dsh-tower 2.5.0 → 2.7.0

package/scripts/component-surface.json

@@ -1,12 +1,12 @@
 {
   "schema": 1,
-  "date": "2026-10-23",
+  "date": "2026-11-01",
   "adr": "docs/adr/0005-component-surface.md",
   "classes": {
     "core": "Removing it breaks the Tower contract. It is never a switch.",
     "optional-component": "A capability whose off state leaves the rest of Tower intact. It must be a user-visible switch with a documented fallback.",
     "optional-config": "A tuning knob, not a capability. It stays in the config form and never hides a component.",
-    "forbidden-to-disable": "The host, the health contract, the recovery escape, the review contract and the merge gates. No group, row or boolean key may turn it off."
+    "forbidden-to-disable": "The host, the health contract, the recovery escape and the merge gates. No group, row or boolean key may turn it off."
   },
   "components": [
     {
@@ -88,7 +88,25 @@
       "id": "preset-tower-reviewer",
       "scope": "visible",
       "kind": "row",
-      "fallback": "Declared by dsh-tower/preset-reviewer: the reviewer cannot be dispatched. Supported while review.requireReview is false (merge is unaffected); with the gate on planning/mode entry is locked with an explanatory error."
+      "fallback": "Declared by dsh-tower/preset-reviewer: the reviewer cannot be dispatched. Supported while review.mode is off or optional (merge is unaffected; off does not use the preset at all); with review.mode required, planning/mode entry is locked with an explanatory error."
+    },
+    {
+      "id": "tower-survey",
+      "scope": "visible",
+      "kind": "group",
+      "fallback": "Declared by the tower-survey group: surveys cannot be planned (planning one is refused with an actionable code) and no survey agent is dispatched, because both the read-only and the sandbox preset are nested dependencies of this row. Build missions and every existing capability are unaffected. survey.sandbox stays tuning: it chooses shared vs detached placement, never whether surveys exist."
+    },
+    {
+      "id": "preset-tower-survey",
+      "scope": "internal",
+      "kind": "row",
+      "fallback": "Declared by dsh-tower/preset-survey: the shared-checkout survey preset is a dependency of the tower-survey group, never its own switch. With the group off, a shared survey cannot be dispatched."
+    },
+    {
+      "id": "preset-tower-survey-sandbox",
+      "scope": "internal",
+      "kind": "row",
+      "fallback": "Declared by dsh-tower/preset-survey-sandbox: the detached-sandbox survey preset is a dependency of the tower-survey group, never its own switch. It is selected only when survey.sandbox is detached; with the group off, a detached survey cannot be dispatched."
     },
     {
       "id": "tower-ui",
@@ -99,6 +117,7 @@
   ],
   "gateableTools": {},
   "behaviorKnobs": [
+    "review.mode",
     "spawn.requireLease",
     "tests.admission"
   ],
@@ -221,10 +240,15 @@
       "class": "optional-config",
       "note": "Bounded wait for the cross-process mode lock."
     },
+    {
+      "name": "review.mode",
+      "class": "core",
+      "note": "The review policy: off, optional (default) or required, selected by one tri-state control on the plugin-page configuration form. It is configuration, not a component row and not three mutually exclusive rows. off intentionally removes tower_review, refuses reviewer spawn and makes the merge gate ignore review; optional never blocks a merge; required makes a clean tip-bound review a merge blocker. The reviewer preset row stays a capability the mode may leave unused."
+    },
     {
       "name": "review.requireReview",
-      "class": "forbidden-to-disable",
-      "note": "Turns independent review into a merge blocker; no component may switch it off. With it on, the preset-tower-reviewer row may not be off (planning/mode entry refuse the combination)."
+      "class": "core",
+      "note": "Deprecated one-release boolean alias for review.mode (true -> required, false -> optional; default optional). It is policy configuration and a deprecated alias, not a switch a row may own; false never overrides an explicit mode. Kept so 2.5 configurations keep working; remove after the 2.6 alias window."
     },
     {
       "name": "review.maxRoundsPerReviewer",
@@ -281,6 +305,16 @@
       "class": "optional-config",
       "note": "Optional independent model route for reviewers."
     },
+    {
+      "name": "spawn.surveyModel",
+      "class": "optional-config",
+      "note": "Optional model route for survey workers."
+    },
+    {
+      "name": "survey.sandbox",
+      "class": "optional-config",
+      "note": "Tuning, not a capability: shared (read-only in the shared checkout) or detached (a disposable detached sandbox that may write and run commands). The tower-survey row is still the switch."
+    },
     {
       "name": "spawn.maxLiveWorkers",
       "class": "core",
@@ -344,17 +378,6 @@
       "class": "optional-config",
       "note": "Captured discovery output cap."
     },
-    {
-      "name": "tests.autoChecks",
-      "class": "optional-config",
-      "note": "Attaches a tests check to completion when discovery runs.",
-      "exemption": {
-        "date": "2026-11-03",
-        "ref": "docs/adr/0005-component-surface.md",
-        "issue": "#138",
-        "reason": "Tuning the default receipt policy inside the optional tower-tests row, which still owns whether any test tooling exists."
-      }
-    },
     {
       "name": "tests.allowPackageDiscovery",
       "class": "core",
@@ -375,6 +398,11 @@
       "class": "forbidden-to-disable",
       "note": "The review-exemption path is part of the review and merge contract."
     },
+    {
+      "name": "gates.requireFreshSurvey",
+      "class": "forbidden-to-disable",
+      "note": "Promotes the survey-stale dependency warning to a merge blocker; the gate itself is part of the merge contract and defaults to advisory."
+    },
     {
       "name": "gates.maxReportBytes",
       "class": "forbidden-to-disable",
@@ -417,37 +445,63 @@
       "capability": "the Tower host",
       "reason": "Without the host the plugin registers nothing; there is no off state that leaves the rest working, and no config boolean may remove it. The visible `tower` anchor is the all-off boundary, and the host section nested under it may never become its own switch.",
       "tools": [],
-      "rowIds": ["tower-host"]
+      "rowIds": [
+        "tower-host"
+      ]
     },
     {
       "id": "health",
       "capability": "tower_doctor (read-only health contract)",
       "reason": "Diagnosis must always exist so a failure message can point at it. #122 removed exposeDoctor and the exposeOperational master switch; the tool is registered for every configuration.",
-      "tools": ["tower_doctor"],
-      "rowIds": ["tower-doctor"]
+      "tools": [
+        "tower_doctor"
+      ],
+      "rowIds": [
+        "tower-doctor"
+      ]
     },
     {
       "id": "recovery",
       "capability": "tower_recover (stale state-lock escape)",
       "reason": "The escape hatch must exist whenever the lock it repairs can be left behind. #122 removed exposeRecovery and the exposeOperational master switch; the tool is registered for every configuration.",
-      "tools": ["tower_recover"],
-      "rowIds": ["tower-recover"]
+      "tools": [
+        "tower_recover"
+      ],
+      "rowIds": [
+        "tower-recover"
+      ]
     },
     {
       "id": "review",
-      "capability": "the review contract",
-      "reason": "review.requireReview is a merge blocker, not a component; a row may not switch it off. The reviewer row is conditional, not a way to weaken the gate.",
-      "tools": ["tower_diff", "tower_preflight", "tower_review"],
-      "rowIds": ["tower-review"],
-      "gatedBy": ["review.requireReview", "review.maxRoundsPerReviewer"]
+      "capability": "the review gate in required mode",
+      "reason": "The policy is one tri-state configuration control on the plugin-page form, not a component row: review.mode is off, optional (default) or required, and off is a documented mode that removes tower_review and makes the merge gate ignore review. What no group, row or boolean key may switch off is the gate once the mode is required: a completed mission still needs a clean review bound to the branch tip, and the exemption path stays explicit. review.requireReview is a deprecated one-release alias, not a switch. The reviewer preset row remains a capability the policy may leave unused, never a way to weaken required mode.",
+      "tools": [],
+      "rowIds": [],
+      "gatedBy": [
+        "review.mode",
+        "review.maxRoundsPerReviewer",
+        "gates.allowReviewExemption"
+      ]
     },
     {
       "id": "merge-gates",
       "capability": "the merge gates",
       "reason": "gates.* decides delivery; a component may not bypass it.",
-      "tools": ["tower_complete", "tower_merge"],
-      "rowIds": ["tower-gates", "tower-merge-gates"],
-      "gatedBy": ["gates.requireChecks", "gates.requireTests", "gates.allowReviewExemption", "gates.maxReportBytes"]
+      "tools": [
+        "tower_complete",
+        "tower_merge"
+      ],
+      "rowIds": [
+        "tower-gates",
+        "tower-merge-gates"
+      ],
+      "gatedBy": [
+        "gates.requireChecks",
+        "gates.requireTests",
+        "gates.allowReviewExemption",
+        "gates.requireFreshSurvey",
+        "gates.maxReportBytes"
+      ]
     }
   ]
 }

package/scripts/generate-capability-locale.mjs

@@ -63,6 +63,11 @@ export const CAPABILITY_LOCALES = [
 export const PRESET_LOCALES = [
   { specifier: 'preset-worker', component: 'preset-tower-worker', mandatory: true },
   { specifier: 'preset-reviewer', component: 'preset-tower-reviewer', mandatory: false },
+  // #148 W2: the survey capability row is a group; its two preset children are
+  // internal dependencies (never individual switches), so both are labelled with
+  // the mandatory-dependency marker.
+  { specifier: 'preset-survey', component: 'preset-tower-survey', mandatory: true },
+  { specifier: 'preset-survey-sandbox', component: 'preset-tower-survey-sandbox', mandatory: true },
 ]
 
 /** Every row that ships a generated subpath locale resource. */

package/scripts/generate-shapes-reference.mjs

@@ -0,0 +1,171 @@
+// Generate the shape reference from the one shape registry (#149).
+//
+// Every fact in docs/reference/shapes.md comes from domain/shapes/index.js and
+// the two shape modules, so documentation cannot drift from the policy the
+// generic layers actually resolve. `--check` is wired into `npm run check`.
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { SHAPE_KINDS, shapeFor } from '../domain/shapes/index.js'
+import { RULES } from './shape-audit.mjs'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const target = path.join(root, 'docs', 'reference', 'shapes.md')
+
+/**
+ * Resolve an audit rule by id. A verdict that names a rule the audit does not
+ * run fails generation, so the reference can never describe an unenforced rule.
+ * @param {string} id
+ */
+function fitness(id) {
+  const rule = RULES.find((entry) => entry.id === id)
+  if (!rule) throw new Error(`unknown shape-audit rule "${id}" named by the shapes reference generator`)
+  return `\`${rule.id}\` — ${rule.rule}`
+}
+
+/** Rule ids as code spans; throws if a verdict names a rule the audit does not run. */
+function rules(...ids) {
+  for (const id of ids) {
+    if (!RULES.some((entry) => entry.id === id)) {
+      throw new Error(`unknown shape-audit rule "${id}" named by the shapes reference generator`)
+    }
+  }
+  return ids.map((id) => `\`${id}\``).join(', ')
+}
+
+const fitnessRules = RULES.map((rule) => `| \`${rule.id}\` | \`${rule.owner}\` | ${rule.rule} |`)
+
+const rows = SHAPE_KINDS.map((kind) => {
+  const shape = shapeFor(kind)
+  const hasTerminal = shape.statuses.some((status) => shape.isTerminal(status))
+  // #148 W2: a shape with a sandbox dimension resolves its placement from
+  // tuning config, so the reference names both placements instead of the static
+  // default only. Both placements render as text: a raw `|` would split the cell.
+  const provisioning = shape.fields.sandbox ? '`shared` / `detached`' : `\`${shape.provisioning}\``
+  return `| \`${kind}\` | \`${shape.statuses.join('`, `')}\` | ${hasTerminal ? 'yes' : 'no'} | ${provisioning} | ${shape.canMerge} | ${shape.canRebase} | ${shape.reach.ownsPaths} / \`${shape.reach.fence}\` | ${shape.requiredComponent ?? '—'} | ${shape.acceptsResult} |`
+})
+
+const transitions = SHAPE_KINDS.map((kind) => {
+  const shape = shapeFor(kind)
+  const body = shape.statuses
+    .map((status) => {
+      const targets = shape.transitions[status] ?? []
+      return `| \`${status}\` | ${shape.isTerminal(status) ? 'terminal' : targets.map((target) => `\`${target}\``).join(', ') || '—'} |`
+    })
+    .join('\n')
+  return `### ${kind}\n\n| From | To |\n|---|---|\n${body}`
+})
+
+const invariants = SHAPE_KINDS.map((kind) => {
+  const { completion } = shapeFor(kind)
+  const flags = Object.entries(completion)
+    .filter(([key]) => key.startsWith('requires'))
+    .map(([key, value]) => `${key}=${value}`)
+    .join(', ')
+  return `| \`${kind}\` | ${flags} | \`${completion.check.name}\` |`
+})
+
+const expected = `# Mission shapes (generated)
+
+> Generated by \`npm run docs:generate:shapes\` from \`domain/shapes/index.js\`. Do not edit by hand.
+
+A mission shape is the single place its kind's contract lives (#148/#149). Generic
+layers resolve \`shapeFor(mission.kind)\` and never branch on a kind literal; the
+shape audit (\`npm run shape:audit\`) refuses kind and role comparisons outside
+\`domain/shapes/\`, the global \`TERMINAL_STATUSES\`/\`TRANSITIONS\` vocabulary,
+one-argument \`isTerminal\`/\`canTransition\` calls, and the dimension regressions
+recorded in the inventory below (review tip, batch status, lease ledger, blocked
+writes, evidence reads, legacy vocabulary, path permission and role/shape
+conflation).
+
+## Kinds
+
+| Kind | Statuses | Has terminal | Provisioning | Can merge | Can rebase | Reach (owns / fence) | Component | Accepts result |
+|---|---|---|---|---|---|---|---|---|
+${rows.join('\n')}
+
+## Transitions
+
+${transitions.join('\n\n')}
+
+## Survey placement (#148 W2)
+
+\`survey.sandbox\` is tuning, not a component: the \`tower-survey\` row stays the
+switch. The shape resolves both the placement and the preset, so generic layers
+never read the raw key or compare a kind.
+
+The decision is made once, at provisioning time. A mission with a recorded
+\`mission.sandbox\` keeps the detached placement and its completion invariants
+even if \`survey.sandbox\` later changes — a config flip can neither skip the
+sandbox HEAD/zero-commit checks nor strand the disposable checkout. A survey
+that never got a sandbox keeps the shared invariants for the same reason.
+
+| \`survey.sandbox\` | Provisioning | Preset | Completion invariants |
+|---|---|---|---|
+| \`none\` (default) | \`shared\`: no checkout, the agent reads the main checkout | \`tower-survey\` (strictly read-only: no write, edit, or shell tool) | HEAD equals \`readCommit\`, tracked-status fingerprint unchanged, zero commits |
+| \`detached\` | \`detached\`: \`git worktree add --detach <worktreeRoot>/<id>-sandbox <readCommit>\` (no branch, no \`baseCommit\`, never merged) | \`tower-survey-sandbox\` (read/write/edit/pwsh plus the mission tools; spawn/merge/rebase/review/diff still absent) | sandbox HEAD equals \`readCommit\`, zero commits; disposable write/shell side effects are ignored; sandbox removed on completion, abandon or teardown with a bounded retry |
+
+## Completion invariants
+
+| Kind | Invariants | Check |
+|---|---|---|
+${invariants.join('\n')}
+
+## Role
+
+| Contract | Owner |
+|---|---|
+| Status, transitions, terminality, merge/rebase, provisioning, reach, plan fields, completion, dependencies, briefing, summary | \`domain/shapes/<kind>.js\` |
+| Kind resolution and the action guard | \`domain/shapes/index.js\` |
+| Role vocabulary and the role contract (preset, model, placement, briefing, prerequisites) | \`domain/roles.js\` |
+| Generated reference and the audit | \`scripts/generate-shapes-reference.mjs\`, \`scripts/shape-audit.mjs\` |
+
+## Dimension inventory (#149)
+
+Every dimension the registry audit covers. A **shape-owned** verdict lives in
+\`domain/shapes/<kind>.js\`; a **correctly generic** verdict has one owner module
+outside the shapes; a **redesigned** verdict replaced an earlier ambiguous
+contract. The fitness rule is the mechanical check the audit (or the generated
+invariant) enforces.
+
+| Dimension | Verdict | Owner module | Fitness rule |
+|---|---|---|---|
+| Mission lifecycle | **Shape-owned.** Statuses, transitions and terminality are per kind. | \`domain/shapes/<kind>.js\` | ${rules('kind-literal', 'global-status-vocabulary', 'shape-entry-point')} |
+| Role vocabulary | **Correctly generic.** Roles are actors, not mission kinds. | \`domain/roles.js\` | ${rules('role-literal')} |
+| Provisioning | **Shape-owned.** A build gets a branch worktree; a survey is shared or a detached sandbox. | \`domain/shapes/<kind>.js\` | Generated invariant: only a build creates a branch/worktree; a recorded \`mission.sandbox\` decides a survey's placement. |
+| Read-only completion | **Shape-owned.** \`resolveCompletion\` derives invariants from the recorded placement. | \`domain/shapes/survey.js\` | Generated invariant: shared survey keeps HEAD and tracked status; detached survey keeps HEAD pinned; both make zero commits. |
+| Dependency | **Shape-owned.** \`dependencySatisfied\` names the terminal statuses that satisfy a dependent. | \`domain/shapes/<kind>.js\` | Generated invariant: a completed survey satisfies a dependent build; a merged build does too. |
+| Archive / reanchor / planning | **Shape-owned.** Terminality is the one archive/reanchor predicate. | \`domain/shapes/<kind>.js\` | Generated invariant: a terminal shape leaves open work and never blocks reanchor. |
+| Completion result | **Shape-owned.** Only a survey may record a completion result. | \`domain/shapes/<kind>.js\` | Generated invariant: \`shape.acceptsResult\`. |
+| Required component | **Shape-owned.** A survey needs the \`tower-survey\` row. | \`domain/shapes/<kind>.js\` | Generated invariant: planning refuses with an actionable code while the required component is off. |
+| Review | **Redesigned.** Commit-stamped evidence: a reviewer reads a disposable checkout at the recorded review commit; only a shape with a branch is reviewable. | \`app/review.js\`, \`app/reviewCheckout.js\`, \`domain/missions/review.js\` | ${fitness('review-tip-read')} |
+| Batch | **Correctly generic second lifecycle.** A batch is finite evidence over missions, not a mission kind; no shape knows about batches. | \`domain/batch.js\`, \`domain/collab/batch.js\`, \`app/batch.js\` | ${fitness('batch-status-literal')} |
+| Leases | **Correctly generic.** One fail-closed admission point; expiry is recovered only by an explicit \`force\` release. | \`adapters/leases.js\`, \`app/spawn-prechecks.js\` | ${fitness('lease-ledger')} |
+| Paused vs blocked | **Redesigned.** \`blocked\` is derived machine state; \`paused\` is a deliberate stop with a cause. | \`domain/missions/lifecycle.js\`, \`domain/state/semantics.js\` | ${fitness('blocked-status-write')} |
+| Test receipts / evidence | **Redesigned — one reader.** Completion checks and discovery receipts are one normalized evidence contract in \`domain/evidence.js\`; the shape declares whether a receipt is tip-bound. \`tower_complete\` no longer copies a synthetic \`tests\` check into the report. | \`domain/evidence.js\`; \`domain/shapes/<kind>.js\` declares \`evidence\` | ${fitness('evidence-single-read')} |
+| Legacy import | **Redesigned — strict adapter.** One payload is one declared format; status remaps, assumed kinds and non-carried fields are reported as \`remapped\`/\`unresolved\`/\`dropped\` instead of approximated. Import stays read-only and never resumes a paused mission. | \`adapters/legacy.js\`; \`domain/batch.js\` reads only the canonical \`pausedMissionIds\` | ${fitness('legacy-vocabulary')} |
+| Scope ownership | **Redesigned — shape.reach.** The shape owns path permission (\`reach.ownsPaths\`, \`reach.fence\`); the gate, planner, lifecycle and auto-deps derive from it through one fence. | \`domain/scope.js\` + \`shape.reach\` in \`domain/shapes/<kind>.js\` | ${fitness('scope-reach')} |
+| Role vs kind | **Redesigned — orthogonal role contract.** Spawn, preset, model, placement, briefing, roster budget and gates resolve the role through \`domain/roles.js\`; the shape only supplies facts. | \`domain/roles.js\`; callers \`tools/spawn.js\`, \`app/spawn-prechecks.js\`, \`app/spawn-support.js\`, \`domain/roster.js\`, \`host/presets.js\` | ${fitness('role-shape-conflation')} |
+
+## Fitness rules
+
+Generated from \`scripts/shape-audit.mjs\` \`RULES\`; the audit is wired into \`npm run check\`.
+
+| Rule | Owner module | Contract |
+|---|---|---|
+${fitnessRules.join('\n')}
+`
+
+if (process.argv.includes('--check')) {
+  const actual = fs.existsSync(target) ? fs.readFileSync(target, 'utf8') : ''
+  if (actual !== expected) {
+    console.error('shapes reference is stale; run npm run docs:generate:shapes')
+    process.exit(1)
+  }
+  console.log(`shapes reference: ${SHAPE_KINDS.length} shapes in sync`)
+} else {
+  fs.mkdirSync(path.dirname(target), { recursive: true })
+  fs.writeFileSync(target, expected)
+  console.log(`wrote ${path.relative(root, target)} (${SHAPE_KINDS.length} shapes)`)
+}
+process.exit(0)

package/scripts/mount-smoke/surface.mjs

@@ -36,6 +36,7 @@ export const OPTIONAL_ROW_IDS = [
   'tower-import',
   'tower-leases',
   'tower-skills',
+  'tower-survey',
   'tower-tests',
 ]
 
@@ -67,6 +68,8 @@ export function defaultOffToolIds() {
 export const PRESET_ROWS = Object.freeze([
   Object.freeze({ id: 'tower-worker', specifier: 'preset-worker', name: 'Tower Worker', order: 60 }),
   Object.freeze({ id: 'tower-reviewer', specifier: 'preset-reviewer', name: 'Tower Reviewer', order: 61 }),
+  Object.freeze({ id: 'tower-survey', specifier: 'preset-survey', name: 'Tower Survey', order: 62 }),
+  Object.freeze({ id: 'tower-survey-sandbox', specifier: 'preset-survey-sandbox', name: 'Tower Survey Sandbox', order: 63 }),
 ])
 
 /** Presets the bundle declares for its worker and reviewer roles. */

package/scripts/pack-manifest.txt

@@ -28,6 +28,7 @@ app/briefing.js
 app/checkCompletion.js
 app/enrichedMissions.js
 app/findings.js
+app/freshness.js
 app/gate.js
 app/init.js
 app/merge.js
@@ -40,12 +41,16 @@ app/read.js
 app/rebase.js
 app/recording.js
 app/review.js
+app/reviewCheckout.js
 app/roster.js
+app/sandbox.js
+app/sharedCheckout.js
 app/spawn-prechecks.js
 app/spawn-support.js
 app/spawn.js
 app/teardown.js
 app/tower.js
+client.js
 cordis.patch.yml
 docs/README.md
 docs/adr/0001-ports-adapters-as-data.md
@@ -53,6 +58,7 @@ docs/adr/0002-single-state-json.md
 docs/adr/0003-allow-agent-control-default-true.md
 docs/adr/0004-surface-budget.md
 docs/adr/0005-component-surface.md
+docs/adr/0006-mission-shapes.md
 docs/adr/README.md
 docs/agents/domain.md
 docs/agents/issue-tracker.md
@@ -79,6 +85,7 @@ docs/reference/errors.generated.md
 docs/reference/errors.md
 docs/reference/events.md
 docs/reference/operations.md
+docs/reference/shapes.md
 docs/reference/surface-budget.md
 docs/reference/testing.md
 docs/reference/tools.generated.md
@@ -115,6 +122,7 @@ domain/contracts/tool-inputs/missions.js
 domain/contracts/tool-inputs/ops.js
 domain/contracts/tool-inputs/shared.js
 domain/errors.js
+domain/evidence.js
 domain/events.js
 domain/gate.js
 domain/integration/gate.js
@@ -137,8 +145,12 @@ domain/read/enrichedMissions.js
 domain/read/missionContext.js
 domain/read/views.js
 domain/report.js
+domain/roles.js
 domain/roster.js
 domain/scope.js
+domain/shapes/build.js
+domain/shapes/index.js
+domain/shapes/survey.js
 domain/state.js
 domain/state/archive.js
 domain/state/migrations.js
@@ -162,6 +174,8 @@ host/hmr.js
 host/modeState.js
 host/modeStore.js
 host/preset-reviewer.js
+host/preset-survey-sandbox.js
+host/preset-survey.js
 host/preset-worker.js
 host/presets.js
 host/tool-registry.js
@@ -183,6 +197,10 @@ locale/leases/en.json
 locale/leases/zh.json
 locale/preset-reviewer/en.json
 locale/preset-reviewer/zh.json
+locale/preset-survey-sandbox/en.json
+locale/preset-survey-sandbox/zh.json
+locale/preset-survey/en.json
+locale/preset-survey/zh.json
 locale/preset-worker/en.json
 locale/preset-worker/zh.json
 locale/skills/en.json
@@ -218,6 +236,7 @@ scripts/generate-component-surface.mjs
 scripts/generate-config-reference.mjs
 scripts/generate-error-reference.mjs
 scripts/generate-events-reference.mjs
+scripts/generate-shapes-reference.mjs
 scripts/generate-tools-reference.mjs
 scripts/generate-types.mjs
 scripts/issue-audit.mjs
@@ -234,6 +253,7 @@ scripts/pack-manifest.txt
 scripts/regression-audit.mjs
 scripts/release-check.mjs
 scripts/release-notes.mjs
+scripts/shape-audit.mjs
 scripts/surface-baseline.json
 scripts/surface-baseline.mjs
 scripts/types-coverage.mjs
@@ -243,6 +263,8 @@ skills.js
 skills/tower-recovery.md
 skills/tower-review.md
 skills/tower-worker-protocol.md
+survey-sandbox.js
+survey.js
 tools/adopt.js
 tools/batch.js
 tools/complete.js