseline.json decision, an unclassified config key or component
-row, a stale generated reference, and (#137) any label copy that names a config
-key or internal tool id, leaves a glossary term untranslated, or diverges between
-zh and en.
+row, a stale generated reference, (#137) any label copy that names a config key or
+internal tool id, leaves a glossary term untranslated, or diverges between zh and
+en, and (#M42) the review policy exposed as a row instead of one tri-state
+configuration control.
 Regenerate the table with \`npm run docs:generate:components\` and the row labels
 with \`npm run docs:generate:locale\`.`
 
@@ -650,6 +656,112 @@ export function checkRowLabelSources(patch, rowLocales) {
   return findings
 }
 
+// #M42: the review policy is one tri-state configuration control on the plugin
+// page. These names are the policy-shaped rows the gate refuses to see: a row
+// per mode (or one "review policy" row) is the shape the product replaced.
+export const REVIEW_POLICY_KEY = 'review.mode'
+export const REVIEW_ALIAS_KEY = 'review.requireReview'
+export const REVIEW_REVIEWER_ROW = 'preset-tower-reviewer'
+const REVIEW_POLICY_ROW_IDS = Object.freeze([
+  'review',
+  'review-policy',
+  'review-mode',
+  'review-modes',
+  'tower-review',
+  'tower-review-policy',
+])
+
+/**
+ * #M42: hold the review control to its declared shape. The policy is one
+ * tri-state control (`off`/`optional`/`required`) on the plugin-page
+ * configuration form, not a component row and not three mutually exclusive rows.
+ *
+ * The gate fails when a review-policy-shaped row exists, when a component
+ * `allowedOverrides` or a shipped row's `config:` block owns `review.mode` (or
+ * the deprecated alias), when the non-disableable required-mode gate is not
+ * recorded on the forbidden list, and when a forbidden capability claims the
+ * reviewer preset row as a disabler. The reviewer row is an optional capability:
+ * it may be off while the policy is off or optional, and is only a precondition
+ * (with an explanatory refusal) under required.
+ *
+ * @param {ReturnType<typeof parseComponentSurface>} surface
+ * @param {{ patch?: ReturnType<typeof parseCordisPatch> }} live
+ */
+export function checkReviewPolicySurface(surface, live) {
+  const findings = []
+  const record = (code, message) => findings.push(finding(code, 'error', message))
+  const components = surface?.components ?? []
+  const byName = new Map((surface?.keys ?? []).map((key) => [key.name, key]))
+
+  for (const name of [REVIEW_POLICY_KEY, REVIEW_ALIAS_KEY]) {
+    const key = byName.get(name)
+    if (!key) {
+      record('review-policy-key', `${name} is missing from the component surface; the review policy needs an explicit class`)
+      continue
+    }
+    if (key.class !== 'core') {
+      record(
+        'review-policy-class',
+        `${name} is classified "${key.class}"; the review policy is one tri-state configuration control and its keys must be core, never a switch a row can turn off`,
+      )
+    }
+  }
+
+  const policyRow = components.find((component) => REVIEW_POLICY_ROW_IDS.includes(component.id))
+  if (policyRow) {
+    record(
+      'review-policy-row',
+      `component "${policyRow.id}" is a review-policy row; the review policy is one tri-state control on the plugin-page configuration form, not a component row and never one row per mode`,
+    )
+  }
+
+  const reviewerRow = components.find((component) => component.id === REVIEW_REVIEWER_ROW)
+  if (!reviewerRow) {
+    record(
+      'review-policy-reviewer-row',
+      `${REVIEW_REVIEWER_ROW} is missing from the component surface; the reviewer preset must stay an optional capability the review policy may leave unused`,
+    )
+  }
+
+  for (const component of components) {
+    for (const override of component.allowedOverrides ?? []) {
+      if (override !== REVIEW_POLICY_KEY && override !== REVIEW_ALIAS_KEY) continue
+      record(
+        'review-policy-switch',
+        `component "${component.id}" lists ${override} in allowedOverrides; the review policy is one tri-state configuration control and no component row may own it`,
+      )
+    }
+  }
+
+  for (const row of live?.patch?.rows ?? []) {
+    for (const override of row.configOverrides ?? []) {
+      if (override.key !== REVIEW_POLICY_KEY && override.key !== REVIEW_ALIAS_KEY) continue
+      record(
+        'review-policy-switch',
+        `row "${row.id}" sets ${override.key} in cordis.patch.yml; the review policy is one tri-state configuration control, not a per-row switch`,
+      )
+    }
+  }
+
+  const gate = (surface?.forbidden ?? []).find((capability) => (capability.gatedBy ?? []).includes(REVIEW_POLICY_KEY))
+  if (!gate) {
+    record(
+      'review-policy-gate',
+      `no forbidden capability records the required-mode review gate via gatedBy ${REVIEW_POLICY_KEY}; required mode must keep its review evidence and exemption path non-disableable`,
+    )
+  }
+
+  for (const capability of surface?.forbidden ?? []) {
+    if (!(capability.rowIds ?? []).includes(REVIEW_REVIEWER_ROW)) continue
+    record(
+      'review-policy-exclusive',
+      `forbidden capability "${capability.id}" lists ${REVIEW_REVIEWER_ROW} as a row it may disable; a component may not be mutually exclusive with the review policy, which is one control, not a row`,
+    )
+  }
+
+  return findings
+}
+
 /**
  * Run every component-surface rule against one repository root.
  * @param {string} root
@@ -735,6 +847,8 @@ export async function checkComponents(root) {
     findings.push(finding('registry-unreadable', 'error', live.registryError))
   }
   findings.push(...checkForbidden(surface, { booleans: live.booleans, registry: live.registry, patch: live.patch }))
+  // #M42: the review policy is one tri-state configuration control, not a row.
+  findings.push(...checkReviewPolicySurface(surface, live))
 
   // The decision record must exist: the ADR is where the policy is argued.
   if (!fs.existsSync(path.join(root, surface.adr))) {

package/scripts/check-docs.mjs

@@ -34,10 +34,10 @@ for (const code of [
   'blockers-present',
   'branch-missing',
   'stale-base',
-  'read-only-survey',
   'out-of-scope',
   'base-dirty',
   'deps-unmerged',
+  'survey-stale',
   'no-review',
   'review-mission-mismatch',
   'not-clean',

package/scripts/check-pack.mjs

@@ -16,6 +16,9 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const REQUIRED_FILES = [
   'cordis.patch.yml',
   'index.js',
+  // #M40: the core Web Client half carries the Plugins-page review policy
+  // control; it is part of the published bundle like ui-bundle/.
+  'client.js',
   'locale/en.json',
   'locale/zh.json',
   // #121: every optional capability row and both preset-declaring rows explain
@@ -25,6 +28,8 @@ const REQUIRED_FILES = [
   ...presetLocalePaths(),
   'host/preset-worker.js',
   'host/preset-reviewer.js',
+  'host/preset-survey.js',
+  'survey.js',
   'ui-bundle/index.js',
   'ui-bundle/package.json',
   'ui-bundle/cordis.patch.yml',